Talk:BD Drive Reverse Engineering

Getting keys the easier way

EID4

First you need to get the sv_iso_spu_module.self individuals seed that can be found in the metadata header:

3E C2 XX XX XX XX XX XX XX XX XX XX XX XX XX XX
04 29 XX XX XX XX XX XX XX XX XX XX XX XX XX XX
3D E0 XX XX XX XX XX XX XX XX XX XX XX XX XX XX
1B A3 XX XX XX XX XX XX XX XX XX XX XX XX XX XX

Using your console specific eid_root_key/iv (e.g. from metldr dump) and libeeid (insert the seed in keys.c) you can then decrypt EID4 directly by calling

u8 eid4[0x30] = {/* your EID4 */};
eid4_decrypt_buffer(eid4);

Now you got the two keys you need in eid4+0x00 and eid4+0x10 :)

EID2

First you need to get the fdm_spu_module.self individuals seed that can be found in the metadata header:

74 92 XX XX XX XX XX XX XX XX XX XX XX XX XX XX
66 83 XX XX XX XX XX XX XX XX XX XX XX XX XX XX
BC 1A XX XX XX XX XX XX XX XX XX XX XX XX XX XX
09 57 XX XX XX XX XX XX XX XX XX XX XX XX XX XX

Using your console specific eid_root_key/iv (e.g. from metldr dump) and libeeid (insert the seed, key and IV in keys.c) you can then decrypt EID2 directly by calling

u8 eid2[0x730] = {/* your EID2 */};
p_block = eid2_generate_block_buffer(p_block_enc, EID2_BLOCKTYPE_P);
s_block = eid2_generate_block_buffer(s_block_enc, EID2_BLOCKTYPE_S);
eid2_decrypt_block(p_block + 0x10, 0x60);
eid2_decrypt_block(s_block + 0x10, 0x670);