net.scee.drm...
Digital Rights Management?
https://www.yourpsp.com/download/static ... ppletS.cab
or
https://www.yourpsp.com/download/static ... ppletS.jar
https://www.yourpsp.com/download/psp_usb/download.jsp
PSP Download Applet
Basically, I grabbed the JAR and started sifting through it. I'm on a mac, and it won't run. Does it run on windows systems? I can't tell from here :(
Anyway I decided to take a good look at the code that is contained in the jar file. While I won't post any code here, I would suggest that you all take a look at what is written in the code using JAD, a java decompiler. I'm only 3rd year CS, but I can tell that not only does the program grab the PSP's ID (This could be the private key) it also provides functions/methods for encryption and decryption.
This could be it, guys. The solution for running code on a 1.5 PSP.
Anyway I decided to take a good look at the code that is contained in the jar file. While I won't post any code here, I would suggest that you all take a look at what is written in the code using JAD, a java decompiler. I'm only 3rd year CS, but I can tell that not only does the program grab the PSP's ID (This could be the private key) it also provides functions/methods for encryption and decryption.
This could be it, guys. The solution for running code on a 1.5 PSP.
At last something I can really help with.
OK First impressions (this will not tell you too much, but is a start) - I will edit it later with further info as I find it.
The jar is a signed, unobfuscated (wow) applet.
1) Signed applet - means it runs in a browser (applet container) but could be allowed acces to local file system (since signed).
2) Unobfuscated means it is easy to read and work out what it does.
It should be possible to get a webpage to point to it and see what it does - more later.
OK First impressions (this will not tell you too much, but is a start) - I will edit it later with further info as I find it.
The jar is a signed, unobfuscated (wow) applet.
1) Signed applet - means it runs in a browser (applet container) but could be allowed acces to local file system (since signed).
2) Unobfuscated means it is easy to read and work out what it does.
It should be possible to get a webpage to point to it and see what it does - more later.
from pspdirstructure..
COMMON_DIR = "PPCD00001DLS001";
PSP_ID_FILENAME = "data2.bin";
so that's where it gets the id, i would imagine..
COMMON_DIR = "PPCD00001DLS001";
PSP_ID_FILENAME = "data2.bin";
so that's where it gets the id, i would imagine..
Chaosmachine Studios: High Quality Homebrew.
Amazing you beat me to it - that bit caught my interest too and I was just about to post about it - lol
But surely the PSP ID would be in firmware and not on the memory stick - is it possible that this is simply the ID to use for DRM and not the PSP ID itself?
I have a feeling that this applet will not be very useful (I may be wrong of course) since at the moment all it seems to do is put files on the Memory Stick using the windows mounted volume, hence ignoring the PSP altogether.
However if the data2.bin is the PSP id and it could be changed meaningfully then what would that mean?
1) Is PPCD00001DLS001 an accessible firmware directory that pretends to be part of the memory stick?
I'm probably talking out of my arse now so I'll shut up for the moment...
But surely the PSP ID would be in firmware and not on the memory stick - is it possible that this is simply the ID to use for DRM and not the PSP ID itself?
I have a feeling that this applet will not be very useful (I may be wrong of course) since at the moment all it seems to do is put files on the Memory Stick using the windows mounted volume, hence ignoring the PSP altogether.
However if the data2.bin is the PSP id and it could be changed meaningfully then what would that mean?
1) Is PPCD00001DLS001 an accessible firmware directory that pretends to be part of the memory stick?
I'm probably talking out of my arse now so I'll shut up for the moment...
OMG identity.class would seem to have some very interesting information in it.
I will not post source since I'm sure that would be illegal, but it seems to be able to read firmware version, nickname, hardwareid and timestamp.
It does this via an SHA1 cypher which has a key as the first bit of the file.
How useful is this?
I will not post source since I'm sure that would be illegal, but it seems to be able to read firmware version, nickname, hardwareid and timestamp.
It does this via an SHA1 cypher which has a key as the first bit of the file.
How useful is this?
Sorry, key seems to be at the end of the file - after a 'fingerprint' ??
It seems that the file has format
version 4 bytes
hardwareId 20 bytes
timeStamp 4 bytes
nickName 208 bytes
fingerprint 20 bytes
if the passed in recordSize is greater than 256 then there is a 20 byte key.
In IdentityCollection.class we see that the record length is 276 byte and that data2.bin must be an exact multiple of this to be valid. Also this means that there is a key.
This is probably to do with DRM isn't it???
It seems that the file has format
version 4 bytes
hardwareId 20 bytes
timeStamp 4 bytes
nickName 208 bytes
fingerprint 20 bytes
if the passed in recordSize is greater than 256 then there is a 20 byte key.
In IdentityCollection.class we see that the record length is 276 byte and that data2.bin must be an exact multiple of this to be valid. Also this means that there is a key.
This is probably to do with DRM isn't it???
here is what it looks like to me. PPCD00001DLS001 is a public folder that all games can access. it's most likely created when you format the memstick in the psp. after formatting, the psp dumps the psp id into a .bin file, so games can access it easily.
