NPDRM

The info on this page is an extract of talk page, conversations and forum posts, please digest the info and move it this page

Once the vsh detects that user is trying to start a SELF, it looks for the appinfo header type. If the type is 8, then the control digest element type 3 (NPD element) is located. From this NPD header the vsh gets the License Types (network license, local or free).

• Network License (type 01): if a remote paid content is to be loaded, the vsh loads the act.dat and the rif associated to the content (will download to vsh process memory)

• Local (type 02): it will locate a file with the same titleid on NPD element (CONTENT_ID), then the signature is checked (last 0x28 bytes of both RIF and act.dat).

• Free (type 03): if a free content (03) is detected then a generic klicense will be use for further steps (go to LV2).

Using the RIF_KEY it will obtain the actdatIndex, and finally having the actDat key index the execution pass to LV2 syscall 471.

act.dat header(encrypted) structure

Name	Offset	Size	Example	Remark
Version Number	0x0	0x4	00000001
License Type	0x4	0x4	00000001
User Number	0x8	0x8	N.A
KeyTable Retail	0x10	0x800	N.A
KeyTable Debug?	0x810	0x800	N.A
Signature	0x1010	0x28	N.A

rif header(encrypted) structure

Name	Offset	Size	Example	Remark
Version Number	0x0	0x4	00 00 00 01
License Type	0x4	0x4	00 01 00 02
User Number	0x8	0x8	00 00 00 00 00 00 00 02	Used on Rap2Rif header
CONTENT ID	0x10	0x30	N.A	Content ID
Random Padding	0x40	0xC	N.A
act.dat index key	0x4C	0x4	N.A
encrypted klic	0x50	0x10	N.A
bought on/ start	0x60	0x8	00 00 01 2F 41 5C 00 00	For human readable, convert to decimal and use one Epoch-Unix converter time format online.
expires in	0x68	0x8	00 00 00 00 00 00 00 00	If zeroed,-, there is no time limit. Used on PS+ for example.
Signature	0x70	0x28	11	Patched on some cfw. See Rif_Junk on Rap2Rif by Flatz

• Rap2Rif source code by Flatz

• Rap2Rif Key souce code by Flatz

• Link download & usage