Editing Keys

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= Useful Information =
= Useful Information =


* Kirk commands 0x10 and 0x11 explanation: [http://www.lolhax.org/2011/07/06/kirk-0x10-private-key/]
* KIRK commands 0x10 and 0x11 explanation: [http://www.lolhax.org/2011/07/06/kirk-0x10-private-key/]
* Save Data encryption code: [http://pastebin.com/RFDXKCAf]
* Save Data encryption code: [http://pastebin.com/RFDXKCAf]
* Kirk Engine code: [https://github.com/tpunix/kirk_engine/blob/master/kirk/kirk_engine.c]
* Kirk Engine code: [https://github.com/tpunix/kirk_engine/blob/master/kirk/kirk_engine.c]
Line 7: Line 7:
== Location ==
== Location ==


keyfiles should be placed in ~/.psp or %userprofile%\pspkeys
keyfiles should be placed in ~/.psp or %userprofile%\pspkeys <br />


== Naming ==
== Naming ==
Line 22: Line 22:
= Keys =
= Keys =


== Kirk Keys ==
== Baryon Keys ==


=== PSP Kirk command 1 AESCBC128-CMAC Key ===
=== Security ID (TA-086 Baryon) ===


<pre>
<pre>
98C940975C1D10E87FE60EA3FD03A8BA
008080A217A91705180F
</pre>
</pre>


=== PSP Kirk command 1 ECDSA Curve ===
=== Sbox ===


<pre>
<pre>
FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFF
637C777BF26B6FC53001672BFED7AB76
FFFFFFFFFFFFFFFF00000001FFFFFFFFFFFFFFFC
CA82C97DFA5947F0ADD4A2AF9CA472C0
65D1488C0359E234ADC95BD3908014BD91A525F9
B7FD9326363FF7CC34A5E5F171D83115
FFFFFFFFFFFFFFFF0001B5C617F290EAE1DBAD8F
04C723C31896059A071280E2EB27B275
2259ACEE15489CB096A882F0AE1CF9FD8EE5F8FA
09832C1A1B6E5AA0523BD6B329E32F84
604358456D0A1CB2908DE90F27D75C82BEC108C0
53D100ED20FCB15B6ACBBE394A4C58CF
D0EFAAFB434D338545F9027F503C9FA8
51A3408F929D38F5BCB6DA2110FFF3D2
CD0C13EC5F974417C4A77E3D645D1973
60814FDC222A908846EEB814DE5E0BDB
E0323A0A4906245CC2D3AC629195E479
E7C8376D8DD54EA96C56F4EA657AAE08
BA78252E1CA6B4C6E8DD741F4BBD8B8A
703EB5664803F60E613557B986C11D9E
E1F8981169D98E949B1E87E9CE5528DF
8CA1890DBFE6426841992D0FB054BB16
</pre>
</pre>


=== PSP Kirk command 1 ECDSA Private Key ===
=== Table Keys ===
 
==== Index Correlation ====
 
* 0 <- TA086 (all)
* 2 <- TA085v2 (fallback, ffs)
* 4 <- TA090,TA093,TA095,TA096 (zeroes)
* 8 <- TA085v2 (main, ffs)
* A <- TA090 (normal)
* D <- TA093,TA095,TA096 (normal)
* 2F <- TA096 (ffs)
* 97 <- TA093, TA095 (ffs)
* D9 <- TA090, TA092 (ffs)
 
==== Keys ====


<pre>
<pre>
F392E26490B80FD889F2D9722C1F34D7274F983D
5C52D91CF382ACA489D88178EC16297B 0
9D4F50FCE1B68E1209307DDBA6A5B5AA 1
0975988864ACF7621BC0909DF0FCABFF 2
C9115CE2064A2686D8D6D9D08CDE3059 3
667539D2FB4273B2903FD7A39ED2C60C 4
F4FAEF20F4DBAB31D18674FD8F990566 5
EA0C811363D7E930F961135A4F352DDC 6
???????????????????????????????? 8
AC00C0E3E80AF0683FDD1745194543BD A
DFF3FCD608B05597CF09A23BD17D3FD2 D
???????????????????????????????? 2F
???????????????????????????????? 97
C7AC1306DEFE39EC83A1483B0EE2EC89 D9
</pre>
</pre>


=== PSP Kirk command 1 ECDSA Public Key ===  
==== Secrets ====


<pre>
<pre>
ED9CE58234E61A53C685D64D51D0236BC3B5D4B9
D2072253A4F27468
049DF1A075C0E04FB344858B61B79B69A63D2C39
F5D7D4B575F08E4E 0
 
B37A16EF557BD089
CC699581FD89126C 1
 
A04E32BBA7139E46
495E034794931D7B 2
 
B0B809833989FAE2
F4E04313AD2EB4DB 3
 
FE7D7899BFEC47C5
865E3EEF9DFBB1FD 4
 
306F3A03D86CBEE4
FF72BD2B83B89D2F 5
 
8422DFEAE21B63C2
58B95AAEF399DBD0 6
 
????????????????
???????????????? 8
 
C2377E8A74096C5F
093EC519AF0F502D A
 
581C7F1944F96262
318053875C203E24 D
 
C9F809452AA2BED5
40D02BACFB1A8BEA 2F
 
????????????????
???????????????? 97
 
90E1F0C00178E3FF
C34A6A7B205FE8F9 D9
 
</pre>
</pre>


=== PSP Kirk commands 4/7 AES128CBC Keys ===
* In psp battery chips (1000-2000) (keyset 7 is supported only on some 2000 and above/3000)
* Added PSP3000 (TA-090) secrets
* TA-090 has keysets 4, A, D9 (4 for 00s, A for normal, D9 for 0xFF)
* TA-093+ has keysets 4, D, 2F (4 for 00s, D for normal, 2F, for 0xFF)
* TA-086 has keyset 0 (for all, 00, FF and normal)
* Some 3000s use 0x97 keyset
* Some 2000s use keysets 2 and 8
 
==== Expansions ====


<pre>
<pre>
2C92E5902B86C106B72EEA6CD4EC7248 0
expansion 0
058DC80B33A5BF9D5698FAE0D3715E1F 1
 
B813C35EC64441E3DC3C16F5B45E6484 2
F35CEC89825216D8ACD92981A41C7B78 k0
9802C4E6EC9E9E2FFC634CE42FBB4668 3
E91A8C6075F7BBAD54F8FCD576D2750E k1
99244CD258F51BCBB0619CA73830075F 4
1BF2F77B3247249F316518E4C0B6BBCE k2
0225D7BA63ECB94A9D237601B3F6AC17 5
DBC057A0D8EA6347BE8F425A1EDE6BD0 k3
6099F28170560E5F747CB520C0CDC23C 6
E8331F481EC63A594EF056149B85204B k4
76368B438F77D87EFE5FB6115939885C 7
4BA31C0369770A3009474B1DDE45B595 k5
14A115EB434A1BA4905E03B617A15C04 8
AFE4B0ACADC4979D9B92CD8607D92792 k6
E65803D9A71AA87F059D229DAF5453D0 9
832C9F2FD479DE49C55E8E43393E8CAB k7
BA3480B428A7CA5F216412F70FBB7323 A
32B1821DB46023FDFF3A32BCDCE5FB77 k8
72AD35AC9AC3130A778CB19D88550B0C B
BE8C21A3F743290ACA3544762AF6A65D k9
8485C848750843BC9B9AECA79C7F6018 C
A11F2302AF588CA5DB11E9AD210BDA7C k10
B5B16EDE23A97B0EA17CDBA2DCDEC46E D
 
C871FDB3BCC5D2F2E2D7729DDF826882 E
expansion 1
0ABB336C96D4CDD8CB5F4BE0BADB9E03 F
 
32295BD5EAF7A34216C88E48FF50D371 10
E19DA609B64FA5308E50B57D12FCAADB k0
46F25E8E4D2AA540730BC46E47EE6F0A 11
7B9AD4722C9AB91C72FCBA0FCAD8BB11 k1
5DC71139D01938BC027FDDDCB0837D9D 12
B5CE13C7426EE75E6416D16B5A90F04B k2
51DD65F071A4E5EA6AAF12194129B8F4 13
EB5E3F2C1250AB4CFE9A4495B7ED0CFC k3
03763C6865C69B0FFE8FD8EEA43616A0 14 (SYSCON)
DF34CCF3594BBE159A644B0F2F98DFD3 k4
7D50B85CAF6769F0E54AA8098B0EBE1C 15 (SYSCON)
558A6AA6A1F80AB460FA246FFCD3F02F k5
72684B32AC3B332F2A7AFC9E14D56F6B 16
98CD543E6FCED1DB16765D792DD1F202 k6
201D31964AD99FBF32D5D61C491BD9FC 17
2BB34115ED82E736E9FFCD90DCF12CDE k7
F8D84463D610D12A448E9690A6BB0BAD 18
8CA7D899D23F03E4678E3AF7AE725C70 k8
5CD4057FA13060440AD9B6745F244F4E 19
4BC70AD26DBF8A89A3C46E54BD1391CD k9
F48AD678599C22C1D411933DF845B893 1A
C48F1C164D204EC4E645DCB2C9749504 k10
CAE7D287A2ECC1CD94542B5E1D9488B2 1B
 
DE26D37A39956C2AD8C3A6AF21EBB301 1C
expansion 2
7CB68B4DA38D1DD932679CA99FFB2852 1D
 
A0B556B469AB368F36DEC9092ECB41B1 1E
6409F01BAC75FCC0F798AB906288FF9D
939DE19B725FEEE2452ABC1706D14769 1F
DCB837C7BB17877B798E42E9660404FB
A4A4E621382EF1AF7B177AE842AD0031 20
71AD81B6803B7CFB057CAEECF89E0703
C37F13E8CF84DB34747BC3A0F19D3A73 21
C8B9FF7E5FDFD8A4BCB9FE506A926E69
2BF7838AD898E95FA5F901DA61FE35BB 22
18D099663B64479F9A2634CAEE84E987
C704621E714A66EA62E04B203DB8C2E5 23
7860871E477C9FD8A2385C68846AEA03
C933859AAB00CDCE4D8B8E9F3DE6C00F 24
E39B7AFD713636A91DBF2975F97D10FA
1842561F2B5F34E3513EB78977431A65 25
3DDEBAC0E2937D4B6875341D5EA7B4A4
DCB0A0065A50A14E59AC973F1758A3A3 26
9CA1E65C698B5F2290F8B98D0D531DA9
C4DBAE83E29CF254A3DD374E807BF425 27
E97553B5B4DDC996CC5CF841D0DD6479
BFAEEB498265C57C64B8C17E19064409 28
779E91C2289C77BED31F6A92E030FD99
797CECC3B3EE0AC03BD8E6C1E0A8B1A4 29
 
7534FE0BD6D0C28D68D4E02AE7D5D155 2A
expansion 3
FAB35326974F4EDFE4C3A814C32F0F88 2B
 
EC97B386B433C6BF4E539D95EBB979E4 2C
06C98CD84A11DED6265C30D986E259D0
B320A204CF480629B5DD8EFC98D4177B 2D
D3D5870B5F155789B1975868008689D0
5DFC0D4F2C39DA684A3374ED4958A73A 2E
5F8CD354207FFEA98130B1E99191C841
D75A5422CED9A3D62B557D8DE8BEC7EC 2F
6C33EB3897B7C03E59D801B066F7EF27
6B4AEE4345AE7007CF8DCF4E4AE93CFA 30
ED813ED55CCBA2625E07EFEE781EB05F
2B522F664C2D114CFE61318C56784EA6 31
46ABAD934814882ABEE0BF50D4AC3B8B
3AA34E44C66FAF7BFAE55327EFCFCC24 32
094F379A541CF67EBC0253ECED395D66
2B5C78BFC38E499D41C33C5C7B2796CE 33
444DE9DEA5F12DDBF24E4D1E4EA37528
F37EEAD2C0C8231DA99BFA495DB7081B 34
5115668FB712416C21D3723FF3BDAEDB
708D4E6FD1F66F1D1E1FCB02F9B39926 35
DC8D3553E552C88916375B297D8E08A6
0F6716E180699C51FCC7AD6E4FB846C9 36
8F53E9DC8E6BCF07110763386518CBC3
560A494A844C8ED982EE0B6DC57D208D 37
 
12468D7E1C42209BBA5426835EB03303 38
expansion 4
C43BB6D653EE67493EA95FBC0CED6F8A 39
 
2CC3CF8C2878A5A663E2AF2D715E86BA 3A
FB669E904275D23F7339C6D7B2D20CA3
833DA70CED6A2012D196E6FE5C4D37C5 3B
29D227B983C16EBCB4C7A5636BD9C4C8
C743D06742EE90B8CA75503520ADBCCE 3C
664FF8DF44C796F86FDBA90C7E1572B6
8AE3663F8D9E82A1EDE68C9CE8256DAA 3D
BDDB9A6250143EA8F49B51F82A54EE9C
7FC96F0BB1485CA55DD364B77AF5E4EA 3E
DC6124BE95C5033D47B3EEBFC6ECB45A
91B765788BCB8BD402ED553A6662D0AD 3F
D60A4C6878ED4645793E28C61CDAF246
2824F9101B8D0F7B6EB263B5B55B2EBB 40
A67082CEA1D9A2E4CEB72008EFF35BA9
30E2575DE0A249CEE8CF2B5E4D9F52C7 41
AC0AE062CF6E892B408E68480FE0FDA6
5EE50439623202FA85393F72BB77FD1A 42
812D03E3E42B46CF9ADABAD20E0155A8
F88174B1BDE9BFDD45E2F55589CF46AB 43
ED6C0D0E3BDFB2F4BC26D46E747A89DC
7DF49265E3FAD678D6FE78ADBB3DFB63 44
806D838EAC97EA583D818753D9AD8C05
747FD62DC7A1CA96E27ACEFFAA723FF7 45
 
1E58EBD065BBF168C5BDF746BA7BE100 46
expansion 5
24347DAF5E4B35727A52276BA05474DB 47
 
09B1C705C35F536677C0EB3677DF8307 48
F4F48FD1DBFA9986ABEF0574312066FD
CCBE615C05A20033378E5964A7DD703D 49
EF1BB13E4A9155CC77DC06036253F99F
0D4750BBFCB0028130E184DEA8D48413 4A
0AE58534B4FE2D7832453731F99B9F66
0CFD679AF9B4724FD78DD6E99642288B 4B
33398207D06485A8AC9EAA9DF50C0C93
7AD31A8B4BEFC2C2B39901A9FE76B987 4C
95A6109218C835B0CC60FB51EA1F7579
BE787817C7F16F1AE0EF3BDE4CC2D786 4D
B5203727DFC75A6F31FD9B603FD53346
7CD8B891910A4314D0533DD84C45BE16 4E
0BBE1B2C0CD339630F3EF46F704F0536
32722C8807CF357D4A2F511944AE68DA 4F
E7ECD0CB606C3A035A55C13590E0A3A6
7E6BBFF6F687B898EEB51B3216E46E5D 50
0BEC10C074144D77055FF130009005A6
08EA5A8349B59DB53E0779B19A59A354 51
1F14CFDFC1B5FBB63134F0015A5AF9FC
F31281BFE69F51D164082521FFBB2261 52
322D22EDF839B54E9CAD6D9D8AD08F76
AFFE8EB13DD17ED80A61241C959256B6 53
 
92CDB4C25BF2355A2309E819C9144235 54
expansion 6
E1C65B226BE1DA02BA18FA21349EF96D 55
 
14EC76CE97F38A0A34506C539A5C9AB4 56
63EA4FF9D70C3561E9812D133013DC5A
1C9BC490E3066481FA59FDB600BB2870 57
1E7DA8E703D45762EE07D0FDA79721FD
43A5CACC0D6C2D3F2BD989676B3F7F57 58
3A2475DDA7A492C514FA39E9F2552E0F
00EFFD1808A405893C38FB2572706106 59
556FFD8811B646D4DFCB0F363AC81B35
EEAF49E009879BEFAAD6326A3213C429 5A
683D1DE0D1C04305BB64828DA69C8893
8D26B90F431DBB08DB1DDAC5B52C92ED 5B
5F37A2BF02D344071BA014969E38850D
577C3060AE6EBEAE3AAB1819C571680B 5C
530C4EEC2B29682C2C37AEBA9C021491
115A5D20D53A8DD39CC5AF410F0F186F 5D
5A09F8B6E6CDA2CAE1CDF55BB12D3420
0D4D51AB2379BF803ABFB90E75FC14BF 5E
E9B3A75FCD2BA50734D59A6FDD6CC9FD
9993DA3E7D2E5B15F252A4E66BB85A98 5F
47AEBF185E93FC593C08C953ED30D910
F42830A5FB0D8D760EA671C22BDE669D 60
6F28C877104EB549013D9B52D5381CC5
FB5FEB7FC7DCDD693701979B29035C47 61
 
02326AE7D396CE7F1C419DD65207ED09 62
</pre>
9C9B1372F8C640CF1C62F5D592DDB582 63
 
03B302E85FF381B13B8DAA2A90FF5E61 64
* Only in psp battery chips (1000-2000) (keyset 7 is supported only on some 2000 and above/3000)
BCD7F9D32FACF847C0FB4D2F309ABDA6 65
F55596E97FAF867FACB33AE69C8B6F93 66
EE297093F94E445944171F8E86E170FC 67
E434520CF088CFC8CD781B6CCF8C48C4 68
C1BF66818EF953F2E1266B6F550CC9CD 69 (SYSCON)
560FFF8F3C9649144516F1BCBFCEA30C 6A
2408DC753760A29F0554B5F243857399 6B
DDD5B56A59C55AE83B9667C75C2AE2DC 6C (SHA1 IPL)
AA686772E02D44D5CDBB6504BCD5BF4E 6D
1F17F014E777A2FE4B136B56CD7EF7E9 6E
C93548CF558D7503896B2EEB618CA902 6F
DE34C541E7CA86E8BEA7C31CECE4360F 70
DDE5FF551B74F6F4E016D7AB22311B6A 71
B0E93521333FD7BAB4762CCB4D8008D8 72
381469C4C3F91B9633638E4D5F3DF029 73
FA486AD98E6716EF6AB087F589457F2A 74
321A091250148A3E963DEA025932E18F 75
4B00BE29BCB02864CEFD43A96FD95CED 76
577DC4FF0244E28091F4CA0A7569FDA8 77
835336C61803E43E4EB30F6B6E799B7A 78
5C9265FD7B596AA37A2F509D85E927F8 79
9A39FB89DF55B2601424CEA6D9650A9D 7A
8B75BE91A8C75AD2D7A594A01CBB9591 7B
95C21B8D05ACF5EC5AEE77812395C4D7 7C
B9A461643633FA5D9488E2D3281E01A2 7D
B8B084FB9F4CFAF730FE7325A2AB897D 7E
5F8C179FC1B21DF1F6367A9CF7D3D47C 7F
</pre>


