Editing Flash:Encrypted Individual Data - eEID
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== Encrypted Individual Data - eEID == | == Encrypted Individual Data - eEID == | ||
This section of flash contains QA tokens | |||
It is 0x10000 in length (64 kb) but only the first 0x1DD0 is used, the rest is padded with FF | |||
It is composed of 6 sections numbered from 0 to 5 | |||
eEID contains your system model data, your target ID, and your PS3 motherboard revision | |||
eEID contains | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! Section | ! Section !! Description !! [[iso module]] | ||
|- | |- | ||
| [[Flash:Encrypted_Individual_Data_-_eEID#EID0|EID0]] | | [[Flash:Encrypted_Individual_Data_-_eEID#EID0|EID0]] || [[Flash:Encrypted_Individual_Data_-_eEID#EID0|EID0]] is needed for loading parameters to isoldr for loading isolated SELF files on a SPE || aim_spu_module | ||
|- | |- | ||
| [[Flash:Encrypted_Individual_Data_-_eEID#EID1|EID1]] | | [[Flash:Encrypted_Individual_Data_-_eEID#EID1|EID1]] || ? + Syscon paring + Auth1/Auth2/Validate (see [[SC_Communication|SC Communication]] for more (log with logic analyzer)) || ?sc_iso_factory or ss_sc_init? | ||
|- | |- | ||
| [[Flash:Encrypted_Individual_Data_-_eEID#EID2|EID2]] || | | [[Flash:Encrypted_Individual_Data_-_eEID#EID2|EID2]] || ? + BD drive pairing || fdm_spu_module | ||
|- | |- | ||
| [[Flash:Encrypted_Individual_Data_-_eEID#EID3|EID3]] || | | [[Flash:Encrypted_Individual_Data_-_eEID#EID3|EID3]] || ? + Movie Per_Device keys || AacsModule.spu.isoself CprmModule.spu.isoself | ||
|- | |- | ||
| [[Flash:Encrypted_Individual_Data_-_eEID#EID4|EID4]] | | [[Flash:Encrypted_Individual_Data_-_eEID#EID4|EID4]] || ? + Drive_auth keys || sv_iso_spu_module, mc_iso_spu_module.self, me_iso_spu_module.self, me_iso_for_ps2emu.self | ||
|- | |- | ||
| [[Flash:Encrypted_Individual_Data_-_eEID#EID5|EID5]] | | [[Flash:Encrypted_Individual_Data_-_eEID#EID5|EID5]] || ? Backup || ? Not used | ||
|} | |} | ||
Note: For data structure of [[Flash:Encrypted_Individual_Data_-_eEID|EID]], see [[Cex2Dex#LibeEID|LibeEID]] | |||
=== Header === | === Header === | ||
==== example ==== | |||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 47: | Line 41: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
==== | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
Line 62: | Line 54: | ||
=== File Table === | === File Table === | ||
This is the whole file table | |||
==== example ==== | |||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 88: | Line 78: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
==== | |||
0x10 bytes per entry as follows: | 0x10 bytes per entry as follows: | ||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
Line 101: | Line 88: | ||
| 0x4 || 0x4 || 0x860 || Length | | 0x4 || 0x4 || 0x860 || Length | ||
|- | |- | ||
| 0x8 || 0x8 || 0x0 || EID number | | 0x8 || 0x8 || 0x0 || EID number | ||
|} | |} | ||
====Typical EID entry addresses and lengths==== | |||
==== Typical EID entry addresses and lengths ==== | Entry point listed is offset from base EID address (NOR:0x002F000 / NAND:0x0080800 in these examples) <br /> | ||
Absolute start address is base EID address + Entry point <br /> | |||
Entry point listed is offset from base EID address (NOR:0x002F000 / NAND:0x0080800 in these examples) | |||
Absolute start address is base EID address + Entry point | |||
Absolute end address is base EID address + Entry point + Length | Absolute end address is base EID address + Entry point + Length | ||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
Line 314: | Line 296: | ||
| colspan="3" | [[Flash:Encrypted_Individual_Data_-_eEID#EID5|EID5]] || 0x13D0 || 0xA00 || 0x00303D0 || 0x0030DCF || 0x0081BD0 || 0x00825CF | | colspan="3" | [[Flash:Encrypted_Individual_Data_-_eEID#EID5|EID5]] || 0x13D0 || 0xA00 || 0x00303D0 || 0x0030DCF || 0x0081BD0 || 0x00825CF | ||
|} | |} | ||
Note: IDPS is present in EID0_0 and EID0_6. PSID is present in EID0_A. They're available only in decrypted form. | |||
=== EID0 === | === EID0 === | ||
