Editing Trophy files

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
Trophies was introduced in 2.40 firmware; therefore, games compiled with an SDK smaller than 2.40 don't have trophies.
[[Category:Software]]
 
Trophies was introduced in 2.40 firmware, games compiled with an SDK smaller than 2.40 doesnt have trophies


=== Firmware related files ===
=== Firmware related files ===
Line 11: Line 13:
  np_trophy_plugin.sprx (/dev_flash/vsh/module)
  np_trophy_plugin.sprx (/dev_flash/vsh/module)
  np_trophy_util.sprx (/dev_flash/vsh/module)
  np_trophy_util.sprx (/dev_flash/vsh/module)
[http://www.mirrorcreator.com/files/U6OQTVZS/np_trophy-02.4000.rar_links np_trophy-02.4000]<br />
[http://www.mirrorcreator.com/files/P4X7EJ6B/np_trophy-04.4500_0.rar_links np_trophy-04.4500]


=== Harddrive related files ===
=== Harddrive related files ===
Line 25: Line 24:
**PARAM.PFD
**PARAM.PFD
**PARAM.SFO
**PARAM.SFO
**[[Content_Information_Files#Trophy_Collection|TROPxxx.PNG]] (e.g. TROP000.PNG ... TROP999.PNG for each individual trophy)
**TROPxxx.PNG (e.g. TROP000.PNG ... TROP999.PNG for each individual trophy)
**TROPCONF.SFM
**TROPCONF.SFM
**TROPTRNS.DAT
**TROPTRNS.DAT
Line 51: Line 50:


===== PARAM.SFO =====
===== PARAM.SFO =====
'' Full Article: [[PARAM.SFO]]''


===== TROPCONF.SFM =====
===== TROPCONF.SFM =====
Line 60: Line 57:
The only way to update this file is by installing a new "trophy installer" (TROPHY.TRP) using the same ID's, but with a higher version (this happens with some "game expansions" that updates the trophy installation with new trophies related with the new content)
The only way to update this file is by installing a new "trophy installer" (TROPHY.TRP) using the same ID's, but with a higher version (this happens with some "game expansions" that updates the trophy installation with new trophies related with the new content)


* Is language specific (texts are not common for all the languages). See [[Languages]]
* Is language specific (texts are not common for all the languages)
Its the trophy installer (TROPHY.TRP) who decides wich '''TROPCONF.SFM''' will be installed depending of the language settings in the XMB
Its the trophy installer (TROPHY.TRP) who decides wich '''TROPCONF.SFM''' will be installed depending of the language settings in the XMB


Line 143: Line 140:
|-
|-
|}
|}
===== How XML is signed? =====
If you take ASCII hex bytes from Sce-Np-Trophy-Signature and convert them to bytes you will see a block of 160 bytes. It contains a header of 12 bytes (the signature header) which contains 4 bytes of a magic (0x4C39B98C), a version (0x01000000) and a padding of 4 zero bytes. There is a SHA1-HMAC hash after the header which is generated using a concatenation of the XML content itself (starting with ''trophyconf'' tag without a signature block) and the mentioned signature header (real bytes, not ASCII bytes!). You can find a HMAC key of 64 bytes inside np_trophy_util.prx module which begins with 6A C0...). After the hmac hash there is a RSA signature of 128 bytes. It is calculated from the SHA1 hash which is generated using a concatenation of the XML content itself (starting with ''trophyconf'' tag without a signature block) and the mentioned signature header (real bytes, not ASCII bytes!) and the SHA1-HMAC hash. A trophy utility uses PKCS1 as a padding scheme, the public exponent of 65537 and the modulus which is placed in a transformed way inside a module. There are 128 bytes started with 92 C8... inside np_trophy_util.prx followed by 8 bytes of a public exponent, they are 16 groups of 8 bytes each written in a reversed order. So the last group of 8 bytes will be the first group of 8 bytes, the penultimate group of 8 bytes will be the second group, etc. A SHA1-HMAC after the signature header and SHA1 hash from the decrypted signature should be equal to the computed hashes. There are different HMAC key and RSA modulus inside a module and I believe they are used for old trophy format which is not used for current games.
== Keys ==
RSA modulus: CA30CEE59BF19E041F6F02C54AE42CD6769185E157AB8659B70DCEC0C3EE6039FF952FD9767D35474B11BB5514205C553864F77BD4DA899B30110B0EA4F8AD33FBE0350E085B2A92A7D327978110AAB95085730235408156707C3B2238F978BFF4F308063809AEAFB2F9AEC62E1968CFF58B9BA834B3588C92C8411C548BFC49
SHA1-HMAC key: 6AC0B3FB1EBB4FB7BCC2A00DA3A2A4BDBCB788EC456748CC86CD9D09EF37937F6EE31167778E414E9B711BE9D8CBB5F8956E454EE94A46C39DC4FF0D090B92B7


