Remarry Bluray Drive on Linux: Difference between revisions
Jump to navigation
Jump to search
(→Test) |
|||
| Line 70: | Line 70: | ||
* Tested on my PS3 Slim with OtherOS++. | * Tested on my PS3 Slim with OtherOS++. | ||
* You cannot just write a new HRL to BD drive buffer 4. First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. Only in this order will it work. | * You cannot just write a new HRL to BD drive buffer 4.You can actually but it will corrupt your current BD HRL. | ||
If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies. | |||
First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. | |||
Only in this order will it work. | |||
<pre> | <pre> | ||
Revision as of 17:37, 25 August 2012
Introduction
EID2
- You will new decrypted EID2 data.
- How to get it on Linux is described here: http://www.ps3devwiki.com/wiki/Spuisofs#Dumping_EID2_Key_with_spuisofs
- EID2 contains encrypted P-Block and S-Block.
- To get decrypted S-Block and P-Block first you have to decrypt EID2 with EID2 key and IV and then decrypt the blocks with DES-CBC.
P-Block and S-Block DES-CBC IV and key:
IV: 00 00 00 00 00 00 00 00 key: 6C CA B3 54 05 FA 56 2C
Writing P-Block
- P-Block is stored in BD buffer 2.
- BD buffer 2 is of size 0x60 bytes.
- P-Block is in decryoted EID2 at offset 0x20 and of size 0x80.
- Not all P-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x60 bytes is written to BD drive buffer 2.
Test
- Tested on my PS3 Slim with OtherOS++.
- After writing P-Block to BD drive buffer 2, authenticate the BD drive with ps3dm.
# First enable writing BD buffer 2 sudo ./bd_enable_buffer_write -b 2 # Write P-Block to BD buffer 2 sudo ./bd_write_buffer -b 2 -i pblock.bin # Authenticate the BD drive sudo ps3dm -v sm drive_auth 0x29 # It should not fail !!! ss status 0
Writing S-Block
- S-Block is stored in BD buffer 3.
- BD buffer 3 is of size 0x670 bytes.
- S-Block is in decryoted EID2 at offset 0xa0 and of size 0x690.
Writing New HRL to BD Drive
- HRL is stored in BD buffer 4.
- BD buffer 4 is of size 0x8000 bytes.
glevand@debian:~$ sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C 00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4| 00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb| 00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d| 00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...| 00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.<| 00000050 20 2d e2 97 00 00 00 00 00 00 00 00 00 00 00 00 | -..............| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008000
Test
- Tested on my PS3 Slim with OtherOS++.
- You cannot just write a new HRL to BD drive buffer 4.You can actually but it will corrupt your current BD HRL.
If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies. First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. Only in this order will it work.
# First enable writing BD buffer 4 sudo ./bd_enable_buffer_write -b 4 # Write HRL to BD buffer 4 sudo ./bd_write_buffer -b 4 -i default_hrl.bin # Read back HRL sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C 00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4| 00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb| 00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d| 00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...| 00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.<| 00000050 20 2d e2 97 00 00 00 00 00 00 00 00 00 00 00 00 | -..............| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008000