''' | |||
Indi manager can write to it <br /> | |||
AIM can rehash it | |||
''' | |||
==== | ==== example ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 338: | Line 325: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
==== | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! Address !! Size !! Value !! Description !! Observations | ! Address !! Size !! Value !! Description !! Observations | ||
|- | |- | ||
| 0x0 || 0x10 || 00 00 00 01 00 89 00 08 14 01 01 06 1B 91 1C 5C || [[IDPS]] | | 0x0 || 0x10 || 00 00 00 01 00 89 00 08 14 01 01 06 1B 91 1C 5C || IDPS || [[IDPS]] - This contains your [[Target ID]]/[[SKU_Models#Regioning|Region]], [[SKU_Models|PS3 Model]], Chassis and others. | ||
|- | |- | ||
| | | 0x10 || 0x4 || 00 12 00 0B || Unknown || Appears to be static (00 11 00 0B on [[DEH-H1000A-E]] and earlier models).<br>Last byte contains number of eid0 sections in hex (11) | ||
|- | |- | ||
| | | 0x14 || 0xC || FC D1 D8 BE 6F F4 C8 D8 8F E1 C3 F7 || [[Flash:perconsole_nonce|perconsole nonce]] || Appear to be the same nonce as in the encrypted files metloader/bootloader at offset 0x14-0x1F | ||
|- | |- | ||
| | | Rest || Rest || Rest || Encrypted Data || | ||
|} | |} | ||
=== EID1 === | === EID1 === | ||
==== example ==== | |||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 445: | Line 361: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
Appears to be encrypted, not much is known about this one | |||
=== EID2 === | === EID2 === | ||
==== example ==== | |||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 500: | Line 391: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
==== | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
Line 517: | Line 404: | ||
| 0x1E? || 0x2 || 0x0000 || || on {{ARC}}/{{DEX}}/{{DECR}} there is 0x0003 | | 0x1E? || 0x2 || 0x0000 || || on {{ARC}}/{{DEX}}/{{DECR}} there is 0x0003 | ||
|- | |- | ||
| 0x20 || 0x80 || encrypted data || P-Block || | | 0x20 || 0x80 || encrypted data || P-Block || | ||
|- | |- | ||
| 0xA0 || 0x690 || encrypted data || S-Block || | | 0xA0 || 0x690 || encrypted data || S-Block || on {{ARC}}/{{DEX}}/{{DECR}} S-Block is 00s | ||
|} | |} | ||
<div id="decryptednotes">Notes</div> | |||
In decrypted P-Block these bytes match [[Target ID]]: | |||
{| class="wikitable" style="font-size:x-small; border:2px ridge #999999;" | {| class="wikitable" style="font-size:x-small; border:2px ridge #999999;" | ||
|- | |- | ||
! Value !! [[ | ! Value !! [[Target ID]] !! Console Type !! Remarks | ||
|- | |- | ||
| || {{TID80}} | | || {{TID80}} || | ||
|- | |- | ||
| 0xFF || {{TID81}} || No BD playback | | 0xFF || {{TID81}} || No BD playback on that [[Target ID]] | ||
|- | |- | ||
| 0xFF || {{TID82}} || No BD playback | | 0xFF || {{TID82}} || No BD playback on that [[Target ID]] | ||
|- | |- | ||
| 0x01 || {{TID83}} || | | 0x01 || {{TID83}} || | ||
|- | |- | ||
| 0x02 || {{TID84}} || | | 0x02 || {{TID84}} || | ||
|- | |- | ||
| 0x04 || {{TID85}} || | | 0x04 || {{TID85}} || | ||
|- | |- | ||
| 0x10 || {{TID86}} || | | 0x10 || {{TID86}} || | ||
|- | |- | ||
| 0x04 || {{TID87}} || | | 0x04 || {{TID87}} || | ||
|- | |- | ||
| | | || {{TID88}} || | ||
|- | |- | ||
| 0x08 || {{TID89}} || | | 0x08 || {{TID89}} || | ||
|- | |- | ||
| | | || {{TID8A}} || | ||
|- | |- | ||
| | | || {{TID8B}} || | ||
|- | |- | ||
| 0x20 || {{TID8C}} || | | 0x20 || {{TID8C}} || | ||
|- | |- | ||
| | | || {{TID8D}} || | ||
|- | |- | ||
| 0x10 || {{TID8E}} || | | 0x10 || {{TID8E}} || | ||
|- | |- | ||
| | | || {{TID8F}} || | ||
|- | |- | ||
| 0xFF || {{TIDA0}} || No BD playback | | 0xFF || {{TIDA0}} || No BD playback on that [[Target ID]] | ||
|- | |- | ||
|} | |} | ||
This value also must be match the first byte of the decrypted EID4. | |||
This value also must match the first byte of the decrypted EID4. | |||
Notes: | Notes: | ||
* | * FF=11111111 - all bits enabled | ||
* | * 20=00100000 - {{TID8C}} - bit 5 | ||
* 10=00010000 - {{TID8E}} | {{TID86}} - bit 4 | |||
* 08=00001000 - {{TID89}} - bit 3 | |||
* | * 04=00000100 - {{TID87}} | {{TID85}} - bit 2 | ||
