IDStorage
Location
IDStorage is located after the IPL on the nand at 0xC0000.
Description
It is used to store low-level information on the PSP, such as the serial, MAC address, UMD, WLAN and region. Most idstorage keys have a pair, although some do not (explained later.)
Structure
Idstorage keys are 512 (+16) bytes and are stored in an index of two nand pages (512 bytes.) Nand pages are also 515 (+16 spare area) bytes. The index of idstorage is identified by byte 6 of the spare (0x73), byte 7 is the idstorage version, byte is either 1 or 0; depending on whether the idstorage has been formatted or not (???), and finally byte 9 indicates if the idstorage is read-only or not.
Idstorage keys are 16 bit integers and are stored in the corresponding user areas. For example, a key appearing at position 27 (byte 54) in the index would find its associated data at the location:0xc0000 + (27 * 512) = 0xC3600
Importance to PSP Functions
As major functions such as UMD Decryption, Ad Hoc and DNAS Authentication rely on IDStorage keys, the loss or corruption of keys can be crippling to the usability of the PSP. Users are strongly recommended to take a NAND Backup, giving them the opportunity to restore their IDStorage using a tool such as NandTool.
Generation
Most of the idstorage generation process is detailed in Despertar Del Cementerio (sources available here: https://github.com/mathieulh/Despertar-Del-Cementerio).
- some PSP JigKick files contain information on how to (re)generate idstorage leaves
- DespertarDelCementerio v7 also contains information about idstorage (re)generation.
- the most significant module used by DCv7 used to do this is idsregeneration.prx
(see DCv7 src code https://github.com/mathieulh/Despertar-Del-Cementerio/tree/master/idsregeneration).
- you can see a plethora of "templates" which are used for the generation of the idstorage sections.
- the idstorage regeneration requires 2, probably more parameters -> Region, MAC Address, and likely a timestamp of sorts.
- on ps3 the generation method wasn't found on the JigKick firmware files (and selfs). however, it seems that factory still does this, but by accessing a server, so the information cannot be deduced anymore unless there's access to the server.
- together with the idps (called PSID on PSP), the openPSID is also generated on PSP (written to IdStorage).
- there are 12 sections on PSP, unlike the 11 ones on PS3 EID0.
IDStorage certified sections
IDStorage certified sections are a security measure for critical information. For example PSID and OpenPSID are certified (leaves 0x100, 0x101, 0x120, 0x121).
KIRK command 0x12 is used to verify IDStorage certificates.
Stucture
Some of the leaves contain certificates similar in PSP, PS3 and PSVita.
Size is 0xB8 bytes: 0x10 bytes of data and 0xA8 bytes of certificate.
| Name | Size | Description |
|---|---|---|
| Data | 0x10 | contains the actual data (either PSID or OpenPSID) |
| plaintext public key | 0x28 | contains the certificate's public key (without padding) |
| R | 0x14 | part of the ECDSA signature pair (R, S) |
| S | 0x14 | part of the ECDSA signature pair (R, S) |
| public key | 0x28 | ECDSA public key (unknown what this is doing here) |
| encrypted private key | 0x20 | encrypted blob that contains the certificate's private key (with padding) |
| omac/cmac1 | 0x10 | hash of the previous information in CMAC1/OMAC mode |
Uses
IPL
The Stage 2 IPL (main.bin) reads 3 keys from the idstorage, 0x004, 0x005 and 0x006. These keys play a significant part in the PSP as they are related to power. In TA-082 and TA-086 PSP's, these keys are at different locations, causing a brick with the 1.50 IPL.
0x004
0000000000 6E 79 72 42 01 00 00 00-10 00 00 00 BB 01 AB 1F nyrB............ 0000000016 D8 00 24 00 14 31 14 00-94 01 48 00 D8 00 00 00 ..$..1....H.....
0x005
0000000000 67 68 6C 43 01 00 00 00-01 00 00 00 CA D9 E3 9B ghlC............ 0000000016 0A 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x006
0000000000 72 64 44 4D 01 00 00 00-07 00 00 00 85 BD 2C 75 rdDM..........,u 0000000016 00 00 00 85 83 81 80 00-00 00 00 00 00 00 00 00 ................
