Editing Talk:Keys

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= EAP/EMC Aeolia Script for decrypting and keeping header =
= system modules keysets changes =
 
<pre>
import struct
from binascii import unhexlify as uhx
from binascii import hexlify as hx
from Crypto.Cipher import AES
from Crypto.Hash import SHA, HMAC
 
import os
import sys
 
CIPHERKEYSEMC = ['5F74FE7790127FECF82CC6E6D91FA2D1'] # FULL
CIPHERKEYSEAP = ['581A75D7E9C01F3C1BD7473DBD443B98']
HASHERKEYEMC  = ['73FE06F3906B05ECB506DFB8691F9F54']
HASHERKEYEAP  = ['824D9BB4DBA3209294C93976221249E4']
ZEROS128 =      ['00000000000000000000000000000000']
 
def aes_decrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).decrypt(input)
   
def aes_encrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).encrypt(input)
 
def emc_decrypt_header(hdr):
    return hdr[:0x30] + aes_decrypt_cbc(uhx(CIPHERKEYSEMC[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
   
def emc_encrypt_header(hdr):
    return hdr[:0x30] + aes_encrypt_cbc(uhx(CIPHERKEYSEMC[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
   
def eap_decrypt_header(hdr):
    return hdr[:0x30] + aes_decrypt_cbc(uhx(CIPHERKEYSEAP[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
   
def eap_encrypt_header(hdr):
    return hdr[:0x30] + aes_encrypt_cbc(uhx(CIPHERKEYSEAP[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
 
def main(argc, argv):
        with open(sys.argv[1], 'rb') as f:
            data = f.read(0x80)
            type = data[7:8]
            if type == uhx('48'):
                print 'EMC'
                hdr = emc_decrypt_header(data)
                body_aes_key  = hdr[0x30:0x40]
                body_hmac_key = hdr[0x40:0x50]
                body_hmac = hdr[0x50:0x64]
                zeroes = hdr[0x64:0x6C]
                print(hx(zeroes))
                header_hmac = hdr[0x6C:0x80]
                body_len = struct.unpack('<L', hdr[0xc:0x10])[0]
                print body_len
                ehdr = hdr[:0x6C]
                ebody = f.read(body_len)
                bhmac = HMAC.new(body_hmac_key, ebody, SHA)
                hhmac = HMAC.new(uhx(HASHERKEYEMC[0]), ehdr, SHA)
                body = aes_decrypt_cbc(body_aes_key, uhx(ZEROS128[0]), ebody)
                print bhmac.hexdigest()
                print hhmac.hexdigest()
                print hx(body_hmac)
                print hx(header_hmac)
                with open(sys.argv[1] + '.bin', 'wb') as g:
                    g.write(hdr+body)
            if type == uhx('68'):
                print 'EAP'
                hdr = eap_decrypt_header(data)
                body_aes_key  = hdr[0x30:0x40]
                body_hmac_key = hdr[0x40:0x50]
                body_hmac = hdr[0x50:0x64]
                zeroes = hdr[0x64:0x6C]
                print(hx(zeroes))
                header_hmac = hdr[0x6C:0x80]
                body_len = struct.unpack('<L', hdr[0xc:0x10])[0]
                print body_len
                ehdr = hdr[:0x6C]
                ebody = f.read(body_len)
                bhmac = HMAC.new(body_hmac_key, ebody, SHA)
                hhmac = HMAC.new(uhx(HASHERKEYEAP[0]), ehdr, SHA)
                body = aes_decrypt_cbc(body_aes_key, uhx(ZEROS128[0]), ebody)
                print bhmac.hexdigest()
                print hhmac.hexdigest()
                print hx(body_hmac)
                print hx(header_hmac)
                with open(sys.argv[1] + '.bin', 'wb') as g:
                    g.write(hdr+body)
           
           
 
if __name__ == '__main__':
    main(len(sys.argv), sys.argv)
</pre>
 
= EAP/EMC Aeolia Script for encrypting (with header necessary) =
 
<pre>
import struct
from binascii import unhexlify as uhx
from binascii import hexlify as hx
from Crypto.Cipher import AES
from Crypto.Hash import SHA, HMAC
 
import os
import sys
 
CIPHERKEYSEMC = ['5F74FE7790127FECF82CC6E6D91FA2D1'] # FULL
CIPHERKEYSEAP = ['581A75D7E9C01F3C1BD7473DBD443B98']
HASHERKEYEMC  = ['73FE06F3906B05ECB506DFB8691F9F54']
HASHERKEYEAP  = ['824D9BB4DBA3209294C93976221249E4']
ZEROS128 =      ['00000000000000000000000000000000']
 
def aes_decrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).decrypt(input)
   
def aes_encrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).encrypt(input)
 
def emc_decrypt_header(hdr):
    return hdr[:0x30] + aes_decrypt_cbc(uhx(CIPHERKEYSEMC[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
   
def emc_encrypt_header(hdr):
    return hdr[:0x30] + aes_encrypt_cbc(uhx(CIPHERKEYSEMC[0]), uhx(ZEROS128[0]), hdr[0x30:])
   
def eap_decrypt_header(hdr):
    return hdr[:0x30] + aes_decrypt_cbc(uhx(CIPHERKEYSEAP[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
   
