Editing Bluray disc

== Overview ==

Generalities about disc images:

* the disc image if made of sectors
* a sector is 2048 bytes
* sector 0 is made of bytes 0 to 2047, etc.

Encryption:

* some regions of the disc are encrypted.
* the encryption is done sector by sector.
* Sector 0 describes which part of the disc is encrypted (see below).
* Sector 1 has information about the disc.

File system:

* [http://www.osta.org/specs/pdf/udf260.pdf UDF] filesystem (a profile of [http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-167.pdf ECMA-167])
* the structure of the UDF filesystem itself is in cleartext
* some files are encrypted (their data fall in the encrypted regions of the disc)
* some files are not encrypted (thei fata fall in the non-encrypted regions of the disc)

== Disc Info ==

Contained in the second sector.

For example for The Last Of Us:

<pre>
00000800: 506c 6179 5374 6174 696f 6e33 0000 0000  PlayStation3....
00000810: 4243 4553 2d30 3135 3834 2020 2020 2020  BCES-01584      
00000820: 2020 2020 2020 2020 2020 2020 2020 2020                  
00000830: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000840: a9c6 f9c8 5e73 7f3b 0442 d0ef 6e95 4caf  ....^s.;.B..n.L.
00000850: 01df f413 6077 f26b b853 1fd2 ca12 5732  ....`w.k.S....W2
00000860: f982 affb 281a 1286 afbd 3faf 50ff 71c6  ....(.....?.P.q.
00000870: a386 d213 7ebe 40b0 3b83 244d 1dd1 4587  ....~.@.;.$M..E.
00000880: f276 704e cb4f fd02 010c c825 35c5 ac89  .vpN.O.....%5...
00000890: a146 df4b 23ca 4281 451f 3cbb c1d3 b734  .F.K#.B.E.<....4
000008a0: ed6a beeb e38f 62e8 60b2 5384 b81e 1fe2  .j....b.`.S.....
000008b0: 0262 2399 4197 c731 1e7d 72fc 1122 4438  .b#.A..1.}r.."D8
000008c0: f2be 70fa eae9 b707 5325 0cd4 2f65 dc2d  ..p.....S%../e.-
000008d0: e55a b8da 27f5 2e01 e6d9 6a25 294a 6243  .Z..'.....j%)JbC
000008e0: 22bf a306 e597 b985 4899 35eb d088 97e1  ".......H.5.....
000008f0: f252 3dec ef07 336c 54b3 c70e 4026 6771  .R=...3lT...@&gq
00000900: a87b 901f 0f91 f216 36ef 4a6d 4576 c51d  .{......6.JmEv..
00000910: e23b 274b 3001 d63c 67e2 4896 20d6 d0f7  .;'K0..<g.H. ...
00000920: fb37 11db 185d 1e1e 8bcc 527d 8591 86ca  .7...]....R}....
00000930: 0ebf 0f05 38c9 ce33 108a 246f fd49 6b5a  ....8..3..$o.IkZ
00000940: c232 e26d d9df f0c1 7a87 bdf6 7a38 9199  .2.m....z...z8..
00000950: 5e7b ffc9 c676 2776 767f d196 584e ee9f  ^{...v'vv...XN..
00000960: 6b45 265e 4f5a a1b2 f96a 6b3a b62b e35d  kE&^OZ...jk:.+.]
00000970: ca9c 263a eb10 797b 90ce 1d43 0d5f 7ead  ..&:..y{...C._~.
00000980: 2717 a0cb 3cf8 943d 5af4 c346 734f 4fe1  '...<..=Z..FsOO.
00000990: 93cd 4408 a836 ffac a114 52f3 ae7d 8b07  ..D..6....R..}..
000009a0: dd9b 16b0 8f76 f8d7 d881 3c60 2923 6bca  .....v....<`)#k.
000009b0: 9405 f135 4439 288e c634 89ad 58cf 4bfd  ...5D9(..4..X.K.
000009c0: 4e9e 9f37 fb70 2fb7 ed1c a802 79b9 1479  N..7.p/.....y..y
000009d0: 12e8 0f0c 424c 1d4b 218d 0d72 9021 3346  ....BL.K!..r.!3F
000009e0: ba47 9953 fe42 c35d d4cf c182 4991 26fd  .G.S.B.]....I.&.
000009f0: 0962 1abb 48cd f6c3 3c11 fd3a bfca c75f  .b..H...<..:..._
00000a00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
...
</pre>

* The first 16 bytes identidy a PS3 disc.
* The next 32 bytes are the disc ID (with space padding)
* 0x840: ?