===== TROPTRNS.DAT =====
===== TROPTRNS.DAT =====
 
Fully encrypted, method unknown
Fully encrypted, the method is the same as used for save games. Besides that, it is signed with a RSA signature and SHA1-HMAC too.


* Specullation
* Specullation
Based in the name (trophy transmission or transfer) its a file derivated of TROPUSR.DAT, with an added layer of encryption, ready to be sended to PSN to synchronize the data related with this game with your trophies in your online account
Based in the name (trophy transmission or transfer) its a file derivated of TROPUSR.DAT, with an added layer of encryption, ready to be sended to PSN to synchronize the data related with this game with your trohpies in your online account


It contains info related with user, either because its present in the source file (TROPUSR.DAT) or because it contains the file PARAM.SFO "incrusted" in the format
It contains info related with user, either because its present in the source file (TROPUSR.DAT) or because it contains the file PARAM.SFO "incrusted" in the format
== Structure of TROPUSR.DAT and TROPTRNS.DAT ==
Structures: https://github.com/bucanero/apollo-ps3/blob/master/include/trophy.h
Block types: https://github.com/bucanero/apollo-ps3/blob/master/source/trophy.c
== How signatures from XML and TROPTRNS.DAT are signed? ==
The signature itself have a size of 160 bytes. It contains a header of 12 bytes (the signature header) which contains 4 bytes of a magic (0x4C39B98C for XML, 0xB9DDE13B for DAT), a version (0x0100 - 1.00) and a padding of 6 zero bytes. There are SHA1-HMAC hash after the header and RSA signature of 128 bytes. A RSA signature uses the SHA1 hash as a message. A trophy utility uses PKCS#1 as a padding scheme, the public exponent of 65537 and the modulus which is placed in a transformed way inside a module. A RSA modulus consists of 128 bytes followed by 8 bytes of a public exponent, they are 16 groups of 8 bytes each written in a reversed order. So the last group of 8 bytes will be the first group of 8 bytes, the penultimate group of 8 bytes will be the second group, etc. A SHA1-HMAC after the signature header and SHA1 hash from the decrypted signature should be equal to the corresponding computed hashes.
===== Keys =====
RSA public exponent: <code>65537</code>
== Signature for XML ==
Take ASCII hex bytes from Sce-Np-Trophy-Signature and convert them to bytes and you will see a block of 160 bytes. This is your XML signature and it uses the format mentioned above.  A SHA1-HMAC hash after the header is generated using a concatenation of the XML content itself (starting with ''trophyconf'' tag without a signature block) and the signature header (real bytes, not ASCII bytes!). You can find a HMAC key of 64 bytes inside np_trophy_util.prx module which begins with 6A C0...). The SHA1 hash for RSA signature is generated using a concatenation of the XML content itself (starting with ''trophyconf'' tag without a signature block), the signature header (real bytes, not ASCII bytes!) and the SHA1-HMAC hash. A RSA modulus started with 92 C8... inside np_trophy_util.prx.