Chaosmachine Studios: High Quality Homebrew.
i like this.
INTERNAL_KEY[] = Util.parseBytes("D3C64E430B3F2C1152DBFEF1A5C71CA4");
INTERNAL_KEY[] = Util.parseBytes("D3C64E430B3F2C1152DBFEF1A5C71CA4");
Chaosmachine Studios: High Quality Homebrew.
my guess is that it uses that key to determine if the data from the data2.bin file is authentic, for drm purposes..
Chaosmachine Studios: High Quality Homebrew.
Ok - apologies in advance if this is illegal (and please remove it if it is).
Here is a little java file that takes a data2.bin formatted file name as input and outputs a little information from it.
It is unfortunately not self contained as it uses the SHA1CypherStream object from the jar and I haven't had time to write my own. Hope it helps someone
package com.piercer.psp;
Here is a little java file that takes a data2.bin formatted file name as input and outputs a little information from it.
It is unfortunately not self contained as it uses the SHA1CypherStream object from the jar and I haven't had time to write my own. Hope it helps someone
package com.piercer.psp;
Code: Select all
import java.io.FileInputStream;
import java.io.File;
import java.io.InputStream;
public class Data2Reader
{
private static final char HEX[] =
{
'0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
'A', 'B', 'C', 'D', 'E', 'F'
};
public static void main (String[] args)
{
File data2File=new File(args[0]);
long fileLength = data2File.length();
if(fileLength % 276L != 0L)
{
System.out.println("Error: File length not multiple of 276");
System.exit(1);
}
else
{
try
{
InputStream dis = new FileInputStream(data2File);
int nIdent = (int) (fileLength / 276L);
for(int i = 0; (long)i < nIdent; i++)
{
byte[] version = new byte[4];
byte[] hardwareId = new byte[20];
byte[] timeStamp = new byte[4];
byte[] nickName = new byte[208];
byte[] fingerprint = new byte[20];
byte[] key = new byte[20];
dis.read(version);
dis.read(hardwareId);
dis.read(timeStamp);
dis.read(nickName);
dis.read(fingerprint);
dis.read(key);
SHA1CipherStream cipher = new SHA1CipherStream(key);
cipher.xor(version);
cipher.xor(hardwareId);
cipher.xor(timeStamp);
cipher.xor(nickName);
cipher.xor(fingerprint);
System.out.println("Found identity: "+convertToString(nickName));
System.out.println("HardwareID: "+dump(hardwareId));
System.out.println("Version: "+dump(version));
System.out.println("TimeStamp: "+dump(timeStamp));
System.out.println();
}
}
catch (Exception e)
{
System.out.println("Error: "+e);
}
}
}
public static final String convertToString(byte[] input)
{
try
{
int n=0;
while (input[n]!=0) n++;
return new String(input, 0, n, "UTF8");
}
catch(Exception e)
{
return null;
}
}
public static final String dump(byte a[])
{
StringBuffer buf = new StringBuffer();
for(int i = 0; i < a.length; i++)
{
buf.append(HEX[a[i] >> 4 & 0xf]);
buf.append(HEX[a[i] & 0xf]);
}
return buf.toString();
}
}
Re: PSP Download Applet
What is that page supposed to do? I tried it (both with and without my PSP connected) and I just get a "your session has timed out" error. Is there a particular sequence of pages I should be going through to get there?Vampire wrote:https://www.yourpsp.com/download/psp_usb/download.jsp
Dan Jackson
Re: PSP Download Applet
try http://www.wipeoutpure.com/Danj wrote:What is that page supposed to do? I tried it (both with and without my PSP connected) and I just get a "your session has timed out" error. Is there a particular sequence of pages I should be going through to get there?Vampire wrote:https://www.yourpsp.com/download/psp_usb/download.jsp
I don't think so. It does the same what the wipeout pure browser does: Downloading something, extracting it and storing it to the memory stick. The only interesting thing is the SHA1 fingerprint check, because game files and other things could use the same signing method (but which is not related to the encryption for executables).Yanks wrote:This could be it, guys. The solution for running code on a 1.5 PSP.
Well, it's still an interesting development even if it is only the encryption for save files. It'd allow hacking of save files, which might then lead to being able to craft a malformed save file to cause a buffer overflow or some other exploit. Personally I'd be quite interested in being able to read data from my Metal Gear Acid save files; not because I want to cheat, but because I want to write a better deck editor/viewer on my PC.Shine wrote:I don't think so. It does the same what the wipeout pure browser does: Downloading something, extracting it and storing it to the memory stick. The only interesting thing is the SHA1 fingerprint check, because game files and other things could use the same signing method (but which is not related to the encryption for executables).Yanks wrote:This could be it, guys. The solution for running code on a 1.5 PSP.
