User Token Manager

0x25000 - User Token Manager

note: inside ss_server1.fself
User Token Manager service is accessed by GameOS syscall 877

Packet ID	Description	Lv1 Parameter Usage	Lv2Syscall Parameter	notes
0x25001	Encrypt User Token
0x25002	Decrypt User Token
0x25003 (Lv2)	Decrypt User Token		uint8_t out[0xC50], uint64_t size (0xC50)
0x25004 (Lv2)
0x25005 (Lv2)	Encrypt User Token		uint8 out[0xC50], uint64_t size (0xC50)
0x25006 (Lv2)	Retrieve Level 2 Syscall Table		0, uint8 out[size], uint64_t size (0x2000)

User Token

• Before User Token Manager encrypts a received user token it checks it's format.
• User Tokens are processed by spu_utoken_processor.self
• Before User Token is processed, User Token Manager reads IDPS by sending SS requests to Indi Info Manager (packet ids 0x17001 and 0x17002). Indi Info Manager runs in HV Process 5.
• First 0x10 bytes of the User Token are always unencrypted. Encrypted data offset: 0x10. Encrypted data size: 0xC40.

User Token Format

stuct user_token_attr
{
    uint32_t type;                                 /* 0x00000001, value != 0x00000001 means attribute list ends here */
    uint32_t size;                                 /* 8 + sizeof(data) */
    /* data follows here, size of data may be 0 */
}

struct user_token
{
    uint32_t magic;                                /* 0x73757400 = "sut\0" */
    uint32_t format_version;                       /* 0x00000001 */
    uint64_t size;
    uint8_t idps[16];
    uint64_t expire_date;
    uint64_t capability;
    union
    {
        stuct user_token_attr attrs[0];
        uint8_t dummy[3072];
    } attrs;
    /* 0xC30 */
    uint8_t digest[20];
}