PS3 SCETool v0.2.2 by Naehrwert Arrives, Fixes and Optimizations

Category: PS3 Hacks & JailBreak By: PS3 News - (twitter.com)
Tags: ps3 scetool scetool v0.2.2 naehrwert ps3hax ps3 hax ps3 hacks ps3 apps ps3 fixes

66w ago - Recently PlayStation 3 developer naehrwert has updated PS3 SCETool to version 0.2.2, which includes several fixes and optimizations as outlined below.

Download: PS3 SCETool v0.2.2 / ZLib1.dll File (Required)

From the included ReadMe file: History:

Version 0.2.2:

Added options to override control/capability flags (32 bytes each).
Fixed where a false keyset would crash scetool when decrypting a file.
Some source level changes and optimizations.

Version 0.2.1:

zlib is required to use scetool.
'sdk_type' was changed to 'revision' in data/keys.

Greetings to: you know who you are!

SCETool 0.2.2 (C) 2011-2012 by naehrwert

Setup:
 - /data/keys : Keyfile.
 - /data/ldr_curves : Loader curves (7744 bytes).
 - /data/vsh_curves : VSH curves (360 bytes).

Keyfile format:
 [keyname]
 type={SELF, RVK, PKG, SPP, OTHER}
 revision={00, ..., 18, 8000}
 version={..., 0001000000000000, ...}
 self_type={LV0, LV1, LV2, APP, ISO, LDR, UNK_7, NPDRM}
 key=...
 erk=...
 riv=...
 pub=...
 priv=...
 ctype=...

Keyset example:
 [metldr]
 type=SELF
 revision=00
 self_type=LDR
 erk=0000000000000000000000000000000000000000000000000000000000000000
 riv=00000000000000000000000000000000
 pub=00000000000000000000000000000000000000000000000000000000000000000000000000000000
 priv=000000000000000000000000000000000000000000
 ctype=00

NPDRM key(set) names:
 - [NP_tid]: Title ID OMAC1 key.
 - [NP_ci]: Control info OMAC1 key.
 - [NP_klic_free]: Free klicensee.
 - [NP_klic_key]: Klicensee key.
 - [NP_sig]: Footer signature ECDSA keyset.

Help text:
 USAGE: scetool [options] command
 COMMANDS           Parameters       Explanation
  -h, --help                         Print this help.
  -k, --print-keys                   List keys.
  -i, --print-infos file_in          Print SCE file info.
  -d, --decrypt     file_in file_out Decrypt/dump SCE file.
  -e, --encrypt     file_in file_out Encrypt/create SCE file.
 OPTIONS                Possible Values       Explanation
  -v, --verbose                               Enable verbose output.
  -0, --sce-type        SELF/RVK/PKG/SPP      SCE File Type
  -1, --compress-data   TRUE/FALSE(default)   Whether to compress data or not.
  -2, --key-revision    e.g. 00,01,...,0A,... Key Revision
  -3, --self-auth-id    e.g. 1010000001000003 Auth ID
  -4, --self-vendor-id  e.g. 01000002         Vendor ID
  -5, --self-type       LV0/LV1/LV2/APP/ISO/
                        LDR/NPDRM             SELF Type
  -6, --self-fw-version e.g. 0003004100000000 Firmware Version
  -7, --self-add-shdrs  TRUE(default)/FALSE   Whether to add ELF shdrs or not.
  -8, --self-ctrl-flags                       Override control flags.
  -9, --self-cap-flags                        Override capability flags.
  -a, --np-license-type FREE                  License Type
  -b, --np-app-type     SPRX/EXEC/UPDATE      App Type
  -c, --np-content-id                         Content ID
  -f, --np-real-fname   e.g. EBOOT.BIN        Real Filename
  -g, --np-add-sig      TRUE/FALSE(default)   Whether to add a NP sig. or not.

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

211 Comments - Go to Forum Thread »

#211 - JOHNBOI - 4d ago

what resigns pkgs from 4.40-4.41? looking for a tool to do this??

#210 - PS3 News - 1w ago

Today PlayStation 3 homebrew developer spacemanspiff has released OpenSCETool (OSCETool) v0.9.2 which is an open-source clone of the original SCETool followed by the SCETool source code by naehrwert with details below.

Download: https://github.com/spacemanspiff/oscetool/archive/master.zip / https://github.com/spacemanspiff/oscetool / https://github.com/naehrwert/scetool/archive/master.zip / https://github.com/naehrwert/scetool

To quote: OpenSCETool is a clone of scetool under an open source license. SCETool was reverse engineered and analized to produce this program, and copied his behaivour.

OpenSCETool (OSCETool) Changelogs:

Version 0.9.2

• Fixed rap/rif/idps/act.dat management. Now it works fine.

Version 0.9.1

• Fixed a segfault decrypt some SELFs.
• Added option -p to patch the sys_process_param when signing an ELF. This is the same as applying FixELF.exe before signing.
• Added support to klics.txt. If the klicensee is not specified, it is looked up in the data/klics.txt automatically (only for decrypt).

Version 0.9.0

• First commited version, compatible with SCETool 0.2.9.

Now GNU/Linux users can have a native tool too. If you want an SCETool replacement, remember to add this keys (this were in the code, you can find them in previous revisions of the code, or in flatz's rif/raf tools:

[NP_rap_initial]
type=OTHER
key=...