Table with each key indexed:
=== Obfuscation Algirithm for the psp-3000 battery firmware keys ===
<pre>
<pre>
u8 kirk7_key00[] = {0x2C, 0x92, 0xE5, 0x90, 0x2B, 0x86, 0xC1, 0x06, 0xB7, 0x2E, 0xEA, 0x6C, 0xD4, 0xEC, 0x72, 0x48};
Public Sub EncryptNec(buff() As Byte, r_key() As Variant)
u8 kirk7_key01[] = {0x05, 0x8D, 0xC8, 0x0B, 0x33, 0xA5, 0xBF, 0x9D, 0x56, 0x98, 0xFA, 0xE0, 0xD3, 0x71, 0x5E, 0x1F};
    Dim i      As Byte
u8 kirk7_key02[] = {0xB8, 0x13, 0xC3, 0x5E, 0xC6, 0x44, 0x41, 0xE3, 0xDC, 0x3C, 0x16, 0xF5, 0xB4, 0x5E, 0x64, 0x84}; // New from PS3
    Dim j      As Byte
u8 kirk7_key03[] = {0x98, 0x02, 0xC4, 0xE6, 0xEC, 0x9E, 0x9E, 0x2F, 0xFC, 0x63, 0x4C, 0xE4, 0x2F, 0xBB, 0x46, 0x68};
    Dim r      As Byte
u8 kirk7_key04[] = {0x99, 0x24, 0x4C, 0xD2, 0x58, 0xF5, 0x1B, 0xCB, 0xB0, 0x61, 0x9C, 0xA7, 0x38, 0x30, 0x07, 0x5F};
    Dim x      As Byte
u8 kirk7_key05[] = {0x02, 0x25, 0xD7, 0xBA, 0x63, 0xEC, 0xB9, 0x4A, 0x9D, 0x23, 0x76, 0x01, 0xB3, 0xF6, 0xAC, 0x17};
    Dim a(15)  As Byte
u8 kirk7_key06[] = {0x60, 0x99, 0xF2, 0x81, 0x70, 0x56, 0x0E, 0x5F, 0x74, 0x7C, 0xB5, 0x20, 0xC0, 0xCD, 0xC2, 0x3C}; // New from PS3
    Dim y(15)  As Byte
u8 kirk7_key07[] = {0x76, 0x36, 0x8B, 0x43, 0x8F, 0x77, 0xD8, 0x7E, 0xFE, 0x5F, 0xB6, 0x11, 0x59, 0x39, 0x88, 0x5C};
   
u8 kirk7_key08[] = {0x14, 0xA1, 0x15, 0xEB, 0x43, 0x4A, 0x1B, 0xA4, 0x90, 0x5E, 0x03, 0xB6, 0x17, 0xA1, 0x5C, 0x04};
   
u8 kirk7_key09[] = {0xE6, 0x58, 0x03, 0xD9, 0xA7, 0x1A, 0xA8, 0x7F, 0x05, 0x9D, 0x22, 0x9D, 0xAF, 0x54, 0x53, 0xD0};
    Debug.Print "entrance: " & Arr2Hex(buff)
u8 kirk7_key0A[] = {0xBA, 0x34, 0x80, 0xB4, 0x28, 0xA7, 0xCA, 0x5F, 0x21, 0x64, 0x12, 0xF7, 0x0F, 0xBB, 0x73, 0x23};
    Debug.Print "key0: " & Arr2Hex(r_key(0))
u8 kirk7_key0B[] = {0x72, 0xAD, 0x35, 0xAC, 0x9A, 0xC3, 0x13, 0x0A, 0x77, 0x8C, 0xB1, 0x9D, 0x88, 0x55, 0x0B, 0x0C};
   
u8 kirk7_key0C[] = {0x84, 0x85, 0xC8, 0x48, 0x75, 0x08, 0x43, 0xBC, 0x9B, 0x9A, 0xEC, 0xA7, 0x9C, 0x7F, 0x60, 0x18};
    '1 round - XOR with first keys
u8 kirk7_key0D[] = {0xB5, 0xB1, 0x6E, 0xDE, 0x23, 0xA9, 0x7B, 0x0E, 0xA1, 0x7C, 0xDB, 0xA2, 0xDC, 0xDE, 0xC4, 0x6E};
   
u8 kirk7_key0E[] = {0xC8, 0x71, 0xFD, 0xB3, 0xBC, 0xC5, 0xD2, 0xF2, 0xE2, 0xD7, 0x72, 0x9D, 0xDF, 0x82, 0x68, 0x82};
For r = 0 To 9
u8 kirk7_key0F[] = {0x0A, 0xBB, 0x33, 0x6C, 0x96, 0xD4, 0xCD, 0xD8, 0xCB, 0x5F, 0x4B, 0xE0, 0xBA, 0xDB, 0x9E, 0x03};
   
u8 kirk7_key10[] = {0x32, 0x29, 0x5B, 0xD5, 0xEA, 0xF7, 0xA3, 0x42, 0x16, 0xC8, 0x8E, 0x48, 0xFF, 0x50, 0xD3, 0x71};
    'sub_F9F and sub_F4E
u8 kirk7_key11[] = {0x46, 0xF2, 0x5E, 0x8E, 0x4D, 0x2A, 0xA5, 0x40, 0x73, 0x0B, 0xC4, 0x6E, 0x47, 0xEE, 0x6F, 0x0A};
   
u8 kirk7_key12[] = {0x5D, 0xC7, 0x11, 0x39, 0xD0, 0x19, 0x38, 0xBC, 0x02, 0x7F, 0xDD, 0xDC, 0xB0, 0x83, 0x7D, 0x9D};
    a(0) = buff(0) Xor r_key(r)(0)
u8 kirk7_key13[] = {0x51, 0xDD, 0x65, 0xF0, 0x71, 0xA4, 0xE5, 0xEA, 0x6A, 0xAF, 0x12, 0x19, 0x41, 0x29, 0xB8, 0xF4};
    a(1) = buff(1) Xor r_key(r)(1)
u8 kirk7_key14[] = {0x03, 0x76, 0x3C, 0x68, 0x65, 0xC6, 0x9B, 0x0F, 0xFE, 0x8F, 0xD8, 0xEE, 0xA4, 0x36, 0x16, 0xA0};
    a(2) = buff(2) Xor r_key(r)(2)
u8 kirk7_key15[] = {0x7D, 0x50, 0xB8, 0x5C, 0xAF, 0x67, 0x69, 0xF0, 0xE5, 0x4A, 0xA8, 0x09, 0x8B, 0x0E, 0xBE, 0x1C};
    a(3) = buff(3) Xor r_key(r)(3)
u8 kirk7_key16[] = {0x72, 0x68, 0x4B, 0x32, 0xAC, 0x3B, 0x33, 0x2F, 0x2A, 0x7A, 0xFC, 0x9E, 0x14, 0xD5, 0x6F, 0x6B};
   
u8 kirk7_key17[] = {0x20, 0x1D, 0x31, 0x96, 0x4A, 0xD9, 0x9F, 0xBF, 0x32, 0xD5, 0xD6, 0x1C, 0x49, 0x1B, 0xD9, 0xFC};
    a(4) = buff(5) Xor r_key(r)(5)
u8 kirk7_key18[] = {0xF8, 0xD8, 0x44, 0x63, 0xD6, 0x10, 0xD1, 0x2A, 0x44, 0x8E, 0x96, 0x90, 0xA6, 0xBB, 0x0B, 0xAD};
    a(5) = buff(6) Xor r_key(r)(6) ' rotate 5-7
u8 kirk7_key19[] = {0x5C, 0xD4, 0x05, 0x7F, 0xA1, 0x30, 0x60, 0x44, 0x0A, 0xD9, 0xB6, 0x74, 0x5F, 0x24, 0x4F, 0x4E};
    a(6) = buff(7) Xor r_key(r)(7)
u8 kirk7_key1A[] = {0xF4, 0x8A, 0xD6, 0x78, 0x59, 0x9C, 0x22, 0xC1, 0xD4, 0x11, 0x93, 0x3D, 0xF8, 0x45, 0xB8, 0x93};
    a(7) = buff(4) Xor r_key(r)(4) ' rotate 5-7
u8 kirk7_key1B[] = {0xCA, 0xE7, 0xD2, 0x87, 0xA2, 0xEC, 0xC1, 0xCD, 0x94, 0x54, 0x2B, 0x5E, 0x1D, 0x94, 0x88, 0xB2};
   
u8 kirk7_key1C[] = {0xDE, 0x26, 0xD3, 0x7A, 0x39, 0x95, 0x6C, 0x2A, 0xD8, 0xC3, 0xA6, 0xAF, 0x21, 0xEB, 0xB3, 0x01};
    a(8) = buff(10) Xor r_key(r)(10)  ' rotate 8-11
u8 kirk7_key1D[] = {0x7C, 0xB6, 0x8B, 0x4D, 0xA3, 0x8D, 0x1D, 0xD9, 0x32, 0x67, 0x9C, 0xA9, 0x9F, 0xFB, 0x28, 0x52};
    a(9) = buff(11) Xor r_key(r)(11)  ' rotate 9-10
u8 kirk7_key1E[] = {0xA0, 0xB5, 0x56, 0xB4, 0x69, 0xAB, 0x36, 0x8F, 0x36, 0xDE, 0xC9, 0x09, 0x2E, 0xCB, 0x41, 0xB1};
    a(10) = buff(8) Xor r_key(r)(8)    ' rotate 9-10
u8 kirk7_key1F[] = {0x93, 0x9D, 0xE1, 0x9B, 0x72, 0x5F, 0xEE, 0xE2, 0x45, 0x2A, 0xBC, 0x17, 0x06, 0xD1, 0x47, 0x69};
    a(11) = buff(9) Xor r_key(r)(9)    ' rotate 8-11
u8 kirk7_key20[] = {0xA4, 0xA4, 0xE6, 0x21, 0x38, 0x2E, 0xF1, 0xAF, 0x7B, 0x17, 0x7A, 0xE8, 0x42, 0xAD, 0x00, 0x31};
   
u8 kirk7_key21[] = {0xC3, 0x7F, 0x13, 0xE8, 0xCF, 0x84, 0xDB, 0x34, 0x74, 0x7B, 0xC3, 0xA0, 0xF1, 0x9D, 0x3A, 0x73};
    a(12) = buff(15) Xor r_key(r)(15)  ' rotate 12-14
u8 kirk7_key22[] = {0x2B, 0xF7, 0x83, 0x8A, 0xD8, 0x98, 0xE9, 0x5F, 0xA5, 0xF9, 0x01, 0xDA, 0x61, 0xFE, 0x35, 0xBB};
    a(13) = buff(12) Xor r_key(r)(12)
u8 kirk7_key23[] = {0xC7, 0x04, 0x62, 0x1E, 0x71, 0x4A, 0x66, 0xEA, 0x62, 0xE0, 0x4B, 0x20, 0x3D, 0xB8, 0xC2, 0xE5};
    a(14) = buff(13) Xor r_key(r)(13)  ' rotate 12-14
u8 kirk7_key24[] = {0xC9, 0x33, 0x85, 0x9A, 0xAB, 0x00, 0xCD, 0xCE, 0x4D, 0x8B, 0x8E, 0x9F, 0x3D, 0xE6, 0xC0, 0x0F};
    a(15) = buff(14) Xor r_key(r)(14)
u8 kirk7_key25[] = {0x18, 0x42, 0x56, 0x1F, 0x2B, 0x5F, 0x34, 0xE3, 0x51, 0x3E, 0xB7, 0x89, 0x77, 0x43, 0x1A, 0x65};
   
u8 kirk7_key26[] = {0xDC, 0xB0, 0xA0, 0x06, 0x5A, 0x50, 0xA1, 0x4E, 0x59, 0xAC, 0x97, 0x3F, 0x17, 0x58, 0xA3, 0xA3};
    'sub_FD4
u8 kirk7_key27[] = {0xC4, 0xDB, 0xAE, 0x83, 0xE2, 0x9C, 0xF2, 0x54, 0xA3, 0xDD, 0x37, 0x4E, 0x80, 0x7B, 0xF4, 0x25};
    For i = 0 To 15
u8 kirk7_key28[] = {0xBF, 0xAE, 0xEB, 0x49, 0x82, 0x65, 0xC5, 0x7C, 0x64, 0xB8, 0xC1, 0x7E, 0x19, 0x06, 0x44, 0x09};
        a(i) = m_fbsub(a(i))
u8 kirk7_key29[] = {0x79, 0x7C, 0xEC, 0xC3, 0xB3, 0xEE, 0x0A, 0xC0, 0x3B, 0xD8, 0xE6, 0xC1, 0xE0, 0xA8, 0xB1, 0xA4};
    Next i
u8 kirk7_key2A[] = {0x75, 0x34, 0xFE, 0x0B, 0xD6, 0xD0, 0xC2, 0x8D, 0x68, 0xD4, 0xE0, 0x2A, 0xE7, 0xD5, 0xD1, 0x55};
   
u8 kirk7_key2B[] = {0xFA, 0xB3, 0x53, 0x26, 0x97, 0x4F, 0x4E, 0xDF, 0xE4, 0xC3, 0xA8, 0x14, 0xC3, 0x2F, 0x0F, 0x88};
' Debug.Print "step1: " & Arr2Hex(a)
u8 kirk7_key2C[] = {0xEC, 0x97, 0xB3, 0x86, 0xB4, 0x33, 0xC6, 0xBF, 0x4E, 0x53, 0x9D, 0x95, 0xEB, 0xB9, 0x79, 0xE4};
   
u8 kirk7_key2D[] = {0xB3, 0x20, 0xA2, 0x04, 0xCF, 0x48, 0x06, 0x29, 0xB5, 0xDD, 0x8E, 0xFC, 0x98, 0xD4, 0x17, 0x7B};
    If r < 9 Then
u8 kirk7_key2E[] = {0x5D, 0xFC, 0x0D, 0x4F, 0x2C, 0x39, 0xDA, 0x68, 0x4A, 0x33, 0x74, 0xED, 0x49, 0x58, 0xA7, 0x3A};
        'sub_EE3
u8 kirk7_key2F[] = {0xD7, 0x5A, 0x54, 0x22, 0xCE, 0xD9, 0xA3, 0xD6, 0x2B, 0x55, 0x7D, 0x8D, 0xE8, 0xBE, 0xC7, 0xEC};
        For j = 0 To 3
u8 kirk7_key30[] = {0x6B, 0x4A, 0xEE, 0x43, 0x45, 0xAE, 0x70, 0x07, 0xCF, 0x8D, 0xCF, 0x4E, 0x4A, 0xE9, 0x3C, 0xFA};
            x = a(j) Xor a(j + 12) Xor a(j + 4) Xor a(j + 8) ' include in X
u8 kirk7_key31[] = {0x2B, 0x52, 0x2F, 0x66, 0x4C, 0x2D, 0x11, 0x4C, 0xFE, 0x61, 0x31, 0x8C, 0x56, 0x78, 0x4E, 0xA6};
            y(j) = a(j) Xor x Xor LShiftByteNec(a(j), 1) Xor LShiftByteNec(a(j + 4), 1)
u8 kirk7_key32[] = {0x3A, 0xA3, 0x4E, 0x44, 0xC6, 0x6F, 0xAF, 0x7B, 0xFA, 0xE5, 0x53, 0x27, 0xEF, 0xCF, 0xCC, 0x24};
            y(j + 4) = a(j + 4) Xor x Xor LShiftByteNec(a(j + 4), 1) Xor LShiftByteNec(a(j + 8), 1)
u8 kirk7_key33[] = {0x2B, 0x5C, 0x78, 0xBF, 0xC3, 0x8E, 0x49, 0x9D, 0x41, 0xC3, 0x3C, 0x5C, 0x7B, 0x27, 0x96, 0xCE};
            y(j + 8) = a(j + 8) Xor x Xor LShiftByteNec(a(j + 8), 1) Xor LShiftByteNec(a(j + 12), 1)
u8 kirk7_key34[] = {0xF3, 0x7E, 0xEA, 0xD2, 0xC0, 0xC8, 0x23, 0x1D, 0xA9, 0x9B, 0xFA, 0x49, 0x5D, 0xB7, 0x08, 0x1B};
            y(j + 12) = a(j + 12) Xor x Xor LShiftByteNec(a(j + 12), 1) Xor LShiftByteNec(a(j), 1)
u8 kirk7_key35[] = {0x70, 0x8D, 0x4E, 0x6F, 0xD1, 0xF6, 0x6F, 0x1D, 0x1E, 0x1F, 0xCB, 0x02, 0xF9, 0xB3, 0x99, 0x26};
        Next
u8 kirk7_key36[] = {0x0F, 0x67, 0x16, 0xE1, 0x80, 0x69, 0x9C, 0x51, 0xFC, 0xC7, 0xAD, 0x6E, 0x4F, 0xB8, 0x46, 0xC9};
       
u8 kirk7_key37[] = {0x56, 0x0A, 0x49, 0x4A, 0x84, 0x4C, 0x8E, 0xD9, 0x82, 0xEE, 0x0B, 0x6D, 0xC5, 0x7D, 0x20, 0x8D};
        For i = 0 To 15
u8 kirk7_key38[] = {0x12, 0x46, 0x8D, 0x7E, 0x1C, 0x42, 0x20, 0x9B, 0xBA, 0x54, 0x26, 0x83, 0x5E, 0xB0, 0x33, 0x03};
            buff(i) = y(i)
u8 kirk7_key39[] = {0xC4, 0x3B, 0xB6, 0xD6, 0x53, 0xEE, 0x67, 0x49, 0x3E, 0xA9, 0x5F, 0xBC, 0x0C, 0xED, 0x6F, 0x8A};
        Next i
u8 kirk7_key3A[] = {0x2C, 0xC3, 0xCF, 0x8C, 0x28, 0x78, 0xA5, 0xA6, 0x63, 0xE2, 0xAF, 0x2D, 0x71, 0x5E, 0x86, 0xBA};
   
u8 kirk7_key3B[] = {0x83, 0x3D, 0xA7, 0x0C, 0xED, 0x6A, 0x20, 0x12, 0xD1, 0x96, 0xE6, 0xFE, 0x5C, 0x4D, 0x37, 0xC5};
    Else
u8 kirk7_key3C[] = {0xC7, 0x43, 0xD0, 0x67, 0x42, 0xEE, 0x90, 0xB8, 0xCA, 0x75, 0x50, 0x35, 0x20, 0xAD, 0xBC, 0xCE};
       
u8 kirk7_key3D[] = {0x8A, 0xE3, 0x66, 0x3F, 0x8D, 0x9E, 0x82, 0xA1, 0xED, 0xE6, 0x8C, 0x9C, 0xE8, 0x25, 0x6D, 0xAA};
        For i = 0 To 15
u8 kirk7_key3E[] = {0x7F, 0xC9, 0x6F, 0x0B, 0xB1, 0x48, 0x5C, 0xA5, 0x5D, 0xD3, 0x64, 0xB7, 0x7A, 0xF5, 0xE4, 0xEA};
            buff(i) = a(i)
u8 kirk7_key3F[] = {0x91, 0xB7, 0x65, 0x78, 0x8B, 0xCB, 0x8B, 0xD4, 0x02, 0xED, 0x55, 0x3A, 0x66, 0x62, 0xD0, 0xAD};
        Next i
u8 kirk7_key40[] = {0x28, 0x24, 0xF9, 0x10, 0x1B, 0x8D, 0x0F, 0x7B, 0x6E, 0xB2, 0x63, 0xB5, 0xB5, 0x5B, 0x2E, 0xBB};
   
u8 kirk7_key41[] = {0x30, 0xE2, 0x57, 0x5D, 0xE0, 0xA2, 0x49, 0xCE, 0xE8, 0xCF, 0x2B, 0x5E, 0x4D, 0x9F, 0x52, 0xC7};
    End If
u8 kirk7_key42[] = {0x5E, 0xE5, 0x04, 0x39, 0x62, 0x32, 0x02, 0xFA, 0x85, 0x39, 0x3F, 0x72, 0xBB, 0x77, 0xFD, 0x1A};
   
u8 kirk7_key43[] = {0xF8, 0x81, 0x74, 0xB1, 0xBD, 0xE9, 0xBF, 0xDD, 0x45, 0xE2, 0xF5, 0x55, 0x89, 0xCF, 0x46, 0xAB};
    'Debug.Print "_EE3-" & r & ": " & Arr2Hex(buff)
u8 kirk7_key44[] = {0x7D, 0xF4, 0x92, 0x65, 0xE3, 0xFA, 0xD6, 0x78, 0xD6, 0xFE, 0x78, 0xAD, 0xBB, 0x3D, 0xFB, 0x63}; // New from PS3
   