Dan Jackson
See standard Java doc: http://www.unix.org.ua/orelly/java-ent/ ... ppa_02.htmMindWall wrote:just want to point out that the CAB and the JAR files are different, and the JAR contains a few more files...
including a file called SCEE.DSA
thanx this explains a few things :)
A signed JAR file is identical to a standard JAR file except that a signed JAR file contains two additional entries:
SIGNER.SF--A file containing an SHA message digest for each class file in the archive. The digest is calculated from the three lines in the manifest for the class file. The base of this name (SIGNER) varies; it is typically based upon the alias of the keystore entry used to sign the archive.
SIGNER.DSA--A file containing the digital signature of the .SF file. The base of this name matches the first part of the .SF file; the extension is the algorithm used to generate the signature. This file also contains the certificate of the entity that signed the archive.
The algorithm used to generate the signature depends upon the type of the key found in the keystore: if the key is a X509 (DSA) key, a DSA signature will be generated. If the key is an RSA key, an RSA signature will be generated (assuming you have installed a security provider capable of producing such signatures). If you have a keystore that contains other types of keys, jarsigner will be unable to use them to sign the JAR file.
These entries are held in the META-INF directory of the JAR file.
Only by curiosity
Go to http://www.wipeoutpure.com and login, now you can make requests to the server DCDP:
https://www.yourpsp.com/download/DCDP/O ... CALE=en_US
https://www.yourpsp.com/download/DCDP/G ... CALE=en_US
https://www.yourpsp.com/download/DCDP/G ... ck1_040505
https://www.yourpsp.com/download/DCDP/G ... ck1_040505
What is DCDP server?
Go to http://www.wipeoutpure.com and login, now you can make requests to the server DCDP:
https://www.yourpsp.com/download/DCDP/O ... CALE=en_US
Code: Select all
<properties>
version=0.20
sessionId=XXXXXXXXXXXXXXXXXX
status=true
valid=true
</properties>Code: Select all
<properties>
version=0.20
sessionId=XXXXXXXXXXXXXXXXXX
assets=liverpool_wop_ucus98612dgammapack1_040505
status=true
valid=true
</properties>Code: Select all
<properties>
version=0.20
sessionId=XXXXXXXXXXXXXXXXXX
name=liverpool_wop_ucus98612dgammapack1_040505
is-restricted=false
length=3660555
file-fingerprint=2A430FFF2867A89DFD8EF2429DBDDE74148E7D91
is-downloadable=true
external=true
application=1
provider=1
is-boundtouser=true
location=http://download.yourpsp.com/psp_asset/UCUS98612DGAMMAPACK1.zip
signature-level=0
content-type=application/octet-stream
local-storage=/PSP/SAVEDATA/UCUS98612DGAMMAPACK1
is-archive=true
status=true
valid=true
</properties>https://www.yourpsp.com/download/DCDP/G ... ck1_040505
Code: Select all
<DOWNLOAD FILE UCUS98612DGAMMAPACK1.zip>http://www.research.ibm.com/people/a/archan/pcs2001.pdf
related to dynamically creating wireless networks if it matches the pdf.
related to dynamically creating wireless networks if it matches the pdf.
OK a question for UTF knowledgeable out there.
My nickname is Piercer on my PSP looking at the way this is stored in DATA2.BIN decrrypted/dehashed of course it looks like
50EFBD P
89EFBD i
85EFBD e
92EFBD r
83EFBD c
85EFBD e
92E38080 r (but slightly different) ????
What for of UTF is this - even though its supposed to be UTF8.
Any info on this encoding and how to view it as ascii?
My nickname is Piercer on my PSP looking at the way this is stored in DATA2.BIN decrrypted/dehashed of course it looks like
50EFBD P
89EFBD i
85EFBD e
92EFBD r
83EFBD c
85EFBD e
92E38080 r (but slightly different) ????
What for of UTF is this - even though its supposed to be UTF8.
Any info on this encoding and how to view it as ascii?
on UTF I've encountered before, the last byte mapped to the ASCII value. It looks like something similiar here, only the lowercase values are offset by 0x20.
for example, (with help from www.lookuptables.com)
0x50 = P
0x69 = i = 0x89 - 0x20
0x65 = e = 0x85 - 0x20
0x72 = r = 0x92 - 0x20
0x63 = c = 0x83 - 0x20
0x55 = e = 0x85 - 0x20
0x72 = r = 0x92 - 0x20
Either your decoding method is slightly wrong, or the version of UTF has the lowercase characters mapped with the LSB(assumably) offset +0x20.
In either case you could just take that LSB, and if it's value is > 0x81, subtract 0x20 and you have the ASCII value for it.
for example, (with help from www.lookuptables.com)
0x50 = P
0x69 = i = 0x89 - 0x20
0x65 = e = 0x85 - 0x20
0x72 = r = 0x92 - 0x20
0x63 = c = 0x83 - 0x20
0x55 = e = 0x85 - 0x20
0x72 = r = 0x92 - 0x20
Either your decoding method is slightly wrong, or the version of UTF has the lowercase characters mapped with the LSB(assumably) offset +0x20.
In either case you could just take that LSB, and if it's value is > 0x81, subtract 0x20 and you have the ASCII value for it.