def eap_encrypt_header(hdr):
    return hdr[:0x30] + aes_encrypt_cbc(uhx(CIPHERKEYSEAP[0]), uhx(ZEROS128[0]), hdr[0x30:0x80])
 
def main(argc, argv):
        with open(sys.argv[1], 'rb') as f:
            data = f.read()
            type = data[7:8]
            if type == uhx('48'):
                print 'EMC'
               
                body_len = struct.unpack('<L', data[0xc:0x10])[0]
                body = data[0x80:0x80+body_len]
                body_aes_key  = data[0x30:0x40]
                ebody = aes_encrypt_cbc(body_aes_key, uhx(ZEROS128[0]), body)
                body_hmac_key = data[0x40:0x50]
                bhmac = HMAC.new(body_hmac_key, ebody, SHA)
                hdr = (data[0:0x50] + uhx(bhmac.hexdigest()) + data[0x64:0x6C])
                hhmac = HMAC.new(uhx(HASHERKEYEMC[0]), hdr, SHA)
                hdr = (hdr + uhx(hhmac.hexdigest()))
                hdr = emc_encrypt_header(hdr)
                print bhmac.hexdigest()
                print hhmac.hexdigest()
                with open(sys.argv[1] + '.bin', 'wb') as g:
                    g.write(hdr+ebody)
            if type == uhx('68'):
                print 'EAP'
                body_len = struct.unpack('<L', data[0xc:0x10])[0]
                body = data[0x80:0x80+body_len]
                body_aes_key  = data[0x30:0x40]
                ebody = aes_encrypt_cbc(body_aes_key, uhx(ZEROS128[0]), body)
                body_hmac_key = data[0x40:0x50]
                bhmac = HMAC.new(body_hmac_key, ebody, SHA)
                hdr = (data[0:0x50] + uhx(bhmac.hexdigest()) + data[0x64:0x6C])
                hhmac = HMAC.new(uhx(HASHERKEYEAP[0]), hdr, SHA)
                hdr = (hdr + uhx(hhmac.hexdigest()))
                hdr = eap_encrypt_header(hdr)
                print bhmac.hexdigest()
                print hhmac.hexdigest()
                with open(sys.argv[1] + '.bin', 'wb') as g:
                    g.write(hdr+ebody)
           
           
 
if __name__ == '__main__':
    main(len(sys.argv), sys.argv)
</pre>
 
= System modules keysets changes =
 
<pre>
<pre>
1.00 to 3.70 are 0
3.70->4.00 0->1 (all from 1.00 to 3.70 are 0)
4.00 to 4.07 are 1
4.07->4.50 1->2 (all from 4.00 to 4.07 are 1)
4.50 to 4.74 are 2
4.74->5.00 2->3 (all from 4.50 to 4.74 are 2)
5.00 to 5.07 are 3
5.05->5.50 3->4 (all from 5.00 to 5.05 are 3)
5.50 to 5.56 are 4
6.00 to 6.20 are 5
6.50 to 6.72 are 6
7.00 to 7.02 are 7
7.50 to 7.55 are 8
8.00 to 8.03 are 9
8.50 to 8.52 are 0xA
9.00 to 9.04 are 0xB
9.50 to 9.60 are 0xC
10.00 to 10.01 are 0xD
10.50 to 10.70 are 0xE
11.00 to 11.02 are 0xF
11.50 to 11.XX are 0 (counter at 0xA at 1 instead of 0)
</pre>
</pre>


* Final slot (0xF) has been depleted so in theory SIE will not be able to update keys again.
= order of keys in shellcore =
 
= Southbridge firmware keysets changes =
 
<pre>
1 is obsolete
13 is 0x10000
32/40 is 0x20000
36 is 0x30000
42 is 0x40000
</pre>
 
= Order of keys in ShellCore =


P->Q->DQ->QP
P->Q->DQ->QP
Line 234: Line 37:
* <s>42 42 AA FD 7A 05 B4 5C F3 5E 08 22 D4 55 97 45</s> (ShellCore, QP, 0x80)
* <s>42 42 AA FD 7A 05 B4 5C F3 5E 08 22 D4 55 97 45</s> (ShellCore, QP, 0x80)


= Database rebuild trigger magic =
= Database reconstruction magic =


<pre>
<pre>
Line 242: Line 45:
= Portable Keys Dumps =
= Portable Keys Dumps =


* Static always.
* Static Always


== sealedkey_key_E ==
== sealedkey_key_E ==
Line 263: Line 66:
</pre>
</pre>


== sealedkey_key_sign_E ==
== sealedkey_key_sign_E ==


<pre>
<pre>
Line 291: Line 94:


== crepo_iv ==
== crepo_iv ==
Used for Crash Report.


<pre>
<pre>
Line 299: Line 100:


== crepo_key_1_sign_E ==
== crepo_key_1_sign_E ==
Used for Crash Report.


<pre>
<pre>
Line 307: Line 106:
</pre>
</pre>


== crepo_key_2_sign_E ==
== crepo_key_2_sign_E ==
 
Used for Crash Report.


<pre>
<pre>
Line 316: Line 113:
</pre>
</pre>


== crepo_key_1_sign_I ==
== crepo_key_1_sign_I   ==
 
Used for Crash Report.


<pre>
<pre>
Line 325: Line 120:
</pre>
</pre>


== crepo_key_2_sign_I ==
== crepo_key_2_sign_I   ==
 
Used for Crash Report.