===== Keys =====
RSA modulus:
<pre>CA 30 CE E5 9B F1 9E 04 1F 6F 02 C5 4A E4 2C D6
76 91 85 E1 57 AB 86 59 B7 0D CE C0 C3 EE 60 39
FF 95 2F D9 76 7D 35 47 4B 11 BB 55 14 20 5C 55
38 64 F7 7B D4 DA 89 9B 30 11 0B 0E A4 F8 AD 33
FB E0 35 0E 08 5B 2A 92 A7 D3 27 97 81 10 AA B9
50 85 73 02 35 40 81 56 70 7C 3B 22 38 F9 78 BF
F4 F3 08 06 38 09 AE AF B2 F9 AE C6 2E 19 68 CF
F5 8B 9B A8 34 B3 58 8C 92 C8 41 1C 54 8B FC 49</pre>
====== SHA1-HMAC key ======
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F                    example 4.45 CEX/Retail
000558F0  6A C0 B3 FB 1E BB 4F B7 BC C2 A0 0D A3 A2 A4 BD  jÀ³û.»O·¼Â .£¢¤½
00055900  BC B7 88 EC 45 67 48 CC 86 CD 9D 09 EF 37 93 7F  ¼·ˆìEgH̆Í..ï7“.
00055910  6E E3 11 67 77 8E 41 4E 9B 71 1B E9 D8 CB B5 F8  nã.gwŽAN›q.éØ˵ø
00055920  95 6E 45 4E E9 4A 46 C3 9D C4 FF 0D 09 0B 92 B7  •nENéJFÃ.Äÿ...’·
====== RSA modulus ======
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F                    example 4.45 CEX/Retail
000557F0  92 C8 41 1C 54 8B FC 49 F5 8B 9B A8 34 B3 58 8C  ’ÈA.T‹üIõ‹›¨4³XŒ
00055800  B2 F9 AE C6 2E 19 68 CF F4 F3 08 06 38 09 AE AF  ²ù®Æ..hÏôó..8.®¯
00055810  70 7C 3B 22 38 F9 78 BF 50 85 73 02 35 40 81 56  p|;"8ùx¿P…[email protected]
00055820  A7 D3 27 97 81 10 AA B9 FB E0 35 0E 08 5B 2A 92  §Ó'—..ª¹ûà5..[*’
00055830  30 11 0B 0E A4 F8 AD 33 38 64 F7 7B D4 DA 89 9B  0...¤ø­38d÷{ÔÚ‰›
00055840  4B 11 BB 55 14 20 5C 55 FF 95 2F D9 76 7D 35 47  K.»U. \Uÿ•/Ùv}5G
00055850  B7 0D CE C0 C3 EE 60 39 76 91 85 E1 57 AB 86 59  ·.ÎÀÃî`9v‘…áW«†Y
00055860  1F 6F 02 C5 4A E4 2C D6 CA 30 CE E5 9B F1 9E 04  .o.ÅJä,ÖÊ0Îå›ñž.
== Signature for TROPTRNS.DAT ==
Decrypt TROPTRNS.DAT and take 160 bytes starting from offset 0x170. This is your TROPTRNS.DAT signature and it uses the format mentioned above. A RSA modulus started with 3C 1C... inside np_trophy_util.prx.
===== Keys =====
====== ? ======
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F                    example 4.45 CEX/Retail
000556E0  A8 AB D9 BC 89 46 46 2B B9 C8 8D 4C 07 ED 22 8B  ¨«Ù¼‰FF+¹È.L.í"‹
000556F0  27 A4 E3 67 15 B0 42 89 8F BC CD C4 1A 02 E5 B0  '¤ãg.°B‰.¼ÍÄ..å°
00055700  A5 F5 AC F7 99 12 45 58 97 19 36 00 BC 66 5F 95  ¥õ¬÷™.EX—.6.¼f_•
00055710  A5 AA 47 84 94 4C 48 6A AA 75 7D D0 73 1D 28 D7  ¥ªG„”LHjªu}Ðs.(×
====== RSA modulus ======
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F                    example 4.45 CEX/Retail
000555E0  3C 1C 00 AC F2 9C F5 E7 57 0B 80 4D 82 1C 17 57  <..¬òœõçW.€M‚..W
000555F0  5E 00 A9 6A 37 4F BF 5C 30 7E C3 EA BB 61 15 7E  ^.©j7O¿\0~Ãê»a.~
00055600  53 B2 0A 50 B6 86 D0 84 D4 C5 E5 28 EF AD BA 5B  S².P¶†Ð„ÔÅå(ï­º[
00055610  DE 69 2C E9 97 02 AA C4 5F E5 1E F4 2D 94 A1 A9  Þi,é—.ªÄ_å.ô-”¡©
00055620  C8 EE 8A DF 10 F4 A1 34 66 0D 18 01 4E 44 4C 46  ÈîŠß.ô¡4f...NDLF
00055630  34 7B BA 58 4E 75 72 F9 7F DE 0E 04 51 ED A0 5C  4{ºXNurù.Þ..Qí \
00055640  D9 44 31 97 04 AD C3 E8 14 57 4E 52 94 2E 1D 25  ÙD1—.­Ãè.WNR”..%
00055650  EA D1 2C 1C D5 EA 95 F9 CE 8A 7F 56 1F 08 EC 50  êÑ,.Õê•ùΊ.V..ìP


