Talk:BD Drive Reverse Engineering

Getting keys the easier way

EID4

First you need to get the sv_iso_spu_module.self individuals seed that can be found in the metadata header:

3E C2 0C 17 02 19 01 97 8A 29 71 79 38 29 D3 08
04 29 FA 84 E3 3E 7F 73 0C 1D 41 6E EA 25 CA FB
3D E0 2B C0 05 EA 49 0B 03 E9 91 98 F8 3F 10 1F
1B A3 4B 50 58 94 28 AD D2 B3 EB 3F F4 C3 1A 58

Using your console specific eid_root_key/iv (e.g. from metldr dump) and libeeid (insert the seed in keys.c) you can then decrypt EID4 directly by calling

u8 eid4[0x30] = {/* your EID4 */};
eid4_decrypt_buffer(eid4);

Now you got the two keys you need in eid4+0x00 and eid4+0x10 :)

EID2

First you need to get the fdm_spu_module.self individuals seed that can be found in the metadata header:

74 92 E5 7C 2C 7C 63 F4 49 42 26 8F B4 1C 58 ED
66 83 41 F9 C9 7B 29 83 96 FA 9D 82 07 51 99 D8
BC 1A 93 4B 37 4F A3 8D 46 AF 94 C7 C3 33 73 B3
09 57 20 84 FE 2D E3 44 57 E0 F8 52 7A 34 75 3D

Using your console specific eid_root_key/iv (e.g. from metldr dump) and libeeid (insert the seed, key and IV in keys.c) you can then decrypt EID2 directly by calling

u8 eid2[0x730] = {/* your EID2 */};
p_block = eid2_generate_block_buffer(p_block_enc, EID2_BLOCKTYPE_P);
s_block = eid2_generate_block_buffer(s_block_enc, EID2_BLOCKTYPE_S);
eid2_decrypt_block(p_block + 0x10, 0x60);
eid2_decrypt_block(s_block + 0x10, 0x670);