<pre>
<pre>
Line 335: Line 128:


== crepo_key_1_E ==
== crepo_key_1_E ==
Used for Crash Report.
<pre>
<pre>
24 3F 86 77 5F 7C DA 8F 9A D4 8A 72 69 9C BC 1E  
24 3F 86 77 5F 7C DA 8F 9A D4 8A 72 69 9C BC 1E  
Line 349: Line 139:
</pre>
</pre>


== crepo_key_2_E ==
== crepo_key_2_E ==
 
Used for Crash Report.


<pre>
<pre>
Line 364: Line 152:
</pre>
</pre>


== crepo_key_1_I ==
== crepo_key_1_I   ==
 
Used for Crash Report.
 
<pre>
<pre>
8B 5B 04 14 D6 26 36 F6 86 37 DD 3A E2 8B EC FA  
8B 5B 04 14 D6 26 36 F6 86 37 DD 3A E2 8B EC FA  
Line 380: Line 165:


== rootparam_key_IV ==
== rootparam_key_IV ==
<pre>
<pre>
95 69 82 9C D4 B1 5F F8 43 30 54 5A 34 EC 1B C5
95 69 82 9C D4 B1 5F F8 43 30 54 5A 34 EC 1B C5
Line 425: Line 209:
9C 5F A8 5E 4D 1C A8 C7 81 D1 EF 42 1E 34 A2 D0  
9C 5F A8 5E 4D 1C A8 C7 81 D1 EF 42 1E 34 A2 D0  
ED 3B 4D E5 6C 7C 34 1B 49 EC CF 36 2D B5 C2 43
ED 3B 4D E5 6C 7C 34 1B 49 EC CF 36 2D B5 C2 43
</pre>
== rootparam_key_0_I ==
<pre>
F6 9F B6 9A 77 1F C2 D5 12 F7 25 2F A5 86 FB 22
0D BF A3 F2 38 89 A5 17 97 49 34 D7 83 83 D6 6D
F9 74 DA 89 35 6B 7F A8 00 63 42 61 ED 70 19 5C
A7 A0 34 73 8D FC 2E E3 66 D6 FC 07 D4 F4 FC 86
E4 67 B4 8B E9 54 34 0D AE B2 01 60 AA A4 70 42
0E 95 62 13 AC D4 7D 11 88 DB 22 7D 4D 1D 92 D2
CF E9 D8 E5 54 7A B6 D6 51 C6 A8 8E 29 B3 C0 51
45 66 F6 41 82 A1 33 1D 7C 6C F8 00 43 F0 BD D3
</pre>
== rootparam_key_1_I ==
<pre>
95 C7 DC 5B 0A EA 8D 72 A2 6A 57 9E 54 12 6F 22
C8 C9 7C 84 1C E9 F3 E4 02 F8 7D 63 03 21 5F 9D
AA 52 46 E7 31 24 58 14 BA ED F2 9D 34 A3 2A 11
C3 08 1E 5C A6 39 50 38 6A 0F CA D4 31 26 31 89
65 78 67 BF 4A BF 4B C0 FE A5 B1 84 48 1D 5A E6
A5 DA 6B BB 54 57 E8 AB A5 2E 95 C4 C5 84 4B EB
95 01 0B 6B 37 8C B6 5D E0 A4 B8 2A 7F 9C 87 9F
46 E4 67 82 84 58 71 C8 6E 41 CF 02 FA 4C 41 D5
</pre>
== rootparam_key_2_I ==
<pre>
A9 60 9B D1 75 16 C8 85 03 49 D2 14 47 04 DD 1A
E7 A5 EF 87 45 76 DA 51 1F 42 82 8F 76 48 81 9B
95 CF 6A 22 21 84 3F 0A 2E 16 B3 64 E5 8C 08 CC
5E AD B8 5B F4 AC AB 9F 6D 3C 7B B9 2B 63 83 FB
89 07 A5 CF 8D 00 18 F9 F5 95 57 7A 8A B2 0A 25
03 53 69 EB BC 58 EE 96 42 D8 3C 99 E1 5F 62 92
C8 05 5B A3 47 25 C5 B5 97 B9 05 5E D2 52 1B 6A
90 22 FD 01 6F D3 95 2B 12 86 F3 7E 1D 74 04 E0
</pre>
== rootparam_key_3_I ==
<pre>
8C E4 47 03 2A C2 DA A9 8C 83 6E 9B 47 35 D5 37
CC B8 36 DA C4 F8 22 E8 7A FA 26 50 C8 17 71 26
BC F4 8A B7 55 EE 81 3A F9 80 6D 34 E6 9A B8 7D
93 8F C0 BD 3A 16 5C 7E CD FF 36 D5 9A BC 6F 15
D5 45 DF 5D 15 5D E7 C6 AF 67 6F 18 D1 8B 95 2E
7C D4 2D B2 E0 72 E3 A1 80 7B 01 F0 32 BB 27 88
24 08 B1 EE BF E0 5E 28 9B 1B C5 F3 F0 84 D5 3E
18 83 AB 46 60 2F 27 D2 6B 86 65 0C CA C7 89 C1
</pre>
== rootparam_key_4_I ==
<pre>
5C 5D B0 53 08 4B A6 BA A7 B1 E2 6B C6 36 32 CA
38 E7 DC 3A 19 67 34 D0 AB 5D 3C CA 29 1B 10 C2
B9 A5 84 99 82 B5 AA EE 75 36 B1 3C 9B 64 A4 83
42 51 68 8E 4B 1F 14 D3 F8 38 1E 8A A3 56 8A 41
43 CD D6 E7 05 6D 7F B5 A9 4E A2 34 ED 82 29 80
8D 63 C0 AF F8 C3 35 66 DC 49 E6 B6 AB F5 AA F6
1E B3 FD 52 F8 79 18 F2 55 98 66 8C 61 4E 83 F1
D6 7E A4 70 53 25 BE 42 D3 19 4A 8D B0 8A AC EF
</pre>
== rootparam_key_5_I ==
<pre>
36 EF D1 C2 7E 49 6E 6B 23 98 C4 43 AE AB DB B0
BA 5D A5 6C 2A E1 86 45 F8 39 E9 26 DB FD 4C 10
1A A4 32 D0 F0 0C A3 13 5D 17 82 5A 45 9C C7 76
5F 70 25 31 23 3E A0 15 C6 01 BE 5F 48 56 A7 15
08 9D F2 D6 64 9A 2F 38 8F 67 DA 09 17 A9 4D 02
79 EA D9 31 23 C4 37 19 36 EE 4F 7D 88 1D 8B 5D
EB C6 74 F2 EA FE F6 E6 F4 66 B6 FF 0A 65 FD 46