* | * 02=00000010 - {{TID84}} - bit 1 | ||
* | * 01=00000001 - {{TID83}} - bit 0 | ||
* | |||
* | |||
=== EID3 === | === EID3 === | ||
==== example ==== | |||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 625: | Line 506: | ||
|} | |} | ||
==== | ==== structure ==== | ||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
Line 658: | Line 521: | ||
| 0x12 || 0x2 || 0x00D0 || || | | 0x12 || 0x2 || 0x00D0 || || | ||
|- | |- | ||
| 0x14 || 0x0C || | | 0x14 || 0x0C || per console nonce || [[Flash:perconsole_nonce|perconsole nonce]] || | ||
|- | |- | ||
| 0x20 || 0xE0 || encrypted data || || | | 0x20 || 0xE0 || encrypted data || || | ||
Line 666: | Line 529: | ||
=== EID4 === | === EID4 === | ||
==== Information about EID4 ==== | |||
* EID4 contains 2 128bit keys which are necessary to establish a secure communication channel to BD drive for sending vendor specific security commands. | |||
* EID4 is encrypted with AES-CBC-256 algorithm. | |||
* EID4 is of size 0x30 bytes: 0x0-0xf bytes = 1st key, 0x10-0x1f - 2nd key, 0x20-0x2f - CMAC-OMAC1 of EID4 | |||
* The first key is used for encrypting data sent from host to BD drive. | |||
* The second key is used for decrypting data sent from BD drive to host. | |||
(More about it in [[BD_Drive_Reverse_Engineering| BD Drive Reverse Engineering]] ) | |||
==== example ==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 690: | Line 555: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
==== | Encrypted encdec key (used for e.g. BD drive) | ||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! | ! Address !! Size !! Value !! Description !! Observations | ||
|- | |- | ||
| 0x0 || 0x10 || encrypted || | | 0x0 || 0x10 || encrypted || 1st 128bit key || Initial byte (decrypted) matches TID (same as EID2 Notes) , used for region | ||
|- | |- | ||
| 0x10 || 0x10 || encrypted || | | 0x10 || 0x10 || encrypted || 2nd 128bit key || | ||
|- | |- | ||
| 0x20 || 0x10 || encrypted || CMAC | | 0x20 || 0x10 || encrypted|| CMAC-OMAC1 of EID4 || | ||
|} | |} | ||
=== EID5 === | === EID5 === | ||
==== example ==== | |||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 737: | Line 595: | ||
|- | |- | ||
|} | |} | ||
==== structure ==== | |||
==== | Similar again to EID0 | ||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! Address !! Size !! Value !! Description !! Observations | ! Address !! Size !! Value !! Description !! Observations | ||
|- | |- | ||
| 0x0 || 0x10 || 00 00 00 01 00 89 00 08 14 01 01 06 1B 91 1C 5C || [[IDPS]] | | 0x0 || 0x10 || 00 00 00 01 00 89 00 08 14 01 01 06 1B 91 1C 5C || IDPS || [[IDPS]] | ||
|- | |- | ||
| 0x10 || | | 0x10 || 0x4 || 00 12 07 30 || Unknown || Changes from EID0/ 00 12 07 E0 on DEX/DECR | ||
|- | |- | ||
| | | 0x14 || 0xC || FC D1 D8 BE 6F F4 C8 D8 8F E1 C3 F7 || [[Flash:perconsole_nonce|perconsole nonce]] || Contains the 0xC byte perconsole nonce (as seen in bootldr/metldr and EID0) again at 0x14 to 0x1F | ||
|- | |- | ||
| | | Rest || Rest || || Encrypted, Unknown|| | ||
|- | |- | ||
|} | |} | ||
=== | === unreferenced area === | ||
Possibly just unused EID region (which also explains why it is FF filled) <br /> | |||
Possibly just unused EID region (which | ==== example ==== | ||
==== | |||
{| class="wikitable" | {| class="wikitable" | ||
|- | |- | ||
Line 780: | Line 631: | ||
000907E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ | 000907E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ | ||
000907F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ</pre> | 000907F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ</pre> | ||
|- | |||
|} | |} | ||
==== structure ==== | |||
==== | |||
{|class="wikitable" | {|class="wikitable" | ||
|- | |- | ||
! Address !! Length !! Value !! Description | ! Address !! Length !! Value !! Description | ||
|- | |- | ||
| 0x0 || 0xE22F || 0xFF || | | 0x0 || 0xE22F || 0xFF || FF filled area | ||
|- | |||
|} | |} | ||
{{Flash}} | {{Flash}} | ||
<noinclude>[[Category:Main]]</noinclude> | <noinclude>[[Category:Main]]</noinclude> |