Editing IDStorage

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
= Location =
IDStorage is located after the IPL on the nand at 0xC0000, and is used to store low-level information on the PSP, such as the serial, [[MAC address]], [[UMD]], WLAN and region. Most idstorage keys have a pair, although some do not (explained later.) Idstorage keys are 512(+16) bytes and are stored in an index of two nand pages (512 bytes.) Nand pages are also 515(+16 spare area) bytes. The index of idstorage is identified by byte 6 of the spare (0x73), byte 7 is the idstorage version, byte is either 1 or 0; depending on whether the idstorage has been formatted or not (???), and finally byte 9 indicates if the idstorage is read-only or not.


== PSP ==
Idstorage keys are 16 bit integers and are stored in the corresponding user areas. For example, a key appearing at position 27 (byte 54) in the index would find its associated data at the location:0xc0000 + (27 * 512) = 0xC3600


IDStorage area is located after the IPL on the NAND at offset 0xC0000.
=Importance to PSP Functions=


= Description =
As major functions such as UMD Decryption, Ad Hoc and DNAS Authentication rely on IDStorage keys, the loss or corruption of keys can be crippling to the usability of the PSP. Users are strongly recommended to take a [[NAND Backup]], giving them the opportunity to restore their IDStorage using a tool such as [[NandTool]].


It is used to store low-level information, such as the serial, [[MAC address]], [[UMD]], WLAN and region.
=Generation=


The IDStorage area is an associative array and information is stored using key/value pairs (index/leaf). The IDStorage seems a little coupled to the physical storage as each leaf is mapped to an area of 512-byte, which is equal to the pagesize of the PSP standard NAND flash, and it seems 512-byte page operations are intended.
Very little is known about the IDStorage generation process, except that it occurs onboard the PSP, leading speculators to believe Sony may use [[Pandora|Jigkick Batteries]] to start the process on the PSP during manufacture.


= Structure =
It was previously believed IDStorage cannot be restored even by Sony technicians after the manufacture process, however with the use of a Pandora's Battery and a Despertar Del Cementerio v7 magic stick, the IDStorage can be (partially?) recreated.


Idstorage leaves are all 512 bytes. Most IDStorage leaves have a pair, although some do not.
=Uses=


Idstorage leaves indexes are 16-bit integers and are stored in an index table of two NAND pages of 512 bytes.
==IPL==


* The index is identified by byte 6 of the spare area (0x73).
The Stage 2 [[IPL]] (main.bin) reads 3 keys from the idstorage, 0x004, 0x005 and 0x006. These keys play a significant part in the PSP as they are related to power. In TA-082 and TA-086 PSP's, these keys are at different locations, causing a brick with the 1.50 IPL.
* byte 7 is the idstorage version.
* byte is either 1 or 0 depending on whether the idstorage has been formatted or not, and finally byte 9 indicates if the idstorage is read-only or not.
 
For example, an index appearing at position 27 (byte 54) in the index table would find its associated data at the NAND offset: 0xC0000 + (27 * 512) = 0xC3600.
 
= Importance in OS =
 
As major functions such as UMD decryption, Ad Hoc and DNAS Authentication rely on IDStorage leaves, the loss or corruption of leaves can be crippling to the usability of the PSP. Users are strongly recommended to take a [[NAND Backup]], giving them the opportunity to restore their IDStorage using a tool such as [[NandTool]].
 
The firmware provides a driver to facilitate manipulations. In PSP: idstorage.prx. In PSVita: idstorage.skprx.
 
= Generation =
 
Most of the idstorage generation process is detailed in Despertar Del Cementerio (sources available here: https://github.com/mathieulh/Despertar-Del-Cementerio).
 