14 D2 98 88 CF 13 49 15 58 BE E6 E6 1E CB 42 F7
</pre>
== rootparam_key_0_sign_E ==
<pre>
6C 11 E6 DD 2F 5D 27 D5 8F 06 9E FC 24 11 6F DD
1D 26 36 33 F4 A7 A2 DE C9 06 17 88 51 88 ED 61
</pre>
== rootparam_key_1_sign_E ==
<pre>
BC 8E 1B D1 91 D4 EF A8 65 A4 25 15 C6 6F BE D1
E6 99 81 1C A7 25 73 C0 00 EA 1C A9 D6 B6 12 3A
</pre>
== rootparam_key_2_sign_E ==
<pre>
55 29 35 D8 4A B8 D5 FD B0 0C B7 71 CF E3 5D 48
4C 60 CC 78 F7 F4 D5 45 82 9B 2E 79 62 D2 D1 CD
</pre>
== rootparam_key_3_sign_E ==
<pre>
55 29 35 D8 4A B8 D5 FD B0 0C B7 71 CF E3 5D 48
4C 60 CC 78 F7 F4 D5 45 82 9B 2E 79 62 D2 D1 CD
</pre>
== rootparam_key_4_sign_E ==
<pre>
F5 AA 42 70 7B D5 F6 3D 3B 9C 6C 99 36 8B 94 65
3D C7 51 95 7B A1 CB 80 A5 EC 47 81 43 A9 61 4E
</pre>
== rootparam_key_5_sign_E ==
<pre>
03 D2 54 72 DB 35 27 C6 7B 98 EE 9F 1F C8 A7 74
6F BB BF DF DD E9 97 5C F7 86 48 8E 5F 4D EE 63
</pre>
== rootparam_key_0_E ==
<pre>
19 54 0D A2 DF F8 D6 6A 66 08 30 0F 37 8B F5 D4
B3 59 C2 EA B7 9B EB C4 5B 8B B5 E8 6A B8 77 A6
4E 7E 7B 33 6D F1 10 A8 C1 2D 46 29 D4 B4 3C 60
B2 AD 4F BB C9 33 39 38 65 62 AA C4 FE 74 D2 4A
CD 23 A9 36 B7 36 3C B0 E1 AB BF 6C 25 C4 2C 4C
58 E9 4D 20 4A A2 AD 15 C2 74 E8 51 00 44 DA 15
BB 74 2D 91 E1 DC 52 DF DC 7D F6 93 3C EF F2 E5
45 5D 3A DA C6 E1 25 12 2B BA B2 42 5E F3 F5 FE
</pre>
== rootparam_key_1_E ==
<pre>
F9 DA 87 36 B5 B2 30 17 DC 1D 47 51 FE 0B 75 23
2A 3E 58 AD 92 96 B3 D1 C1 11 97 DA FD 7D A2 E5
51 33 49 F4 31 DC EA 7B 3F 15 54 DF 26 6B 66 88
50 4D 3B 59 AD 95 0B D6 6F B5 62 AF 0F F6 BD E0
CB 08 FA 5D 44 B1 A4 94 82 A3 74 63 25 C5 56 9E
12 54 53 B6 DA C8 DD BF CF 7A 7B A2 1A 8C A0 88
AC 74 2E D4 96 CD 36 2E 14 83 A1 51 5A 0D 8A A9
28 1B 53 FA 5A C2 DF C5 EE E9 37 0F F5 64 61 F7
</pre>
== rootparam_key_2_E ==
<pre>
E6 EA DF D7 E8 B0 23 7B 9A 40 8F 96 52 15 3B 78
2C 63 28 6A 47 AE 91 92 36 DF 6B D1 BE A5 10 34
55 EC C7 D3 FE 43 5C 60 27 4F AB BC 68 2A 00 37
EB 28 7C 58 54 E1 0A 1C D5 30 47 B5 6E 40 8E A3
6D ED 64 81 CE A1 81 D8 CF 9E C7 C2 1E 6C 2F 86
CF 30 F3 16 A8 5B C0 74 EB 03 6A E4 C3 48 82 2E
54 75 61 44 B5 D5 4F BB 24 7A E5 21 11 49 1D 48
8F D2 B0 78 AA EF 6A 3B A5 C9 35 62 C7 7A 6C C2
</pre>
== rootparam_key_3_E ==
<pre>
E6 EA DF D7 E8 B0 23 7B 9A 40 8F 96 52 15 3B 78
2C 63 28 6A 47 AE 91 92 36 DF 6B D1 BE A5 10 34
55 EC C7 D3 FE 43 5C 60 27 4F AB BC 68 2A 00 37
EB 28 7C 58 54 E1 0A 1C D5 30 47 B5 6E 40 8E A3
6D ED 64 81 CE A1 81 D8 CF 9E C7 C2 1E 6C 2F 86
CF 30 F3 16 A8 5B C0 74 EB 03 6A E4 C3 48 82 2E
54 75 61 44 B5 D5 4F BB 24 7A E5 21 11 49 1D 48
8F D2 B0 78 AA EF 6A 3B A5 C9 35 62 C7 7A 6C C2
</pre>
== rootparam_key_4_E ==
<pre>
F6 C5 1C A3 8E F0 18 2D 55 35 48 75 47 AE BE BA
D2 70 93 D5 C5 87 01 00 34 65 FE D8 87 A4 2C B3
0F D0 C5 F3 FD EA B2 78 09 CB 4D BF 4C 02 26 02
F6 5D 0E 86 C3 D5 30 5B 78 9A E8 A4 3E 19 22 FC
5B 7D F4 4D 66 50 73 72 CF EB 03 AC 7F 82 55 90
F1 06 02 2F A5 88 93 07 2C 94 51 57 05 92 87 F9
F6 2B 15 6B F4 EE 15 BF D2 2B C4 BE 4C D7 AC 28
AD 52 F0 E4 F4 92 CC 90 E6 20 D6 F7 DD D4 AA 57
</pre>
== rootparam_key_5_E ==
<pre>
B2 37 2E C2 0A CA 40 00 99 03 21 83 3B 03 D2 74
5C 41 42 A4 13 F3 E1 28 CB B5 BC 7B 3A D0 30 20
CC 5D 99 AB 56 4B F4 B2 05 57 26 C3 63 EC 93 32
5B 4A 66 06 88 B5 91 02 CD D5 35 2F E2 C1 B7 7A
14 E3 B2 D5 14 80 06 28 F3 00 D7 61 32 5B F9 54
A1 25 D2 EC 69 16 4B 0C 95 06 86 60 50 31 80 67
44 9F 57 87 4E 8D 09 20 73 3E BE F8 A9 CF C2 0B
68 22 EC DD 65 8A D8 BB 70 04 F5 7A 69 3D 19 DC
</pre>
</pre>


