Activation ACF: Difference between revisions

From PS4 Developer wiki
Jump to navigation Jump to search
No edit summary
m (Text replacement - "<source lang" to "<syntaxhighlight lang")
 
(12 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Found in the System Flash on offset [http://www.psdevwiki.com/ps4/Flash-Main#0x1C9080_ACF_.28Dev.2FTest.29 0x1C9080] and only present on Dev / Test Dumps.
ACF, certainly standing for Activation Code File, is a data structure present in the [[Serial Flash]] [[Non Volatile Storage]] of a PS4 Dev/Test Kit or prototype when it is activated.


Total length = 0x68 ~= 104 bytes.
On PS Vita, compared to PS4, it is named "act" instead of "acf" and is stored in Syscon NVS instead of Serial Flash NVS. On PS5, Kit activation requires a [https://www.psdevwiki.com/ps5/CP_Box Communication Processor Box] and so may be contained in the [https://www.psdevwiki.com/ps5/CP_Box_Non_Volatile_Storage PS5 CP Box NVS].


There is a structure in it. It hase a Magic of 4 bytes, then there are constant 4 bytes following by unique changing 16 bytes. Then again constant 4 bytes following by unique 8 bytes and a third time, constant 4 bytes following by unique 64 bytes.
See also [https://wiki.henkaku.xyz/vita/AFV PS Vita Activation AFV especially its token] and [https://wiki.henkaku.xyz/vita/Ernie#NVS PS Vita Syscon NVS Activation Data].


Structure and constant bytes are for every Dev / Test the same. Example:
The PS4 ACF is completed by a RSA-2048 signature stored as well in the [[Serial Flash]] [[NVS]].


Magic Bytes == Red.
The PS4 ACF is checked in the sceSblDevActVerifyCheckExpire kernel function.


Constant Bytes == Blue.
= Structure =


Unique Bytes == Green.
Total length is 0x68 bytes. It may also be 0x6C bytes for some PS4 consoles, according to zecoxao.


Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
It is written to a 0x80-byte area in [[Serial Flash]] [[Non Volatile Storage]] bank 0 block 4 offset 0x80.
001C9080  <span style="background:#ff6666;">61 63 66 00</span> <span style="background:#8888ff;">01 02 00 00</span> <span style="background:#00ff00;">D6 B1 DA DE C7 82 7A A4</span> acf.....Ö±ÚÞÇ‚z¤
001C9090  <span style="background:#00ff00;">21 AE 4E D0 D9 BF B1 1A</span> <span style="background:#8888ff;">03 00 00 00</span> <span style="background:#00ff00;">11 55 E2 52</span> !®NÐÙ¿±......UâR
001C90A0  <span style="background:#00ff00;">11 FC 58 53</span> <span style="background:#8888ff;">00 00 00 00</span> <span style="background:#00ff00;">CC B4 CD 3A 0A F5 C0 F4</span> .üXS....Ì´Í:.õÀô
001C90B0  <span style="background:#00ff00;">4F 04 6B C3 95 16 E6 D8 FB 0B F2 56 B0 3B BA 00</span> O.kÕ.æØû.òV°;º.
001C90C0  <span style="background:#00ff00;">26 B0 D3 BA 55 5F B0 40 0F 54 34 22 E1 E4 DA A7</span> &°ÓºU_°@.T4"áäÚ§
001C90D0  <span style="background:#00ff00;">D1 7D EE BC EF 03 3C 23 37 EE 10 EB F6 88 1B 85</span> Ñ}î¼ï.<#7î.ëöˆ.…
001C90E0  <span style="background:#00ff00;">35 8F 4B F5 D5 1A C7 3D</span>                        5.KõÕ.Ç=


