Remarry Bluray Drive on Linux

Introduction

• I was playing with HRL buffer of my BD drive on PS3 Slim and corrupted it.
• After that i couldn't play BD movies on GameOS, BD player returned an error.
• After i have written P-Block, S-Block and a new HRL, i could play my BD movies again :)
• Hope this guide can help someone too.

EID2

• You will need decrypted EID2 data.
• How to get it on Linux is described here: http://www.ps3devwiki.com/wiki/Spuisofs#Dumping_EID2_Key_with_spuisofs
• EID2 contains encrypted P-Block and S-Block.
• To get decrypted S-Block and P-Block first you have to decrypt EID2 with EID2 key and IV and then decrypt the blocks with DES-CBC.

P-Block and S-Block DES-CBC IV and key:

IV: 00 00 00 00 00 00 00 00
key: 6C CA B3 54 05 FA 56 2C

Tools

• ps3vuart-tools: http://www.ps3devwiki.com/wiki/Ps3vuart-tools
• bd_enable_buffer_write.c: http://www.multiupload.nl/0GD1CQV9UX
• bd_read_buffer.c: http://www.multiupload.nl/OQCDJLA1EM
• bd_write_buffer.c: http://www.multiupload.nl/AK5JSAK9N3
• You could also use my PS3 Debian LiveCD which has ps3vuart-tools preinstalled and GCC compiler which you can use to compile all necessary BD tools. See http://www.ps3devwiki.com/wiki/Debian_LiveCD.

Writing P-Block

• P-Block is stored in BD buffer 2.
• BD buffer 2 is of size 0x60 bytes.
• P-Block is in decrypted EID2 at offset 0x20 and of size 0x80.
• Not all P-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x60 bytes is written to BD drive buffer 2.

Test

• Tested on my PS3 Slim with OtherOS++.
• After writing P-Block to BD drive buffer 2, authenticate the BD drive with ps3dm.

ls -l pblock.bin
-rw-r--r-- 1 glevand glevand 96 Aug 25 07:44 pblock.bin

# First enable writing BD buffer 2

sudo ./bd_enable_buffer_write -b 2

# Write P-Block to BD buffer 2

sudo ./bd_write_buffer -b 2 -i pblock.bin

# Authenticate the BD drive

sudo ps3dm -v sm drive_auth 0x29                 # It should not fail !!!
ss status 0

Writing S-Block

• S-Block is stored in BD buffer 3.
• BD buffer 3 is of size 0x670 bytes.
• S-Block is in decryoted EID2 at offset 0xa0 and of size 0x690.
• Not all S-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x670 bytes is written to BD drive buffer 3.

Test

• Tested on my PS3 Slim with OtherOS++.

# First enable writing BD buffer 3

sudo ./bd_enable_buffer_write -b 3

# Write P-Block to BD buffer 3

sudo ./bd_write_buffer -b 3 -i sblock.bin

Writing New HRL to BD Drive

• HRL is stored in BD buffer 4.
• BD buffer 4 is of size 0x8000 bytes.

glevand@debian:~$ sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C
00000000  10 00 00 0c 00 03 10 03  00 00 00 01 21 00 00 34  |............!..4|
00000010  00 00 00 00 00 00 00 00  1b 0b f2 6d 47 9e 77 62  |...........mG.wb|
00000020  3d 91 fc 78 b1 59 c9 52  ca a4 c7 41 85 24 96 64  |=..x.Y.R...A.$.d|
00000030  8d 1d 95 8e 9b 84 c6 fa  4a dd 43 9b 42 98 fe ff  |........J.C.B...|
00000040  df e6 f3 56 85 81 e1 1b  27 53 08 14 16 6d 97 3c  |...V....'S...m.<|
00000050  20 2d e2 97 00 00 00 00  00 00 00 00 00 00 00 00  | -..............|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00008000

Test

• Tested on my PS3 Slim with OtherOS++.
• You cannot just write a new HRL to BD drive buffer 4. You can actually but it will corrupt your current BD HRL.
• If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies.
• First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. Only in this order will it work.

# First enable writing BD buffer 4

sudo ./bd_enable_buffer_write -b 4

# Write HRL to BD buffer 4

sudo ./bd_write_buffer -b 4 -i default_hrl.bin

# Read back HRL

sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C
00000000  10 00 00 0c 00 03 10 03  00 00 00 01 21 00 00 34  |............!..4|
00000010  00 00 00 00 00 00 00 00  1b 0b f2 6d 47 9e 77 62  |...........mG.wb|
00000020  3d 91 fc 78 b1 59 c9 52  ca a4 c7 41 85 24 96 64  |=..x.Y.R...A.$.d|
00000030  8d 1d 95 8e 9b 84 c6 fa  4a dd 43 9b 42 98 fe ff  |........J.C.B...|
00000040  df e6 f3 56 85 81 e1 1b  27 53 08 14 16 6d 97 3c  |...V....'S...m.<|
00000050  20 2d e2 97 00 00 00 00  00 00 00 00 00 00 00 00  | -..............|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00008000