== sealedkey_key_E (pfsSKKey__SecKey) ==
== sealedkey_key_E (pfsSKKey__SecKey) ==
Used for PFS encryption.


<pre>
<pre>
Line 637: Line 221:
00000080
00000080
</pre>
</pre>
* flag is 0
* identical to I


== SCE_EAP_HDD__KEY (External) ==
== SCE_EAP_HDD__KEY (External) ==
Used for HDD encryption.


<pre>
<pre>
Line 656: Line 235:
00000080
00000080
</pre>
</pre>
* flag is 0x20


== crepo_key_1_E (CFK1) ==
== crepo_key_1_E (CFK1) ==
Used for Crash Report.


<pre>
<pre>
Line 673: Line 248:
00000070  aa cd 9d 9d 2a a2 30 cc  0d 37 b8 69 47 d1 6a ac  |....*.0..7.iG.j.|
00000070  aa cd 9d 9d 2a a2 30 cc  0d 37 b8 69 47 d1 6a ac  |....*.0..7.iG.j.|
00000080
00000080
</pre>
* flag is 0xC
== crepo_key_1_I (CFK1) ==
Used for Crash Report.
<pre>
43 46 4B 31 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
77 B7 5A 04 C9 69 D3 FE BC 11 38 EE 2F B1 31 CC
71 E6 66 F7 D3 78 E4 F4 CD AB 35 D7 DE C4 A3 26
3B 2A 68 2C 43 06 15 CE 04 77 3D 4B A5 BC F8 7E
CF 9B CF 77 B4 8B A7 78 DE BD 09 75 BB 5B B1 27
44 A1 E3 CC EC 71 4F 10 09 48 CC 23 55 41 3C CE
11 34 1A 57 F2 34 69 F9 62 6B 2E 71 AD 17 B2 2C
</pre>
</pre>


== crepo_key_2_E (CFK1) ==
== crepo_key_2_E (CFK1) ==
Used for Crash Report.