== Struct ==
{| class="wikitable"
{| class="wikitable"
|-
|-
! From !! To !! Description
! Offset !! Size !! Description
|-
|-
| 1C9080 || 1C9083 || '''MAGIC''' acf
| 0 || 4 || '''Magic'''. Always "acf\0" on PS4, "act\0" on PS Vita.
|-
|-
| 1C9084 || 1C9087 || '''Constant1''' Constant 4 bytes always the same.
| 4 || 1 || '''Format Version'''. Always 1 on PS4 and PS Vita.
|-
|-
| 1C9088 || 1C9097 || '''Unique1''' Unique 16 bytes.
| 5 || 1 || '''Format Minor Version'''. Always 2 on PS4, 0 on PS Vita.
|-
|-
| 1C9098 || 1C909B || '''Constant2''' Constant 4 bytes always the same.
| 6 || 2 || '''Reserved'''. Padding. Always zeroed on PS4 and PS Vita.
|-
|-
| 1C909C || 1C90A3 || '''Unique2''' Unique 8 bytes.
| 8 || 0x10 || '''Activation Key'''. Likely derived from OpenPsId.
|-
|-
| 1C90A4 || 1C90A7 || '''Const3''' Constant 4 bytes always the same.
| 0x18 || 4 || '''Issue Number'''. Ex: 3, 15.
|-
|-
| 1C90A8 || 1C90E7 || '''Unique3''' Unique 64 bytes.
| 0x1C || 4 || '''Start Date'''. Little Endian.
|-
|-
| 0x20 || 4 || '''End Date'''. Little Endian. Usually 90 days after Start Date.
|-
| 0x24 || 4 || '''Reserved'''. Always zeroed.
|-
| 0x28 || 0x40 || '''Key Hash'''. Unique hash of previous data (maybe AES-CMAC (0x20 key + 0x20 hash) or HMAC). On PS Vita it is a 16-byte AES-128-CMAC hash.
|}
|}


<syntaxhighlight lang="C">
typedef struct SceAcf {
    char magic[4];
    uint8_t format_ver;
    uint8_t format_minor_ver;
    uint16_t reserved;
    char activation_key[16];
    uint32_t issue_no;
    uint32_t start_date;
    uint32_t end_date;
    uint32_t reserved;
    char key_hash[64];
} SceAcf;
</syntaxhighlight>


<source lang="c">
= RSA-2048 Signature =
typedef struct ACF {
    const unsigned char MAGIC;
    const int32 CONST1;
    unsigned char BYTE16;
    const int32 CONST2;
    unsigned char BYTE8;
    const int32 CONST3;
    unsigned char BYTE64;
} ACF;
</source>


A RSA-2048 signature of the ACF is present in [[Serial Flash]] [[NVS]] bank 0 block 4 offset 0x900.


<source lang="csharp">
On PS Vita, the RSA-2048 signature is only present since System Software version 2.10 and is stored in the eMMC in the tm0:act/actsig.dat file instead of the NVS.
  protected internal struct ACF {
 
    internal static byte[] MAGIC = new byte[4];
= Example =
    internal static int CONST1;
 
    internal static byte[] BYTE16 = new byte[16];
* Magic bytes: red.
    internal static int CONST2;
* Constant bytes: blue.
    internal static byte[] BYTE8 = new byte[8];
* Unique bytes: green.
    internal static int CONST3;
 
    internal static byte[] BYTE64 = new byte[64];
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
  }
001C9080  <span style="background:#ff6666;">61 63 66 00</span> <span style="background:#8888ff;">01 02 00 00</span> <span style="background:#00ff00;">D6 B1 DA DE C7 82 7A A4</span> acf.....Ö±ÚÞÇ‚z¤
</source>
  001C9090  <span style="background:#00ff00;">21 AE 4E D0 D9 BF B1 1A 03 00 00 00 11 55 E2 52</span> !®NÐÙ¿±......UâR
001C90A0  <span style="background:#00ff00;">11 FC 58 53</span> <span style="background:#8888ff;">00 00 00 00</span> <span style="background:#00ff00;">CC B4 CD 3A 0A F5 C0 F4</span> .üXS....Ì´Í:.õÀô
001C90B0  <span style="background:#00ff00;">4F 04 6B C3 95 16 E6 D8 FB 0B F2 56 B0 3B BA 00</span> O.kÕ.æØû.òV°;º.
001C90C0  <span style="background:#00ff00;">26 B0 D3 BA 55 5F B0 40 0F 54 34 22 E1 E4 DA A7</span> &°ÓºU_°@.T4"áäÚ§
  001C90D0  <span style="background:#00ff00;">D1 7D EE BC EF 03 3C 23 37 EE 10 EB F6 88 1B 85</span> Ñ}î¼ï.<#7î.ëöˆ.…
001C90E0  <span style="background:#00ff00;">35 8F 4B F5 D5 1A C7 3D</span>                         5.KõÕ.Ç=

Latest revision as of 07:11, 18 January 2025

ACF, certainly standing for Activation Code File, is a data structure present in the Serial Flash Non Volatile Storage of a PS4 Dev/Test Kit or prototype when it is activated.