u8 kirk7_key45[] = {0x74, 0x7F, 0xD6, 0x2D, 0xC7, 0xA1, 0xCA, 0x96, 0xE2, 0x7A, 0xCE, 0xFF, 0xAA, 0x72, 0x3F, 0xF7};
Next r
u8 kirk7_key46[] = {0x1E, 0x58, 0xEB, 0xD0, 0x65, 0xBB, 0xF1, 0x68, 0xC5, 0xBD, 0xF7, 0x46, 0xBA, 0x7B, 0xE1, 0x00};
u8 kirk7_key47[] = {0x24, 0x34, 0x7D, 0xAF, 0x5E, 0x4B, 0x35, 0x72, 0x7A, 0x52, 0x27, 0x6B, 0xA0, 0x54, 0x74, 0xDB};
    'last round XOR
u8 kirk7_key48[] = {0x09, 0xB1, 0xC7, 0x05, 0xC3, 0x5F, 0x53, 0x66, 0x77, 0xC0, 0xEB, 0x36, 0x77, 0xDF, 0x83, 0x07};
    For i = 0 To 15
u8 kirk7_key49[] = {0xCC, 0xBE, 0x61, 0x5C, 0x05, 0xA2, 0x00, 0x33, 0x37, 0x8E, 0x59, 0x64, 0xA7, 0xDD, 0x70, 0x3D};
        buff(i) = buff(i) Xor r_key(10)(i)
u8 kirk7_key4A[] = {0x0D, 0x47, 0x50, 0xBB, 0xFC, 0xB0, 0x02, 0x81, 0x30, 0xE1, 0x84, 0xDE, 0xA8, 0xD4, 0x84, 0x13};
    Next i
u8 kirk7_key4B[] = {0x0C, 0xFD, 0x67, 0x9A, 0xF9, 0xB4, 0x72, 0x4F, 0xD7, 0x8D, 0xD6, 0xE9, 0x96, 0x42, 0x28, 0x8B}; // 1.xx game eboot.bin
u8 kirk7_key4C[] = {0x7A, 0xD3, 0x1A, 0x8B, 0x4B, 0xEF, 0xC2, 0xC2, 0xB3, 0x99, 0x01, 0xA9, 0xFE, 0x76, 0xB9, 0x87};
' Debug.Print "_EE3-" & r & ": " & Arr2Hex(a)
u8 kirk7_key4D[] = {0xBE, 0x78, 0x78, 0x17, 0xC7, 0xF1, 0x6F, 0x1A, 0xE0, 0xEF, 0x3B, 0xDE, 0x4C, 0xC2, 0xD7, 0x86};
u8 kirk7_key4E[] = {0x7C, 0xD8, 0xB8, 0x91, 0x91, 0x0A, 0x43, 0x14, 0xD0, 0x53, 0x3D, 0xD8, 0x4C, 0x45, 0xBE, 0x16};
End Sub
u8 kirk7_key4F[] = {0x32, 0x72, 0x2C, 0x88, 0x07, 0xCF, 0x35, 0x7D, 0x4A, 0x2F, 0x51, 0x19, 0x44, 0xAE, 0x68, 0xDA};
u8 kirk7_key50[] = {0x7E, 0x6B, 0xBF, 0xF6, 0xF6, 0x87, 0xB8, 0x98, 0xEE, 0xB5, 0x1B, 0x32, 0x16, 0xE4, 0x6E, 0x5D};
u8 kirk7_key51[] = {0x08, 0xEA, 0x5A, 0x83, 0x49, 0xB5, 0x9D, 0xB5, 0x3E, 0x07, 0x79, 0xB1, 0x9A, 0x59, 0xA3, 0x54};
Private Function LShiftByteNec(ByVal bytValue As Integer, _
u8 kirk7_key52[] = {0xF3, 0x12, 0x81, 0xBF, 0xE6, 0x9F, 0x51, 0xD1, 0x64, 0x08, 0x25, 0x21, 0xFF, 0xBB, 0x22, 0x61};
                    &nbs
u8 kirk7_key53[] = {0xAF, 0xFE, 0x8E, 0xB1, 0x3D, 0xD1, 0x7E, 0xD8, 0x0A, 0x61, 0x24, 0x1C, 0x95, 0x92, 0x56, 0xB6};
p;     ByVal bytShiftBits As Byte) As Byte
u8 kirk7_key54[] = {0x92, 0xCD, 0xB4, 0xC2, 0x5B, 0xF2, 0x35, 0x5A, 0x23, 0x09, 0xE8, 0x19, 0xC9, 0x14, 0x42, 0x35};
   
u8 kirk7_key55[] = {0xE1, 0xC6, 0x5B, 0x22, 0x6B, 0xE1, 0xDA, 0x02, 0xBA, 0x18, 0xFA, 0x21, 0x34, 0x9E, 0xF9, 0x6D};
bytValue = LShift(bytValue, bytShiftBits)
u8 kirk7_key56[] = {0x14, 0xEC, 0x76, 0xCE, 0x97, 0xF3, 0x8A, 0x0A, 0x34, 0x50, 0x6C, 0x53, 0x9A, 0x5C, 0x9A, 0xB4};
   
u8 kirk7_key57[] = {0x1C, 0x9B, 0xC4, 0x90, 0xE3, 0x06, 0x64, 0x81, 0xFA, 0x59, 0xFD, 0xB6, 0x00, 0xBB, 0x28, 0x70};
If bytValue > &HFF Then
u8 kirk7_key58[] = {0x43, 0xA5, 0xCA, 0xCC, 0x0D, 0x6C, 0x2D, 0x3F, 0x2B, 0xD9, 0x89, 0x67, 0x6B, 0x3F, 0x7F, 0x57};
    LShiftByteNec = (bytValue - &HFF) Xor &H1A
u8 kirk7_key59[] = {0x00, 0xEF, 0xFD, 0x18, 0x08, 0xA4, 0x05, 0x89, 0x3C, 0x38, 0xFB, 0x25, 0x72, 0x70, 0x61, 0x06};
Else
u8 kirk7_key5A[] = {0xEE, 0xAF, 0x49, 0xE0, 0x09, 0x87, 0x9B, 0xEF, 0xAA, 0xD6, 0x32, 0x6A, 0x32, 0x13, 0xC4, 0x29};
    LShiftByteNec = bytValue
u8 kirk7_key5B[] = {0x8D, 0x26, 0xB9, 0x0F, 0x43, 0x1D, 0xBB, 0x08, 0xDB, 0x1D, 0xDA, 0xC5, 0xB5, 0x2C, 0x92, 0xED};
End If
u8 kirk7_key5C[] = {0x57, 0x7C, 0x30, 0x60, 0xAE, 0x6E, 0xBE, 0xAE, 0x3A, 0xAB, 0x18, 0x19, 0xC5, 0x71, 0x68, 0x0B};
u8 kirk7_key5D[] = {0x11, 0x5A, 0x5D, 0x20, 0xD5, 0x3A, 0x8D, 0xD3, 0x9C, 0xC5, 0xAF, 0x41, 0x0F, 0x0F, 0x18, 0x6F};
End Function
u8 kirk7_key5E[] = {0x0D, 0x4D, 0x51, 0xAB, 0x23, 0x79, 0xBF, 0x80, 0x3A, 0xBF, 0xB9, 0x0E, 0x75, 0xFC, 0x14, 0xBF};
</pre>
u8 kirk7_key5F[] = {0x99, 0x93, 0xDA, 0x3E, 0x7D, 0x2E, 0x5B, 0x15, 0xF2, 0x52, 0xA4, 0xE6, 0x6B, 0xB8, 0x5A, 0x98};
 
u8 kirk7_key60[] = {0xF4, 0x28, 0x30, 0xA5, 0xFB, 0x0D, 0x8D, 0x76, 0x0E, 0xA6, 0x71, 0xC2, 0x2B, 0xDE, 0x66, 0x9D};
== Spock Keys ==
u8 kirk7_key61[] = {0xFB, 0x5F, 0xEB, 0x7F, 0xC7, 0xDC, 0xDD, 0x69, 0x37, 0x01, 0x97, 0x9B, 0x29, 0x03, 0x5C, 0x47};
 
u8 kirk7_key62[] = {0x02, 0x32, 0x6A, 0xE7, 0xD3, 0x96, 0xCE, 0x7F, 0x1C, 0x41, 0x9D, 0xD6, 0x52, 0x07, 0xED, 0x09};
=== Spock Master Key (Spock command 9) ===
u8 kirk7_key63[] = {0x9C, 0x9B, 0x13, 0x72, 0xF8, 0xC6, 0x40, 0xCF, 0x1C, 0x62, 0xF5, 0xD5, 0x92, 0xDD, 0xB5, 0x82};
u8 kirk7_key64[] = {0x03, 0xB3, 0x02, 0xE8, 0x5F, 0xF3, 0x81, 0xB1, 0x3B, 0x8D, 0xAA, 0x2A, 0x90, 0xFF, 0x5E, 0x61};
u8 kirk7_key65[] = {0xBC, 0xD7, 0xF9, 0xD3, 0x2F, 0xAC, 0xF8, 0x47, 0xC0, 0xFB, 0x4D, 0x2F, 0x30, 0x9A, 0xBD, 0xA6};
u8 kirk7_key66[] = {0xF5, 0x55, 0x96, 0xE9, 0x7F, 0xAF, 0x86, 0x7F, 0xAC, 0xB3, 0x3A, 0xE6, 0x9C, 0x8B, 0x6F, 0x93};
u8 kirk7_key67[] = {0xEE, 0x29, 0x70, 0x93, 0xF9, 0x4E, 0x44, 0x59, 0x44, 0x17, 0x1F, 0x8E, 0x86, 0xE1, 0x70, 0xFC};
u8 kirk7_key68[] = {0xE4, 0x34, 0x52, 0x0C, 0xF0, 0x88, 0xCF, 0xC8, 0xCD, 0x78, 0x1B, 0x6C, 0xCF, 0x8C, 0x48, 0xC4};
u8 kirk7_key69[] = {0xC1, 0xBF, 0x66, 0x81, 0x8E, 0xF9, 0x53, 0xF2, 0xE1, 0x26, 0x6B, 0x6F, 0x55, 0x0C, 0xC9, 0xCD};
u8 kirk7_key6A[] = {0x56, 0x0F, 0xFF, 0x8F, 0x3C, 0x96, 0x49, 0x14, 0x45, 0x16, 0xF1, 0xBC, 0xBF, 0xCE, 0xA3, 0x0C};
u8 kirk7_key6B[] = {0x24, 0x08, 0xDC, 0x75, 0x37, 0x60, 0xA2, 0x9F, 0x05, 0x54, 0xB5, 0xF2, 0x43, 0x85, 0x73, 0x99};
u8 kirk7_key6C[] = {0xDD, 0xD5, 0xB5, 0x6A, 0x59, 0xC5, 0x5A, 0xE8, 0x3B, 0x96, 0x67, 0xC7, 0x5C, 0x2A, 0xE2, 0xDC};
u8 kirk7_key6D[] = {0xAA, 0x68, 0x67, 0x72, 0xE0, 0x2D, 0x44, 0xD5, 0xCD, 0xBB, 0x65, 0x04, 0xBC, 0xD5, 0xBF, 0x4E};
u8 kirk7_key6E[] = {0x1F, 0x17, 0xF0, 0x14, 0xE7, 0x77, 0xA2, 0xFE, 0x4B, 0x13, 0x6B, 0x56, 0xCD, 0x7E, 0xF7, 0xE9};
u8 kirk7_key6F[] = {0xC9, 0x35, 0x48, 0xCF, 0x55, 0x8D, 0x75, 0x03, 0x89, 0x6B, 0x2E, 0xEB, 0x61, 0x8C, 0xA9, 0x02};
u8 kirk7_key70[] = {0xDE, 0x34, 0xC5, 0x41, 0xE7, 0xCA, 0x86, 0xE8, 0xBE, 0xA7, 0xC3, 0x1C, 0xEC, 0xE4, 0x36, 0x0F};
u8 kirk7_key71[] = {0xDD, 0xE5, 0xFF, 0x55, 0x1B, 0x74, 0xF6, 0xF4, 0xE0, 0x16, 0xD7, 0xAB, 0x22, 0x31, 0x1B, 0x6A};
u8 kirk7_key72[] = {0xB0, 0xE9, 0x35, 0x21, 0x33, 0x3F, 0xD7, 0xBA, 0xB4, 0x76, 0x2C, 0xCB, 0x4D, 0x80, 0x08, 0xD8};
u8 kirk7_key73[] = {0x38, 0x14, 0x69, 0xC4, 0xC3, 0xF9, 0x1B, 0x96, 0x33, 0x63, 0x8E, 0x4D, 0x5F, 0x3D, 0xF0, 0x29};
u8 kirk7_key74[] = {0xFA, 0x48, 0x6A, 0xD9, 0x8E, 0x67, 0x16, 0xEF, 0x6A, 0xB0, 0x87, 0xF5, 0x89, 0x45, 0x7F, 0x2A};
u8 kirk7_key75[] = {0x32, 0x1A, 0x09, 0x12, 0x50, 0x14, 0x8A, 0x3E, 0x96, 0x3D, 0xEA, 0x02, 0x59, 0x32, 0xE1, 0x8F};
u8 kirk7_key76[] = {0x4B, 0x00, 0xBE, 0x29, 0xBC, 0xB0, 0x28, 0x64, 0xCE, 0xFD, 0x43, 0xA9, 0x6F, 0xD9, 0x5C, 0xED};
u8 kirk7_key77[] = {0x57, 0x7D, 0xC4, 0xFF, 0x02, 0x44, 0xE2, 0x80, 0x91, 0xF4, 0xCA, 0x0A, 0x75, 0x69, 0xFD, 0xA8};
u8 kirk7_key78[] = {0x83, 0x53, 0x36, 0xC6, 0x18, 0x03, 0xE4, 0x3E, 0x4E, 0xB3, 0x0F, 0x6B, 0x6E, 0x79, 0x9B, 0x7A};
u8 kirk7_key79[] = {0x5C, 0x92, 0x65, 0xFD, 0x7B, 0x59, 0x6A, 0xA3, 0x7A, 0x2F, 0x50, 0x9D, 0x85, 0xE9, 0x27, 0xF8};
u8 kirk7_key7A[] = {0x9A, 0x39, 0xFB, 0x89, 0xDF, 0x55, 0xB2, 0x60, 0x14, 0x24, 0xCE, 0xA6, 0xD9, 0x65, 0x0A, 0x9D};
u8 kirk7_key7B[] = {0x8B, 0x75, 0xBE, 0x91, 0xA8, 0xC7, 0x5A, 0xD2, 0xD7, 0xA5, 0x94, 0xA0, 0x1C, 0xBB, 0x95, 0x91};
u8 kirk7_key7C[] = {0x95, 0xC2, 0x1B, 0x8D, 0x05, 0xAC, 0xF5, 0xEC, 0x5A, 0xEE, 0x77, 0x81, 0x23, 0x95, 0xC4, 0xD7};
u8 kirk7_key7D[] = {0xB9, 0xA4, 0x61, 0x64, 0x36, 0x33, 0xFA, 0x5D, 0x94, 0x88, 0xE2, 0xD3, 0x28, 0x1E, 0x01, 0xA2};
u8 kirk7_key7E[] = {0xB8, 0xB0, 0x84, 0xFB, 0x9F, 0x4C, 0xFA, 0xF7, 0x30, 0xFE, 0x73, 0x25, 0xA2, 0xAB, 0x89, 0x7D};
u8 kirk7_key7F[] = {0x5F, 0x8C, 0x17, 0x9F, 0xC1, 0xB2, 0x1D, 0xF1, 0xF6, 0x36, 0x7A, 0x9C, 0xF7, 0xD3, 0xD4, 0x7C};
u8 kirk7_key80[] = {0x83, 0xFF, 0xF1, 0x49, 0xA6, 0x87, 0xA5, 0xC5, 0xCD, 0x95, 0x77, 0x93, 0x52, 0xC8, 0xBF, 0x66}; // New Kirk service, only on PS Vita
u8 kirk7_key81[] = {0xD8, 0x3D, 0x2D, 0x27, 0x7C, 0xE2, 0xDE, 0x15, 0x4A, 0x4E, 0x2A, 0xA6, 0xD1, 0xE8, 0xD2, 0x0B}; // New Kirk service, only on PS Vita
u8 kirk7_key82[] = {0x4C, 0x5C, 0x71, 0x51, 0x9F, 0x62, 0xA5, 0xFE, 0x5E, 0xF3, 0x6D, 0x4B, 0x07, 0x5B, 0xE2, 0xF3}; // New Kirk service, only on PS Vita
u8 kirk7_key83[] = {0x80, 0x05, 0xEF, 0x43, 0x12, 0x4F, 0x65, 0x0A, 0x9D, 0xF1, 0x58, 0xF7, 0x2A, 0x50, 0x9C, 0x10}; // New Kirk service, only on PS Vita
u8 kirk7_keyC0[] = {0xBF, 0x57, 0xAE, 0xF0, 0x2D, 0xC5, 0x87, 0xF3, 0x27, 0xC8, 0xC3, 0xF8, 0xBD, 0xEC, 0xA5, 0xEE}; // New Kirk service, only on PS Vita
u8 kirk7_keyC1[] = {0x9F, 0xFF, 0x2E, 0xEC, 0xED, 0x84, 0x76, 0xD9, 0x00, 0xDF, 0xD5, 0x79, 0xE1, 0xAA, 0xAB, 0x63}; // New Kirk service, only on PS Vita
u8 kirk7_keyC2[] = {0x04, 0x46, 0x0D, 0x61, 0xF5, 0x63, 0xD4, 0x6C, 0x0C, 0x4E, 0xB9, 0xAA, 0xE5, 0x46, 0x6E, 0x84}; // New Kirk service, only on PS Vita
u8 kirk7_keyC3[] = {0x1E, 0x5B, 0x17, 0xDA, 0xC3, 0x21, 0xE6, 0xB8, 0xDF, 0xE7, 0x71, 0x8C, 0xA2, 0x93, 0x03, 0x70}; // New Kirk service, only on PS Vita
</pre>


== Baryon Keys ==
private byte[] PSPSpockMasterKey = new byte[16] {
0x9F, 0x46, 0xF9, 0xFC, 0xFA, 0xB2, 0xAD, 0x05, 0x69, 0xF6, 0x88, 0xD8, 0x79, 0x4B, 0x92, 0xBA
};


=== Table Keys ===
== PSP IdStorage Keys ==


==== Index Correlation (0x80 Exchange) ====
=== PSP IdStorage Master Key ===


* 0x00 <- TA-086 (all)
//PSP Kirk commands 16 and 18 master key, also used for UMD Keys decryption
* 0x02 <- TA-085v2 (fallback, 0xFFs)
private byte[] PSPIDStorageKey = new byte[16] {
* 0x04 <- TA-090, TA093, TA-095, TA-096 (zeroes)
0x47, 0x5E, 0x09, 0xF4, 0xA2, 0x37, 0xDA, 0x9B, 0xEF, 0xFF, 0x3B, 0xC0, 0x77, 0x14, 0x3D, 0x8A
* 0x08 <- TA-085v2 (main, 0xFFs)
};
* 0x0A <- TA-090 (normal)
* 0x0D <- TA-093, TA-095, TA-096 (normal)
* 0x2F <- TA-096 (0xFFs)
* 0x97 <- TA-093, TA-095 (0xFFs)
* 0xB3 <- TA-091 (0xFFs)
* 0xD9 <- TA-090, TA-092 (0xFFs)
* 0xEB <- TA-091 (0xFFs)


==== Keys (0x80 Exchange) ====
=== PSP IdStorage Certificates ECDSA Public Keys ===


