Remarry Bluray Drive on Linux

EID2

• You will new decrypted EID2 data.
• How to get it on Linux is described here: http://www.ps3devwiki.com/wiki/Spuisofs#Dumping_EID2_Key_with_spuisofs
• EID2 contains encrypted P-Block and S-Block.
• To get decrypted S-Block and P-Block first you have to decrypt EID2 with EID2 key and IV and then decrypt the blocks with DES-CBC.

P-Block and S-Block DES-CBC IV and key:

IV: 00 00 00 00 00 00 00 00
key: 6C CA B3 54 05 FA 56 2C

Writing P-Block

• P-Block is stored in BD buffer 2.
• BD buffer 2 is of size 0x60 bytes.
• P-Block is in decryoted EID2 at offset 0x20 and of size 0x80.
• Not all P-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x60 bytes is written to BD drive buffer 2.

Test

• Tested on my PS3 Slim with OtherOS++.
• After writing P-Block to BD drive buffer 2, authenticate the BD drive with ps3dm.

# First enable writing BD buffer 2

sudo ./bd_enable_buffer_write -b 2

# Write P-Block to BD buffer 2

sudo ./bd_write_buffer -b 2 -i pblock.bin

# Authenticate the BD drive

sudo ps3dm -v sm drive_auth 0x29                 # It should not fail !!!
ss status 0

Writing S-Block

• S-Block is stored in BD buffer 3.
• BD buffer 3 is of size 0x670 bytes.
• S-Block is in decryoted EID2 at offset 0xa0 and of size 0x690.

Writing New HRL to BD Drive

• HRL is stored in BD buffer 4.
• BD buffer 4 is of size 0x8000 bytes.

glevand@debian:~$ sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C
00000000  10 00 00 0c 00 03 10 03  00 00 00 01 21 00 00 34  |............!..4|
00000010  00 00 00 00 00 00 00 00  1b 0b f2 6d 47 9e 77 62  |...........mG.wb|
00000020  3d 91 fc 78 b1 59 c9 52  ca a4 c7 41 85 24 96 64  |=..x.Y.R...A.$.d|
00000030  8d 1d 95 8e 9b 84 c6 fa  4a dd 43 9b 42 98 fe ff  |........J.C.B...|
00000040  df e6 f3 56 85 81 e1 1b  27 53 08 14 16 6d 97 3c  |...V....'S...m.<|
00000050  20 2d e2 97 00 00 00 00  00 00 00 00 00 00 00 00  | -..............|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00008000