Editing Flash:Encrypted Individual Data - eEID

eEID certainly stands for encrypted EID as each section eEID embeds is encrypted. EID certainly stands for Encrypted Individual Data. Why two 'e' in eEID ?

 

EID is the equivalent of IdStorage on PSP and PSVita.

 

eEID is decrypted by metldr and is passed over to the isolated loader which may pass it to a SELF. We can see this in graf_chokolo’s original payload.

EID0 embeds many (usually 11) AES128CBC encrypted sections. Each section is a IDPS Certificate.

We do not have all EID0 sections enc/dec key seeds:

section 0 (PS3 cert keyset 0) -> yes

section 1 (PS3 cert keyset 1)-> missing

section 2 (PS3 cert keyset 2) -> missing

section 3 (PS3 cert keyset 3) -> missing

section 4 (PS3 cert keyset 4) -> missing

section 5 (PS3 cert keyset 5) -> missing

section 6 (PSP cert keyset 1) -> yes

section 7 (PSP cert keyset 2) -> missing

section 8 (PSP cert keyset 3) -> missing

section 9 (PSP cert keyset 4) -> missing

section 0xA (PSP cert keyset 5) -> yes

 

===== EID0 Sections =====

 

====== IDPS Certificate Structure ======

| Data || 0x10 || actual data (either IDPS or OpenPSID)

| plaintext public key || 0x28 || public key (without padding)

| R || 0x14 || part of the ECDSA signature pair (r,s)

| S || 0x14 || part of the ECDSA signature pair (r,s)

| public key || 0x28 || ECDSA public key (can be used to verify ECDSA signature RS)

| encrypted private key || 0x20 || encrypted ECDSA private key

| cmac || 0x10 || hash of the previous information in AES CMAC mode

====== EID0 section 0-5 crypto ======

====== EID0 sections 6-0xA crypto ======

 

 

====== Note ======

On PS3 it uses ECDSA curve VSH type 2 with the PSP IDPS Certificates, whilst it uses a different curve with the PS3 exclusive IDPS Certificates (for example section 0). That is maybe how Davee and Proxima figured out the KIRK 0x10 and 0x11 ECDSA crypto keys. But not sure because their work was in 2011, not in 2012 (naehrwert) and it seems that PS3 uses a different seed for encrypting the ECDSA private key (see section 6 ECDSA private key seed).

! Value !! [[Product Code]] !! Console Type !! Remarks !! Confirmed ?

| || {{TID80}} || ||

| 0xFF || {{TID81}} || No BD playback with this [[Product Code]]. || {{yes}}

| 0xFF || {{TID82}} || No BD playback with this [[Product Code]]. || {{yes}}

| 0x01 || {{TID83}} || DVD Region 2 (NTSC)  || {{no}}

| 0x02 || {{TID84}} || DVD Region 1 (NTSC)  || {{yes}}

| 0x04 || {{TID85}} || DVD Region 2 (PAL)  || {{yes}}

| 0x10 || {{TID86}} || DVD Region 3 (NTSC)  || {{no}}

| 0x04 || {{TID87}} || DVD Region 2 (PAL)  || {{yes}}

| 0x80 || {{TID88}} || DVD Region 4 (NTSC) || {{yes}}

| 0x08 || {{TID89}} || DVD Region 4 (PAL)  || {{no}}

| 0x10 || {{TID8A}} || DVD Region 3 (NTSC)  || {{yes}}

| 0x10 || {{TID8B}} || DVD Region 3 (NTSC)  || {{yes}}

| 0x20 || {{TID8C}} || DVD Region 5 (NTSC/PAL)  || {{no}}

| 0x40 || {{TID8D}} || DVD Region 6  || {{no}}

| 0x10 || {{TID8E}} || DVD Region 3 (NTSC)  || {{yes}}

| 0x80 || {{TID8F}} || DVD Region 4 (NTSC)  || {{no}}

| 0xFF || {{TIDA0}} || No BD playback with this [[Product Code]]. || {{yes}}

* 0x20 = 0b00100000 - {{TID8C}} - bit 5 (DVD Region 5 (NTSC/PAL))

* 0x10 = 0b00010000 - {{TID8E}} | {{TID86}} | {{TID8A}} | {{TID8B}} -  bit 4 (DVD Region 3 (NTSC))

* 0x08 = 0b00001000 - {{TID89}} - bit 3 (DVD Region 4 (PAL))

* 0x04 = 0b00000100 - {{TID87}} | {{TID85}} - bit 2 (DVD Region 2(PAL))

* 0x02 = 0b00000010 - {{TID84}} - bit 1 (DVD Region 1 (NTSC))

* 0x01 = 0b00000001 - {{TID83}} - bit 0 (DVD Region 2 (NTSC))

The largest and quite possibly the most important EID section of all 6. It's unknown what is inside this specific EID. We will probably never know without analyzing every possible clue about the PS3. And even then, it might be impossible to find its real use.

EID5 size is quite similar to EID0, but it has an additional 0x1A0 bytes. EID5 header has many similarities with EID0 header.

| 0x12 || 0x2 || 07 30 || Unknown || Maybe data size in bytes (in EID0 it is encrypted Identification Certificates count). 0x730 on CEX, 0x7E0 on DEX/DECR.