Remarry Bluray Drive on Linux
Jump to navigation
Jump to search
Introduction
- I was playing with HRL buffer of my BD drive on PS3 Slim and corrupted it.
- After that i couldn't play BD movies on GameOS, BD player returned an error.
- After i have written P-Block, S-Block and a new HRL, i could play my BD movies again :)
- Hope this guide can help someone too.
EID2
- You will need decrypted EID2 data.
- How to get it on Linux is described here: http://www.ps3devwiki.com/wiki/Spuisofs#Dumping_EID2_Key_with_spuisofs
- EID2 contains encrypted P-Block and S-Block.
- To get decrypted S-Block and P-Block first you have to decrypt EID2 with EID2 key and IV and then decrypt the blocks with DES-CBC.
P-Block and S-Block DES-CBC IV and key:
IV: 00 00 00 00 00 00 00 00 key: 6C CA B3 54 05 FA 56 2C
Tools
- ps3vuart-tools: http://www.ps3devwiki.com/wiki/Ps3vuart-tools
- bd_enable_buffer_write.c: http://www.multiupload.nl/0GD1CQV9UX
- bd_read_buffer.c: http://www.multiupload.nl/OQCDJLA1EM
- bd_write_buffer.c: http://www.multiupload.nl/AK5JSAK9N3
- You could also use my PS3 Debian LiveCD which has ps3vuart-tools preinstalled. It also has GCC compiler and you can compile all BD tools.
Writing P-Block
- P-Block is stored in BD buffer 2.
- BD buffer 2 is of size 0x60 bytes.
- P-Block is in decrypted EID2 at offset 0x20 and of size 0x80.
- Not all P-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x60 bytes is written to BD drive buffer 2.
Test
- Tested on my PS3 Slim with OtherOS++.
- After writing P-Block to BD drive buffer 2, authenticate the BD drive with ps3dm.
# First enable writing BD buffer 2 sudo ./bd_enable_buffer_write -b 2 # Write P-Block to BD buffer 2 sudo ./bd_write_buffer -b 2 -i pblock.bin # Authenticate the BD drive sudo ps3dm -v sm drive_auth 0x29 # It should not fail !!! ss status 0
Writing S-Block
- S-Block is stored in BD buffer 3.
- BD buffer 3 is of size 0x670 bytes.
- S-Block is in decryoted EID2 at offset 0xa0 and of size 0x690.
- Not all S-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x670 bytes is written to BD drive buffer 3.
Test
- Tested on my PS3 Slim with OtherOS++.
# First enable writing BD buffer 3 sudo ./bd_enable_buffer_write -b 3 # Write P-Block to BD buffer 3 sudo ./bd_write_buffer -b 3 -i sblock.bin
Writing New HRL to BD Drive
- HRL is stored in BD buffer 4.
- BD buffer 4 is of size 0x8000 bytes.
glevand@debian:~$ sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C 00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4| 00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb| 00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d| 00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...| 00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.<| 00000050 20 2d e2 97 00 00 00 00 00 00 00 00 00 00 00 00 | -..............| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008000
Test
- Tested on my PS3 Slim with OtherOS++.
- You cannot just write a new HRL to BD drive buffer 4. You can actually but it will corrupt your current BD HRL.
- If you corrupt your HRL then nothing bad will happen but you won't be able to play BD movies.
- First you have to send P-Block to BD drive, after that authenticate the BD drive and then write a new HRL. Only in this order will it work.
# First enable writing BD buffer 4 sudo ./bd_enable_buffer_write -b 4 # Write HRL to BD buffer 4 sudo ./bd_write_buffer -b 4 -i default_hrl.bin # Read back HRL sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C 00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4| 00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb| 00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d| 00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...| 00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.<| 00000050 20 2d e2 97 00 00 00 00 00 00 00 00 00 00 00 00 | -..............| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00008000