<pre>
<pre>
Line 705: Line 261:
00000080
00000080
</pre>
</pre>
* flag is 0xC


== rootparam_key_0_E (SCEROOTPARAM_KEY) ==
== rootparam_key_0_E (SCEROOTPARAM_KEY) ==
Line 722: Line 276:
</pre>
</pre>


* flag is 0x14
== rootparam_key_1_E (SCEROOTPARAM_KEY) ==
 
== rootparam_key_0_I (SCEROOTPARAM_KEY) ==
 
<pre>
53 43 45 52 4F 4F 54 50 41 52 41 4D 5F 4B 45 59
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CA 5C 5D 73 F7 57 0D 77 E9 00 AB 72 C0 5A C3 C4
B4 9C 45 CB CD 90 29 61 58 EC 47 1F 5F 26 72 52
29 ED 9C 0A F8 D3 97 00 29 85 A9 DF D0 F2 47 21
03 EA A7 1E B1 10 C0 03 99 B1 1D EC B2 E5 DF 08
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>
 
== rootparam_key_4_E (SCEROOTPARAM_KEY) ==


<pre>
<pre>
Line 751: Line 290:
</pre>
</pre>


* flag is 0x14
== rootparam_key_2_E  (SCEROOTPARAM_KEY) ==
 
== rootparam_key_5_E (SCEROOTPARAM_KEY) ==


<pre>
<pre>
Line 766: Line 303:
00000080
00000080
</pre>
</pre>
* flag is 0x14


== SCE_LwUtoken_Key (External) ==
== SCE_LwUtoken_Key (External) ==
Used for "low" user tokens.


<pre>
<pre>
Line 783: Line 316:
00000080
00000080
</pre>
</pre>
* flag is 0x24


== SCE_LwUtoken_Key (External-Extra1) ==
== SCE_LwUtoken_Key (External-Extra1) ==
Used for "low" user tokens.


<pre>
<pre>
Line 801: Line 330:
00000080
00000080
</pre>
</pre>
* flag is 0x24


== SCE_LwUtoken_Key (External-Extra2) ==  
== SCE_LwUtoken_Key (External-Extra2) ==  
Used for "low" user tokens.