Chkreg.prx
sceChkregGetPsCode
Chkreg (chkreg.prx) reads 2 keys, 0x100 and 0x102 or 0x120 and 0x122. All contain the PsCode at 3 locations. The 1st occurrence of the PsCode is at 0x38, the second at 0xF0 and the third at 0x1A8. Each occurrence is 0xAF (175 bytes) apart.
Example of PsCode:
0000000048 00 00 00 01 00 03 00 01 ........ 0000000240 00 00 00 01 00 03 00 01 ........ 0000000416 00 00 00 01 00 03 00 01 ........
The return from sceChkregGetPsCode is determined to be valid or invalid via KIRK command 0x12, just like other functions using IDStorage keys 0x100, 0x120.
openpsid.prx
sceOpenPSIDGetPSID
sceOpenPSIDGetPSID first reads leaf 0x100 or 0x120 into a buffer using sceIdStorageLookup with the following args:
sceIdStorageLookup(0x120, 0x38, buf, 0xB8); // ???offset to check???
The buffer is then sent to KIRK using sceUtilsBufferCopyWithRange with the following args:
sceUtilsBufferCopyWithRange(0, 0, buf, 0xB8, 0x12);
It sends data to 2 modules: OpenPSID and memab. Once the scrambled buffer has been sent, "some check" is performed.
If sceUtilsBufferCopyWithRange is sucessful, this part of sceChkregGetPsCode returns 0, else it returns 0x80000108.
sceOpenPSIDGetOpenPSID
OpenPSID (openpsid.prx) reads 2 keys, both relating to the region: 0x101 or 0x121 and 0x102 or 0x122. The OpenPSID is calculated via the above keys and sceUtilsBufferCopyWithRange.
It first reads 0x101 or 0x121 into a buffer. If this fails it returns 0xC0520001 and reads 0x102 or 0x122 into the buffer. If it fails again, it returns 0xC0520002.
The buffer is then passed to sceUtilsBufferCopyWithRange with the following args:
sceUtilsBufferCopyWithRange(0, 0, buf, 0xB8, 0x12);
If the sceUtilsBufferCopyWithRange returns 1, OpenPSID returns 0xC0520001, else it returns 0.
Memab
Memab (memab.prx) reads 1 key, 0x100 or 0x120.
Mgr (mgr.prx) reads 2 keys, 0x040 and another unknown key.
0x040
00000001E0 03 86 00 20 F8 47 90 88-58 99 2E 88 F8 47 90 88 ... .G..X....G.. 00000001F0 25 00 00 00 64 99 2E 88-01 00 00 00 D0 99 2E 88 %...d...........
Another unknown key.
Power
Power (power.prx) reads 1 key, 0x0004. This key is related to power and is also read by the IPL.
Umdman
Umdman (umdman.prx) reads 1 key, 0x102. This key is related to the region, and is probably used to determine what UMD video's can be read on the PSP.
USB
usb.prx
USB (usb.prx) reads 1 key, 0x041. This key has information on the USB types.
0x041
0000000000 4C 05 00 00 0A 03 53 00-6F 00 6E 00 79 00 00 00 L.....S.o.n.y... 0000000064 00 00 00 00 05 00 00 00-C8 01 00 00 16 03 50 00 ..............P. 0000000080 53 00 50 00 20 00 54 00-79 00 70 00 65 00 20 00 S.P. .T.y.p.e. . 0000000096 41 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 A............... 0000000128 00 00 00 00 00 00 00 00-00 00 00 00 C9 01 00 00 ................ 0000000144 16 03 50 00 53 00 50 00-20 00 54 00 79 00 70 00 ..P.S.P. .T.y.p. 0000000160 65 00 20 00 42 00 00 00-00 00 00 00 00 00 00 00 e. .B........... 0000000208 CA 01 00 00 16 03 50 00-53 00 50 00 20 00 54 00 ......P.S.P. .T. 0000000224 79 00 70 00 65 00 20 00-43 00 00 00 00 00 00 00 y.p.e. .C....... 0000000272 00 00 00 00 CB 01 00 00-16 03 50 00 53 00 50 00 ..........P.S.P. 0000000288 20 00 54 00 79 00 70 00-65 00 20 00 44 00 00 00 .T.y.p.e. .D... 0000000336 00 00 00 00 00 00 00 00-CC 01 00 00 16 03 50 00 ..............P. 0000000352 53 00 50 00 20 00 54 00-79 00 70 00 65 00 20 00 S.P. .T.y.p.e. . 0000000368 45 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 E...............