== Encryption ==

The first sector of the disc tells which parts of the disc are unencrypted and which one are encoded.

For example, this is the beginning of "The Last of Us" disc:

<pre>
00000000: 0000 0003 0000 0000 0000 0000 0000 099f  ................
00000010: 00a2 6160 00ba 73ff 011d dda0 011f ddbf  ..a`..s.........
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
</pre>

* 0x00000003: number of unencrypted regions
* Sectors 0x00000000 to 0x0000099f: first unencrypted region
* Sectors 0x0000099f to 0x00a26160The: first encrypted region
* Sectors 0x00a26160 to 0x00ba73ff: second unencrypted region
* Sectors 0x00ba73ff to 0x011ddda0: second encrypted region
* Sectors 0x011ddda0 to 0x011fddbf: third unencrypted region

Note:

* 0x011fddbf sectors is 38636746752 bytes whereas the file is 38636748800 bytes;
* the last sector is not included for some reason.

=== Deriving the disc key ===

The disc key is obtained by encrypting "data1" with AES CBC:

* with the secret 0x380bcf0b53455b3c7817ab4fa3ba90ed
* with the IV 0x69474772af6fdab342743aefaa186287
* no padding

Where can I get data1?

* it can be found on the disc with a bunch of SCSI commands (assuming you have a suitable BD drive)
* for the rest of us, it is available in the IRD file

=== Sector encryption ===

Each disc sector is encrypted (independently from the other sectors) with AES CBC:

* using the disc key
* no padding

The IV is derived from the sector number with:

<pre>
int num = sectorNumber;
byte[] iv = new byte[16];
for (int j = 0; j < 16; j++)
{
	iv[16 - j - 1] = (byte)(num & 0xFF);
	num >>= 8;
}
</pre>

== File system layout ==
* PS3_DISC.SFB
* PS3_GAME/ICON0.PNG
* PS3_GAME/LICDIR/LIC.DAT
* PS3_GAME/PARAM.SFO
* PS3_GAME/PIC1.PNG
* PS3_GAME/PS3LOGO.DAT
* PS3_GAME/SND0.AT3
* PS3_GAME/TROPDIR/
* PS3_GAME/USRDIR/build/
* PS3_GAME/USRDIR/data/
* PS3_GAME/USRDIR/EBOOT.BIN
* PS3_UPDATE/PS3UPDAT.PUP

{{PS3 Disc Game Structure}}
See also [[Content Information Files]]

== Extra "tracks" ==

=== Blu-ray Disc Information ===

See http://www.t10.org/ftp/t10/document.04/04-328r0.pdf#page=43:

<blockquote>A DI unit is 112 bytes in PIC on a BD-RE disc.  The DI unit that contains physical information shall 
be returned.  The information for layer 0 shall be returned when the Layer field of the CDB is set 
to zero.  The information for layer 1 shall be returned when the Layer field of the CDB is set to 1.  
See 
System Description Blu-ray Disc Rewritable Format, Part 1 Basic Format Specifications 
for 
DI unit detailed definition.</blockquote>

AFAIU, the description of its content is in a spec under NDA.

Exemple from "The Last Of Us":

<pre>
00000000: 1002 0000 4449 0110 0000 2000 4244 4f01  ....DI.... .BDO.
00000010: 2101 0300 0000 0000 019a f5bf 0010 0000  !...............
00000020: 00ca 73fe 0000 0000 0000 0000 0000 0000  ..s.............
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 4449 0111 0001 2000 4244 4f01  ....DI.... .BDO.
00000050: 2101 0300 0000 0000 019a f5bf 0135 8c00  !............5..
00000060: 01ef fffe 0000 0000 0000 0000 0000 0000  ................
</pre>

It can be read with the [http://www.t10.org/ftp/t10/document.04/04-328r0.pdf#page=43 READ DISC STRUCTURE] SCSI command.