* some PSP JigKick files contain information on how to (re)generate idstorage leaves
* DespertarDelCementerio v7 also contains information about idstorage (re)generation.
* the most significant module used by DCv7 used to do this is idsregeneration.prx<br />
(see DCv7 src code https://github.com/mathieulh/Despertar-Del-Cementerio/tree/master/idsregeneration).
* you can see a plethora of "templates" which are used for the generation of the idstorage sections.
* the idstorage regeneration requires 2, probably more parameters -> Region, MAC Address, and likely a timestamp of sorts.
* on ps3 the generation method wasn't found on the JigKick firmware files (and selfs). however, it seems that factory still does this, but by accessing a server, so the information cannot be deduced anymore unless there's access to the server.
* together with the idps (called PSID on PSP), the openPSID is also generated on PSP (written to IdStorage).
* there are 12 sections on PSP, unlike the 11 ones on PS3 EID0.
 
= IDStorage certified sections =
 
IDStorage certified sections are a security measure for critical information. For example PSID and OpenPSID are certified (leaves 0x100, 0x101, 0x120, 0x121). For PSPemu on PS3 and PS Vita, the same sort of certificates are contained in PS3 eEID and PS Vita ID Storage, and Kirk commands are implemented to handle them. Moreover, PS3 eEID certificates use almost the same structure and algorithms, whilst PS Vita extends block sizes from 128 to 192 and 256 bits.
 
Kirk command 0x12 is used to verify IDStorage certificates.
 
== Structure ==
 
{|class="wikitable"
|-
! Name !! Size !! Description
|-
| Data || 0x10 || contains the actual data (either PSID or OpenPSID)
|-
| plaintext public key || 0x28 || contains the certificate's public key (without padding)
|-
| R || 0x14 || part of the ECDSA signature pair (R, S)
|-
| S || 0x14 || part of the ECDSA signature pair (R, S)
|-
| public key || 0x28 || ECDSA public key (unknown what this is doing here)
|-
| encrypted private key || 0x20 || encrypted blob that contains the certificate's private key (with padding)
|-
| omac/cmac1 || 0x10 || hash of the previous information in CMAC1/OMAC mode
|}
 
<source lang="C">
typedef struct ECDSA160_signature { // size is 0x28
  unsigned char r[0x14];
  unsigned char s[0x14];
} ECDSA160_signature;
 
typedef struct ids_cert_main_psp { // size is 0xA8
char data[0x10];
char pub_key[0x28]; // ?generated using Kirk command 0xC? sent to Kirk command 0x11 for verification
ECDSA160_signature signature;
char constant_pub_key[0x28]; // hardcoded constant, same in all PSP consoles but depends on the certificate index in ID Storage
char enc_priv_key[0x20]; // decrypted and verified by Kirk command 0x10
} ids_cert_main_psp;
 
typedef struct ids_cert_psp { // size is 0xB8
ids_cert_main_psp cert_data; // data input for generating enc_aes_cmac_hash
char aes_cmac[0x10]; // verified by Kirk command 0x12
} ids_cert_psp;
</source>
 