On PS Vita, compared to PS4, it is named "act" instead of "acf" and is stored in Syscon NVS instead of Serial Flash NVS. On PS5, Kit activation requires a Communication Processor Box and so may be contained in the PS5 CP Box NVS.

See also PS Vita Activation AFV especially its token and PS Vita Syscon NVS Activation Data.

The PS4 ACF is completed by a RSA-2048 signature stored as well in the Serial Flash NVS.

The PS4 ACF is checked in the sceSblDevActVerifyCheckExpire kernel function.

Structure[edit | edit source]

Total length is 0x68 bytes. It may also be 0x6C bytes for some PS4 consoles, according to zecoxao.

It is written to a 0x80-byte area in Serial Flash Non Volatile Storage bank 0 block 4 offset 0x80.

Offset Size Description
0 4 Magic. Always "acf\0" on PS4, "act\0" on PS Vita.
4 1 Format Version. Always 1 on PS4 and PS Vita.
5 1 Format Minor Version. Always 2 on PS4, 0 on PS Vita.
6 2 Reserved. Padding. Always zeroed on PS4 and PS Vita.
8 0x10 Activation Key. Likely derived from OpenPsId.
0x18 4 Issue Number. Ex: 3, 15.
0x1C 4 Start Date. Little Endian.
0x20 4 End Date. Little Endian. Usually 90 days after Start Date.
0x24 4 Reserved. Always zeroed.
0x28 0x40 Key Hash. Unique hash of previous data (maybe AES-CMAC (0x20 key + 0x20 hash) or HMAC). On PS Vita it is a 16-byte AES-128-CMAC hash. 
 typedef struct SceAcf {
     char magic[4];
     uint8_t format_ver;
     uint8_t format_minor_ver;
     uint16_t reserved;
     char activation_key[16];
     uint32_t issue_no; 
     uint32_t start_date;
     uint32_t end_date;
     uint32_t reserved;
     char key_hash[64];
 } SceAcf;

RSA-2048 Signature[edit | edit source]

A RSA-2048 signature of the ACF is present in Serial Flash NVS bank 0 block 4 offset 0x900.

On PS Vita, the RSA-2048 signature is only present since System Software version 2.10 and is stored in the eMMC in the tm0:act/actsig.dat file instead of the NVS.

Example[edit | edit source]

  • Magic bytes: red.
  • Constant bytes: blue.
  • Unique bytes: green.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
001C9080  61 63 66 00 01 02 00 00 D6 B1 DA DE C7 82 7A A4 acf.....Ö±ÚÞÇ‚z¤
001C9090  21 AE 4E D0 D9 BF B1 1A 03 00 00 00 11 55 E2 52 !®NÐÙ¿±......UâR
001C90A0  11 FC 58 53 00 00 00 00 CC B4 CD 3A 0A F5 C0 F4 .üXS....Ì´Í:.õÀô
001C90B0  4F 04 6B C3 95 16 E6 D8 FB 0B F2 56 B0 3B BA 00 O.kÕ.æØû.òV°;º.
001C90C0  26 B0 D3 BA 55 5F B0 40 0F 54 34 22 E1 E4 DA A7 &°ÓºU_°@.T4"áäÚ§
001C90D0  D1 7D EE BC EF 03 3C 23 37 EE 10 EB F6 88 1B 85 Ñ}î¼ï.<#7î.ëöˆ.…
001C90E0  35 8F 4B F5 D5 1A C7 3D                         5.KõÕ.Ç=
Retrieved from "https://www.psdevwiki.com/ps4/index.php?title=Activation_ACF&oldid=295229"