<pre>
They all use Curve Type 2 (VSH).
5C52D91CF382ACA489D88178EC16297B 0x00
9D4F50FCE1B68E1209307DDBA6A5B5AA 0x01
0975988864ACF7621BC0909DF0FCABFF 0x02
C9115CE2064A2686D8D6D9D08CDE3059 0x03
667539D2FB4273B2903FD7A39ED2C60C 0x04
F4FAEF20F4DBAB31D18674FD8F990566 0x05
EA0C811363D7E930F961135A4F352DDC 0x06
0A2E73305C382D4F310D0AED84A41800 0x08
D20474308FE269046ED7BB07CF1CFF43 0x09
AC00C0E3E80AF0683FDD1745194543BD 0x0A
0177D750BDFD2BC1A0493A134A4C6ACF 0x0B
05349170939345EE951A14843334A0DE 0x0C
DFF3FCD608B05597CF09A23BD17D3FD2 0x0D
4AA7C7B01134466FAC82163E4BB51BF9 0x2F
CAC8B87ACD9EC49690ABE0813920B110 0x97
03BEB65499140483BA187A64EF90261D 0xB3
C7AC1306DEFE39EC83A1483B0EE2EC89 0xD9
418499BE9D35A3B9FC6AD0D6F041BB26 0xEB
</pre>


==== Keys (0x90 Exchange, PSP Go Only!) ====
==== Section 0 ====


<pre>
Public key: <code>4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E</code>
880E2A94110926B20E53E22AE648AE9D IV/DATA
C66E9ED6ECBCB121B7465D25037D6646 KEY
DA24DAB43A61CBDF61FD255D0AEA7957 KEY
82828282 CONST VAL
</pre>


==== Keys (Syscon Flash Update Exchange, PSP Go Only!) ====
==== Section 1 ====


<pre>
Public key: <code>06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE</code>
78721A6284050ACF07F52C6EBAA32F98 KEY 1
08489E59EDD0666E6A83237585C795CB KEY 2
</pre>


==== Secrets (0x80 Exchange) ====
==== Section 2 ====


<pre>
Public key: <code>3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5</code>
D2072253A4F27468
F5D7D4B575F08E4E 0x00


B37A16EF557BD089
==== Section 3 ====
CC699581FD89126C 0x01


A04E32BBA7139E46
Public key: <code>CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786</code>
495E034794931D7B 0x02


B0B809833989FAE2
==== Section 4 ====
F4E04313AD2EB4DB 0x03


FE7D7899BFEC47C5
Public key: <code>08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6</code>
865E3EEF9DFBB1FD 0x04


306F3A03D86CBEE4
==== Section 5 ====
FF72BD2B83B89D2F 0x05


8422DFEAE21B63C2
Public key: <code>4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A</code>
58B95AAEF399DBD0 0x06


AD4043B256EB458B
<pre>
67C07215D96B39A1 0x08
public static final int[] psp_ids_certs_pub_keys = {
// certificate 0
0x40, 0x04, 0xC8, 0x0B, 0xD9, 0xC8, 0xBA, 0x38, 0x22, 0x10, 0x65, 0x92, 0x3E, 0x32, 0x4B, 0x5F, 0x0E, 0xC1, 0x65, 0xED,
0x6C, 0xFF, 0x7D, 0x9F, 0x2C, 0x42, 0x0B, 0x84, 0xDF, 0xDA, 0x6E, 0x96, 0xC0, 0xAE, 0xE2, 0x99, 0x27, 0xBC, 0xAF, 0x1E,
// certificate 1
0x06, 0x48, 0x5F, 0xD0, 0x29, 0x85, 0x3B, 0x55, 0x2F, 0x7E, 0xFD, 0xD6, 0x7A, 0x2D, 0xE7, 0xA1, 0xA4, 0xE2, 0x55, 0x37,
0xB2, 0x45, 0x9D, 0x87, 0x86, 0x42, 0x6D, 0x5B, 0x27, 0xEF, 0xA5, 0xA9, 0x31, 0x1C, 0xB8, 0xAB, 0xAB, 0xFA, 0x0E, 0xCE,
// certificate 2
0x3F, 0x8C, 0x34, 0xF2, 0x10, 0xAE, 0xC4, 0x8E, 0x15, 0x20, 0xFF, 0x2A, 0x44, 0x89, 0x9E, 0x05, 0x4A, 0x0D, 0xA3, 0x3D,
0xF8, 0xB9, 0x75, 0x4B, 0x09, 0xC0, 0xEC, 0x7E, 0x61, 0x86, 0x7A, 0x51, 0x26, 0xFE, 0x69, 0x26, 0x97, 0x21, 0x96, 0xF5,
// certificate 3
0xCC, 0xB3, 0x44, 0x0D, 0xC4, 0x83, 0x6D, 0xD5, 0x19, 0xE1, 0x3B, 0x28, 0x05, 0xB3, 0x08, 0x70, 0xDC, 0xAE, 0xE4, 0x62,
0x13, 0x6B, 0x38, 0x88, 0x65, 0x1A, 0x98, 0xE0, 0x2B, 0x29, 0xFA, 0x0C, 0xD3, 0x4F, 0x16, 0x16, 0xF1, 0xED, 0x57, 0x86,
// certificate 4
0x08, 0xB3, 0x36, 0x92, 0x5C, 0x2B, 0x44, 0x5D, 0x03, 0xA9, 0xBE, 0x51, 0xB9, 0xAA, 0xBF, 0x54, 0xE4, 0xCC, 0x14, 0x2E,
0xA7, 0x2A, 0x23, 0xBB, 0x80, 0x60, 0xB0, 0x3B, 0x71, 0xCD, 0xE0, 0x77, 0x2D, 0xE8, 0x2A, 0xD8, 0x93, 0x16, 0x48, 0xD6,
// certificate 5
0x4F, 0x0A, 0x2B, 0xC9, 0x98, 0x76, 0x40, 0x86, 0x0E, 0x22, 0xEE, 0x5D, 0x86, 0x08, 0x7C, 0x96, 0x92, 0x47, 0x0B, 0xDF,
0x59, 0xDC, 0x4C, 0x1F, 0x2E, 0x38, 0xF9, 0x2C, 0xE7, 0xB6, 0x68, 0x75, 0xB5, 0x9E, 0xD1, 0x0C, 0x9D, 0x84, 0xFA, 0x6A,
};
<pre>


C2377E8A74096C5F
== PSP Save Data Hash Keys ==
093EC519AF0F502D 0x0A


581C7F1944F96262
private byte[] PSPSDHashKey1 = new byte[16] { 0x40, 0xE6, 0x53, 0x3F, 0x05, 0x11, 0x3A, 0x4E, 0xA1, 0x4B, 0xDA, 0xD6, 0x72, 0x7C, 0x53, 0x4C };
318053875C203E24 0x0D
private byte[] PSPSDHashKey2 = new byte[16] { 0xFA, 0xAA, 0x50, 0xEC, 0x2F, 0xDE, 0x54, 0x93, 0xAD, 0x14, 0xB2, 0xCE, 0xA5, 0x30, 0x05, 0xDF };
private byte[] PSPSDHashKey3 = new byte[16] { 0x36, 0xA5, 0x3E, 0xAC, 0xC5, 0x26, 0x9E, 0xA3, 0x83, 0xD9, 0xEC, 0x25, 0x6C, 0x48, 0x48, 0x72 };
private byte[] PSPSDHashKey4 = new byte[16] { 0xD8, 0xC0, 0xB0, 0xF3, 0x3E, 0x6B, 0x76, 0x85, 0xFD, 0xFB, 0x4D, 0x7D, 0x45, 0x1E, 0x92, 0x03 };
private byte[] PSPSDHashKey5 = new byte[16] { 0xCB, 0x15, 0xF4, 0x07, 0xF9, 0x6A, 0x52, 0x3C, 0x04, 0xB9, 0xB2, 0xEE, 0x5C, 0x53, 0xFA, 0x86 };
private byte[] PSPSDHashKey6 = new byte[16] { 0x70, 0x44, 0xA3, 0xAE, 0xEF, 0x5D, 0xA5, 0xF2, 0x85, 0x7F, 0xF2, 0xD6, 0x94, 0xF5, 0x36, 0x3B };
private byte[] PSPSDHashKey7 = new byte[16] { 0xEC, 0x6D, 0x29, 0x59, 0x26, 0x35, 0xA5, 0x7F, 0x97, 0x2A, 0x0D, 0xBC, 0xA3, 0x26, 0x33, 0x00 };


F1BC562BD55BB077
== PSP AMCTRL Hash Keys ==
1BDF2433EB29155B 0x2F


AF6010A846F741F3
private byte[] PSPAMHashKey1 = new byte[16] { 0x9C, 0x48, 0xB6, 0x28, 0x40, 0xE6, 0x53, 0x3F, 0x05, 0x11, 0x3A, 0x4E, 0x65, 0xE6, 0x3A, 0x64 };
9DEEC01144B66F41 0x97
private byte[] PSPAMHashKey2 = new byte[16] { 0x70, 0xB4, 0x7B, 0xC0, 0xA1, 0x4B, 0xDA, 0xD6, 0xE0, 0x10, 0x14, 0xED, 0x72, 0x7C, 0x53, 0x4C };
private byte[] PSPAMHashKey3 = new byte[16] { 0xE3, 0x50, 0xED, 0x1D, 0x91, 0x0A, 0x1F, 0xD0, 0x29, 0xBB, 0x1C, 0x3E, 0xF3, 0x40, 0x77, 0xFB };
private byte[] PSPAMHashKey4 = new byte[16] { 0x13, 0x5F, 0xA4, 0x7C, 0xAB, 0x39, 0x5B, 0xA4, 0x76, 0xB8, 0xCC, 0xA9, 0x8F, 0x3A, 0x04, 0x45 };
private byte[] PSPAMHashKey5 = new byte[16] { 0x67, 0x8D, 0x7F, 0xA3, 0x2A, 0x9C, 0xA0, 0xD1, 0x50, 0x8A, 0xD8, 0x38, 0x5E, 0x4B, 0x01, 0x7E };


DBD3AEA4DB046410
== PSP Kirk command 1 AESCBC128-CMAC Key ==
E32B8F56B2641298 0xB3


90E1F0C00178E3FF
private byte[] kirk_command_1_aes128cmac_key = new byte[16] {
C34A6A7B205FE8F9 0xD9
0x98, 0xC9, 0x40, 0x97, 0x5C, 0x1D, 0x10, 0xE8, 0x7F, 0xE6, 0x0E, 0xA3, 0xFD, 0x03, 0xA8, 0xBA
};


0BD9027E851FA123
== PSP Kirk command 1 ECDSA Curve ==
F791ED0B3F49A448 0xEB


</pre>
private byte[][] kirk_command_1_ecdsa_curve = new byte[6][] {
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF },
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC },
new byte[20] { 0x65, 0xD1, 0x48, 0x8C, 0x03, 0x59, 0xE2, 0x34, 0xAD, 0xC9, 0x5B, 0xD3, 0x90, 0x80, 0x14, 0xBD, 0x91, 0xA5, 0x25, 0xF9 },
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x01, 0xB5, 0xC6, 0x17, 0xF2, 0x90, 0xEA, 0xE1, 0xDB, 0xAD, 0x8F },
new byte[20] { 0x22, 0x59, 0xAC, 0xEE, 0x15, 0x48, 0x9C, 0xB0, 0x96, 0xA8, 0x82, 0xF0, 0xAE, 0x1C, 0xF9, 0xFD, 0x8E, 0xE5, 0xF8, 0xFA },
new byte[20] { 0x60, 0x43, 0x58, 0x45, 0x6D, 0x0A, 0x1C, 0xB2, 0x90, 0x8D, 0xE9, 0x0F, 0x27, 0xD7, 0x5C, 0x82, 0xBE, 0xC1, 0x08, 0xC0 },
};


==== Secrets (Syscon Flash Update Exchange, PSP Go Only!) ====
== PSP Kirk command 1 ECDSA Private Key ==


<pre>
private byte[] kirk_command_1_ecdsa_private_key = new byte[20] = {
6EBE650DCEDCB6163158AC0CAD158907 SHARED SECRET
0xF3, 0x92, 0xE2, 0x64, 0x90, 0xB8, 0x0F, 0xD8, 0x89, 0xF2, 0xD9, 0x72, 0x2C, 0x1F, 0x34, 0xD7, 0x27, 0x4F, 0x98, 0x3D
</pre>
};
 
== PSP Kirk command 1 ECDSA Public Key ==


private byte[] kirk_command_1_ecdsa_pub_key_x = new byte[20] { 0xED, 0x9C, 0xE5, 0x82, 0x34, 0xE6, 0x1A, 0x53, 0xC6, 0x85, 0xD6, 0x4D, 0x51, 0xD0, 0x23, 0x6B, 0xC3, 0xB5, 0xD4, 0xB9 };
private byte[] kirk_command_1_ecdsa_pub_key_y = new byte[20] { 0x04, 0x9D, 0xF1, 0xA0, 0x75, 0xC0, 0xE0, 0x4F, 0xB3, 0x44, 0x85, 0x8B, 0x61, 0xB7, 0x9B, 0x69, 0xA6, 0x3D, 0x2C, 0x39 };


* TA-090/TA-092(03g) has keysets 4, 0xA, 0xD9 (4 for 0x00s, 0xA for normal, 0xD9 for 0xFF)
private byte[] kirk_command_1_ecdsa_ec_m_header = new byte[20] { 0x7D, 0x7E, 0x46, 0x85, 0x4D, 0x07, 0xFA, 0x0B, 0xC6, 0xE8, 0xED, 0x62, 0x99, 0x89, 0x26, 0x14, 0x39, 0x5F, 0xEA, 0xFC };
* TA-096/TA-097(11g) has keysets 4, 0xD, 0x2F (4 for 0x00s, 0xD for normal, 0x2F, for 0xFF)
private byte[] kirk_command_1_ecdsa_ec_r_header = new byte[20] { 0x66, 0x4f, 0xe1, 0xf2, 0xe9, 0xd6, 0x63, 0x36, 0xf7, 0x33, 0x0b, 0xca, 0xb9, 0x55, 0x6d, 0xb6, 0xeb, 0xe8, 0x05, 0xdc };
* TA-086(01g) has keyset 0 (for all, 0x00, 0xFF and normal)
private byte[] kirk_command_1_ecdsa_ec_m_data = new byte[20] { 0x15, 0xee, 0x16, 0x24, 0x12, 0x09, 0x58, 0x16, 0x0f, 0x8b, 0x1a, 0x21, 0x33, 0x7a, 0x38, 0xf8, 0x29, 0xf7, 0x2e, 0x58 };
* Some PSP 3000s(04g/07g/09g) use 0x97 keyset
private byte[] kirk_command_1_ecdsa_ec_r_data = new byte[20] { 0xcd, 0xe3, 0x88, 0xa6, 0x3c, 0x1d, 0x57, 0xdc, 0x5e, 0x94, 0xee, 0xac, 0x2e, 0x6c, 0x9f, 0x2e, 0x81, 0xc7, 0x1c, 0x58 };
* Some PSP 2000s(02g) use keysets 2 and 8
* TA-091(05g) uses keysets 0xB3, 0xEB for 0xFF


==== Expansions (0x80 Exchange, Old) ====
== PSP Applications ECDSA Curve ==


<pre>
private byte[][] psp_applications_ecdsa_curve = new byte[6][] {
expansion 0
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF },
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC },
new byte[20] { 0xA6, 0x8B, 0xED, 0xC3, 0x34, 0x18, 0x02, 0x9C, 0x1D, 0x3C, 0xE3, 0x3B, 0x9A, 0x32, 0x1F, 0xCC, 0xBB, 0x9E, 0x0F, 0x0B },
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xB5, 0xAE, 0x3C, 0x52, 0x3E, 0x63, 0x94, 0x4F, 0x21, 0x27 },
new byte[20] { 0x12, 0x8E, 0xC4, 0x25, 0x64, 0x87, 0xFD, 0x8F, 0xDF, 0x64, 0xE2, 0x43, 0x7B, 0xC0, 0xA1, 0xF6, 0xD5, 0xAF, 0xDE, 0x2C },
new byte[20] { 0x59, 0x58, 0x55, 0x7E, 0xB1, 0xDB, 0x00, 0x12, 0x60, 0x42, 0x55, 0x24, 0xDB, 0xC3, 0x79, 0xD5, 0xAC, 0x5F, 0x4A, 0xDF },
};
 
== PSP EDATA ECDSA Private Key ==


F35CEC89825216D8ACD92981A41C7B78 k0
private byte[] psp_edata_ecdsa_private_key = new byte[20] {
E91A8C6075F7BBAD54F8FCD576D2750E k1
0xE5, 0xC4, 0xD0, 0xA8, 0x24, 0x9A, 0x6F, 0x27, 0xE5, 0xE0, 0xC9, 0xD5, 0x34, 0xF4, 0xDA, 0x15, 0x22, 0x3F, 0x42, 0xAD
1BF2F77B3247249F316518E4C0B6BBCE k2
};
DBC057A0D8EA6347BE8F425A1EDE6BD0 k3
E8331F481EC63A594EF056149B85204B k4
4BA31C0369770A3009474B1DDE45B595 k5
AFE4B0ACADC4979D9B92CD8607D92792 k6
832C9F2FD479DE49C55E8E43393E8CAB k7
32B1821DB46023FDFF3A32BCDCE5FB77 k8
BE8C21A3F743290ACA3544762AF6A65D k9
A11F2302AF588CA5DB11E9AD210BDA7C k10


expansion 1
== PSP EDATA ECDSA Public Key ==


E19DA609B64FA5308E50B57D12FCAADB k0
private byte[] psp_edata_ecdsa_public_key = new byte[20] {
7B9AD4722C9AB91C72FCBA0FCAD8BB11 k1
0x1F, 0x07, 0x2B, 0xCC, 0xC1, 0x62, 0xF2, 0xCF, 0xAE, 0xA0, 0xE7, 0xF4, 0xCD, 0xFD, 0x9C, 0xAE, 0xC6, 0xC4, 0x55, 0x21,
B5CE13C7426EE75E6416D16B5A90F04B k2
0x53, 0x01, 0xF4, 0xE3, 0x70, 0xC3, 0xED, 0xE2, 0xD4, 0xF5, 0xDB, 0xC3, 0xA7, 0xDE, 0x8C, 0xAA, 0xE8, 0xAD, 0x5B, 0x7D
EB5E3F2C1250AB4CFE9A4495B7ED0CFC k3
};
DF34CCF3594BBE159A644B0F2F98DFD3 k4
558A6AA6A1F80AB460FA246FFCD3F02F k5
98CD543E6FCED1DB16765D792DD1F202 k6
2BB34115ED82E736E9FFCD90DCF12CDE k7
8CA7D899D23F03E4678E3AF7AE725C70 k8
4BC70AD26DBF8A89A3C46E54BD1391CD k9
C48F1C164D204EC4E645DCB2C9749504 k10


expansion 2
== PSP Kirk commands 4/7 AES128CBC Keys ==


6409F01BAC75FCC0F798AB906288FF9D
<pre>
DCB837C7BB17877B798E42E9660404FB
2C92E5902B86C106B72EEA6CD4EC7248 0
71AD81B6803B7CFB057CAEECF89E0703
058DC80B33A5BF9D5698FAE0D3715E1F 1
C8B9FF7E5FDFD8A4BCB9FE506A926E69
B813C35EC64441E3DC3C16F5B45E6484 2
18D099663B64479F9A2634CAEE84E987
9802C4E6EC9E9E2FFC634CE42FBB4668 3
7860871E477C9FD8A2385C68846AEA03
99244CD258F51BCBB0619CA73830075F 4
E39B7AFD713636A91DBF2975F97D10FA
0225D7BA63ECB94A9D237601B3F6AC17 5
3DDEBAC0E2937D4B6875341D5EA7B4A4
6099F28170560E5F747CB520C0CDC23C 6
9CA1E65C698B5F2290F8B98D0D531DA9
76368B438F77D87EFE5FB6115939885C 7
E97553B5B4DDC996CC5CF841D0DD6479
14A115EB434A1BA4905E03B617A15C04 8
779E91C2289C77BED31F6A92E030FD99
E65803D9A71AA87F059D229DAF5453D0 9
 