= Content =
{| class="wikitable"
!Key
!Information
!Unique?
|-
|0x4
|Baryon settings/information + extra data since TA-085v1
|Same per model
|-
|0x5
|Clockgen/I2C setup commands
|Same per model
|-
|0x6
|Battery, CPU frequency and general power settings + extra data since TA-085v1
|Same per model
|-
|0x7
|Unknown (exists since TA-085v1/TA-086, changed in TA-088)
|Yes
|-
|0x8
|Brightness hardware control (exists since TA-085v1/TA-086, changed in TA-085v2 and TA-088)
|Same per model
|-
|0x10
|MagicGate
|Yes
|-
|0x11
|MagicGate
|Yes
|-
|0x12
|MagicGate
|Same per model
|-
|0x13
|MagicGate
|Yes
|-
|0x40
|Contains the 0x5 bytes at 0x88 from key 0x10
|Yes
|-
|0x41
|USB (Driver type identifier) (slightly different since TA-085v1)
|Same per model
|-
|0x43
|USB (Device ID) (slightly different since TA-085v1)
|Same per model
|-
|0x44
|WLAN MAC Address (can be rebuilt using Noobz MAC Address Fixer)
|Yes
|-
|0x45
|WLAN Region (can be rebuilt using KeyCleaner)
|Partially
|-
|0x47
|Default parental lock level (first byte is 0x09, rest is empty)
|Same per model
|-
|0x50
|Serial number (not used since TA-082)
|Yes
|-
|0x51
|Firmware the PSP shipped with, and unknown unique data (exists since TA-085v1/TA-086)
|Yes
|-
|0x52
|Unused by PSP - Mostly the same per PSP except for slight variations, could be manufacturing info (exists since TA-085v1)
|Partially
|-
|0x54
|Default XMB background colour - first 3 bytes: 02 00 02 in PSP-200X IS, 02 00 00 in PSP-200X PB (exists since TA-085v1)
|Partially
|-
|0x100
|DNAS, VSH & Internet browser region, ad-hoc region (if missing, official updaters cannot run - error CTA80000025)
|Yes
|-
|0x101
|OpenPSID (non-indexed duplicate at [location of original + 0x8000])
|Yes
|-
|0x102
|UMD (non-indexed duplicate at [location of original + 0x8000])
|Yes
|-
|0x103
|UMD (non-indexed duplicate at [location of original + 0x8000])
|Yes
|-
|0x104
|UMD (non-indexed duplicate at [location of original + 0x8000])
|Yes
|-
|0x105
|UMD (non-indexed duplicate at [location of original + 0x8000])
|Yes
|-
|0x106
|UMD (non-indexed duplicate at [location of original + 0x8000])
|Yes
|-
|0x120-0x126
|Backup of respective 0x0100-106 key
|Yes
|-
|0x140
|Unknown unique data
|Yes
|}
* Leaves 0x100-0x11F are identical to their backup leaves 0x120-0x13F
* Old PSP revision haven't leaves 0x046, 0x047
* Very old PSP revisions haven't leaf 0x140
 
= Uses =
 
== IPL ==
 
The Stage 2 [[IPL]] (main.bin) reads 3 leaves, 0x004, 0x005 and 0x006. These leaves play a significant part in the PSP as they are related to power. In TA-082 and TA-086 PSP's, these leaves are at different locations, causing a brick with the 1.50 IPL.


0x004
0x004
Line 230: Line 31:
  0000000016  00 00 00 85 83 81 80 00-00 00 00 00 00 00 00 00  ................
  0000000016  00 00 00 85 83 81 80 00-00 00 00 00 00 00 00 00  ................


== Chkreg.prx ==
==Chkreg.prx==


=== sceChkregGetPsCode ===
Chkreg (chkreg.prx) reads 2 keys... 0x100 and 0x102 or 0x120 and 0x122 all contain the return of getpscode 3 times.
getpscode: 0x00 0x00 0x00 0x01 0x00 0x03 0x00 0x01


Chkreg (chkreg.prx) reads 2 leaves, 0x100 and 0x102 or 0x120 and 0x122.
==Region Key (0x0100)==


It gets PSID from the IdStorage and convert it to PsCode.
0000000048                          00 00 00 01 00 '''03''' 00 01          ........
0000000240  00 00 00 01 00 '''03''' 00 01                          ........       
0000000416                          00 00 00 01 00 '''03''' 00 01          ........
('''Highlighted Byte''' - 01 for Development Tool, 02 for Testing Tool, 03 for Japan, 04 for USA, 05 for Europe/Africa, 06 for Korea, 09 for Australia/New Zealand, 0A for Hong Kong and Singapore)


Example of PSP PsCode: 00 00 00 01 00 03 00 01
The rest of key is filled with random data, which is unique to each PSP. If this data is changed, getpscode will return: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00, meaning an invalid region. The data above is also the return of getpscode inside vshbridge.prx and chkreg.prx. The return from getpscode is determined to be valid or invalid via semaphore and openpsid... Getpscode first reads 0x100 or 0x120 into a buffer, this buffer is then sent to semaphore_4C537C72 (the same as OpenPSID) with the following args:


The return from sceChkregGetPsCode is determined to be valid or invalid via KIRK command 0x12, just like other functions using leaves 0x100, 0x120.
semaphore_4C537C72(0, 0, scrambled_buf, 0xb8, 0x12);


== openpsid.prx ==
Arg 1 - Destination. ??
Arg 2 - size. ??
Arg 3 - Buffer 0x100 or 0x120 was read into and is 512 bytes.
Arg 4 - Length. ??
Arg 5 - Semaphore key, and sends data to 2 modules, these are OpenPSID and memab. Once the scrambled buffer has been sent, "some check" is performed. If semaphore_4C537C72 ws sucessful, this part of getpscod returns 0, else it returns 0x80000108.