Offset Description Data
0x0000 idVendor 0x4C 0x05
0x0002 ??? 0x00 0x00
0x0004 bLength 0x0A
0x0005 ??? 0x03
0x0006 iManufacturer String 0x53 0x00 0x6F 0x00 0x6E 0x00 0x79
0x0044 ? bNum 0x05
0x0045 ??? 0x00 0x00 0x00
0x0048 idProduct 0xC8 0x01
0x004A ??? 0x00 0x00
0x004C bLength 0x16
0x004D ? bDescriptorType 0x03
0x004E iProduct String 0x50 0x00 0x53 0x00 0x50 0x00 0x20
0x00 0x54 0x00 0x79 0x00 0x70 0x00
0x65 0x00 0x20 0x00 0x41
0x008C idProduct 0xC9 0x01
0x008E ??? 0x00 0x00
0x0090 bLength 0x16
0x0091 ? bDescriptorType 0x03
0x0092 iProduct String 0x50 0x00 0x53 0x00 0x50 0x00 0x20
0x00 0x54 0x00 0x79 0x00 0x70 0x00
0x65 0x00 0x20 0x00 0x42
0x00D0 idProduct 0xCA 0x01
0x00D2 ??? 0x00 0x00
0x00D4 bLength 0x16
0x00D5 ? bDescriptorType 0x03
0x00D6 iProduct String 0x50 0x00 0x53 0x00 0x50 0x00 0x20
0x00 0x54 0x00 0x79 0x00 0x70 0x00
0x65 0x00 0x20 0x00 0x43
0x0114 idProduct 0xCB 0x01
0x0116 ??? 0x00 0x00
0x0118 bLength 0x16
0x0119 ? bDescriptorType 0x03
0x011A iProduct String 0x50 0x00 0x53 0x00 0x50 0x00 0x20
0x00 0x54 0x00 0x79 0x00 0x70 0x00
0x65 0x00 0x20 0x00 0x44
0x0158 idProduct 0xCC 0x01
0x015A ??? 0x00 0x00
0x015C bLength 0x16
0x015D ? bDescriptorType 0x03
0x015E iProduct String 0x50 0x00 0x53 0x00 0x50 0x00 0x20
0x00 0x54 0x00 0x79 0x00 0x70 0x00
0x65 0x00 0x20 0x00 0x45
usbstor.prx
USBstor (usbstor.prx) reads 1 key, ?0x040 or 0x043?.
?0x040 or 0x043?
0000000000 55 73 74 72 53 6F 6E 79-20 20 20 20 50 53 50 20 UstrSony PSP 0000000016 20 20 20 20 20 20 20 20-20 20 20 20 31 2E 30 30 1.00 0000000032 50 00 53 00 50 00 00 00-00 00 00 00 00 00 00 00 P.S.P...........
WLAN
WLAN (wlan.prx) reads 2 keys, 0x044 and 0x045.
0x044
0000000000 00 16 FE 86 FA 28 .....(
0x045
0000000000 03 00 01 ...
This key contains the MAC address of the PSP. This can be changed, but does not effect the hardware, only the address displayed under System Information.
Sysconf_plugin
Sysconf_plugin (sysconf_plugin.prx) reads 1 key, 0x044. This is probably why the VSH displays a different MAC address when 0x044 is changed.
Vshmain
Vshmain (vshmain.prx) reads 1 key, 0x046.
0x046
Empty, however vshmain uses the first byte of this key to set a param for vshImposeSetParam.
Legality of Distribution
There is question as to whether Sony are able to take legal action against those found to be distributing IDStorage keys among the community, for research, repair, or otherwise. The worry is that the keys are proprietary data (particularly UMD Decryption keys).