Editing IDStorage
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 17: | Line 17: | ||
Idstorage leaves indexes are 16-bit integers and are stored in an index table of two NAND pages of 512 bytes. | Idstorage leaves indexes are 16-bit integers and are stored in an index table of two NAND pages of 512 bytes. | ||
* The index is identified by byte 6 of the spare area (0x73). | * The index of idstorage is identified by byte 6 of the spare area (0x73). | ||
* byte 7 is the idstorage version. | * byte 7 is the idstorage version. | ||
* byte is either 1 or 0 depending on whether the idstorage has been formatted or not, and finally byte 9 indicates if the idstorage is read-only or not. | * byte is either 1 or 0 depending on whether the idstorage has been formatted or not, and finally byte 9 indicates if the idstorage is read-only or not. | ||
For example, | For example, a key appearing at position 27 (byte 54) in the index table would find its associated data at the NAND offset: 0xC0000 + (27 * 512) = 0xC3600. | ||
= Importance in OS = | = Importance in OS = | ||
As major functions such as UMD decryption, Ad Hoc and DNAS Authentication rely on IDStorage | As major functions such as UMD decryption, Ad Hoc and DNAS Authentication rely on IDStorage keys, the loss or corruption of keys can be crippling to the usability of the PSP. Users are strongly recommended to take a [[NAND Backup]], giving them the opportunity to restore their IDStorage using a tool such as [[NandTool]]. | ||
The firmware provides a driver to facilitate manipulations. In PSP: idstorage.prx. In PSVita: idstorage.skprx. | The firmware provides a driver to facilitate manipulations. In PSP: idstorage.prx. In PSVita: idstorage.skprx. | ||
| Line 45: | Line 45: | ||
= IDStorage certified sections = | = IDStorage certified sections = | ||
IDStorage certified sections are a security measure for critical information. For example PSID and OpenPSID are certified (leaves 0x100, 0x101, 0x120, 0x121) | IDStorage certified sections are a security measure for critical information. For example PSID and OpenPSID are certified (leaves 0x100, 0x101, 0x120, 0x121). | ||
KIRK command 0x12 is used to verify IDStorage certificates. | |||
== | == Stucture == | ||
Some of the leaves contain certificates similar in PSP, PS3 and PSVita. | |||
Size is 0xB8 bytes: 0x10 bytes of data and 0xA8 bytes of certificate. | |||
{|class="wikitable" | {|class="wikitable" | ||
| Line 69: | Line 73: | ||
| omac/cmac1 || 0x10 || hash of the previous information in CMAC1/OMAC mode | | omac/cmac1 || 0x10 || hash of the previous information in CMAC1/OMAC mode | ||
|} | |} | ||
= Content = | = Content = | ||
* | * leaves 0x100-0x11F are identical to their backup leaves 0x120-0x13F | ||
* | * old PSP revision haven't leaves 0x046, 0x047 | ||
* Very old PSP revisions haven't leaf 0x140 | * Very old PSP revisions haven't leaf 0x140 | ||
= Uses = | = Uses = | ||
| Line 101: | Line 84: | ||
== IPL == | == IPL == | ||
The Stage 2 [[IPL]] (main.bin) reads 3 | The Stage 2 [[IPL]] (main.bin) reads 3 keys from the idstorage, 0x004, 0x005 and 0x006. These keys play a significant part in the PSP as they are related to power. In TA-082 and TA-086 PSP's, these keys are at different locations, causing a brick with the 1.50 IPL. | ||
0x004 | 0x004 | ||
| Line 119: | Line 102: | ||
=== sceChkregGetPsCode === | === sceChkregGetPsCode === | ||
Chkreg (chkreg.prx) reads 2 | Chkreg (chkreg.prx) reads 2 keys, 0x100 and 0x102 or 0x120 and 0x122. All contain the PsCode at 3 locations. The 1st occurrence of the PsCode is at 0x38, the second at 0xF0 and the third at 0x1A8. Each occurrence is 0xAF (175 bytes) apart. | ||
Example of PsCode: | |||
0000000048 00 00 00 01 00 '''03''' 00 01 ........ | |||