Reading it (in C on Linux):

<pre>
#define PIC_SIZE 112

  unsigned char read_pic_command[12] = {
    173, // Operation Code=READ_DISC_STRUCTURE
    1,   // Reserved=0, MediaType=1 (BD)
    0,
    0,
    0,
    0,
    0,
    0, // FormatCode=0 (Disc Information)
    pic_size / 256,
    pic_size % 256,
    0,
    0
  };

  int drive = open(drive_filename, 0, O_RDONLY);
  if (drive == -1) {
    fputs("Can't open file\n", stderr);
    return 1;
  }

  unsigned char sense_data[12];

  // Actually there is a lot more than that:
  unsigned char* pic = malloc(pic_size);
  memset(pic, 0, pic_size);

  struct sg_io_hdr header;
  memset(&header, 0, sizeof(header));
  header.interface_id = 'S'; // SCSI
  header.dxfer_direction = SG_DXFER_FROM_DEV;
  header.cmd_len = sizeof(read_pic_command);
  header.mx_sb_len = sizeof(sense_data);
  header.iovec_count = 0;
  header.dxfer_len = pic_size;
  header.dxferp = pic;
  header.cmdp = (unsigned char*) read_pic_command;
  header.sbp = sense_data;
  header.timeout = 60 * 1000;
  header.flags = 0;
  header.pack_id = 0;
  header.usr_ptr = NULL;
  header.status = 0;
  header.msg_status = 0;
  header.sb_len_wr = 0;
  header.host_status = 0;
  header.driver_status = 0;
  header.resid = 0;
  header.duration = 0;
  header.info = 0;

  if (ioctl(drive, SG_IO, &header) < 0) {
    fputs("ioctl failed\n", stderr);
    return 1;
  }

  if ((header.info & SG_INFO_OK_MASK) != SG_INFO_OK) {
    fputs("SCSI failed\n", stderr);
    return 1;
  }
</pre>

=== "Data1" and "Data2" ===

Read after authentication with some undocumented SCSI commands. Not sure if those are PS3-specific SCSI commands.

== IRD file ==

3k3y generates [http://jonnysp.bplaced.net/ IRD files] which contains some information about the disc. In particular, it contains "data1" which is used to derive the disc AES encryption key.

The file is:

* either uncompressed (magic string "3IRD");
* or gzipped (gzip magic string 0x1f8b) with a (4 bytes) CRC afterwards.

The format is based on .NET BinaryReader/BinaryWriter:

* Integer are in little endian format:
* Variable length strings use a [https://msdn.microsoft.com/fr-fr/library/system.io.binaryreader.readstring(v=vs.110).aspx compressed length prefix].

Compressed data are compressed with gzipped and prefixed with a length (uint32).

The format is (v6 to v9):

{|class="wikitable"
!Size
!Format
!Description
!Example
!Versions
|-
|4B
|string
|Magic string ("3IRD")
|3IRD
|
|-
|1B
|uint
|Version
|6, 7, 8, 9
|
|-
|9B
|string
|Game ID
|BCES01584
|
|-
|var
|string
|Game name
|The Last Of Us
|
|-
|4B
|string
|Update version
|4.41
|
|-
|5B
|string
|Game version
|4.41
|
|-
|5B
|string
|App version
|01.00
|
|-
|4B
|uint
|ID
|
|v=7
|-
|var
|compressed
|Header
|
|
|-
|var
|compressed
|Footer
|
|
|-
|1B
|uint
|Region count
|
|
|-
|16B
|bytes
|Region 1 hash
|
|
|-
|…
|…
|…
|…
|…
|-
|4B
|uint
|File count
|
|
|-
|8B
|uint
|File 1 key
|
|
|-
|16B
|bytes
|File 1 hash
|
|
|-
|…
|…
|…
|…
|…
|-
|115B
|bytes
|PIC
|
|v=9
|-
|16B
|bytes
|Data 1
|
|
|-
|16B
|bytes
|Data 2
|
|
|-
|115B
|bytes
|PIC
|
|v<9
|-
|2B
|uint/bytes
|UID
|
|
|}

== References ==

* 3k3y IsoTools, this is a .NET program available in binary form. The [https://github.com/icsharpcode/ILSpy ILspy] decompiler produces a very readable output.
* PS3 ISO Patcher by BlackDaemon, is a .NET program available in source code

{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>