BA3480B428A7CA5F216412F70FBB7323 A
expansion 3
72AD35AC9AC3130A778CB19D88550B0C B
 
8485C848750843BC9B9AECA79C7F6018 C
06C98CD84A11DED6265C30D986E259D0
B5B16EDE23A97B0EA17CDBA2DCDEC46E D
D3D5870B5F155789B1975868008689D0
C871FDB3BCC5D2F2E2D7729DDF826882 E
5F8CD354207FFEA98130B1E99191C841
0ABB336C96D4CDD8CB5F4BE0BADB9E03 F
6C33EB3897B7C03E59D801B066F7EF27
32295BD5EAF7A34216C88E48FF50D371 10
ED813ED55CCBA2625E07EFEE781EB05F
46F25E8E4D2AA540730BC46E47EE6F0A 11
46ABAD934814882ABEE0BF50D4AC3B8B
5DC71139D01938BC027FDDDCB0837D9D 12
094F379A541CF67EBC0253ECED395D66
51DD65F071A4E5EA6AAF12194129B8F4 13
444DE9DEA5F12DDBF24E4D1E4EA37528
03763C6865C69B0FFE8FD8EEA43616A0 14 (SYSCON)
5115668FB712416C21D3723FF3BDAEDB
7D50B85CAF6769F0E54AA8098B0EBE1C 15 (SYSCON)
DC8D3553E552C88916375B297D8E08A6
72684B32AC3B332F2A7AFC9E14D56F6B 16
8F53E9DC8E6BCF07110763386518CBC3
201D31964AD99FBF32D5D61C491BD9FC 17
 
F8D84463D610D12A448E9690A6BB0BAD 18
expansion 4
5CD4057FA13060440AD9B6745F244F4E 19
 
F48AD678599C22C1D411933DF845B893 1A
FB669E904275D23F7339C6D7B2D20CA3
CAE7D287A2ECC1CD94542B5E1D9488B2 1B
29D227B983C16EBCB4C7A5636BD9C4C8
DE26D37A39956C2AD8C3A6AF21EBB301 1C
664FF8DF44C796F86FDBA90C7E1572B6
7CB68B4DA38D1DD932679CA99FFB2852 1D
BDDB9A6250143EA8F49B51F82A54EE9C
A0B556B469AB368F36DEC9092ECB41B1 1E
DC6124BE95C5033D47B3EEBFC6ECB45A
939DE19B725FEEE2452ABC1706D14769 1F
D60A4C6878ED4645793E28C61CDAF246
A4A4E621382EF1AF7B177AE842AD0031 20
A67082CEA1D9A2E4CEB72008EFF35BA9
C37F13E8CF84DB34747BC3A0F19D3A73 21
AC0AE062CF6E892B408E68480FE0FDA6
2BF7838AD898E95FA5F901DA61FE35BB 22
812D03E3E42B46CF9ADABAD20E0155A8
C704621E714A66EA62E04B203DB8C2E5 23
ED6C0D0E3BDFB2F4BC26D46E747A89DC
C933859AAB00CDCE4D8B8E9F3DE6C00F 24
806D838EAC97EA583D818753D9AD8C05
1842561F2B5F34E3513EB78977431A65 25
 
DCB0A0065A50A14E59AC973F1758A3A3 26
expansion 5
C4DBAE83E29CF254A3DD374E807BF425 27
 
BFAEEB498265C57C64B8C17E19064409 28
F4F48FD1DBFA9986ABEF0574312066FD
797CECC3B3EE0AC03BD8E6C1E0A8B1A4 29
EF1BB13E4A9155CC77DC06036253F99F
7534FE0BD6D0C28D68D4E02AE7D5D155 2A
0AE58534B4FE2D7832453731F99B9F66
FAB35326974F4EDFE4C3A814C32F0F88 2B
33398207D06485A8AC9EAA9DF50C0C93
EC97B386B433C6BF4E539D95EBB979E4 2C
95A6109218C835B0CC60FB51EA1F7579
B320A204CF480629B5DD8EFC98D4177B 2D
B5203727DFC75A6F31FD9B603FD53346
5DFC0D4F2C39DA684A3374ED4958A73A 2E
0BBE1B2C0CD339630F3EF46F704F0536
D75A5422CED9A3D62B557D8DE8BEC7EC 2F
E7ECD0CB606C3A035A55C13590E0A3A6
6B4AEE4345AE7007CF8DCF4E4AE93CFA 30
0BEC10C074144D77055FF130009005A6
2B522F664C2D114CFE61318C56784EA6 31
1F14CFDFC1B5FBB63134F0015A5AF9FC
3AA34E44C66FAF7BFAE55327EFCFCC24 32
322D22EDF839B54E9CAD6D9D8AD08F76
2B5C78BFC38E499D41C33C5C7B2796CE 33
 
F37EEAD2C0C8231DA99BFA495DB7081B 34
expansion 6
708D4E6FD1F66F1D1E1FCB02F9B39926 35
 
0F6716E180699C51FCC7AD6E4FB846C9 36
63EA4FF9D70C3561E9812D133013DC5A
560A494A844C8ED982EE0B6DC57D208D 37
1E7DA8E703D45762EE07D0FDA79721FD
12468D7E1C42209BBA5426835EB03303 38
3A2475DDA7A492C514FA39E9F2552E0F
C43BB6D653EE67493EA95FBC0CED6F8A 39
556FFD8811B646D4DFCB0F363AC81B35
2CC3CF8C2878A5A663E2AF2D715E86BA 3A
683D1DE0D1C04305BB64828DA69C8893
833DA70CED6A2012D196E6FE5C4D37C5 3B
5F37A2BF02D344071BA014969E38850D
C743D06742EE90B8CA75503520ADBCCE 3C
530C4EEC2B29682C2C37AEBA9C021491
8AE3663F8D9E82A1EDE68C9CE8256DAA 3D
5A09F8B6E6CDA2CAE1CDF55BB12D3420
7FC96F0BB1485CA55DD364B77AF5E4EA 3E
E9B3A75FCD2BA50734D59A6FDD6CC9FD
91B765788BCB8BD402ED553A6662D0AD 3F
47AEBF185E93FC593C08C953ED30D910
2824F9101B8D0F7B6EB263B5B55B2EBB 40
6F28C877104EB549013D9B52D5381CC5
30E2575DE0A249CEE8CF2B5E4D9F52C7 41
 
5EE50439623202FA85393F72BB77FD1A 42
</pre>
F88174B1BDE9BFDD45E2F55589CF46AB 43
 
7DF49265E3FAD678D6FE78ADBB3DFB63 44
* Only in PSP battery chips (PSP 1000-2000) (keyset 7 is supported only on some PSP 2000 and above / PSP 3000)
747FD62DC7A1CA96E27ACEFFAA723FF7 45
 
1E58EBD065BBF168C5BDF746BA7BE100 46
=== Obfuscation Algorithm for the PSP 3000 battery firmware keys ===
24347DAF5E4B35727A52276BA05474DB 47
 
09B1C705C35F536677C0EB3677DF8307 48
<pre>
CCBE615C05A20033378E5964A7DD703D 49
Public Sub EncryptNec(buff() As Byte, r_key() As Variant)
0D4750BBFCB0028130E184DEA8D48413 4A
    Dim i      As Byte
0CFD679AF9B4724FD78DD6E99642288B 4B
    Dim j      As Byte
7AD31A8B4BEFC2C2B39901A9FE76B987 4C
    Dim r      As Byte
BE787817C7F16F1AE0EF3BDE4CC2D786 4D
    Dim x      As Byte
7CD8B891910A4314D0533DD84C45BE16 4E
    Dim a(15)  As Byte
32722C8807CF357D4A2F511944AE68DA 4F
    Dim y(15)  As Byte
7E6BBFF6F687B898EEB51B3216E46E5D 50
   
08EA5A8349B59DB53E0779B19A59A354 51
   
F31281BFE69F51D164082521FFBB2261 52
    Debug.Print "entrance: " & Arr2Hex(buff)
AFFE8EB13DD17ED80A61241C959256B6 53
    Debug.Print "key0: " & Arr2Hex(r_key(0))
92CDB4C25BF2355A2309E819C9144235 54
   
E1C65B226BE1DA02BA18FA21349EF96D 55
    '1 round - XOR with first keys
14EC76CE97F38A0A34506C539A5C9AB4 56
   
1C9BC490E3066481FA59FDB600BB2870 57
For r = 0 To 9
43A5CACC0D6C2D3F2BD989676B3F7F57 58
   
00EFFD1808A405893C38FB2572706106 59
    'sub_F9F and sub_F4E
EEAF49E009879BEFAAD6326A3213C429 5A
   
8D26B90F431DBB08DB1DDAC5B52C92ED 5B
    a(0) = buff(0) Xor r_key(r)(0)
577C3060AE6EBEAE3AAB1819C571680B 5C
    a(1) = buff(1) Xor r_key(r)(1)
115A5D20D53A8DD39CC5AF410F0F186F 5D
    a(2) = buff(2) Xor r_key(r)(2)
0D4D51AB2379BF803ABFB90E75FC14BF 5E
    a(3) = buff(3) Xor r_key(r)(3)
9993DA3E7D2E5B15F252A4E66BB85A98 5F
   
F42830A5FB0D8D760EA671C22BDE669D 60
    a(4) = buff(5) Xor r_key(r)(5)
FB5FEB7FC7DCDD693701979B29035C47 61
    a(5) = buff(6) Xor r_key(r)(6) ' rotate 5-7
02326AE7D396CE7F1C419DD65207ED09 62
    a(6) = buff(7) Xor r_key(r)(7)
9C9B1372F8C640CF1C62F5D592DDB582 63
    a(7) = buff(4) Xor r_key(r)(4) ' rotate 5-7
03B302E85FF381B13B8DAA2A90FF5E61 64
   
BCD7F9D32FACF847C0FB4D2F309ABDA6 65
    a(8) = buff(10) Xor r_key(r)(10)  ' rotate 8-11
F55596E97FAF867FACB33AE69C8B6F93 66
    a(9) = buff(11) Xor r_key(r)(11)  ' rotate 9-10
EE297093F94E445944171F8E86E170FC 67
    a(10) = buff(8) Xor r_key(r)(8)    ' rotate 9-10
E434520CF088CFC8CD781B6CCF8C48C4 68
    a(11) = buff(9) Xor r_key(r)(9)    ' rotate 8-11
C1BF66818EF953F2E1266B6F550CC9CD 69 (SYSCON)
   
560FFF8F3C9649144516F1BCBFCEA30C 6A
    a(12) = buff(15) Xor r_key(r)(15)  ' rotate 12-14
2408DC753760A29F0554B5F243857399 6B
    a(13) = buff(12) Xor r_key(r)(12)
DDD5B56A59C55AE83B9667C75C2AE2DC 6C
    a(14) = buff(13) Xor r_key(r)(13)  ' rotate 12-14
AA686772E02D44D5CDBB6504BCD5BF4E 6D
    a(15) = buff(14) Xor r_key(r)(14)
1F17F014E777A2FE4B136B56CD7EF7E9 6E
   
C93548CF558D7503896B2EEB618CA902 6F
    'sub_FD4
DE34C541E7CA86E8BEA7C31CECE4360F 70
    For i = 0 To 15
DDE5FF551B74F6F4E016D7AB22311B6A 71
        a(i) = m_fbsub(a(i))
B0E93521333FD7BAB4762CCB4D8008D8 72
    Next i
381469C4C3F91B9633638E4D5F3DF029 73
   
FA486AD98E6716EF6AB087F589457F2A 74
' Debug.Print "step1: " & Arr2Hex(a)
321A091250148A3E963DEA025932E18F 75
   
4B00BE29BCB02864CEFD43A96FD95CED 76
    If r < 9 Then
577DC4FF0244E28091F4CA0A7569FDA8 77
        'sub_EE3
835336C61803E43E4EB30F6B6E799B7A 78
        For j = 0 To 3
5C9265FD7B596AA37A2F509D85E927F8 79
            x = a(j) Xor a(j + 12) Xor a(j + 4) Xor a(j + 8) ' include in X
9A39FB89DF55B2601424CEA6D9650A9D 7A
            y(j) = a(j) Xor x Xor LShiftByteNec(a(j), 1) Xor LShiftByteNec(a(j + 4), 1)
8B75BE91A8C75AD2D7A594A01CBB9591 7B
            y(j + 4) = a(j + 4) Xor x Xor LShiftByteNec(a(j + 4), 1) Xor LShiftByteNec(a(j + 8), 1)
95C21B8D05ACF5EC5AEE77812395C4D7 7C
            y(j + 8) = a(j + 8) Xor x Xor LShiftByteNec(a(j + 8), 1) Xor LShiftByteNec(a(j + 12), 1)
B9A461643633FA5D9488E2D3281E01A2 7D
            y(j + 12) = a(j + 12) Xor x Xor LShiftByteNec(a(j + 12), 1) Xor LShiftByteNec(a(j), 1)
B8B084FB9F4CFAF730FE7325A2AB897D 7E
        Next
5F8C179FC1B21DF1F6367A9CF7D3D47C 7F
       
</pre>
        For i = 0 To 15
 
            buff(i) = y(i)
Table with each key indexed:
        Next i
<pre>
   
u8 kirk7_key00[] = {0x2C, 0x92, 0xE5, 0x90, 0x2B, 0x86, 0xC1, 0x06, 0xB7, 0x2E, 0xEA, 0x6C, 0xD4, 0xEC, 0x72, 0x48};
    Else
u8 kirk7_key01[] = {0x05, 0x8D, 0xC8, 0x0B, 0x33, 0xA5, 0xBF, 0x9D, 0x56, 0x98, 0xFA, 0xE0, 0xD3, 0x71, 0x5E, 0x1F};
       
u8 kirk7_key02[] = {0xB8, 0x13, 0xC3, 0x5E, 0xC6, 0x44, 0x41, 0xE3, 0xDC, 0x3C, 0x16, 0xF5, 0xB4, 0x5E, 0x64, 0x84}; // New from PS3
        For i = 0 To 15
u8 kirk7_key03[] = {0x98, 0x02, 0xC4, 0xE6, 0xEC, 0x9E, 0x9E, 0x2F, 0xFC, 0x63, 0x4C, 0xE4, 0x2F, 0xBB, 0x46, 0x68};
            buff(i) = a(i)
u8 kirk7_key04[] = {0x99, 0x24, 0x4C, 0xD2, 0x58, 0xF5, 0x1B, 0xCB, 0xB0, 0x61, 0x9C, 0xA7, 0x38, 0x30, 0x07, 0x5F};
        Next i
u8 kirk7_key05[] = {0x02, 0x25, 0xD7, 0xBA, 0x63, 0xEC, 0xB9, 0x4A, 0x9D, 0x23, 0x76, 0x01, 0xB3, 0xF6, 0xAC, 0x17};
   
u8 kirk7_key06[] = {0x60, 0x99, 0xF2, 0x81, 0x70, 0x56, 0x0E, 0x5F, 0x74, 0x7C, 0xB5, 0x20, 0xC0, 0xCD, 0xC2, 0x3C}; // New from PS3
    End If
u8 kirk7_key07[] = {0x76, 0x36, 0x8B, 0x43, 0x8F, 0x77, 0xD8, 0x7E, 0xFE, 0x5F, 0xB6, 0x11, 0x59, 0x39, 0x88, 0x5C};
   
u8 kirk7_key08[] = {0x14, 0xA1, 0x15, 0xEB, 0x43, 0x4A, 0x1B, 0xA4, 0x90, 0x5E, 0x03, 0xB6, 0x17, 0xA1, 0x5C, 0x04};
    'Debug.Print "_EE3-" & r & ": " & Arr2Hex(buff)
u8 kirk7_key09[] = {0xE6, 0x58, 0x03, 0xD9, 0xA7, 0x1A, 0xA8, 0x7F, 0x05, 0x9D, 0x22, 0x9D, 0xAF, 0x54, 0x53, 0xD0};
   
u8 kirk7_key0A[] = {0xBA, 0x34, 0x80, 0xB4, 0x28, 0xA7, 0xCA, 0x5F, 0x21, 0x64, 0x12, 0xF7, 0x0F, 0xBB, 0x73, 0x23};
Next r
u8 kirk7_key0B[] = {0x72, 0xAD, 0x35, 0xAC, 0x9A, 0xC3, 0x13, 0x0A, 0x77, 0x8C, 0xB1, 0x9D, 0x88, 0x55, 0x0B, 0x0C};
u8 kirk7_key0C[] = {0x84, 0x85, 0xC8, 0x48, 0x75, 0x08, 0x43, 0xBC, 0x9B, 0x9A, 0xEC, 0xA7, 0x9C, 0x7F, 0x60, 0x18};
    'last round XOR
u8 kirk7_key0D[] = {0xB5, 0xB1, 0x6E, 0xDE, 0x23, 0xA9, 0x7B, 0x0E, 0xA1, 0x7C, 0xDB, 0xA2, 0xDC, 0xDE, 0xC4, 0x6E};
    For i = 0 To 15
u8 kirk7_key0E[] = {0xC8, 0x71, 0xFD, 0xB3, 0xBC, 0xC5, 0xD2, 0xF2, 0xE2, 0xD7, 0x72, 0x9D, 0xDF, 0x82, 0x68, 0x82};
        buff(i) = buff(i) Xor r_key(10)(i)
u8 kirk7_key0F[] = {0x0A, 0xBB, 0x33, 0x6C, 0x96, 0xD4, 0xCD, 0xD8, 0xCB, 0x5F, 0x4B, 0xE0, 0xBA, 0xDB, 0x9E, 0x03};
    Next i
u8 kirk7_key10[] = {0x32, 0x29, 0x5B, 0xD5, 0xEA, 0xF7, 0xA3, 0x42, 0x16, 0xC8, 0x8E, 0x48, 0xFF, 0x50, 0xD3, 0x71};
u8 kirk7_key11[] = {0x46, 0xF2, 0x5E, 0x8E, 0x4D, 0x2A, 0xA5, 0x40, 0x73, 0x0B, 0xC4, 0x6E, 0x47, 0xEE, 0x6F, 0x0A};
' Debug.Print "_EE3-" & r & ": " & Arr2Hex(a)
u8 kirk7_key12[] = {0x5D, 0xC7, 0x11, 0x39, 0xD0, 0x19, 0x38, 0xBC, 0x02, 0x7F, 0xDD, 0xDC, 0xB0, 0x83, 0x7D, 0x9D};
u8 kirk7_key13[] = {0x51, 0xDD, 0x65, 0xF0, 0x71, 0xA4, 0xE5, 0xEA, 0x6A, 0xAF, 0x12, 0x19, 0x41, 0x29, 0xB8, 0xF4};
End Sub
u8 kirk7_key14[] = {0x03, 0x76, 0x3C, 0x68, 0x65, 0xC6, 0x9B, 0x0F, 0xFE, 0x8F, 0xD8, 0xEE, 0xA4, 0x36, 0x16, 0xA0};
u8 kirk7_key15[] = {0x7D, 0x50, 0xB8, 0x5C, 0xAF, 0x67, 0x69, 0xF0, 0xE5, 0x4A, 0xA8, 0x09, 0x8B, 0x0E, 0xBE, 0x1C};
u8 kirk7_key16[] = {0x72, 0x68, 0x4B, 0x32, 0xAC, 0x3B, 0x33, 0x2F, 0x2A, 0x7A, 0xFC, 0x9E, 0x14, 0xD5, 0x6F, 0x6B};
Private Function LShiftByteNec(ByVal bytValue As Integer, _
u8 kirk7_key17[] = {0x20, 0x1D, 0x31, 0x96, 0x4A, 0xD9, 0x9F, 0xBF, 0x32, 0xD5, 0xD6, 0x1C, 0x49, 0x1B, 0xD9, 0xFC};
                    &nbs
u8 kirk7_key18[] = {0xF8, 0xD8, 0x44, 0x63, 0xD6, 0x10, 0xD1, 0x2A, 0x44, 0x8E, 0x96, 0x90, 0xA6, 0xBB, 0x0B, 0xAD};
p;      ByVal bytShiftBits As Byte) As Byte
u8 kirk7_key19[] = {0x5C, 0xD4, 0x05, 0x7F, 0xA1, 0x30, 0x60, 0x44, 0x0A, 0xD9, 0xB6, 0x74, 0x5F, 0x24, 0x4F, 0x4E};
   