=== sceOpenPSIDGetPSID ===


sceOpenPSIDGetPSID first reads leaf 0x100 or 0x120 into a buffer using sceIdStorageLookup with the following args:
Getpscode reads 0x120 using sceIdStorageLookup with the following args:


  sceIdStorageLookup(0x120, 0x38, buf, 0xB8); // ???offset to check???
  sceIdStorageLookup(0x120, 0x38, scrambled_buf, 0xb8);
Arg 1 - Idstorage key.
Arg 2 - Offset within the 512 byte leaf. The 1st occurrence of the region (getpscode) is at 0x38, the second at 0xF0 and the third at 0x1A8. Each occurrence is 0xAF (175 bytes) apart.
Arg 3 - Buffer.
Arg 4 - Length.


The buffer is then sent to KIRK using sceUtilsBufferCopyWithRange with the following args:
==Memab==


sceUtilsBufferCopyWithRange(0, 0, buf, 0xB8, 0x12);
Memab (memab.prx) reads 1 key... once again being 0x100 or 0x120.


It sends data to 2 modules: OpenPSID and memab. Once the scrambled buffer has been sent, "some check" is performed.
Mgr (mgr.prx) reads 2 keys.


If sceUtilsBufferCopyWithRange is sucessful, this part of sceChkregGetPsCode returns 0, else it returns 0x80000108.
0x040
00000001E0  03 86 00 20 F8 47 90 88-58 99 2E 88 F8 47 90 88  ... .G..X....G..
00000001F0  25 00 00 00 64 99 2E 88-01 00 00 00 D0 99 2E 88  %...d...........


=== sceOpenPSIDGetOpenPSID ===
Another unknown key.


OpenPSID (openpsid.prx) reads 2 leaves, both relating to the region: 0x101 or 0x121 and 0x102 or 0x122. The OpenPSID is calculated via the above leaves and sceUtilsBufferCopyWithRange.
==OpenPSID==


It first reads 0x101 or 0x121 into a buffer. If this fails it returns 0xC0520001 and reads 0x102 or 0x122 into the buffer. If it fails again, it returns 0xC0520002.
OpenPSID (openpsid.prx) reads 2 keys, both relating to the region: 0x101 or 0x121 and 0x102 or 0x122. The OpenPSID is calculated via the above keys and semaphore. It first reads 0x101 or 0x121 into a buffer, if this fails it returns 0xC0520001 and reads 0x102 or 0x122 into the buffer, if thisfails again, it returns 0xC0520002. this is then passed to semaphore_4C537C72 with the following args:


The buffer is then passed to sceUtilsBufferCopyWithRange with the following args:
semaphore_4C537C72(0, 0, buf, 184, 0x12);


sceUtilsBufferCopyWithRange(0, 0, buf, 0xB8, 0x12);
The args are explained above.
If the function returns 1, OpenPSID returns 0x0xC0520001, else it returns 0.


If the sceUtilsBufferCopyWithRange returns 1, OpenPSID returns 0xC0520001, else it returns 0.
==Power==


== Memab ==
Power (power.prx) reads 1 key, 0x0004. This key is related to power and is also read by the IPL.


Memab (memab.prx) reads 1 leaf, 0x100 or 0x120.
==Umdman==


Mgr (mgr.prx) reads 2 leaves, 0x040 and another unknown leaf.
Umdman (umdman.prx) reads 1 key, 0x102. This key is related to the region, and is probably used to determine what UMD video's can be read on the PSP.


0x040
==USB==
00000001E0  03 86 00 20 F8 47 90 88-58 99 2E 88 F8 47 90 88  ... .G..X....G..
00000001F0  25 00 00 00 64 99 2E 88-01 00 00 00 D0 99 2E 88  %...d...........


