Activation ACF
ACF, certainly standing for Activation Code File, is a data structure present in the Serial Flash Non Volatile Storage of a PS4 Dev/Test Kit or prototype when it is activated.
On PS Vita, compared to PS4, it is named "act" instead of "acf" and is stored in Syscon NVS instead of Serial Flash NVS. On PS5, Kit activation requires a Communication Processor Box and so may be contained in the PS5 CP Box NVS.
See also PS Vita Activation AFV especially its token and PS Vita Syscon NVS Activation Data.
The PS4 ACF is completed by a RSA-2048 signature stored as well in the Serial Flash NVS.
The PS4 ACF is checked in the sceSblDevActVerifyCheckExpire kernel function.
Structure[edit | edit source]
Total length is 0x68 bytes. It may also be 0x6C bytes for some PS4 consoles, according to zecoxao.
It is written to a 0x80-byte area in Serial Flash Non Volatile Storage bank 0 block 4 offset 0x80.
| Offset | Size | Description |
|---|---|---|
| 0 | 4 | Magic. Always "acf\0" on PS4, "act\0" on PS Vita. |
| 4 | 1 | Format Version. Always 1 on PS4 and PS Vita. |
| 5 | 1 | Format Minor Version. Always 2 on PS4, 0 on PS Vita. |
| 6 | 2 | Reserved. Padding. Always zeroed on PS4 and PS Vita. |
| 8 | 0x10 | Activation Key. Likely derived from OpenPsId. |
| 0x18 | 4 | Issue Number. Ex: 3, 15. |
| 0x1C | 4 | Start Date. Little Endian. |
| 0x20 | 4 | End Date. Little Endian. Usually 90 days after Start Date. |
| 0x24 | 4 | Reserved. Always zeroed. |
| 0x28 | 0x40 | Key Hash. Unique hash of previous data (maybe AES-CMAC (0x20 key + 0x20 hash) or HMAC). On PS Vita it is a 16-byte AES-128-CMAC hash. |
typedef struct SceAcf {
char magic[4];
uint8_t format_ver;
uint8_t format_minor_ver;
uint16_t reserved;
char activation_key[16];
uint32_t issue_no;
uint32_t start_date;
uint32_t end_date;
uint32_t reserved;
char key_hash[64];
} SceAcf;
RSA-2048 Signature[edit | edit source]
A RSA-2048 signature of the ACF is present in Serial Flash NVS bank 0 block 4 offset 0x900.
On PS Vita, the RSA-2048 signature is only present since System Software version 2.10 and is stored in the eMMC in the tm0:act/actsig.dat file instead of the NVS.
Example[edit | edit source]
- Magic bytes: red.
- Constant bytes: blue.
- Unique bytes: green.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 001C9080 61 63 66 00 01 02 00 00 D6 B1 DA DE C7 82 7A A4 acf.....Ö±ÚÞÇ‚z¤ 001C9090 21 AE 4E D0 D9 BF B1 1A 03 00 00 00 11 55 E2 52 !®NÐÙ¿±......UâR 001C90A0 11 FC 58 53 00 00 00 00 CC B4 CD 3A 0A F5 C0 F4 .üXS....Ì´Í:.õÀô 001C90B0 4F 04 6B C3 95 16 E6 D8 FB 0B F2 56 B0 3B BA 00 O.kÕ.æØû.òV°;º. 001C90C0 26 B0 D3 BA 55 5F B0 40 0F 54 34 22 E1 E4 DA A7 &°ÓºU_°@.T4"áäÚ§ 001C90D0 D1 7D EE BC EF 03 3C 23 37 EE 10 EB F6 88 1B 85 Ñ}î¼ï.<#7î.ëöˆ.… 001C90E0 35 8F 4B F5 D5 1A C7 3D 5.KõÕ.Ç=