u8 kirk7_key1A[] = {0xF4, 0x8A, 0xD6, 0x78, 0x59, 0x9C, 0x22, 0xC1, 0xD4, 0x11, 0x93, 0x3D, 0xF8, 0x45, 0xB8, 0x93};
bytValue = LShift(bytValue, bytShiftBits)
u8 kirk7_key1B[] = {0xCA, 0xE7, 0xD2, 0x87, 0xA2, 0xEC, 0xC1, 0xCD, 0x94, 0x54, 0x2B, 0x5E, 0x1D, 0x94, 0x88, 0xB2};
   
u8 kirk7_key1C[] = {0xDE, 0x26, 0xD3, 0x7A, 0x39, 0x95, 0x6C, 0x2A, 0xD8, 0xC3, 0xA6, 0xAF, 0x21, 0xEB, 0xB3, 0x01};
If bytValue > &HFF Then
u8 kirk7_key1D[] = {0x7C, 0xB6, 0x8B, 0x4D, 0xA3, 0x8D, 0x1D, 0xD9, 0x32, 0x67, 0x9C, 0xA9, 0x9F, 0xFB, 0x28, 0x52};
    LShiftByteNec = (bytValue - &HFF) Xor &H1A
u8 kirk7_key1E[] = {0xA0, 0xB5, 0x56, 0xB4, 0x69, 0xAB, 0x36, 0x8F, 0x36, 0xDE, 0xC9, 0x09, 0x2E, 0xCB, 0x41, 0xB1};
Else
u8 kirk7_key1F[] = {0x93, 0x9D, 0xE1, 0x9B, 0x72, 0x5F, 0xEE, 0xE2, 0x45, 0x2A, 0xBC, 0x17, 0x06, 0xD1, 0x47, 0x69};
    LShiftByteNec = bytValue
u8 kirk7_key20[] = {0xA4, 0xA4, 0xE6, 0x21, 0x38, 0x2E, 0xF1, 0xAF, 0x7B, 0x17, 0x7A, 0xE8, 0x42, 0xAD, 0x00, 0x31};
End If
u8 kirk7_key21[] = {0xC3, 0x7F, 0x13, 0xE8, 0xCF, 0x84, 0xDB, 0x34, 0x74, 0x7B, 0xC3, 0xA0, 0xF1, 0x9D, 0x3A, 0x73};
u8 kirk7_key22[] = {0x2B, 0xF7, 0x83, 0x8A, 0xD8, 0x98, 0xE9, 0x5F, 0xA5, 0xF9, 0x01, 0xDA, 0x61, 0xFE, 0x35, 0xBB};
End Function
u8 kirk7_key23[] = {0xC7, 0x04, 0x62, 0x1E, 0x71, 0x4A, 0x66, 0xEA, 0x62, 0xE0, 0x4B, 0x20, 0x3D, 0xB8, 0xC2, 0xE5};
</pre>
u8 kirk7_key24[] = {0xC9, 0x33, 0x85, 0x9A, 0xAB, 0x00, 0xCD, 0xCE, 0x4D, 0x8B, 0x8E, 0x9F, 0x3D, 0xE6, 0xC0, 0x0F};
 
u8 kirk7_key25[] = {0x18, 0x42, 0x56, 0x1F, 0x2B, 0x5F, 0x34, 0xE3, 0x51, 0x3E, 0xB7, 0x89, 0x77, 0x43, 0x1A, 0x65};
== Spock Keys ==
u8 kirk7_key26[] = {0xDC, 0xB0, 0xA0, 0x06, 0x5A, 0x50, 0xA1, 0x4E, 0x59, 0xAC, 0x97, 0x3F, 0x17, 0x58, 0xA3, 0xA3};
 
u8 kirk7_key27[] = {0xC4, 0xDB, 0xAE, 0x83, 0xE2, 0x9C, 0xF2, 0x54, 0xA3, 0xDD, 0x37, 0x4E, 0x80, 0x7B, 0xF4, 0x25};
=== Spock Master Key (Spock command 9) ===
u8 kirk7_key28[] = {0xBF, 0xAE, 0xEB, 0x49, 0x82, 0x65, 0xC5, 0x7C, 0x64, 0xB8, 0xC1, 0x7E, 0x19, 0x06, 0x44, 0x09};
 
u8 kirk7_key29[] = {0x79, 0x7C, 0xEC, 0xC3, 0xB3, 0xEE, 0x0A, 0xC0, 0x3B, 0xD8, 0xE6, 0xC1, 0xE0, 0xA8, 0xB1, 0xA4};
<pre>
u8 kirk7_key2A[] = {0x75, 0x34, 0xFE, 0x0B, 0xD6, 0xD0, 0xC2, 0x8D, 0x68, 0xD4, 0xE0, 0x2A, 0xE7, 0xD5, 0xD1, 0x55};
9F46F9FCFAB2AD0569F688D8794B92BA
u8 kirk7_key2B[] = {0xFA, 0xB3, 0x53, 0x26, 0x97, 0x4F, 0x4E, 0xDF, 0xE4, 0xC3, 0xA8, 0x14, 0xC3, 0x2F, 0x0F, 0x88};
</pre>
u8 kirk7_key2C[] = {0xEC, 0x97, 0xB3, 0x86, 0xB4, 0x33, 0xC6, 0xBF, 0x4E, 0x53, 0x9D, 0x95, 0xEB, 0xB9, 0x79, 0xE4};
 
u8 kirk7_key2D[] = {0xB3, 0x20, 0xA2, 0x04, 0xCF, 0x48, 0x06, 0x29, 0xB5, 0xDD, 0x8E, 0xFC, 0x98, 0xD4, 0x17, 0x7B};
* Located in Kicho & Dencho flashData.prx
u8 kirk7_key2E[] = {0x5D, 0xFC, 0x0D, 0x4F, 0x2C, 0x39, 0xDA, 0x68, 0x4A, 0x33, 0x74, 0xED, 0x49, 0x58, 0xA7, 0x3A};
 
u8 kirk7_key2F[] = {0xD7, 0x5A, 0x54, 0x22, 0xCE, 0xD9, 0xA3, 0xD6, 0x2B, 0x55, 0x7D, 0x8D, 0xE8, 0xBE, 0xC7, 0xEC};
=== Spock Unknown Key ===
u8 kirk7_key30[] = {0x6B, 0x4A, 0xEE, 0x43, 0x45, 0xAE, 0x70, 0x07, 0xCF, 0x8D, 0xCF, 0x4E, 0x4A, 0xE9, 0x3C, 0xFA};
 
u8 kirk7_key31[] = {0x2B, 0x52, 0x2F, 0x66, 0x4C, 0x2D, 0x11, 0x4C, 0xFE, 0x61, 0x31, 0x8C, 0x56, 0x78, 0x4E, 0xA6};
<pre>
u8 kirk7_key32[] = {0x3A, 0xA3, 0x4E, 0x44, 0xC6, 0x6F, 0xAF, 0x7B, 0xFA, 0xE5, 0x53, 0x27, 0xEF, 0xCF, 0xCC, 0x24};
0C0D0E0F08090A0B0405060700010203
u8 kirk7_key33[] = {0x2B, 0x5C, 0x78, 0xBF, 0xC3, 0x8E, 0x49, 0x9D, 0x41, 0xC3, 0x3C, 0x5C, 0x7B, 0x27, 0x96, 0xCE};
</pre>
u8 kirk7_key34[] = {0xF3, 0x7E, 0xEA, 0xD2, 0xC0, 0xC8, 0x23, 0x1D, 0xA9, 0x9B, 0xFA, 0x49, 0x5D, 0xB7, 0x08, 0x1B};
 
u8 kirk7_key35[] = {0x70, 0x8D, 0x4E, 0x6F, 0xD1, 0xF6, 0x6F, 0x1D, 0x1E, 0x1F, 0xCB, 0x02, 0xF9, 0xB3, 0x99, 0x26};
* Located in Kicho & Dencho TESTMODE.prx
u8 kirk7_key36[] = {0x0F, 0x67, 0x16, 0xE1, 0x80, 0x69, 0x9C, 0x51, 0xFC, 0xC7, 0xAD, 0x6E, 0x4F, 0xB8, 0x46, 0xC9};
 
u8 kirk7_key37[] = {0x56, 0x0A, 0x49, 0x4A, 0x84, 0x4C, 0x8E, 0xD9, 0x82, 0xEE, 0x0B, 0x6D, 0xC5, 0x7D, 0x20, 0x8D};
== PSP IdStorage Keys ==
u8 kirk7_key38[] = {0x12, 0x46, 0x8D, 0x7E, 0x1C, 0x42, 0x20, 0x9B, 0xBA, 0x54, 0x26, 0x83, 0x5E, 0xB0, 0x33, 0x03};
 
u8 kirk7_key39[] = {0xC4, 0x3B, 0xB6, 0xD6, 0x53, 0xEE, 0x67, 0x49, 0x3E, 0xA9, 0x5F, 0xBC, 0x0C, 0xED, 0x6F, 0x8A};
=== PSP Fuse KeyGen Master Key ===
u8 kirk7_key3A[] = {0x2C, 0xC3, 0xCF, 0x8C, 0x28, 0x78, 0xA5, 0xA6, 0x63, 0xE2, 0xAF, 0x2D, 0x71, 0x5E, 0x86, 0xBA};
 
u8 kirk7_key3B[] = {0x83, 0x3D, 0xA7, 0x0C, 0xED, 0x6A, 0x20, 0x12, 0xD1, 0x96, 0xE6, 0xFE, 0x5C, 0x4D, 0x37, 0xC5};
<pre>
u8 kirk7_key3C[] = {0xC7, 0x43, 0xD0, 0x67, 0x42, 0xEE, 0x90, 0xB8, 0xCA, 0x75, 0x50, 0x35, 0x20, 0xAD, 0xBC, 0xCE};
475E09F4A237DA9BEFFF3BC077143D8A
u8 kirk7_key3D[] = {0x8A, 0xE3, 0x66, 0x3F, 0x8D, 0x9E, 0x82, 0xA1, 0xED, 0xE6, 0x8C, 0x9C, 0xE8, 0x25, 0x6D, 0xAA};
</pre>
u8 kirk7_key3E[] = {0x7F, 0xC9, 0x6F, 0x0B, 0xB1, 0x48, 0x5C, 0xA5, 0x5D, 0xD3, 0x64, 0xB7, 0x7A, 0xF5, 0xE4, 0xEA};
 
u8 kirk7_key3F[] = {0x91, 0xB7, 0x65, 0x78, 0x8B, 0xCB, 0x8B, 0xD4, 0x02, 0xED, 0x55, 0x3A, 0x66, 0x62, 0xD0, 0xAD};
* Located in Kicho & Dencho flashData.prx
u8 kirk7_key40[] = {0x28, 0x24, 0xF9, 0x10, 0x1B, 0x8D, 0x0F, 0x7B, 0x6E, 0xB2, 0x63, 0xB5, 0xB5, 0x5B, 0x2E, 0xBB};
 
u8 kirk7_key41[] = {0x30, 0xE2, 0x57, 0x5D, 0xE0, 0xA2, 0x49, 0xCE, 0xE8, 0xCF, 0x2B, 0x5E, 0x4D, 0x9F, 0x52, 0xC7};
=== PSP IdStorage Certificates ECDSA Public Keys ===
u8 kirk7_key42[] = {0x5E, 0xE5, 0x04, 0x39, 0x62, 0x32, 0x02, 0xFA, 0x85, 0x39, 0x3F, 0x72, 0xBB, 0x77, 0xFD, 0x1A};
 
u8 kirk7_key43[] = {0xF8, 0x81, 0x74, 0xB1, 0xBD, 0xE9, 0xBF, 0xDD, 0x45, 0xE2, 0xF5, 0x55, 0x89, 0xCF, 0x46, 0xAB};
They all use Curve Type 2 (VSH).
u8 kirk7_key44[] = {0x7D, 0xF4, 0x92, 0x65, 0xE3, 0xFA, 0xD6, 0x78, 0xD6, 0xFE, 0x78, 0xAD, 0xBB, 0x3D, 0xFB, 0x63}; // New from PS3
 
u8 kirk7_key45[] = {0x74, 0x7F, 0xD6, 0x2D, 0xC7, 0xA1, 0xCA, 0x96, 0xE2, 0x7A, 0xCE, 0xFF, 0xAA, 0x72, 0x3F, 0xF7};
==== Keyset 0 ====
u8 kirk7_key46[] = {0x1E, 0x58, 0xEB, 0xD0, 0x65, 0xBB, 0xF1, 0x68, 0xC5, 0xBD, 0xF7, 0x46, 0xBA, 0x7B, 0xE1, 0x00};
 
u8 kirk7_key47[] = {0x24, 0x34, 0x7D, 0xAF, 0x5E, 0x4B, 0x35, 0x72, 0x7A, 0x52, 0x27, 0x6B, 0xA0, 0x54, 0x74, 0xDB};
Public key: <code>4004C80BD9C8BA38221065923E324B5F0EC165ED6CFF7D9F2C420B84DFDA6E96C0AEE29927BCAF1E</code>
u8 kirk7_key48[] = {0x09, 0xB1, 0xC7, 0x05, 0xC3, 0x5F, 0x53, 0x66, 0x77, 0xC0, 0xEB, 0x36, 0x77, 0xDF, 0x83, 0x07};
 
u8 kirk7_key49[] = {0xCC, 0xBE, 0x61, 0x5C, 0x05, 0xA2, 0x00, 0x33, 0x37, 0x8E, 0x59, 0x64, 0xA7, 0xDD, 0x70, 0x3D};
==== Keyset 1 ====
u8 kirk7_key4A[] = {0x0D, 0x47, 0x50, 0xBB, 0xFC, 0xB0, 0x02, 0x81, 0x30, 0xE1, 0x84, 0xDE, 0xA8, 0xD4, 0x84, 0x13};
 
u8 kirk7_key4B[] = {0x0C, 0xFD, 0x67, 0x9A, 0xF9, 0xB4, 0x72, 0x4F, 0xD7, 0x8D, 0xD6, 0xE9, 0x96, 0x42, 0x28, 0x8B}; // 1.xx game eboot.bin
Public key: <code>06485FD029853B552F7EFDD67A2DE7A1A4E25537B2459D8786426D5B27EFA5A9311CB8ABABFA0ECE</code>
u8 kirk7_key4C[] = {0x7A, 0xD3, 0x1A, 0x8B, 0x4B, 0xEF, 0xC2, 0xC2, 0xB3, 0x99, 0x01, 0xA9, 0xFE, 0x76, 0xB9, 0x87};
 
u8 kirk7_key4D[] = {0xBE, 0x78, 0x78, 0x17, 0xC7, 0xF1, 0x6F, 0x1A, 0xE0, 0xEF, 0x3B, 0xDE, 0x4C, 0xC2, 0xD7, 0x86};
==== Keyset 2 ====
u8 kirk7_key4E[] = {0x7C, 0xD8, 0xB8, 0x91, 0x91, 0x0A, 0x43, 0x14, 0xD0, 0x53, 0x3D, 0xD8, 0x4C, 0x45, 0xBE, 0x16};
 
u8 kirk7_key4F[] = {0x32, 0x72, 0x2C, 0x88, 0x07, 0xCF, 0x35, 0x7D, 0x4A, 0x2F, 0x51, 0x19, 0x44, 0xAE, 0x68, 0xDA};
Public key: <code>3F8C34F210AEC48E1520FF2A44899E054A0DA33DF8B9754B09C0EC7E61867A5126FE6926972196F5</code>
u8 kirk7_key50[] = {0x7E, 0x6B, 0xBF, 0xF6, 0xF6, 0x87, 0xB8, 0x98, 0xEE, 0xB5, 0x1B, 0x32, 0x16, 0xE4, 0x6E, 0x5D};
 
u8 kirk7_key51[] = {0x08, 0xEA, 0x5A, 0x83, 0x49, 0xB5, 0x9D, 0xB5, 0x3E, 0x07, 0x79, 0xB1, 0x9A, 0x59, 0xA3, 0x54};
==== Keyset 3 ====
u8 kirk7_key52[] = {0xF3, 0x12, 0x81, 0xBF, 0xE6, 0x9F, 0x51, 0xD1, 0x64, 0x08, 0x25, 0x21, 0xFF, 0xBB, 0x22, 0x61};
 
u8 kirk7_key53[] = {0xAF, 0xFE, 0x8E, 0xB1, 0x3D, 0xD1, 0x7E, 0xD8, 0x0A, 0x61, 0x24, 0x1C, 0x95, 0x92, 0x56, 0xB6};
Public key: <code>CCB3440DC4836DD519E13B2805B30870DCAEE462136B3888651A98E02B29FA0CD34F1616F1ED5786</code>
u8 kirk7_key54[] = {0x92, 0xCD, 0xB4, 0xC2, 0x5B, 0xF2, 0x35, 0x5A, 0x23, 0x09, 0xE8, 0x19, 0xC9, 0x14, 0x42, 0x35};
 
u8 kirk7_key55[] = {0xE1, 0xC6, 0x5B, 0x22, 0x6B, 0xE1, 0xDA, 0x02, 0xBA, 0x18, 0xFA, 0x21, 0x34, 0x9E, 0xF9, 0x6D};
==== Keyset 4 ====
u8 kirk7_key56[] = {0x14, 0xEC, 0x76, 0xCE, 0x97, 0xF3, 0x8A, 0x0A, 0x34, 0x50, 0x6C, 0x53, 0x9A, 0x5C, 0x9A, 0xB4};
 
u8 kirk7_key57[] = {0x1C, 0x9B, 0xC4, 0x90, 0xE3, 0x06, 0x64, 0x81, 0xFA, 0x59, 0xFD, 0xB6, 0x00, 0xBB, 0x28, 0x70};
Public key: <code>08B336925C2B445D03A9BE51B9AABF54E4CC142EA72A23BB8060B03B71CDE0772DE82AD8931648D6</code>
u8 kirk7_key58[] = {0x43, 0xA5, 0xCA, 0xCC, 0x0D, 0x6C, 0x2D, 0x3F, 0x2B, 0xD9, 0x89, 0x67, 0x6B, 0x3F, 0x7F, 0x57};
 
u8 kirk7_key59[] = {0x00, 0xEF, 0xFD, 0x18, 0x08, 0xA4, 0x05, 0x89, 0x3C, 0x38, 0xFB, 0x25, 0x72, 0x70, 0x61, 0x06};
==== Keyset 5 ====
u8 kirk7_key5A[] = {0xEE, 0xAF, 0x49, 0xE0, 0x09, 0x87, 0x9B, 0xEF, 0xAA, 0xD6, 0x32, 0x6A, 0x32, 0x13, 0xC4, 0x29};
 
u8 kirk7_key5B[] = {0x8D, 0x26, 0xB9, 0x0F, 0x43, 0x1D, 0xBB, 0x08, 0xDB, 0x1D, 0xDA, 0xC5, 0xB5, 0x2C, 0x92, 0xED};
Public key: <code>4F0A2BC9987640860E22EE5D86087C9692470BDF59DC4C1F2E38F92CE7B66875B59ED10C9D84FA6A</code>
u8 kirk7_key5C[] = {0x57, 0x7C, 0x30, 0x60, 0xAE, 0x6E, 0xBE, 0xAE, 0x3A, 0xAB, 0x18, 0x19, 0xC5, 0x71, 0x68, 0x0B};
 
