Editing Activation ACF

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
ACF, certainly standing for Activation Code File, is a data structure present in the [[Serial Flash]] [[Non Volatile Storage]] of a PS4 Dev/Test Kit or prototype when it is activated.
Found in the System Flash on offset [http://www.psdevwiki.com/ps4/Flash-Main#0x1C9080_ACF_.28Dev.2FTest.29 0x1C9080] and only present on Dev / Test Dumps.


On PS Vita, compared to PS4, it is named "act" instead of "acf" and is stored in Syscon NVS instead of Serial Flash NVS. On PS5, Kit activation requires a [https://www.psdevwiki.com/ps5/CP_Box Communication Processor Box] and so may be contained in the [https://www.psdevwiki.com/ps5/CP_Box_Non_Volatile_Storage PS5 CP Box NVS].
Total length = 0x68 ~= 104 bytes.


See also [https://wiki.henkaku.xyz/vita/AFV PS Vita Activation AFV especially its token] and [https://wiki.henkaku.xyz/vita/Ernie#NVS PS Vita Syscon NVS Activation Data].
There is a structure in it. It hase a Magic of 4 bytes, then there are constant 4 bytes following by unique changing 16 bytes. Then again constant 4 bytes following by unique 8 bytes and a third time, constant 4 bytes following by unique 64 bytes.


The PS4 ACF is completed by a RSA-2048 signature stored as well in the [[Serial Flash]] [[NVS]].
Structure and constant bytes are for every Dev / Test the same. Example:


The PS4 ACF is checked in the sceSblDevActVerifyCheckExpire kernel function.
Magic Bytes == Red.


= Structure =
Constant Bytes == Blue.


Total length is 0x68 bytes. It may also be 0x6C bytes for some PS4 consoles, according to zecoxao.
Unique Bytes == Green.


It is written to a 0x80-byte area in [[Serial Flash]] [[Non Volatile Storage]] bank 0 block 4 offset 0x80.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
001C9080  <span style="background:#ff6666;">61 63 66 00</span> <span style="background:#8888ff;">01 02 00 00</span> <span style="background:#00ff00;">D6 B1 DA DE C7 82 7A A4</span> acf.....Ö±ÚÞÇ‚z¤
001C9090  <span style="background:#00ff00;">21 AE 4E D0 D9 BF B1 1A</span> <span style="background:#8888ff;">03 00 00 00</span> <span style="background:#00ff00;">11 55 E2 52</span> !®NÐÙ¿±......UâR
001C90A0  <span style="background:#00ff00;">11 FC 58 53</span> <span style="background:#8888ff;">00 00 00 00</span> <span style="background:#00ff00;">CC B4 CD 3A 0A F5 C0 F4</span> .üXS....Ì´Í:.õÀô
001C90B0  <span style="background:#00ff00;">4F 04 6B C3 95 16 E6 D8 FB 0B F2 56 B0 3B BA 00</span> O.kÕ.æØû.òV°;º.
001C90C0  <span style="background:#00ff00;">26 B0 D3 BA 55 5F B0 40 0F 54 34 22 E1 E4 DA A7</span> &°ÓºU_°@.T4"áäÚ§
001C90D0  <span style="background:#00ff00;">D1 7D EE BC EF 03 3C 23 37 EE 10 EB F6 88 1B 85</span> Ñ}î¼ï.<#7î.ëöˆ.…
001C90E0  <span style="background:#00ff00;">35 8F 4B F5 D5 1A C7 3D</span>                        5.KõÕ.Ç=


