Bluray disc

Overview

• UDF filesystem (a profile of ECMA-167) in cleartext
• File entries are not encrypted, some files are not encrypted
• Some regions of the disc are encrypted (sector by sector)
• One sector is 2048 bytes

Encryption

The first sector of the disc tells which parts of the disc are unencrypted and which one are encoded.

For example, this is the beginning of "The Last of Us" disc:

00000000: 0000 0003 0000 0000 0000 0000 0000 099f  ................
00000010: 00a2 6160 00ba 73ff 011d dda0 011f ddbf  ..a`..s.........
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................

• 0x00000003 is the number of unencrypted regions
• The first unencrypted region is from sector 0x00000000 to sector 0x0000099f
• The first encrypted region is from sector 0x0000099f to sector 0x00a26160
• The second unencrypted region is from sector 0x00a26160 to sector 0x00ba73ff
• The second encrypted region is from sector 0x00ba73ff to sector 0x011ddda0
• The third unencrypted region is from sector 0x011ddda0 to sector 0x011fddbf
• 0x011fddbf sectors is 38636746752 bytes whereas the file is 38636748800 bytes : the last sector is not included for some reason.

Deriving the disc key

The disc key is obtained by encrypting "data1" with AES CBC:

• with the secret 0x380bcf0b53455b3c7817ab4fa3ba90ed
• with the IV 0x69474772af6fdab342743aefaa186287
• no padding
• data1 is available in the IRD file
• it can be found on the disc with a bunch of SCSI commands.

Sector encryption

Each sector is encrypted with AES CBC:

• using the disc key
• no padding

The IV is derived from the sector number with:

int num = sectorNumber;
byte[] iv = new byte[16];
for (int j = 0; j < 16; j++)
{
	iv[16 - j - 1] = (byte)(num & 0xFF);
	num >>= 8;
}

File system layout

• PS3_DISC.SFB
• PS3_GAME/ICON0.PNG
• PS3_GAME/LICDIR/LIC.DAT
• PS3_GAME/PARAM.SFO
• PS3_GAME/PIC1.PNG
• PS3_GAME/PS3LOGO.DAT
• PS3_GAME/SND0.AT3
• PS3_GAME/TROPDIR/
• PS3_GAME/USRDIR/build/
• PS3_GAME/USRDIR/data/
• PS3_GAME/USRDIR/EBOOT.BIN
• PS3_UPDATE/PS3UPDAT.PUP

PS3 Disc Game Structure

Disc Path					XMB icon	SFB/SFO/SFX Mandatory Parameters						Since	Enabled by
						APP_VER	ATTRIBUTE	BOOTABLE	CATEGORY	TITLE	TITLE_ID
dev_bdvd/	PS3_DISC.SFB										Yes	1.00	Enables others with HYBRID_FLAG
	PS3_GAME/	PARAM.SFO				Opt	Opt	Opt	DG	Yes	Yes	1.00	HYBRID_FLAG (g) in PS3_DISC.FSB
		USRDIR/	EBOOT.BIN									1.00	BOOTABLE (1) in parent PARAM.SFO
		INSDIR/	PARAM.SFO		No?	Yes	No	No	AR	No	No	?	HYBRID_FLAG (g) in PS3_DISC.FSB ?
			DATA000.PKG (up to 999)									?
		PKGDIR/	PARAM.SFO			No	Yes	No	DP	Yes	Yes	1.00 ?	ATTRIBUTE (131072) in parent PARAM.SFO
			PKG01/ (up to 99)	PARAM.SFO		No	No	No	IP	Yes	Yes	1.00 ?	ATTRIBUTE (1) in parent PARAM.SFO
				INSTALL.PKG								1.00 ?
		LICDIR/	LIC.DAT									1.00
		TROPDIR/	<NPCOMMID>/	TROPHY.TRP								2.40
	PS3_GM01/ (up to 99?)	PARAM.SFO				Opt	Opt	Opt	DG	Yes	Yes	4.00+ ?	HYBRID_FLAG (g) in PS3_DISC.FSB
		USRDIR/	EBOOT.BIN									4.00+ ?	BOOTABLE (1) in parent PARAM.SFO
		LICDIR/	LIC.DAT									4.00+ ?	dev_bdvd/PS3_GAME/LICDIR/LIC.DAT
	PS3_CONTENT/	THEMEDIR/	PARAM.SFO			No	Yes	No	TR	Yes	No ?	2.00+	HYBRID_FLAG (T) in PS3_DISC.FSB
			D001/	DATA001.P3T (up to 999)								2.00+	ATTRIBUTE (1) in parent PARAM.SFO
		VIDEODIR/	PARAM.SFO			No	Yes	No	VR	Yes	No ?	?	HYBRID_FLAG (V) in PS3_DISC.FSB
			D001/ (up to 999)	PARAM.SFO	?	No	No	No	VI	Yes	No	?	ATTRIBUTE (1) in parent PARAM.SFO
				DATA000.MP4								?
	PS3_EXTRA/	PARAM.SFO				No	Yes	No	XR	Yes	Yes	3.41-	HYBRID_FLAG (g) in PS3_DISC.FSB ?
		D001/ (up to 999)	PARAM.SFX			No	No	No	IP	Yes	No	3.41-	ATTRIBUTE (1) in parent PARAM.SFO
			DATA000.PKG									3.41-
		D002/ (up to 999)	PARAM.SFX			No	No	No	TI	Yes	No	3.41-	ATTRIBUTE (1) in parent PARAM.SFO
			DATA000.P3T									3.41-
		D003/ (up to 999)	PARAM.SFX			No	No	No	VI	Yes	No	3.41-	ATTRIBUTE (1) in parent PARAM.SFO
			DATA000.MP4									3.41-
	PS3_VPRM/	PARAM.SFO				No	No	No	DM	No	No	?	HYBRID_FLAG (v) in PS3_DISC.FSB
	PS3_UPDATE/	PS3UPDAT.PUP										1.00 ?	HYBRID_FLAG (u) in PS3_DISC.FSB