<pre>
<pre>
Line 819: Line 344:
00000080
00000080
</pre>
</pre>
* flag is 0x24
== IPMI (E) ==
Used for Inter-Process Method Invocation.
<pre>
ffffff80869df8e0  53 49 45 49 50 4d 49 00  00 00 00 00 00 00 00 00  |SIEIPMI.........|
ffffff80869df8f0  1a 88 b2 a3 64 e6 a2 8e  78 08 4e 3f 7f 40 fd 01  |....d...x.N?.@..|
ffffff80869df900  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag is 0x50
== SCE_SBL_BAR_KEY1 (E) ==
Used for Secure Block Backup And Restore feature.
<pre>
ffffff80869df8e0  53 43 45 5f 53 42 4c 5f  42 41 52 5f 4b 45 59 31  |SCE_SBL_BAR_KEY1|
ffffff80869df8f0  1f 18 c9 70 d0 00 ac 7e  6f cc 1a 8c dd 89 b4 fe  |...p...~o.......|
ffffff80869df900  cd a1 33 a1 0e c8 f5 25  98 22 23 f5 86 1f 02 00  |..3....%."#.....|
ffffff80869df910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df930  79 c8 cc c8 89 a1 54 0d  4f 2e 27 bb 61 4f d6 53  |y.....T.O.'.aO.S|
ffffff80869df940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag is 0x28
== SCE_KDF_NCDT_PSK(E) ==
<pre>
ffffff80869df8e0  53 43 45 5f 4b 44 46 5f  4e 43 44 54 5f 50 53 4b  |SCE_KDF_NCDT_PSK|
ffffff80869df8f0  59 e6 32 88 b0 4e 7f 68  f8 b8 db 83 86 1e 07 50  |Y.2..N.h.......P|
ffffff80869df900  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff80869df950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag is 0x4C
== Unknown key 0x54 ==
<pre>
91 0B 7C A6 6B 4B F9 DA 00 72 F1 67 6C 51 99 70
C1 4D B2 26 6A 59 29 C2 5E 1A 72 5D D8 19 05 BF
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>
* flag 0x54
== hidAuthThreadMain ==
<pre>
ED E7 41 CC 7F D6 0E 1F 2D B0 89 16 1F C0 EB 66
7C A4 DA 59 40 CE 19 54 00 90 1D BF 59 25 EE 4F
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>
* hidAuthThreadMain
* flag 0x48
== livedump ==
<pre>
96 1E 5E 85 B5 3E 77 64 43 E5 F4 45 85 E8 90 0A
52 5E 06 2A 4C 79 64 69 0F 75 2F 28 71 9C 6B A1
A8 C2 A0 0D 84 31 E7 17 DD EF 6D 80 F6 5C AE 32
42 1F CB E5 E7 A4 F9 1F 79 2B 25 C7 A1 0C 9E 5A
7B 07 82 9F F3 7C 3F B4 66 2F CB F8 E4 0A 63 F2
99 EE B8 6F 06 D5 58 CD 6E 8E 6A F7 5E 48 3A 24
CC 73 EA E7 73 2F 44 2F 8B E5 28 FB 19 60 62 50
F4 A9 9C A5 9E FC 63 2C 2D CC 67 73 2B 8B 5A DE
</pre>
* livedump
* flag 0x44
== pfs_sbl_key ==
<pre>
2B CF 69 8E 79 CF DD FA C2 4D 4C 25 BF 35 1E 62
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>
* pfs_sbl_key
* flag 0x58
== SCECloudSD___KEY ==
Used for Cloud Save Data features. Similar to the Cloud Data Key Ring used in PS Vita since System Software version 3.100.081.
<pre>
53 43 45 43 6C 6F 75 64 53 44 5F 5F 5F 4B 45 59
01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00
61 6F AD DF 22 04 AC 7A 24 06 4C CE D8 CD 88 A0
DE 07 F0 15 43 45 32 7D BE 4D 49 E1 CA 87 5D 98
5E F0 E4 AB 2A CE 26 69 00 96 D9 48 D4 C0 1B 36
8B B0 B2 1D 45 72 7D 70 91 26 F4 A1 10 77 0C F9
7A 0A F1 17 81 97 33 CC 71 05 73 92 4F D2 5C 1B
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>
<pre>
5F 15 6F 65 CF DA 91 51 83 7C E3 06 D3 39 75 71
08 3C 5B 08 10 5A 9C 6D 79 F0 64 29 DF D1 6D 33
4A 75 88 66 9B 61 54 B4 2F A6 C2 29 55 6E AD 76
34 4B B4 B8 F6 03 83 4D F4 B4 92 5A C8 F9 39 8E
31 60 25 1A 88 51 53 F7 A4 D9 5E 4C FF D0 3D 4B
95 A7 6F E8 DD BF 92 B2 D4 1C 0B 0E 28 29 B3 40
B0 AD 2F 35 8A 19 D9 C1 2D AA 81 C3 23 16 3A 17
15 0D 4C 33 3A 62 49 A7 51 A3 3C 4E 78 01 50 F8
B1 24 25 11 6E C0 95 15 9E FA 11 B6 48 BD 96 70
AE 87 C9 99 DA 38 2E F1 B7 D6 41 81 09 98 A1 FF
27 69 85 D1 68 1C BE 72 2A F2 38 7F 65 AD 66 95
8B 72 A5 C8 73 34 3E A8 35 E2 82 74 2A 94 67 40
30 DF 3B 19 6C 5D CC D9 AD 44 7E 6C 22 76 ED 0A
64 E8 A1 46 A0 BE B7 D9 CA 6F CB 4F 54 92 2F 0F
41 90 1F 95 62 AF 0B 0E 18 63 06 C0 EA 22 8C 2E
3C 7E E9 79 73 A0 09 0C 36 D2 09 8D 75 DE 88 C7
EB 3E E3 B6 66 0F DD 75 99 CE 39 76 59 07 15 60
86 92 96 C5 B3 CB 06 B1 C2 E9 E9 C5 8B 13 35 5E
76 34 61 BA A2 4F F2 DB 99 CC BC DC 3C 13 2C A3
13 56 55 A7 0A FD 88 43 11 95 0A 0D 6D A4 7F 74
F3 2C 67 BC F4 E9 6F 1E 4D 69 5C CC 2E 1C 57 A8
CE 97 0B 4B D9 6A 5A 81 42 3F 6E 5C 7B A5 4A 78
AE 95 97 26 2A FF 9E 00 4F B4 F0 BB 40 72 1C 1F
8F 4B F7 AB FD D3 8C DC 14 FE 92 DD 16 51 A1 2F
01 AB 69 DF 87 71 AE BF E7 97 CD 88 18 F1 98 BF
A9 D3 3B 1A 95 C5 F1 37 65 17 DB FE C4 4D 0C 3B
26 27 73 61 F9 60 36 BE 90 36 A5 73 0F A5 98 EB
AE BD 9E 84 35 BD B4 CD A8 59 15 4C 25 CA DE 33
FA 53 D9 5C 9B 26 CD 1A BA CC 80 8F A5 0F 1A 6A
1D 2D A3 0D 52 56 89 FF BC 63 AE 7A 0B D4 F6 24
8F 3D BF F8 BD DB DB 9A 2A 52 85 EB AB D4 BA 08
37 39 EE EE 4A D2 ED D3 52 A5 BA 39 50 1B BA A3
F7 1B 39 B8 5D 55 7D 5E B7 6F 22 F9 82 95 0E 45
1B CC 18 CD B9 FB 14 25 5A 22 FC BA 98 1D 50 C6
20 1C 15 47 C7 1D 1D 55 CC A2 94 8D CF 4E A9 8E
4D F8 2F 96 D6 C3 AB B9 46 A4 0C 1A FD E5 01 B9