Another unknown leaf.
===usb.prx===


== Power ==
USB (usb.prx) reads 1 key, 0x041. This key has information on the USB types.
 
Power (power.prx) reads 1 leaf, 0x0004. This leaf is related to power and is also read by the IPL.
 
== Umdman ==
 
Umdman (umdman.prx) reads 5 leafs, 0x102, 0x103, 0x104, 0x105, 0x106, 0x107. The leaf 0x102 is related to the region, and is probably used to determine what UMD video's can be read on the PSP.
 
== USB ==
 
=== usb.prx ===
 
USB (usb.prx) reads 1 leaf, 0x041. This leaf has information on the USB types.


0x041
0x041
Line 356: Line 157:
                                       0x65 0x00 0x20 0x00 0x45
                                       0x65 0x00 0x20 0x00 0x45


=== usbstor.prx ===
===usbstor.prx===


USBstor (usbstor.prx) reads 1 leaf, ?0x040 or 0x043?.
USBstor (usbstor.prx) reads 1 key, 0x043.


?0x040 or 0x043?
0x040
  0000000000  55 73 74 72 53 6F 6E 79-20 20 20 20 50 53 50 20  UstrSony    PSP  
  0000000000  55 73 74 72 53 6F 6E 79-20 20 20 20 50 53 50 20  UstrSony    PSP  
  0000000016  20 20 20 20 20 20 20 20-20 20 20 20 31 2E 30 30              1.00
  0000000016  20 20 20 20 20 20 20 20-20 20 20 20 31 2E 30 30              1.00
  0000000032  50 00 53 00 50 00 00 00-00 00 00 00 00 00 00 00  P.S.P...........  
  0000000032  50 00 53 00 50 00 00 00-00 00 00 00 00 00 00 00  P.S.P...........  


== WLAN ==
==WLAN==


WLAN (wlan.prx) reads 2 leaves, 0x044 and 0x045.
WLAN (wlan.prx) reads 2 keys, 0x044 and 0x045.


0x044
0x044
Line 375: Line 176:
  0000000000  03 00 01                                        ...             
  0000000000  03 00 01                                        ...             


These leaves contains the MAC address of the PSP. This can be changed, but does not effect the hardware, only the address displayed under System Information.
This key contains the MAC address of the PSP. This can be changed, but does not effect the hardware, only the address displayed under System Information.


== Sysconf_plugin ==
==Sysconf_plugin==


Sysconf_plugin (sysconf_plugin.prx) reads 1 leaf, 0x044. This is probably why the VSH displays a different MAC address when leaves 0x044/0x045 are changed.
Sysconf_plugin (sysconf_plugin.prx) reads 1 key, 0x044. This is probably why the VSH displays a different MAC address when 0x044 is changed.


== Vshmain ==
==Vshmain==


Vshmain (vshmain.prx) reads 1 leaf, 0x046.
Vshmain (vshmain.prx) reads 1 key, 0x046.


0x046
0x046
  Empty, however vshmain uses the first byte of this leaf to set a param for vshImposeSetParam.
  Empty, however vshmain uses the first byte of this key to set a param for vshImposeSetParam.  
 
= Legality of distribution =
 
There is question as to whether [[Sony]] are able to take legal action against those found to be distributing IDStorage leaves among the community, for research, repair, or otherwise. The worry is that the leaves are proprietary data (particularly UMD decryption leaves).


= Useful links =
=Legality of Distribution=


* [https://github.com/esxgx/uofw/blob/master/src/lowio/nand.c]
There is question as to whether [[Sony]] are able to take legal action against those found to be distributing IDStorage keys among the community, for research, repair, or otherwise. The worry is that the keys are proprietary data (particularly UMD Decryption keys).
* [https://gigawiz.github.io/yapspd/html_chapters_split/chap19.html#sec19.2.4]
* [https://xero1.wordpress.com/2007/01/06/hello-world/]
* [https://www.elotrolado.net/hilo_referencia-sobre-el-idstorage_839995]
Please note that all contributions to PSP Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PSP Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/psp/IDStorage"