See also Content Information Files

Extra "tracks"

Blu-ray Disc Information

See http://www.t10.org/ftp/t10/document.04/04-328r0.pdf#page=43:

A DI unit is 112 bytes in PIC on a BD-RE disc. The DI unit that contains physical information shall

be returned. The information for layer 0 shall be returned when the Layer field of the CDB is set to zero. The information for layer 1 shall be returned when the Layer field of the CDB is set to 1. See System Description Blu-ray Disc Rewritable Format, Part 1 Basic Format Specifications for

DI unit detailed definition.

AFAIU, the description of its content is in a spec under NDA.

Exemple from "The Last Of Us":

00000000: 1002 0000 4449 0110 0000 2000 4244 4f01  ....DI.... .BDO.
00000010: 2101 0300 0000 0000 019a f5bf 0010 0000  !...............
00000020: 00ca 73fe 0000 0000 0000 0000 0000 0000  ..s.............
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 4449 0111 0001 2000 4244 4f01  ....DI.... .BDO.
00000050: 2101 0300 0000 0000 019a f5bf 0135 8c00  !............5..
00000060: 01ef fffe 0000 0000 0000 0000 0000 0000  ................

It can be read with the READ DISC STRUCTURE SCSI command.

Reading it (in C on Linux):

#define PIC_SIZE 112

  unsigned char read_pic_command[12] = {
    173, // Operation Code=READ_DISC_STRUCTURE
    1,   // Reserved=0, MediaType=1 (BD)
    0,
    0,
    0,
    0,
    0,
    0, // FormatCode=0 (Disc Information)
    pic_size / 256,
    pic_size % 256,
    0,
    0
  };

  int drive = open(drive_filename, 0, O_RDONLY);
  if (drive == -1) {
    fputs("Can't open file\n", stderr);
    return 1;
  }

  unsigned char sense_data[12];

  // Actually there is a lot more than that:
  unsigned char* pic = malloc(pic_size);
  memset(pic, 0, pic_size);

  struct sg_io_hdr header;
  memset(&header, 0, sizeof(header));
  header.interface_id = 'S'; // SCSI
  header.dxfer_direction = SG_DXFER_FROM_DEV;
  header.cmd_len = sizeof(read_pic_command);
  header.mx_sb_len = sizeof(sense_data);
  header.iovec_count = 0;
  header.dxfer_len = pic_size;
  header.dxferp = pic;
  header.cmdp = (unsigned char*) read_pic_command;
  header.sbp = sense_data;
  header.timeout = 60 * 1000;
  header.flags = 0;
  header.pack_id = 0;
  header.usr_ptr = NULL;
  header.status = 0;
  header.msg_status = 0;
  header.sb_len_wr = 0;
  header.host_status = 0;
  header.driver_status = 0;
  header.resid = 0;
  header.duration = 0;
  header.info = 0;

  if (ioctl(drive, SG_IO, &header) < 0) {
    fputs("ioctl failed\n", stderr);
    return 1;
  }

  if ((header.info & SG_INFO_OK_MASK) != SG_INFO_OK) {
    fputs("SCSI failed\n", stderr);
    return 1;
  }

"Data1" and "Data2"

Read after authentication with some undocumented SCSI commands. Not sure if those are PS3-specific SCSI commands.

IRD file

3k3y generates IRD files which contains some information about the disc. In particular, it contains "data1" which is used to derived the disc AES encryption key.

The file is:

• either uncompressed (magic string "3IRD");
• or gzipped (gzip magic string 0x1f8b) with a (4 bytes) CRC afterwards.

The format is based on .NET BinaryReader/BinaryWriter:

• Integer are in little endian format:
• Variable length strings use a compressed length prefix.

Compressed data are compressed with gzipped and prefixed with a length (uint32).

The format is (v6 to v9):

Size	Format	Description	Example	Versions
4B	string	Magic string ("3IRD")	3IRD
1B	uint	Version	6, 7, 8, 9
9B	string	Game ID	BCES01584
var	string	Game name	The Last Of Us
4B	string	Update version	4.41
5B	string	Game version	4.41
5B	string	App version	01.00
4B	uint	ID		v=7
var	compressed	Header
var	compressed	Footer
1B	uint	Region count
16B	bytes	Region 1 hash
…	…	…	…	…
4B	uint	File count
8B	uint	File 1 key
16B	bytes	File 1 hash
…	…	…	…	…
115B	bytes	PIC		v=9
16B	bytes	Data 1
16B	bytes	Data 2
115B	bytes	PIC		v<9
2B	uint/bytes	UID

References

• 3k3y IsoTools, this is a .NET program available in binary form. The ILspy decompiler produces a very readable output.
• PS3 ISO Patcher by BlackDaemon, is a .NET program available in source code