u8 kirk7_key5D[] = {0x11, 0x5A, 0x5D, 0x20, 0xD5, 0x3A, 0x8D, 0xD3, 0x9C, 0xC5, 0xAF, 0x41, 0x0F, 0x0F, 0x18, 0x6F};
<pre>
u8 kirk7_key5E[] = {0x0D, 0x4D, 0x51, 0xAB, 0x23, 0x79, 0xBF, 0x80, 0x3A, 0xBF, 0xB9, 0x0E, 0x75, 0xFC, 0x14, 0xBF};
public static final int[] psp_ids_certs_pub_keys = {
u8 kirk7_key5F[] = {0x99, 0x93, 0xDA, 0x3E, 0x7D, 0x2E, 0x5B, 0x15, 0xF2, 0x52, 0xA4, 0xE6, 0x6B, 0xB8, 0x5A, 0x98};
// Keyset 0
u8 kirk7_key60[] = {0xF4, 0x28, 0x30, 0xA5, 0xFB, 0x0D, 0x8D, 0x76, 0x0E, 0xA6, 0x71, 0xC2, 0x2B, 0xDE, 0x66, 0x9D};
0x40, 0x04, 0xC8, 0x0B, 0xD9, 0xC8, 0xBA, 0x38, 0x22, 0x10, 0x65, 0x92, 0x3E, 0x32, 0x4B, 0x5F, 0x0E, 0xC1, 0x65, 0xED,  
u8 kirk7_key61[] = {0xFB, 0x5F, 0xEB, 0x7F, 0xC7, 0xDC, 0xDD, 0x69, 0x37, 0x01, 0x97, 0x9B, 0x29, 0x03, 0x5C, 0x47};
0x6C, 0xFF, 0x7D, 0x9F, 0x2C, 0x42, 0x0B, 0x84, 0xDF, 0xDA, 0x6E, 0x96, 0xC0, 0xAE, 0xE2, 0x99, 0x27, 0xBC, 0xAF, 0x1E,
u8 kirk7_key62[] = {0x02, 0x32, 0x6A, 0xE7, 0xD3, 0x96, 0xCE, 0x7F, 0x1C, 0x41, 0x9D, 0xD6, 0x52, 0x07, 0xED, 0x09};
// Keyset 1
u8 kirk7_key63[] = {0x9C, 0x9B, 0x13, 0x72, 0xF8, 0xC6, 0x40, 0xCF, 0x1C, 0x62, 0xF5, 0xD5, 0x92, 0xDD, 0xB5, 0x82};
0x06, 0x48, 0x5F, 0xD0, 0x29, 0x85, 0x3B, 0x55, 0x2F, 0x7E, 0xFD, 0xD6, 0x7A, 0x2D, 0xE7, 0xA1, 0xA4, 0xE2, 0x55, 0x37,  
u8 kirk7_key64[] = {0x03, 0xB3, 0x02, 0xE8, 0x5F, 0xF3, 0x81, 0xB1, 0x3B, 0x8D, 0xAA, 0x2A, 0x90, 0xFF, 0x5E, 0x61};
0xB2, 0x45, 0x9D, 0x87, 0x86, 0x42, 0x6D, 0x5B, 0x27, 0xEF, 0xA5, 0xA9, 0x31, 0x1C, 0xB8, 0xAB, 0xAB, 0xFA, 0x0E, 0xCE,
u8 kirk7_key65[] = {0xBC, 0xD7, 0xF9, 0xD3, 0x2F, 0xAC, 0xF8, 0x47, 0xC0, 0xFB, 0x4D, 0x2F, 0x30, 0x9A, 0xBD, 0xA6};
// Keyset 2
u8 kirk7_key66[] = {0xF5, 0x55, 0x96, 0xE9, 0x7F, 0xAF, 0x86, 0x7F, 0xAC, 0xB3, 0x3A, 0xE6, 0x9C, 0x8B, 0x6F, 0x93};
0x3F, 0x8C, 0x34, 0xF2, 0x10, 0xAE, 0xC4, 0x8E, 0x15, 0x20, 0xFF, 0x2A, 0x44, 0x89, 0x9E, 0x05, 0x4A, 0x0D, 0xA3, 0x3D,  
u8 kirk7_key67[] = {0xEE, 0x29, 0x70, 0x93, 0xF9, 0x4E, 0x44, 0x59, 0x44, 0x17, 0x1F, 0x8E, 0x86, 0xE1, 0x70, 0xFC};
0xF8, 0xB9, 0x75, 0x4B, 0x09, 0xC0, 0xEC, 0x7E, 0x61, 0x86, 0x7A, 0x51, 0x26, 0xFE, 0x69, 0x26, 0x97, 0x21, 0x96, 0xF5,
u8 kirk7_key68[] = {0xE4, 0x34, 0x52, 0x0C, 0xF0, 0x88, 0xCF, 0xC8, 0xCD, 0x78, 0x1B, 0x6C, 0xCF, 0x8C, 0x48, 0xC4};
// Keyset 3
u8 kirk7_key69[] = {0xC1, 0xBF, 0x66, 0x81, 0x8E, 0xF9, 0x53, 0xF2, 0xE1, 0x26, 0x6B, 0x6F, 0x55, 0x0C, 0xC9, 0xCD};
0xCC, 0xB3, 0x44, 0x0D, 0xC4, 0x83, 0x6D, 0xD5, 0x19, 0xE1, 0x3B, 0x28, 0x05, 0xB3, 0x08, 0x70, 0xDC, 0xAE, 0xE4, 0x62,  
u8 kirk7_key6A[] = {0x56, 0x0F, 0xFF, 0x8F, 0x3C, 0x96, 0x49, 0x14, 0x45, 0x16, 0xF1, 0xBC, 0xBF, 0xCE, 0xA3, 0x0C};
0x13, 0x6B, 0x38, 0x88, 0x65, 0x1A, 0x98, 0xE0, 0x2B, 0x29, 0xFA, 0x0C, 0xD3, 0x4F, 0x16, 0x16, 0xF1, 0xED, 0x57, 0x86,
u8 kirk7_key6B[] = {0x24, 0x08, 0xDC, 0x75, 0x37, 0x60, 0xA2, 0x9F, 0x05, 0x54, 0xB5, 0xF2, 0x43, 0x85, 0x73, 0x99};
// Keyset 4
u8 kirk7_key6C[] = {0xDD, 0xD5, 0xB5, 0x6A, 0x59, 0xC5, 0x5A, 0xE8, 0x3B, 0x96, 0x67, 0xC7, 0x5C, 0x2A, 0xE2, 0xDC};
0x08, 0xB3, 0x36, 0x92, 0x5C, 0x2B, 0x44, 0x5D, 0x03, 0xA9, 0xBE, 0x51, 0xB9, 0xAA, 0xBF, 0x54, 0xE4, 0xCC, 0x14, 0x2E,  
u8 kirk7_key6D[] = {0xAA, 0x68, 0x67, 0x72, 0xE0, 0x2D, 0x44, 0xD5, 0xCD, 0xBB, 0x65, 0x04, 0xBC, 0xD5, 0xBF, 0x4E};
0xA7, 0x2A, 0x23, 0xBB, 0x80, 0x60, 0xB0, 0x3B, 0x71, 0xCD, 0xE0, 0x77, 0x2D, 0xE8, 0x2A, 0xD8, 0x93, 0x16, 0x48, 0xD6,
u8 kirk7_key6E[] = {0x1F, 0x17, 0xF0, 0x14, 0xE7, 0x77, 0xA2, 0xFE, 0x4B, 0x13, 0x6B, 0x56, 0xCD, 0x7E, 0xF7, 0xE9};
// Keyset 5
u8 kirk7_key6F[] = {0xC9, 0x35, 0x48, 0xCF, 0x55, 0x8D, 0x75, 0x03, 0x89, 0x6B, 0x2E, 0xEB, 0x61, 0x8C, 0xA9, 0x02};
0x4F, 0x0A, 0x2B, 0xC9, 0x98, 0x76, 0x40, 0x86, 0x0E, 0x22, 0xEE, 0x5D, 0x86, 0x08, 0x7C, 0x96, 0x92, 0x47, 0x0B, 0xDF,  
u8 kirk7_key70[] = {0xDE, 0x34, 0xC5, 0x41, 0xE7, 0xCA, 0x86, 0xE8, 0xBE, 0xA7, 0xC3, 0x1C, 0xEC, 0xE4, 0x36, 0x0F};
0x59, 0xDC, 0x4C, 0x1F, 0x2E, 0x38, 0xF9, 0x2C, 0xE7, 0xB6, 0x68, 0x75, 0xB5, 0x9E, 0xD1, 0x0C, 0x9D, 0x84, 0xFA, 0x6A,
u8 kirk7_key71[] = {0xDD, 0xE5, 0xFF, 0x55, 0x1B, 0x74, 0xF6, 0xF4, 0xE0, 0x16, 0xD7, 0xAB, 0x22, 0x31, 0x1B, 0x6A};
};
u8 kirk7_key72[] = {0xB0, 0xE9, 0x35, 0x21, 0x33, 0x3F, 0xD7, 0xBA, 0xB4, 0x76, 0x2C, 0xCB, 0x4D, 0x80, 0x08, 0xD8};
u8 kirk7_key73[] = {0x38, 0x14, 0x69, 0xC4, 0xC3, 0xF9, 0x1B, 0x96, 0x33, 0x63, 0x8E, 0x4D, 0x5F, 0x3D, 0xF0, 0x29};
u8 kirk7_key74[] = {0xFA, 0x48, 0x6A, 0xD9, 0x8E, 0x67, 0x16, 0xEF, 0x6A, 0xB0, 0x87, 0xF5, 0x89, 0x45, 0x7F, 0x2A};
u8 kirk7_key75[] = {0x32, 0x1A, 0x09, 0x12, 0x50, 0x14, 0x8A, 0x3E, 0x96, 0x3D, 0xEA, 0x02, 0x59, 0x32, 0xE1, 0x8F};
u8 kirk7_key76[] = {0x4B, 0x00, 0xBE, 0x29, 0xBC, 0xB0, 0x28, 0x64, 0xCE, 0xFD, 0x43, 0xA9, 0x6F, 0xD9, 0x5C, 0xED};
u8 kirk7_key77[] = {0x57, 0x7D, 0xC4, 0xFF, 0x02, 0x44, 0xE2, 0x80, 0x91, 0xF4, 0xCA, 0x0A, 0x75, 0x69, 0xFD, 0xA8};
u8 kirk7_key78[] = {0x83, 0x53, 0x36, 0xC6, 0x18, 0x03, 0xE4, 0x3E, 0x4E, 0xB3, 0x0F, 0x6B, 0x6E, 0x79, 0x9B, 0x7A};
u8 kirk7_key79[] = {0x5C, 0x92, 0x65, 0xFD, 0x7B, 0x59, 0x6A, 0xA3, 0x7A, 0x2F, 0x50, 0x9D, 0x85, 0xE9, 0x27, 0xF8};
u8 kirk7_key7A[] = {0x9A, 0x39, 0xFB, 0x89, 0xDF, 0x55, 0xB2, 0x60, 0x14, 0x24, 0xCE, 0xA6, 0xD9, 0x65, 0x0A, 0x9D};
u8 kirk7_key7B[] = {0x8B, 0x75, 0xBE, 0x91, 0xA8, 0xC7, 0x5A, 0xD2, 0xD7, 0xA5, 0x94, 0xA0, 0x1C, 0xBB, 0x95, 0x91};
u8 kirk7_key7C[] = {0x95, 0xC2, 0x1B, 0x8D, 0x05, 0xAC, 0xF5, 0xEC, 0x5A, 0xEE, 0x77, 0x81, 0x23, 0x95, 0xC4, 0xD7};
u8 kirk7_key7D[] = {0xB9, 0xA4, 0x61, 0x64, 0x36, 0x33, 0xFA, 0x5D, 0x94, 0x88, 0xE2, 0xD3, 0x28, 0x1E, 0x01, 0xA2};
u8 kirk7_key7E[] = {0xB8, 0xB0, 0x84, 0xFB, 0x9F, 0x4C, 0xFA, 0xF7, 0x30, 0xFE, 0x73, 0x25, 0xA2, 0xAB, 0x89, 0x7D};
u8 kirk7_key7F[] = {0x5F, 0x8C, 0x17, 0x9F, 0xC1, 0xB2, 0x1D, 0xF1, 0xF6, 0x36, 0x7A, 0x9C, 0xF7, 0xD3, 0xD4, 0x7C};
u8 kirk7_key80[] = {0x83, 0xFF, 0xF1, 0x49, 0xA6, 0x87, 0xA5, 0xC5, 0xCD, 0x95, 0x77, 0x93, 0x52, 0xC8, 0xBF, 0x66}; // New kirk Service, Only on PS Vita
u8 kirk7_key81[] = {0xD8, 0x3D, 0x2D, 0x27, 0x7C, 0xE2, 0xDE, 0x15, 0x4A, 0x4E, 0x2A, 0xA6, 0xD1, 0xE8, 0xD2, 0x0B}; // New kirk Service, Only on PS Vita
u8 kirk7_key82[] = {0x4C, 0x5C, 0x71, 0x51, 0x9F, 0x62, 0xA5, 0xFE, 0x5E, 0xF3, 0x6D, 0x4B, 0x07, 0x5B, 0xE2, 0xF3}; // New kirk Service, Only on PS Vita
u8 kirk7_key83[] = {0x80, 0x05, 0xEF, 0x43, 0x12, 0x4F, 0x65, 0x0A, 0x9D, 0xF1, 0x58, 0xF7, 0x2A, 0x50, 0x9C, 0x10}; // New kirk Service, Only on PS Vita
u8 kirk7_keyC0[] = {0xBF, 0x57, 0xAE, 0xF0, 0x2D, 0xC5, 0x87, 0xF3, 0x27, 0xC8, 0xC3, 0xF8, 0xBD, 0xEC, 0xA5, 0xEE}; // New kirk Service, Only on PS Vita
u8 kirk7_keyC1[] = {0x9F, 0xFF, 0x2E, 0xEC, 0xED, 0x84, 0x76, 0xD9, 0x00, 0xDF, 0xD5, 0x79, 0xE1, 0xAA, 0xAB, 0x63}; // New kirk Service, Only on PS Vita
u8 kirk7_keyC2[] = {0x04, 0x46, 0x0D, 0x61, 0xF5, 0x63, 0xD4, 0x6C, 0x0C, 0x4E, 0xB9, 0xAA, 0xE5, 0x46, 0x6E, 0x84}; // New kirk Service, Only on PS Vita
u8 kirk7_keyC3[] = {0x1E, 0x5B, 0x17, 0xDA, 0xC3, 0x21, 0xE6, 0xB8, 0xDF, 0xE7, 0x71, 0x8C, 0xA2, 0x93, 0x03, 0x70}; // New kirk Service, Only on PS Vita
</pre>
</pre>


== PSP Save Data Hash Keys ==
== DRM Keys ==


  private byte[] PSPSDHashKey1 = new byte[16] { 0x40, 0xE6, 0x53, 0x3F, 0x05, 0x11, 0x3A, 0x4E, 0xA1, 0x4B, 0xDA, 0xD6, 0x72, 0x7C, 0x53, 0x4C };
  public static final int[] drmFixedKey = { 0x38, 0x20, 0xD0, 0x11, 0x07, 0xA3, 0xFF, 0x3E, 0x0A, 0x4C, 0x20, 0x85, 0x39, 0x10, 0xB5, 0x54 };
private byte[] PSPSDHashKey2 = new byte[16] { 0xFA, 0xAA, 0x50, 0xEC, 0x2F, 0xDE, 0x54, 0x93, 0xAD, 0x14, 0xB2, 0xCE, 0xA5, 0x30, 0x05, 0xDF };
  public static final int[] drmModuleKey = { 0xBA, 0x87, 0xE4, 0xAB, 0x2C, 0x60, 0x5F, 0x59, 0xB8, 0x3B, 0xDB, 0xA6, 0x82, 0xFD, 0xAE, 0x14 };
  private byte[] PSPSDHashKey3 = new byte[16] { 0x36, 0xA5, 0x3E, 0xAC, 0xC5, 0x26, 0x9E, 0xA3, 0x83, 0xD9, 0xEC, 0x25, 0x6C, 0x48, 0x48, 0x72 };
private byte[] PSPSDHashKey4 = new byte[16] { 0xD8, 0xC0, 0xB0, 0xF3, 0x3E, 0x6B, 0x76, 0x85, 0xFD, 0xFB, 0x4D, 0x7D, 0x45, 0x1E, 0x92, 0x03 };
private byte[] PSPSDHashKey5 = new byte[16] { 0xCB, 0x15, 0xF4, 0x07, 0xF9, 0x6A, 0x52, 0x3C, 0x04, 0xB9, 0xB2, 0xEE, 0x5C, 0x53, 0xFA, 0x86 };
private byte[] PSPSDHashKey6 = new byte[16] { 0x70, 0x44, 0xA3, 0xAE, 0xEF, 0x5D, 0xA5, 0xF2, 0x85, 0x7F, 0xF2, 0xD6, 0x94, 0xF5, 0x36, 0x3B };
private byte[] PSPSDHashKey7 = new byte[16] { 0xEC, 0x6D, 0x29, 0x59, 0x26, 0x35, 0xA5, 0x7F, 0x97, 0x2A, 0x0D, 0xBC, 0xA3, 0x26, 0x33, 0x00 };


== PSP AMCTRL Hash Keys ==
public static final int[] drmRifKey = { 0xDA, 0x7D, 0x4B, 0x5E, 0x49, 0x9A, 0x4F, 0x53, 0xB1, 0xC1, 0xA1, 0x4A, 0x74, 0x84, 0x44, 0x3B };
public static final int[] drmActdatKey = { 0x5E, 0x06, 0xE0, 0x4F, 0xD9, 0x4A, 0x71, 0xBF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };


private byte[] PSPAMHashKey1 = new byte[16] { 0x9C, 0x48, 0xB6, 0x28, 0x40, 0xE6, 0x53, 0x3F, 0x05, 0x11, 0x3A, 0x4E, 0x65, 0xE6, 0x3A, 0x64 };
Unknown Keys
private byte[] PSPAMHashKey2 = new byte[16] { 0x70, 0xB4, 0x7B, 0xC0, 0xA1, 0x4B, 0xDA, 0xD6, 0xE0, 0x10, 0x14, 0xED, 0x72, 0x7C, 0x53, 0x4C };
private byte[] PSPAMHashKey3 = new byte[16] { 0xE3, 0x50, 0xED, 0x1D, 0x91, 0x0A, 0x1F, 0xD0, 0x29, 0xBB, 0x1C, 0x3E, 0xF3, 0x40, 0x77, 0xFB };
private byte[] PSPAMHashKey4 = new byte[16] { 0x13, 0x5F, 0xA4, 0x7C, 0xAB, 0x39, 0x5B, 0xA4, 0x76, 0xB8, 0xCC, 0xA9, 0x8F, 0x3A, 0x04, 0x45 };
private byte[] PSPAMHashKey5 = new byte[16] { 0x67, 0x8D, 0x7F, 0xA3, 0x2A, 0x9C, 0xA0, 0xD1, 0x50, 0x8A, 0xD8, 0x38, 0x5E, 0x4B, 0x01, 0x7E };


