NPDRM: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
(16 intermediate revisions by 5 users not shown)
Line 1: Line 1:
[[Category:Software]]{{Wikify}}
{{Wikify}}


'''The info on this page is an extract (and simplify) of talk page, conversations and forum posts, please digest the info and move it this page'''
'''The info on this page is an extract (and simplify) of talk page, conversations and forum posts, please digest the info and move it to this page'''


See also [https://wiki.henkaku.xyz/vita/SceNpDrm].


Once the user is trying to start a [[SELF File Format and Decryption|SELF]], the [[VSH|vsh]] looks for the [[SELF_File_Format_and_Decryption#App_Info|appinfo header type]]; if the [[SELF_Types|type is 8]], then the [[SELF_File_Format_and_Decryption#Control_Information|control digest element type 3]] (NPD element) is located. From this NPD header the vsh gets the [[License Types]] (network license, local or free).
= PS3 NPDRM SELF - SPRX decryption steps =


*'''Type 1''' (Network License): if a remote paid content is to be loaded, the vsh loads the act.dat and the rif associated to the content (will download to vsh process memory).
Once the user is trying to start a [[SELF File Format and Decryption|SELF]], the [[VSH|vsh]] looks for the [[SELF_File_Format_and_Decryption#Program_Identification_Header|Program Identification Header]]. If the [[Program Type]] is NPDRM, then the [[SELF_File_Format_and_Decryption#Supplemental_Header_Table|NPDRM info]] is located. From this NPD header the vsh gets the [[NPDRM_Selfs#License_Type]].


*'''Type 2''' (Local): For this paid content too, the vsh locate a file with the same title id on NPD element (CONTENT_ID), then the signature is checked (last 0x28 bytes of both RIF and act.dat).
If a Network Licensed content is to be loaded, the vsh loads the act.dat and the .rif associated to the content (will download .rif to vsh process memory).


*'''Type 3''' (Free): if a free content (no license check: no need for rif/act.dat) is detected then a [[Keys#klic_free_key|generic klicense]] will be use for further steps (go to LV2).  
For Local License content too, the vsh locates a file with the same CONTENT ID than in NPDRM header, then the signatures are checked (last 0x28 bytes of both RIF and act.dat).


Using the RIF_KEY with the [[Keys#RIF.27s_act.dat_index_decryption_key|act.dat index decryption key]],  it will obtain the actdatIndex, and finally having the actDat key index, the execution pass to [[LV2_Functions_and_Syscalls#LV2_Syscalls|LV2 Syscalls 471.]]
If a Free content (no license check: no need for .rif/act.dat) is detected then a [[Keys#klic_free_key|generic klicense]] will be use for further steps (go to LV2).


This function has different parameters depending if the content is debug, paid (type 1 & 2) or free (type 3):
Using the RIF_KEY with the [[Keys#RIF.27s_act.dat_index_decryption_key|act.dat index decryption key]], it will obtain the actdatIndex, then the execution passes to [[LV2_Functions_and_Syscalls#LV2_Syscalls|LV2 Syscalls 471]].
 
This function has different parameters depending of the License Type:


<div style="width:600px; overflow:auto">
<div style="width:600px; overflow:auto">
Line 23: Line 26:


The lv2 keeps a memory table with contentID and the associated key:
The lv2 keeps a memory table with contentID and the associated key:
*Paid content: the rif.key is converted to the klicensee (by using a [[Keys#klicensee_constant|constant value on lv2]], [[IDPS|IDPS]] and the act.dat) and once transformed it is stored on memory table.
*Licensed content: the encrypted klicensee is converted to the klicensee (by using a [[Keys#klicensee_constant|constant value on lv2]], [[IDPS|IDPS]] and the act.dat) and once transformed it is stored in memory table.
*free content: copies the titleID and the generic klicensee to the table.
*Free content: copies the titleID and the generic klicensee to the table.
 
 
From there, the lv1 hypervisor by loading [[Hypervisor_Reverse_Engineering#appldr|Appldr]], will transform (again) this key by using the [[Keys#klic_dec_key|klic_dec_key]] and finally remove the NPDRM layer for start the [[SELF File Format and Decryption|SELF]] decryption.


==act.dat header(encrypted) structure==
From there, the lv1 hypervisor by loading [[Hypervisor_Reverse_Engineering#appldr|Appldr]], will transform (again) this key by using the [[Keys#klic_dec_key|klic_dec_key]] and finally remove the NPDRM layer to start the [[SELF - SPRX]] decryption.


{| class="wikitable sortable"
See also:
|-
*http://wololo.net/talk/viewtopic.php?f=67&t=40656 Tutorial: How to find dev klicensee by '''Mysis'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Name'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Offset'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Size'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Example'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Remark'''
|-
| Version Number || 0x0 || 0x4 || 00000001 ||
|-
| License Type || 0x4 || 0x4 || 00000001 ||
|-
| User Number || 0x8 || 0x8 || N.A ||
|-
| KeyTable Retail || 0x10 || 0x800 || N.A ||
|-
| KeyTable Debug? || 0x810 || 0x800 || N.A ||
|-
| Signature || 0x1010 || 0x28 || N.A ||
|-
|}


= PS3 NPDRM EDAT decryption steps =


==rif file(encrypted) structure==
To document.