8F 07 DE DA BC 20 FF 0D BD CC CE FD 77 E2 28 62
25 56 1A F3 D1 92 DD F7 72 43 64 9C D4 38 7A C6
FA C3 60 45 61 B2 EA 3B C5 90 AC 0F 20 0F 26 73
14 03 A8 2D 00 48 35 2D 45 8A 86 7B 6B 28 69 02
</pre>
* Cloud Key
* flag 0x1C
= Portable Keys Dumps (ShellCore) =
== SCE_CFS_hostname (E) ==
Host by Amazon AWS at Portland, Oregon, 97086 United States of America. Alias of cfss.crs.playstation.net.
Zeke Jedediah Dunbar is a main character of the Infamous videogame developped by Sony Computer Entertainment America.
<pre>
-------HEX DUMP------
ffffff8085f7f8e0  53 43 45 5f 43 46 53 5f  68 6f 73 74 6e 61 6d 65  |SCE_CFS_hostname|
ffffff8085f7f8f0  63 66 73 73 2e 64 75 6e  62 61 72 2e 73 63 65 61  |cfss.dunbar.scea|
ffffff8085f7f900  2e 63 6f 6d 00 00 00 00  00 00 00 00 00 00 00 00  |.com............|
ffffff8085f7f910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag 0xD
== SCE_RCR_hostname (E) ==
Host by Amazon AWS at Portland, Oregon, 97086 United States of America. Owned by Minato-ku for Sony Computer Entertainment Inc. Network Platform Service Department at Tokyo (Japan).
Zeke Jedediah Dunbar is a main character of the Infamous videogame developped by Sony Computer Entertainment America.
<pre>
-------HEX DUMP------
ffffff8085f7f8e0  53 43 45 5f 52 43 52 5f  68 6f 73 74 6e 61 6d 65  |SCE_RCR_hostname|
ffffff8085f7f8f0  7a 65 6b 65 2e 73 63 65  61 2e 63 6f 6d 00 00 00  |zeke.scea.com...|
ffffff8085f7f900  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag 0xD
== SCE_CDN_hostname (E) ==
Used for Crash Report.
<pre>
-------HEX DUMP------
ffffff8085f7f8e0  53 43 45 5f 43 44 4e 5f  68 6f 73 74 6e 61 6d 65  |SCE_CDN_hostname|
ffffff8085f7f8f0  63 72 65 70 6f 2e 77 77  2e 64 6c 2e 70 6c 61 79  |crepo.ww.dl.play|
ffffff8085f7f900  73 74 61 74 69 6f 6e 2e  6e 65 74 00 00 00 00 00  |station.net.....|
ffffff8085f7f910  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8085f7f950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag 0xD
== SCE_SYS_TLM_SECK (E) ==
Used in GetOpenPsIdHash.
<pre>
-------HEX DUMP------
ffffff80861838e0  53 43 45 5f 53 59 53 5f  54 4c 4d 5f 53 45 43 4b  |SCE_SYS_TLM_SECK|
ffffff80861838f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8086183900  99 e9 ac b7 36 53 5e 4b  25 4d 25 b9 e2 ab 3e 09  |....6S^K%M%...>.|
ffffff8086183910  cb cb c7 a7 c0 e8 1a ef  93 cf ae e1 57 4c 1a 7c  |............WL.||
ffffff8086183920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8086183930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8086183940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff8086183950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag 0x3C
== Other Keys ==
<pre>
-------HEX DUMP------
ffffff807b92b8e0  15 a0 cb 65 d6 a4 05 27  e6 1c cd da 2a ef 53 3b  |...e...'....*.S;|
ffffff807b92b8f0  13 fc 7c 35 24 14 b3 54  3d c7 83 24 6e fc c9 64  |..|5$..T=..$n..d|
ffffff807b92b900  9d f8 40 9a c2 02 09 82  3c 08 61 2b e6 2a 51 79  |..@.....<.a+.*Qy|
ffffff807b92b910  cf 87 62 61 c0 85 46 c2  a5 da a1 9b d0 e7 ff 79  |..ba..F........y|
ffffff807b92b920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff807b92b930  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff807b92b940  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
ffffff807b92b950  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
</pre>
* flag 0xA
<pre>
C6 8A 9B 40 49 35 77 E7 54 3A 2D 95 59 9F 7E 96
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>
* beta_update_key_E | flag = 0x40
<pre>
56 6B DD 67 C3 B6 B5 04 EF 1A 39 C0 CC AC 4B E2
</pre>
* same as Internal
* timezone_key_E | flag = 0x40
<pre>
8C 81 17 54 AB E7 2C 8A 1B 4D DC A2 32 B8 CC 2A
</pre>
* system_log_config_key_E | flag = 0x40
<pre>
8A 7A 15 CE 5D 21 62 19 7C FA 83 B1 DC 77 3C C7
</pre>
* system_log_unknown_key_E | flag = 0x40
<pre>
DA AF 3B 06 99 F7 6E 04 8F 3C 27 BF 0B E8 95 1C
</pre>
* bgdc_key_E | flag = 0x40
<pre>
67 EE DA F2 67 E0 43 BE B5 AD 5C 7A 6F 54 C5 37
</pre>
* wctl_key_E | flag = 0x40
<pre>
5A 1F 16 C3 47 F8 24 6B F6 D7 8B E3 C4 D6 F2 D1
</pre>
* morpheus_updatelist_key_E | flag = 0x40
<pre>
49 B6 1A 0B 8F 33 BC 28 6F 85 6D A8 CB 04 B8 B4
</pre>
* entitlementmgr_key_E | flag = 0x40
<pre>
66 01 69 2E 46 1B BD CC 85 6E A8 DC CE 06 3C F1
</pre>
* netev_key_E | flag = 0x40
<pre>
9B 12 DA 7C 22 44 3B CD 2B BC F6 C0 18 5E 77 70
</pre>
* patch_key_E | flag = 0x40
<pre>
F1 1B 19 25 D9 3C E7 70 86 F4 9C CC 50 96 45 56
</pre>
* bgft_key_E | flag = 0x40
<pre>
CE A4 74 20 1F 0C A2 36 8D D8 37 BF A1 B4 BD 78
</pre>
* system_log_privacy_key_E | flag = 0x40
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps4/Talk:Keys"