[NP_rap_pbox]
type=OTHER
key=...

[NP_rap_e1]
type=OTHER
key=...

[NP_rap_e2]
type=OTHER
key=....

From mind: Seems the keys are:

[NP_rap_initial]
type=OTHER
key=869F7745C13FD890CCF29188E3CC3EDF

[NP_rap_pbox]
type=OTHER
key=0C030604010B0F08020700050A0E0D09

[NP_rap_e1]
type=OTHER
key=A93E1FD67C55A329B75FDDA62A95C7A5

[NP_rap_e2]
type=OTHER
key=67D45DA3296D006A4E7C537BF5538C74

SCETool Changelog: History:

Version 0.2.9

• Plaintext sections will now take less space in metadata header keys array.
• Added option to specifiy a template SELF to take configuration values from.
• Added option to override the keyset used for en-/decryption.
• Fixed NP application types.
• [Firmware Version] will now be written to control info only.
• [Application Version] will now be written to application info only.

Version 0.2.8 (intermediate release):

• Fixed minor bugs where scetool would crash.
• Added SPP parsing.
• Decrypting RVK/SPP will now write header+data to file.

Version 0.2.7:

• Added local NP license handling.
• Added option to override klicensee.
• Added option to disable section skipping (in SELF generation).

Version 0.2.5:

• Added option to use provided metadata info for decryption.
• "PS3" path environment variable will now be searched for keys/ldr_curves/vsh_curves too.

Version 0.2.4:

• Added option to display raw values.
• Moved factory Auth-IDs to (as they are on ps3devwiki now).

Version 0.2.2:

• Added options to override control/capability flags (32 bytes each).
• Fixed where a false keyset would crash scetool when decrypting a file.
• Some source level changes and optimizations.

Version 0.2.1:

• zlib is required to use scetool.
• 'sdk_type' was changed to 'revision' in data/keys.

Greetings to: you know who you are!

More PlayStation 3 News...

#209 - PS3 News - 2w ago

Following up on his previous updates, today PlayStation 3 developer JjKkYu has released TrueAncestor EDAT Rebuilder v1.2 followed by v1.25 with details below.

Download: http://www.mediafire.com/?xi61k6jc9vj8g6s / http://www.mediafire.com/?hy22xvcu6l9y6x8

Changelogs:

v1.25:

1. Add subfolder traversal in edat/sdat folder.
2. Fix 2G+ file handling issue (probably).
3. Fix syntax issue while handling certian edat files.
4. Re-adjust the mainmenu.

v1.2:

1. Add SDAT file supporting.

v1.1:

1. Fix Java OutOfMemory for encrypting big files.
2. Add JVM Memory config in toolcore.cfg.

v1.0 Features:

1. Decrypt and encrypt edat files on pc.
2. Fast rebuild mode.
3. Batch mode.
4. Dev Klic should be input manually at now.

It seems Windows 8 cannot pass the java check.. maybe fix it in next version.

Finally, from oakhead69: Hi jjkkyu, If you have based your code on my C# code which in turn is based on the port by KDSBest. There is a significant bug in the reverseByteWithSizeFIX code.

It will fail the hash check on some data blocks, hench KDSBest removed the test. More importantly when generating the hash for the data blocks during encryption, the hash will be incorrect. Hench the resulting SDAT/EDAT will be bad. I have attached some updated code below.

public static byte[] reverseByteWithSizeFIX(byte[] b)
{
int i;
byte[] b2;

if (b.Length < 0x10 && (b[b.Length - 1] & 0x80) != 0)
{
b2 = new byte[0x10];
for (i = 0; i < b.Length; i++)
{
b2[b2.Length - 1 - i] = b[i];
}
for (i = b.Length; i < 0x10; i++)
{
b2[0x10 -1 - i] = 0xff;
}
}
else
{
b2 = new byte[b.Length];
for (i = 0; i < b2.Length; i++)
{
b2[b2.Length - 1 - i] = b[i];
}
}
return b2;
}

More PlayStation 3 News...

#208 - ps33ps - 4w ago

for me at the moment, a waste of time. 28 hours waiting and key not been found. UnEDAT show devklic very fast but klic is invalid. probably only flatz tools show good devklic

#207 - ps33ps - 4w ago

how to get devklic? i try to decrypt dlc gran tuismo 5 BCES00569 and i use Bruteforce Edat 1.0.4 but not working properly foundkey:

Decrypt: vou30.edat
Content ID: EP9001-BCES00569_00-0000000000000000
Done!
Key found: 00000000000000000000000000000000

Decrypt: vou30.edat
Content ID: EP9001-BCES00569_00-0000000000000000
Done!
Key found: 72F990788F9CFF745725F08E4C128387

Decrypt: vou30.edat
Content ID: EP9001-BCES00569_00-0000000000000000
Done!
Key found: 44F8C99E9272AEAAEFA946680E1DC590

Decrypt: vou30.edat
Content ID: EP9001-BCES00569_00-0000000000000000
Done!
Key found: 8D5B3D9ACE0BAC2794A1434D92E689F7

Decrypt: vou30.edat
Content ID: EP9001-BCES00569_00-0000000000000000
Done!
Key found: 00875F084DF2B8D68AA06D55335E1276

and many more, but any key doesn't work

regards