The rif holds the klicensee for both SELF and paid [[EDAT_files|EDAT]].
= License Type =


{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
| style="background-color:#123EDA; color:#FFFFFF;" |'''Name'''
! Value !! Type !! Remarks
| style="background-color:#123EDA; color:#FFFFFF;" |'''Offset'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Size'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Example'''
| style="background-color:#123EDA; color:#FFFFFF;" |'''Remark'''
|-
| Version Number || 0x0 || 0x4 || 00 00 00 01 ||
|-
| License Type || 0x4 || 0x4 || 00 01 00 02 ||
|-
| User Number || 0x8 || 0x8 || 00 00 00 00 00 00 00 02 || Used on Rap2Rif header
|-
|-
| [[PARAM.SFO#CONTENT_ID|CONTENT ID]] || 0x10 || 0x30 || N.A || Content ID
| 0 || Debug || SDAT
|-
|-
| Random Padding || 0x40 || 0xC || N.A ||
| 1 || Network License || It requires network authentication every time the content is launched. [http://en.wikipedia.org/wiki/PlayStation_Network_outage#Inability_to_use_PlayStation_3_content See inability example].
|-
|-
| act.dat index key || 0x4C || 0x4 || N.A ||
| 2 || Local License || It requires first time activation online (paid content but also demo & free of charge content).
|-
|-
| encrypted klic || 0x50 || 0x10 || N.A  ||
| 3 || Free || It does not require any license file nor console activation (act.dat).
|-
| bought on/ start || 0x60 || 0x8 || 00 00 01 2F 41 5C 00 00 || For human readable, convert to decimal and use one [http://www.epochconverter.com/ Epoch-Unix converter] time format online.
|-
| expires in || 0x68 || 0x8 || 00 00 00 00 00 00 00 00 || If zeroed,-, there is no time limit. Used on PS+ for example.
|-
| Signature || 0x70 || 0x28 || 11 || [[Patches#reActPSN|Patched]] in some CFW to allow unsigned. See Rif_Junk on Rap2Rif by '''Flatz'''
|-
|}
|}
= Tools =


*[http://pastie.org/private/yltlfwubsz8w5pyhmojyfg '''Rap2Rif''' source code by '''Flatz''' ]
*[http://pastie.org/private/yltlfwubsz8w5pyhmojyfg '''Rap2Rif''' source code by '''Flatz''' ]
Line 93: Line 60:


*[[Dev_Tools#ReactPSN_.rap_-.3E_.rif_converter|Link download & usage]]
*[[Dev_Tools#ReactPSN_.rap_-.3E_.rif_converter|Link download & usage]]
*[http://www.emunewz.net/forum/showthread.php?tid=8134 another reference]
{{File Formats}}<noinclude>[[Category:Main]]</noinclude>

Revision as of 03:26, 26 December 2019

This article is marked for rewrite/restructuring in proper wiki format.
You can help PS3 Developer wiki by editing it.

The info on this page is an extract (and simplify) of talk page, conversations and forum posts, please digest the info and move it to this page

See also [1].

PS3 NPDRM SELF - SPRX decryption steps

Once the user is trying to start a SELF, the vsh looks for the Program Identification Header. If the Program Type is NPDRM, then the NPDRM info is located. From this NPD header the vsh gets the NPDRM_Selfs#License_Type.

If a Network Licensed content is to be loaded, the vsh loads the act.dat and the .rif associated to the content (will download .rif to vsh process memory).

For Local License content too, the vsh locates a file with the same CONTENT ID than in NPDRM header, then the signatures are checked (last 0x28 bytes of both RIF and act.dat).

If a Free content (no license check: no need for .rif/act.dat) is detected then a generic klicense will be use for further steps (go to LV2).

Using the RIF_KEY with the act.dat index decryption key, it will obtain the actdatIndex, then the execution passes to LV2 Syscalls 471.

This function has different parameters depending of the License Type: 

PAID: syscall471(npd.type, &npd.titleID, NULL, &actdat.keyTable[rif.actDatIndex], &rif.key, npd.license, &npd);
FREE: syscall471(npd.type, &npd.titleID, freeklicensee, NULL, NULL, npd.license, &npd);
*PAID can also include free games/apps too but require this licensing check

The lv2 keeps a memory table with contentID and the associated key:

  • Licensed content: the encrypted klicensee is converted to the klicensee (by using a constant value on lv2, IDPS and the act.dat) and once transformed it is stored in memory table.
  • Free content: copies the titleID and the generic klicensee to the table.

From there, the lv1 hypervisor by loading Appldr, will transform (again) this key by using the klic_dec_key and finally remove the NPDRM layer to start the SELF - SPRX decryption.

See also:

PS3 NPDRM EDAT decryption steps

To document.

License Type

Value Type Remarks
0 Debug SDAT
1 Network License It requires network authentication every time the content is launched. See inability example.
2 Local License It requires first time activation online (paid content but also demo & free of charge content).
3 Free It does not require any license file nor console activation (act.dat).

Tools


SCE File Types
Certified File
NPDRM
NPDRM · App Types · ACT.DAT · RIF
PKG
EDAT
RCOXML
CXML
XMBML
XMB Config
DB Config
Databases
System Data
XMB Preload
Licences
 ·
Games/Apps
PS3
Emulators
Web
Unsorted
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=NPDRM&oldid=55161"