== Struct ==
{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! From !! To !! Description
|-
|-
| 0 || 4 || '''Magic'''. Always "acf\0" on PS4, "act\0" on PS Vita.
| 1C9080 || 1C9083 || '''MAGIC''' acf
|-
|-
| 4 || 1 || '''Format Version'''. Always 1 on PS4 and PS Vita.
| 1C9084 || 1C9087 || '''Constant1''' Constant 4 bytes always the same.
|-
|-
| 5 || 1 || '''Format Minor Version'''. Always 2 on PS4, 0 on PS Vita.
| 1C9088 || 1C9097 || '''Unique1''' Unique 16 bytes.
|-
|-
| 6 || 2 || '''Reserved'''. Padding. Always zeroed on PS4 and PS Vita.
| 1C9098 || 1C909B || '''Constant2''' Constant 4 bytes always the same.
|-
|-
| 8 || 0x10 || '''Activation Key'''. Likely derived from OpenPsId.
| 1C909C || 1C90A3 || '''Unique2''' Unique 8 bytes.
|-
|-
| 0x18 || 4 || '''Issue Number'''. Ex: 3, 15.
| 1C90A4 || 1C90A7 || '''Const3''' Constant 4 bytes always the same.
|-
|-
| 0x1C || 4 || '''Start Date'''. Little Endian.
| 1C90A8 || 1C90E7 || '''Unique3''' Unique 64 bytes.
|-
|-
| 0x20 || 4 || '''End Date'''. Little Endian. Usually 90 days after Start Date.
|-
| 0x24 || 4 || '''Reserved'''. Always zeroed.
|-
| 0x28 || 0x40 || '''Key Hash'''. Unique hash of previous data (maybe AES-CMAC (0x20 key + 0x20 hash) or HMAC). On PS Vita it is a 16-byte AES-128-CMAC hash.
|}
|}


<syntaxhighlight lang="C">
typedef struct SceAcf {
    char magic[4];
    uint8_t format_ver;
    uint8_t format_minor_ver;
    uint16_t reserved;
    char activation_key[16];
    uint32_t issue_no;
    uint32_t start_date;
    uint32_t end_date;
    uint32_t reserved;
    char key_hash[64];
} SceAcf;
</syntaxhighlight>


= RSA-2048 Signature =
<source lang="c">
typedef struct ACF {
    const unsigned char MAGIC;
    const int32 CONST1;
    unsigned char BYTE16;
    const int32 CONST2;
    unsigned char BYTE8;
    const int32 CONST3;
    unsigned char BYTE64;
} ACF;
</source>


A RSA-2048 signature of the ACF is present in [[Serial Flash]] [[NVS]] bank 0 block 4 offset 0x900.


On PS Vita, the RSA-2048 signature is only present since System Software version 2.10 and is stored in the eMMC in the tm0:act/actsig.dat file instead of the NVS.
<source lang="csharp">
 
  protected internal struct ACF {
= Example =
    internal static byte[] MAGIC = new byte[4];
 
    internal static int CONST1;
* Magic bytes: red.
    internal static byte[] BYTE16 = new byte[16];
* Constant bytes: blue.
    internal static int CONST2;
* Unique bytes: green.
    internal static byte[] BYTE8 = new byte[8];
 
    internal static int CONST3;
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    internal static byte[] BYTE64 = new byte[64];
001C9080  <span style="background:#ff6666;">61 63 66 00</span> <span style="background:#8888ff;">01 02 00 00</span> <span style="background:#00ff00;">D6 B1 DA DE C7 82 7A A4</span> acf.....Ö±ÚÞÇ‚z¤
  }
  001C9090  <span style="background:#00ff00;">21 AE 4E D0 D9 BF B1 1A 03 00 00 00 11 55 E2 52</span> !®NÐÙ¿±......UâR
</source>
001C90A0  <span style="background:#00ff00;">11 FC 58 53</span> <span style="background:#8888ff;">00 00 00 00</span> <span style="background:#00ff00;">CC B4 CD 3A 0A F5 C0 F4</span> .üXS....Ì´Í:.õÀô
001C90B0  <span style="background:#00ff00;">4F 04 6B C3 95 16 E6 D8 FB 0B F2 56 B0 3B BA 00</span> O.kÕ.æØû.òV°;º.
001C90C0  <span style="background:#00ff00;">26 B0 D3 BA 55 5F B0 40 0F 54 34 22 E1 E4 DA A7</span> &°ÓºU_°@.T4"áäÚ§
  001C90D0  <span style="background:#00ff00;">D1 7D EE BC EF 03 3C 23 37 EE 10 EB F6 88 1B 85</span> Ñ}î¼ï.<#7î.ëöˆ.…
001C90E0  <span style="background:#00ff00;">35 8F 4B F5 D5 1A C7 3D</span>                         5.KõÕ.Ç=
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "https://www.psdevwiki.com/ps4/Activation_ACF"