0000000240 00 00 00 01 00 '''03''' 00 01 ........ | |||
0000000416 00 00 00 01 00 '''03''' 00 01 ........ | |||
The return from sceChkregGetPsCode is determined to be valid or invalid via KIRK command 0x12, just like other functions using | The return from sceChkregGetPsCode is determined to be valid or invalid via KIRK command 0x12, just like other functions using IDStorage keys 0x100, 0x120. | ||
== openpsid.prx == | == openpsid.prx == | ||
| Line 145: | Line 130: | ||
=== sceOpenPSIDGetOpenPSID === | === sceOpenPSIDGetOpenPSID === | ||
OpenPSID (openpsid.prx) reads 2 | OpenPSID (openpsid.prx) reads 2 keys, both relating to the region: 0x101 or 0x121 and 0x102 or 0x122. The OpenPSID is calculated via the above keys and sceUtilsBufferCopyWithRange. | ||
It first reads 0x101 or 0x121 into a buffer. If this fails it returns 0xC0520001 and reads 0x102 or 0x122 into the buffer. If it fails again, it returns 0xC0520002. | It first reads 0x101 or 0x121 into a buffer. If this fails it returns 0xC0520001 and reads 0x102 or 0x122 into the buffer. If it fails again, it returns 0xC0520002. | ||
| Line 157: | Line 142: | ||
== Memab == | == Memab == | ||
Memab (memab.prx) reads 1 | Memab (memab.prx) reads 1 key, 0x100 or 0x120. | ||
Mgr (mgr.prx) reads 2 | Mgr (mgr.prx) reads 2 keys, 0x040 and another unknown key. | ||
0x040 | 0x040 | ||
| Line 165: | Line 150: | ||
00000001F0 25 00 00 00 64 99 2E 88-01 00 00 00 D0 99 2E 88 %...d........... | 00000001F0 25 00 00 00 64 99 2E 88-01 00 00 00 D0 99 2E 88 %...d........... | ||
Another unknown | Another unknown key. | ||
== Power == | == Power == | ||
Power (power.prx) reads 1 | Power (power.prx) reads 1 key, 0x0004. This key is related to power and is also read by the IPL. | ||
== Umdman == | == Umdman == | ||
Umdman (umdman.prx) reads | Umdman (umdman.prx) reads 1 key, 0x102. This key is related to the region, and is probably used to determine what UMD video's can be read on the PSP. | ||
== USB == | == USB == | ||
| Line 179: | Line 164: | ||
=== usb.prx === | === usb.prx === | ||
USB (usb.prx) reads 1 | USB (usb.prx) reads 1 key, 0x041. This key has information on the USB types. | ||
0x041 | 0x041 | ||
| Line 243: | Line 228: | ||
=== usbstor.prx === | === usbstor.prx === | ||
USBstor (usbstor.prx) reads 1 | USBstor (usbstor.prx) reads 1 key, ?0x040 or 0x043?. | ||
?0x040 or 0x043? | ?0x040 or 0x043? | ||
| Line 252: | Line 237: | ||
== WLAN == | == WLAN == | ||
WLAN (wlan.prx) reads 2 | WLAN (wlan.prx) reads 2 keys, 0x044 and 0x045. | ||
0x044 | 0x044 | ||
| Line 260: | Line 245: | ||
0000000000 03 00 01 ... | 0000000000 03 00 01 ... | ||
This key contains the MAC address of the PSP. This can be changed, but does not effect the hardware, only the address displayed under System Information. | |||
== Sysconf_plugin == | == Sysconf_plugin == | ||
Sysconf_plugin (sysconf_plugin.prx) reads 1 | Sysconf_plugin (sysconf_plugin.prx) reads 1 key, 0x044. This is probably why the VSH displays a different MAC address when 0x044 is changed. | ||
== Vshmain == | == Vshmain == | ||
Vshmain (vshmain.prx) reads 1 | Vshmain (vshmain.prx) reads 1 key, 0x046. | ||
0x046 | 0x046 | ||
Empty, however vshmain uses the first byte of this | Empty, however vshmain uses the first byte of this key to set a param for vshImposeSetParam. | ||
= Legality of distribution = | = Legality of distribution = | ||
There is question as to whether [[Sony]] are able to take legal action against those found to be distributing IDStorage | There is question as to whether [[Sony]] are able to take legal action against those found to be distributing IDStorage keys among the community, for research, repair, or otherwise. The worry is that the keys are proprietary data (particularly UMD Decryption keys). | ||
= Useful links = | = Useful links = | ||