St4rk documente les clés PFS de la PS Vita

Le développeur Maxton quand à lui en profite pour mettre à jour son programme GameArchiveExplorer qui passe en version v0.9.0 qui vient justement corriger un bug sur PFS.

 

 

GameArchives ArchiveExplorer v0.8.0

(Library) Add PSARC support, for zlib-compressed archives.

(Library) Begin work on archive modification.

(ArchiveExplorer) Add property view.

 

GameArchives ArchiveExplorer0.9.0

 

(Library) Fixed a bug in PFS dirent reading that could leave files missing

(ArchiveExplorer) Added editor window with Disk Defragmenter-esque usage chart and file replacement (for Xbox ISOs only)

For binaries (.NET 4.5 required) download "Release-0.9.0.zip" below.

 

 

 

1a) The cart has encryption on the raw data (that's why if you dump it externally, you'll see encrypted data). However, as soon as the game is placed into the vita, that layer is decrypted before the vita sees the game. Then we have "gro0" mounted, which is the unencrypted FAT partition.

 

1b) Digital games are encrypted in the SCE PKG format. Basically there is an encryption key chosen (at random) by the developer. The package is encrypted and signed by sony. Package Installer can get past this encryption (and it does for drm-free packages). For other packages, package installer sees that you don't have a license and errors out, but you can bypass this without kernel or anything (exercise left for the reader). Once the package is decrypted, it is basically an archive of files that is extracted to "ux0"

 

2) The second layer of encryption is PFS. All game data (images, textures, executables, etc) are encrypted with PFS. PFS key is derived from a passphrase chosen by the developer. It is also signed (either with a key derived from the passphrase or with sony's key, I'm not sure). This layer is decrypted when a game is mounted (gro0: => app0: or ux0:app/titleid => app0). mr.gas & major_tom's trick gets you past this layer.

 

3) Now, the showstopper. Game executable files (eboot.self, *.suprx, etc) are encrypted through NPDRM. The key to decrypt this is derived from ux0:license/titleid/*.rif AND tm0:npdrm/act.dat (for digital games) or just gro0:license/titleid/*.rif (for game cart). Of course, the key derivation process includes secrets that userland/system does not have access to and therefore there is no current public way of decrypting it. This is the last line of defense for Sony.

 

Basically #1 can be bypassed through BlackFin or HENkaku's FS access. #2 was bypassed by mr.gas and Major_Tom's pfs mounting trick. And we are waiting for #3 to be bypassed before the floodgates of piracy opens."