== PSP Applications ECDSA Curve ==
  public static final int[] drmUnkKey1 = { 0x69, 0xB4, 0x53, 0xF2, 0xE4, 0x21, 0x89, 0x8E, 0x53, 0xE4, 0xA3, 0x5A, 0x5B, 0x91, 0x79, 0x51 };
 
  public static final int[] drmUnkKey2 = { 0xF0, 0x79, 0xD5, 0x19, 0x2D, 0x5D, 0xD3, 0x8C, 0xB5, 0x4B, 0x9E, 0xCD, 0xCD, 0xFD, 0xD3, 0xD7 };
  private byte[][] psp_applications_ecdsa_curve = new byte[6][] {
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF },
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC },
new byte[20] { 0xA6, 0x8B, 0xED, 0xC3, 0x34, 0x18, 0x02, 0x9C, 0x1D, 0x3C, 0xE3, 0x3B, 0x9A, 0x32, 0x1F, 0xCC, 0xBB, 0x9E, 0x0F, 0x0B },
new byte[20] { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xB5, 0xAE, 0x3C, 0x52, 0x3E, 0x63, 0x94, 0x4F, 0x21, 0x27 },
new byte[20] { 0x12, 0x8E, 0xC4, 0x25, 0x64, 0x87, 0xFD, 0x8F, 0xDF, 0x64, 0xE2, 0x43, 0x7B, 0xC0, 0xA1, 0xF6, 0xD5, 0xAF, 0xDE, 0x2C },
new byte[20] { 0x59, 0x58, 0x55, 0x7E, 0xB1, 0xDB, 0x00, 0x12, 0x60, 0x42, 0x55, 0x24, 0xDB, 0xC3, 0x79, 0xD5, 0xAC, 0x5F, 0x4A, 0xDF },
};
 
== DRM Keys ==
 
  public static final int[] drmFixedKey = { 0x38, 0x20, 0xD0, 0x11, 0x07, 0xA3, 0xFF, 0x3E, 0x0A, 0x4C, 0x20, 0x85, 0x39, 0x10, 0xB5, 0x54 };
public static final int[] drmModuleKey = { 0xBA, 0x87, 0xE4, 0xAB, 0x2C, 0x60, 0x5F, 0x59, 0xB8, 0x3B, 0xDB, 0xA6, 0x82, 0xFD, 0xAE, 0x14 };


Rename Key
Rename Key
Line 928: Line 930:
  public static final int[] drmkeys_6XX_1 = {0x36, 0xEF, 0x82, 0x4E, 0x74, 0xFB, 0x17, 0x5B, 0x14, 0x14, 0x05, 0xF3, 0xB3, 0x8A, 0x76, 0x18};
  public static final int[] drmkeys_6XX_1 = {0x36, 0xEF, 0x82, 0x4E, 0x74, 0xFB, 0x17, 0x5B, 0x14, 0x14, 0x05, 0xF3, 0xB3, 0x8A, 0x76, 0x18};
  public static final int[] drmkeys_6XX_2 = {0x21, 0x52, 0x5D, 0x76, 0xF6, 0x81, 0x0F, 0x15, 0x2F, 0x4A, 0x40, 0x89, 0x63, 0xA0, 0x10, 0x55};
  public static final int[] drmkeys_6XX_2 = {0x21, 0x52, 0x5D, 0x76, 0xF6, 0x81, 0x0F, 0x15, 0x2F, 0x4A, 0x40, 0x89, 0x63, 0xA0, 0x10, 0x55};
public static final int[] key_indexdat2 = {0x6B, 0x3F, 0x91, 0x58, 0xED, 0x40, 0x68, 0x54, 0x93, 0xD6, 0x45, 0x3F, 0x2C, 0xD4, 0x23, 0x43};


== PRXDecrypter 144-byte Tag Keys ==
== PRXDecrypter 144-byte Tag Keys ==
Line 4,907: Line 4,908:


<pre>
<pre>
  int __sceFactoryGetUMDKey(unsigned int part1, unsigned int part2, u8* out) {
  int __sceFactoryGetUMDKey(unsigned int part1, unsigned int part2, u8* out) {
  u8* key = NULL;
  u8* key = NULL;
  int ret = 0, x, i;
  int ret = 0, x, i;
  u8 key_00001708[16] = { 0x05, 0x8F, 0xE5, 0x35, 0xA0, 0x4C, 0x89, 0xB1, 0xC0, 0x12, 0xAD, 0xE7, 0xDA, 0x06, 0xD9, 0x22 };
  u8 key_00001708[16] = { 0x05, 0x8F, 0xE5, 0x35, 0xA0, 0x4C, 0x89, 0xB1, 0xC0, 0x12, 0xAD, 0xE7, 0xDA, 0x06, 0xD9, 0x22 };
  u8 key_000016D0[16] = { 0x80, 0x8C, 0x8D, 0xA8, 0x66, 0x65, 0x5C, 0x11, 0x35, 0x12, 0xA6, 0xBF, 0x96, 0x6D, 0x3C, 0x46 };
  u8 key_000016D0[16] = { 0x80, 0x8C, 0x8D, 0xA8, 0x66, 0x65, 0x5C, 0x11, 0x35, 0x12, 0xA6, 0xBF, 0x96, 0x6D, 0x3C, 0x46 };
  u8 key_00001698[16] = { 0x77, 0xA5, 0x97, 0xDE, 0x0A, 0xF3, 0xEF, 0x40, 0x06, 0x96, 0x00, 0x9C, 0x03, 0x3C, 0xE3, 0xAE };
  u8 key_00001698[16] = { 0x77, 0xA5, 0x97, 0xDE, 0x0A, 0xF3, 0xEF, 0x40, 0x06, 0x96, 0x00, 0x9C, 0x03, 0x3C, 0xE3, 0xAE };
  u8 key_00001664[16] = { 0x9F, 0x26, 0xB3, 0x3D, 0x66, 0xAF, 0xFC, 0xF7, 0xC6, 0xC0, 0x1A, 0x35, 0xAB, 0x32, 0x24, 0x22 };
  u8 key_00001664[16] = { 0x9F, 0x26, 0xB3, 0x3D, 0x66, 0xAF, 0xFC, 0xF7, 0xC6, 0xC0, 0x1A, 0x35, 0xAB, 0x32, 0x24, 0x22 };
  u8 key_00001614[16] = { 0xAA, 0x62, 0x42, 0x04, 0x9E, 0x40, 0xFB, 0xBF, 0x91, 0x16, 0xC3, 0x23, 0x6F, 0xEA, 0x17, 0xEF };
  u8 key_00001614[16] = { 0xAA, 0x62, 0x42, 0x04, 0x9E, 0x40, 0xFB, 0xBF, 0x91, 0x16, 0xC3, 0x23, 0x6F, 0xEA, 0x17, 0xEF };
  u8 key_00001598[16] = { 0x1A, 0x4A, 0xA0, 0x55, 0x30, 0x8D, 0x2B, 0xBC, 0x63, 0x2B, 0x54, 0x68, 0xBB, 0x3A, 0x9D, 0x5B };
  u8 key_00001598[16] = { 0x1A, 0x4A, 0xA0, 0x55, 0x30, 0x8D, 0x2B, 0xBC, 0x63, 0x2B, 0x54, 0x68, 0xBB, 0x3A, 0x9D, 0x5B };
  u8 key_00001564[16] = { 0xF2, 0x2C, 0x77, 0xAA, 0x4B, 0x1C, 0x14, 0x01, 0x9D, 0xE5, 0x53, 0x23, 0xE3, 0x41, 0x3D, 0x21 };
  u8 key_00001564[16] = { 0xF2, 0x2C, 0x77, 0xAA, 0x4B, 0x1C, 0x14, 0x01, 0x9D, 0xE5, 0x53, 0x23, 0xE3, 0x41, 0x3D, 0x21 };
  u8 key_000014D0[16] = { 0x42, 0x01, 0x82, 0x19, 0x24, 0xFF, 0x0C, 0x34, 0xEB, 0xB4, 0x3F, 0x5D, 0xCA, 0x80, 0x7E, 0x8D };
  u8 key_000014D0[16] = { 0x42, 0x01, 0x82, 0x19, 0x24, 0xFF, 0x0C, 0x34, 0xEB, 0xB4, 0x3F, 0x5D, 0xCA, 0x80, 0x7E, 0x8D };
  u8 key_00001498[16] = { 0x40, 0x78, 0x66, 0xEB, 0x9B, 0xA5, 0xE9, 0x29, 0x0B, 0x2F, 0x8E, 0x4D, 0x30, 0x11, 0x67, 0x54 };
  u8 key_00001498[16] = { 0x40, 0x78, 0x66, 0xEB, 0x9B, 0xA5, 0xE9, 0x29, 0x0B, 0x2F, 0x8E, 0x4D, 0x30, 0x11, 0x67, 0x54 };
  u8 key_00001460[16] = { 0x27, 0xC7, 0x59, 0xF1, 0x48, 0xD8, 0x7E, 0xA8, 0xC0, 0xC2, 0x7F, 0x01, 0x3A, 0xE6, 0xEC, 0xD6 };
  u8 key_00001460[16] = { 0x27, 0xC7, 0x59, 0xF1, 0x48, 0xD8, 0x7E, 0xA8, 0xC0, 0xC2, 0x7F, 0x01, 0x3A, 0xE6, 0xEC, 0xD6 };
  u8 key_000013F0[16] = { 0x3A, 0xBA, 0x2E, 0x14, 0xC1, 0x07, 0x37, 0x9F, 0x5F, 0x03, 0x3F, 0x79, 0x4D, 0xE0, 0xCE, 0x7E };
  u8 key_000013F0[16] = { 0x3A, 0xBA, 0x2E, 0x14, 0xC1, 0x07, 0x37, 0x9F, 0x5F, 0x03, 0x3F, 0x79, 0x4D, 0xE0, 0xCE, 0x7E };
  u8 key_000013BC[16] = { 0x71, 0x16, 0x41, 0x21, 0xC3, 0xE0, 0x6A, 0xB5, 0x76, 0x57, 0x35, 0x90, 0xAB, 0x22, 0x3E, 0xFD };
  u8 key_000013BC[16] = { 0x71, 0x16, 0x41, 0x21, 0xC3, 0xE0, 0x6A, 0xB5, 0x76, 0x57, 0x35, 0x90, 0xAB, 0x22, 0x3E, 0xFD };
  }
  }
</pre>
 
== PKG AES Keys ==
 
psp_gpkg_aes_key: 07F2C68290B50D2C33818D709B60E62B
* Location: nas_plugin.sprx , from FW 3.55 cex: sub_36EEC, offset: 0x3724A@elf file
 
psp_gpkg_aes_idu_key: 7547EE76CA8C55AC1BA8D22535E05593
* Location: nas_plugin.sprx , from FW 2.60 IDU: FUN_00027f98
 
 
== 3.5.0 DTP-T1000 Lib-PSP iplloader ==
 
=== IPL KIRK1 header xor key ===
 
<pre>
0E82DE13A84BB23E1FEC71542153C45A
A97D9B6A461B761DD1B921E594E08D4F
96402C0524660D700C8FFEB089D53E0E
6390CE0E5E71CBA581915314993E3474
</pre>
 
=== IPL decryption seed hash (key) ===
 
<pre>
8E939AF03C553F7775317044853D9323
6C7F856DCF97F759EFC3236762E80AF7
4A9561D58704E6538410D9EEBFED2E97
EE4C8B042BC817DFD3D91EF6714055F7
</pre>
 
=== IPL decryption seed binary (0x280) ===
 
<pre>
DF0CBB0F808D785D705C60DBA33B8788
CBA210244B6DD7FB292C57223B6D217F
F009617CEA31EA1D0A1FA3DA07B69BA0
910E008C3857AE8C49E001A52AB646FE
58630E67F4267508AB555CC8439932A5
44951FD52A252D98A851C1A6F11DCDBD
4F0A0AE2E464D5234B6BF7DE36E37AF2
0690A308851D37E95B714F624078D5A4
35368B4E0E07905F960A61D20B9D5D90
D63E58ACBE2EF551B42FCCD345237587
F5FA7F05067D0584215981BBA5FC2063
EEBFD9C8CB65F909F6F75395CF5B3D19
64E8B9E71378B22FC3B69F36E4FFAE60
A2BBFE9DA5AC7BC0B9A98841754D195B
1AF570B4EFEB2CBCF4B6A8E6A4575526
3D0B87D1E0611BDB784420A589ED3B4D
F1D2921126814B4939F667BC9A1FD079
1A8F1DE1D06DBAF1CD353AD96873B5C9
0CC19EBB24FF782E03652F4AE388904F
80EDB0F1EEE6C862C98793DD4FB67924
C2D34CD92A2BF844B5A15CDA6B59CB9C
FAFC5A908F0BAF7C1E30AC16E08E1B21
50F0D6F002769B14D045AEF4871380FC
2C7875F3C14B3B67EB203C99B4FAC201
4195C22D825FCC655891E511D1FDF0C8
4FA5B548CC08B88DE68047E5720DDFEA
DFFEEC7A635C12D59EFCA7904EE74CD3
782AD158E5D4C6510FC0C42F62587386
1138EBC2A7945063A037467B1C577719
FAEF02E0DCF5DC2BD5CEB7A26CE9183D
9F5BDFF79DE8621D9776B5F5DAE229C6
6E4BA0FEA033DA86D7039EEB7D806B19
62F460EB11219C15C38B0D33C3C4E279
F6FF0F97E1A4F681C22AC1AD9601B051
4276F2346C6B2E8CFA74A2E3EBEBB8A2
92FB9EAC103B44FF79A8919F5AE72B8C
D713B7D64C89838E1F0F218C47924A63
4C1348E3C0CCA3F8701B0ED7C874B121
1E90787C973528504F79A587427A358D
8460F60E9D6A91B80BF27E6AC0291BF7
</pre>
</pre>


* Located in Kicho & Dencho
=== 3.5.0 + Bootrom Date ===
 
== NPDRM Keys ==
 
See [https://www.psdevwiki.com/ps3/edit/Keys#NPDRM_Keys|NPDRM Keys on PS3 Dev Wiki].
 
== Retail iplloader ==
 
=== IPL header Kirk command 1 XOR keys ===
 
The XOR key is set by altering the index and rotation values on the NAND write. There are 64 possible index values and 32 possible rotation values.
 
* 03g, 04g, 07g, 09g, 11g use a index of 0 and rotation value of 1
* 05g uses an index of 0 and rotation value of 2.
 
Only the first 0x10 bytes of the block are XORed.


<pre>
<pre>
xorkeys = [ 0x61A0C918, 0x45695E82, 0x9CAFD36E, 0xFA499B0F,
12 02 07 20
            0x7E84B6E2, 0x91324D29, 0xB3522009, 0xA8BC0FAF,
            0x48C3C1C5, 0xE4C2A9DC, 0x00012ED1, 0x57D9327C,
            0xAFB8E4EF, 0x72489A15, 0xC6208D85, 0x06021249,
            0x41BE16DB, 0x2BD98F2F, 0xD194BEEB, 0xD1A6E669,
            0xC0AC336B, 0x88FF3544, 0x5E018640, 0x34318761,
            0x5974E1D2, 0x1E55581B, 0x6F28379E, 0xA90E2587,
            0x091CB883, 0xBDC2088A, 0x7E76219C, 0x9C4BEE1B,
            0xDD322601, 0xBB477339, 0x6678CF47, 0xF3C1209B,
            0x5A96E435, 0x908896FA, 0x5B2D962A, 0x7FEC378C,
            0xE3A3B3AE, 0x8B902D93, 0xD0DF32EF, 0x6484D261,
            0x0A84A153, 0x7EB16575, 0xB10E53DD, 0x1B222753,
            0x58DD63D0, 0x8E8B8D48, 0x755B32C2, 0xA63DFFF7,
            0x97CABF7C, 0x33BDC660, 0x64522286, 0x403F3698,
            0x3406C651, 0x9F4B8FB9, 0xE284F475, 0xB9189A13,
            0x12C6F917, 0x5DE6B7ED, 0xDB674F88, 0x06DDB96E,
            0x2B2165A6, 0x0F920D3F, 0x732B3475, 0x1908D613 ]
</pre>
 
calculated 03g XOR key
<pre>
8C64D030442DF582B8721EB487CD24FD
</pre>
 
calculated 05g XOR key
<pre>
46326818895AEA05D46F625DC36692FE
</pre>
 
== 3.5.0 DTP-T1000 iplloader ==
 
=== IPL header Kirk command 1 XOR key ===
 
<pre>
0E82DE13A84BB23E1FEC71542153C45A
A97D9B6A461B761DD1B921E594E08D4F
96402C0524660D700C8FFEB089D53E0E
6390CE0E5E71CBA581915314993E3474
</pre>
 
=== IPL decryption seed hash (key) ===
 
<pre>
8E939AF03C553F7775317044853D9323
6C7F856DCF97F759EFC3236762E80AF7
4A9561D58704E6538410D9EEBFED2E97
EE4C8B042BC817DFD3D91EF6714055F7
</pre>
</pre>


=== IPL decryption seed binary (0x280 bytes) ===
* 12th February 2007
 
<pre>
DF0CBB0F808D785D705C60DBA33B8788
CBA210244B6DD7FB292C57223B6D217F
F009617CEA31EA1D0A1FA3DA07B69BA0
910E008C3857AE8C49E001A52AB646FE
58630E67F4267508AB555CC8439932A5
44951FD52A252D98A851C1A6F11DCDBD
4F0A0AE2E464D5234B6BF7DE36E37AF2
0690A308851D37E95B714F624078D5A4
35368B4E0E07905F960A61D20B9D5D90
D63E58ACBE2EF551B42FCCD345237587
F5FA7F05067D0584215981BBA5FC2063
EEBFD9C8CB65F909F6F75395CF5B3D19
64E8B9E71378B22FC3B69F36E4FFAE60
A2BBFE9DA5AC7BC0B9A98841754D195B
1AF570B4EFEB2CBCF4B6A8E6A4575526
3D0B87D1E0611BDB784420A589ED3B4D
F1D2921126814B4939F667BC9A1FD079
1A8F1DE1D06DBAF1CD353AD96873B5C9
0CC19EBB24FF782E03652F4AE388904F
80EDB0F1EEE6C862C98793DD4FB67924
C2D34CD92A2BF844B5A15CDA6B59CB9C
FAFC5A908F0BAF7C1E30AC16E08E1B21
50F0D6F002769B14D045AEF4871380FC
2C7875F3C14B3B67EB203C99B4FAC201
4195C22D825FCC655891E511D1FDF0C8
4FA5B548CC08B88DE68047E5720DDFEA
DFFEEC7A635C12D59EFCA7904EE74CD3
782AD158E5D4C6510FC0C42F62587386
1138EBC2A7945063A037467B1C577719
FAEF02E0DCF5DC2BD5CEB7A26CE9183D
9F5BDFF79DE8621D9776B5F5DAE229C6
6E4BA0FEA033DA86D7039EEB7D806B19
62F460EB11219C15C38B0D33C3C4E279
F6FF0F97E1A4F681C22AC1AD9601B051
4276F2346C6B2E8CFA74A2E3EBEBB8A2
92FB9EAC103B44FF79A8919F5AE72B8C
D713B7D64C89838E1F0F218C47924A63
4C1348E3C0CCA3F8701B0ED7C874B121
1E90787C973528504F79A587427A358D
8460F60E9D6A91B80BF27E6AC0291BF7
</pre>


== SDK ARC DES Key ==
== SDK ARC DES Key ==


* DES encrypted, every 0x200 bytes are reset for the info blocks and every 0x400 bytes are reset for the data blocks.
* DES encrypted, every 0x200 are reset for the info blocks and every 0x400 are reset for the data blocks.
* see https://github.com/galaxyhaxz/psp-arc-sdk


=== 0.6.5 ===
=== 0.6.5 ===
Line 5,054: Line 5,024:
IV: 41FBCFDDDE9E5B2C
IV: 41FBCFDDDE9E5B2C


 
[[Category:Software]]<noinclude>[[Category:Main]]</noinclude>
[[Category:Software]]
<noinclude>
[[Category:Main]]
</noinclude>
Please note that all contributions to PSP Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PSP Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)