===== TROPUSR.DAT =====
===== TROPUSR.DAT =====
Stores data related with the unlocked trophies for this specific game, included timestamps when the trophy was unlocked, etc...
Stores data related with the unlocked trophies for this specific game, included timestamps when the trophy was unlocked, etc...


The file is updated every time a trophy is unlocked, and at the same time the [[PARAM.PFD]] is updated to store the new signature
The file is updated everytime a trophy is unlocked, and at the same time his [[PARAM.PFD]] is updated to store the new signature


The file is encrypted, some tricks can be done to tamper with this files to unlock trophies, but consider the methods not perfect (they generates semi-corrupted files that can be considered valid under some circunstancies, but are corrupted in the end)
The file is encrypted, some tricks can be done to tamper with this files to unlock trophies, but consider the methods not perfect (they generates semi-corrupted files that can be considered valid under some circunstancies, but are corrupted in the end)
*Notes
**The trophies unlocked in a PS3 that has never been connected online doesnt contains timestamps, this is easy to identify by looking in the "trophy collection" in [[XMB]] under the individual trophies names if is displayed the date and time when this specific trophy was unlocked. Additionally the user accounts that has never been registered in PSN contains a dummy ACCOUNTID filled with zeroes, this dummy ACCOUNTID is stored in the [[PARAM.SFO#ACCOUNTID | PARAM.SFO]] of the trophies


===== Content information files =====
===== Content information files =====
These are "multimedia" files, not critical and not protected in any way, for more information see: [[Content_Information_Files|Content Information Files]]
These are "multimedia" files, not cryticall and not protected in any way, for more information see: [[Content_Information_Files|Content Information Files]]


=== [[TROPHY.TRP|Trophy Installer]] ===
=== Trophy Installer ===


In blu-ray discs in path: bdvb/PS3_GAME/TROPDIR/[[PARAM.SFO#NPCOMMID|NPCOMMID]]/'''[[TROPHY.TRP]]'''. e.g: bdvb/PS3_GAME/TROPDIR/NPWR00001/TROPHY.TRP
In blu-ray discs in path: bdvb/PS3_GAME/TROPDIR/[[PARAM.SFO#NPCOMMID|NPCOMMID]]/'''TROPHY.TRP'''. e.g: bdvb/PS3_GAME/TROPDIR/NPWR00001/TROPHY.TRP


In HDD games in path: ???
In HDD games in path: ???
Line 276: Line 209:


*TROP_'''xx'''.SFM (optionall)
*TROP_'''xx'''.SFM (optionall)
Same than TROP.SFM but containing texts for other [[Languages]]
Same than TROP.SFM but containing texts for other languages. For a list of all languages see: [[Content_Information_Files#Regional_codes_in_file_names_.28languages.29|Content Information Files - Languages]]


*ICON0.PNG, TROP'''xxx'''.PNG, and GR00'''x'''.PNG. See [[Content Information Files]]
*ICON0.PNG, TROP'''xxx'''.PNG, and GR00'''x'''.PNG
ICON0.PNG is the main icon always visible in XMB
ICON0.PNG is the main icon always visible in XMB
GR00'''x'''.PNG (optionall) is a subicon when trophies are grouped
GR00'''x'''.PNG (optionall) is a subicon when trophies are grouped
TROP'''xxx'''.PNG is the icon for every trophy
TROP'''xxx'''.PNG is the icon for every trophy
[[Content_Information_Files#Trophies|Content Information Files - Trophies]]


