Remarry Bluray Drive on Linux: Difference between revisions
Jump to navigation
Jump to search
(→Test) |
(→Test) |
||
| Line 70: | Line 70: | ||
* Tested on my PS3 Slim with OtherOS++. | * Tested on my PS3 Slim with OtherOS++. | ||
* You cannot just write a new HRL to BD drive buffer 4.You can actually but it will corrupt your current BD HRL. | * You cannot just write a new HRL to BD drive buffer 4. You can actually but it will corrupt your current BD HRL. | ||
If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies. | * If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies. | ||
First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. | * First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. Only in this order will it work. | ||
Only in this order will it work. | |||
<pre> | <pre> | ||
Revision as of 16:37, 25 August 2012
Introduction
EID2
- You will new decrypted EID2 data.
- How to get it on Linux is described here: http://www.ps3devwiki.com/wiki/Spuisofs#Dumping_EID2_Key_with_spuisofs
- EID2 contains encrypted P-Block and S-Block.
- To get decrypted S-Block and P-Block first you have to decrypt EID2 with EID2 key and IV and then decrypt the blocks with DES-CBC.
P-Block and S-Block DES-CBC IV and key:
IV: 00 00 00 00 00 00 00 00 key: 6C CA B3 54 05 FA 56 2C
Writing P-Block
- P-Block is stored in BD buffer 2.
- BD buffer 2 is of size 0x60 bytes.
- P-Block is in decryoted EID2 at offset 0x20 and of size 0x80.
- Not all P-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x60 bytes is written to BD drive buffer 2.
Test
- Tested on my PS3 Slim with OtherOS++.
- After writing P-Block to BD drive buffer 2, authenticate the BD drive with ps3dm.
# First enable writing BD buffer 2 sudo ./bd_enable_buffer_write -b 2 # Write P-Block to BD buffer 2 sudo ./bd_write_buffer -b 2 -i pblock.bin # Authenticate the BD drive sudo ps3dm -v sm drive_auth 0x29 # It should not fail !!! ss status 0
Writing S-Block
- S-Block is stored in BD buffer 3.
- BD buffer 3 is of size 0x670 bytes.
- S-Block is in decryoted EID2 at offset 0xa0 and of size 0x690.
Writing New HRL to BD Drive
- HRL is stored in BD buffer 4.
- BD buffer 4 is of size 0x8000 bytes.
glevand@debian:~$ sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C 00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4| 00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb| 00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d| 00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...| 00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.<| 00000050 20 2d e2 97 00 00 00 00 00 00 00 00 00 00 00 00 | -..............| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008000
Test
- Tested on my PS3 Slim with OtherOS++.
- You cannot just write a new HRL to BD drive buffer 4. You can actually but it will corrupt your current BD HRL.
- If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies.
- First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. Only in this order will it work.
# First enable writing BD buffer 4 sudo ./bd_enable_buffer_write -b 4 # Write HRL to BD buffer 4 sudo ./bd_write_buffer -b 4 -i default_hrl.bin # Read back HRL sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C 00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4| 00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb| 00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d| 00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...| 00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.<| 00000050 20 2d e2 97 00 00 00 00 00 00 00 00 00 00 00 00 | -..............| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008000