QA Token SELF Structure
| Offset |
Size |
Description |
Notes
|
| 0 |
4 |
Magic |
54 14 F5 EE
|
| 0x4 |
4 |
Unknown ?Version? |
Always 10 01 01 32
|
| 0x8 |
1 |
Category |
06 on QA Token SELF
|
| 0x9 |
1 |
Program Type |
00 for Token
|
| 0xA |
2 |
Padding |
|
| 0xC |
2 |
Header Size |
0xC0 for Token
|
| 0xE |
2 |
Metadata Size |
0x1E0 for Token
|
| 0x10 |
8 |
File Size |
Size of SELF (0x300 for Token)
|
| 0x18 |
2 |
Number of Segments |
1 for Token
|
| 0x1A |
2 |
Unknown ?Algorithm? |
Always 0x32
|
| 0x1C |
4 |
Padding |
|
QA Token Segment (1 segment example)
| Offset |
Size |
Description |
Notes
|
| 0x20 |
0x8 |
Flags |
0x6 for token (encrypted and signed)
|
| 0x28 |
0x8 |
Offset |
0x2A0 for token (also header size + metadata size)
|
| 0x30 |
0x8 |
ENCRYPTED_COMPRESSED_SIZE |
0x60 for token
|
| 0x38 |
0x8 |
DECRYPTED_DECOMPRESSED_SIZE |
0x60 for token
|
QA Token Additional Information
| Offset |
Size |
Description |
Notes
|
| 0x40 |
0x10 |
Padding? |
|
| 0x50 |
0x20 |
SHA256 of body? |
ex: 13 18 98 62 FC FE C7 13 A6 0A 82 5B 70 4C 92 41 C5 39 27 F6 8F 41 B6 56 C8 9F 8B 17 59 58 B4 2F
|
| 0x70 |
0x40 |
QAF Name |
ex: QAF_SYS_DEV_I. Some PS5 QAF names are similar with PS Vita and PS4 ones.
|
| 0xB0 |
0x8 |
Start Date |
ex: 20191010
|
| 0xB8 |
0x8 |
End Date |
ex: 20210410
|
QA Token Metadata (1 segment example)
| Offset |
Size |
Description |
Notes
|
| 0xC0 |
0x10 |
AES-CBC-CTS Key |
Key used to Decrypt Body
|
| 0xD0 |
0x10 |
AES-CBC-CTS IV |
IV used to Decrypt Body
|
| 0xE0 |
0x20 |
HMAC DIGEST |
HMAC-SHA256 Digest of Segment
|
| 0x100 |
0x20 |
HMAC KEY |
HMAC-SHA256 Key of Segment
|
| 0x120 |
0x180 |
RSA 3096 SIGNATURE |
RSA Signature used to validate the self
|
QA Token Body
As the only known QA Token dump is in encrypted form, what follows is guessed from the structure of decrypted QA Tokens of previous PlayStation consoles (PS Vita, PS3).
| Offset |
Size |
Description |
Notes
|
| 0 |
0x10 |
CONSOLE ID |
Console ID of the system. Could also be another per-console identifier like the OpenPSID or Device ID.
|
| 0x10 |
0x10 |
QA FLAGS |
QA FLAGS of the system.
|
| 0x20 |
0x30 |
PADDING |
|
| 0x50 |
0x10 |
AES128-CMAC |
Hash of previous in AES128-CMAC format (key is external to this and not in meta)
|
Example
QAF Names
QAF_SYS_DEV_I (for the only known sample in existence)
Validity Period
10 Oct 2019 - 4 October 2021 (for the only known sample in existence)
- 725 Days = 365 Days + 360 Days
- US Date Format in ASCII
Token Size
0x60 bytes -> for the only known sample in existence