==PSL1GHT and trophy's==
==PSL1GHT and trophy's==
Line 289: Line 224:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Game type  
! Game type !! Platinum (180 points) !! Gold (90 points) !! Silver (30 points) !! Bronze (15 points) !! Points Max
! [[File:Trophy-platinum.png|20px]]Platinum (180 points)  
! [[File:Trophy-gold.png|20px]]Gold (90 points)  
! [[File:Trophy-silver.png|20px]]Silver (30 points)  
! [[File:Trophy-bronze.png|20px]]Bronze (15 points)  
! Points Max
|-
|-
| Disc Game || {{yes}} || {{yes}} || {{yes}} || {{yes}} || 1230
| Disc Game || {{yes}} || {{yes}} || {{yes}} || {{yes}} || 1230
Line 325: Line 255:
**Level 19 = 70,000
**Level 19 = 70,000
**Level 20 and up = previous level plus 8,000
**Level 20 and up = previous level plus 8,000
== Tools ==
<syntaxhighlight lang="python" enclose="div">
# (c) flatz
import sys, os, urllib2
import hashlib, hmac
from Crypto.Cipher import AES
def aes_encrypt_cbc(key, iv, input):
aes = AES.new(key, AES.MODE_CBC, iv)
output = aes.encrypt(input)
return output
def aes_decrypt_cbc(key, iv, input):
aes = AES.new(key, AES.MODE_CBC, iv)
output = aes.decrypt(input)
return output
def sha1_hmac(key, message):
return hmac.new(key, message, digestmod=hashlib.sha1).digest()
# paste a HMAC key from np_trophy_util.prx here... hint:
#  C3A3A0...
hmac_key =
'C3A3A0..........................................................................................................................'.decode('hex')
# paste an ERK from np_trophy_util.prx here... hint:
#  02499F...
keygen_erk = '02499F..........................'.decode('hex')
keygen_riv = '00000000000000000000000000000000'.decode('hex')
def build_url(np_comm_id, file_name, encrypted=False, env='np'):
np_comm_id_hash = sha1_hmac(hmac_key, np_comm_id).encode('hex').upper()
file_name_hash = sha1_hmac(hmac_key, '{0}/{1}'.format(np_comm_id, file_name)).encode('hex').upper()
file_extension = os.path.splitext(file_name)[1]
if encrypted:
file_extension_parts = file_extension.rpartition('.')
file_extension = file_extension_parts[1] + 'E' + file_extension_parts[2]
return 'http://trophy01.{0}.community.playstation.net/trophy/{0}/{1}_{2}/{3}{4}'.format(env, np_comm_id, np_comm_id_hash, file_name_hash, file_extension)
def fetch_file_data(np_comm_id, file_name, encrypted=False, env='np'):
file_url = build_url(np_comm_id, file_name, encrypted, env)
connection = urllib2.urlopen(file_url)
data = connection.read()
if encrypted:
data_erk = aes_encrypt_cbc(keygen_erk, keygen_riv, np_comm_id.ljust(16, '\x00'))
data_riv = data[:16]
data = aes_decrypt_cbc(data_erk, data_riv, data)[16:]
return data
icon0_png_url = build_url('NPWR03612_00', 'ICON0.PNG')
trop_sfm_url = build_url('NPWR03612_00', 'TROP.SFM', True)
trop000_png_url = build_url('NPWR03612_00', 'TROP000.PNG')
trop_sfm = fetch_file_data('NPWR03612_00', 'TROP.SFM', True)
print 'ICON0.PNG:', icon0_png_url
print 'TROP.SFM:', trop_sfm_url
print 'TROP000.PNG:', trop000_png_url
print trop_sfm
</syntaxhighlight>
== Unlock Trophys ==
* https://github.com/darkautism/PS3TrophyIsGood
* http://www.mediafire.com/download/4650ncmu8ud2wcl/PS3TrophyIsGood.zip
* https://www.youtube.com/watch?v=Z0e14M3v8OM
{{File Formats}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Trophy_files"