Difference between revisions of "Ticket"
Jump to navigation
Jump to search
(Added some padding, also added ending locations) |
(Changed some more stuff. Added observations about VC games' tickets.) |
||
| Line 1: | Line 1: | ||
| − | Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key" and the Title ID of the data followed by a [[certificate chain]]. | + | Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key" and the Title ID of the data followed by a [[certificate chain]]. VC games do not have Certificate Chains. |
So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4) | So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4) | ||
| Line 33: | Line 33: | ||
| 0x01bf | | 0x01bf | ||
| 63 | | 63 | ||
| − | | | + | | Unknown (0, unless it is a VC game) |
|- | |- | ||
| 0x01bf | | 0x01bf | ||
| Line 53: | Line 53: | ||
| 0x01f1 | | 0x01f1 | ||
| 13 | | 13 | ||
| − | | | + | | Unknown |
|- | |- | ||
| 0x01f1 | | 0x01f1 | ||
| Line 63: | Line 63: | ||
| 0x0222 | | 0x0222 | ||
| 48 | | 48 | ||
| − | | | + | | Unknown. Is all 0 for non-VC, for VC, all 0 except last byte is 1. |
|- | |- | ||
| 0x0222 | | 0x0222 | ||
Revision as of 09:42, 3 November 2008
Tickets are found in many encrypted files used by the Wii (e.g. WAD Files or Wiidiscs). They contain the encrypted AES "title key" and the Title ID of the data followed by a certificate chain. VC games do not have Certificate Chains. So far only tickets with RSA-2048 signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
File structure
| Start | End | Length | Description |
|---|---|---|---|
| 0x0000 | 0x0004 | 4 | Signature type (always 0x10001 for RSA-2048) |
| 0x0004 | 0x0104 | 256 | Signature by a certificate's key (everything after this field is covered by this signature) |
| 0x0104 | 0x0140 | 60 | Padding (Always 0) |
| 0x0140 | 0x0180 | 64 | Signature issuer |
| 0x0180 | 0x01bf | 63 | Unknown (0, unless it is a VC game) |
| 0x01bf | 0x01cf | 16 | Encrypted title key |
| 0x01cf | 0x01bf | 16 | Unknown |
| 0x01dc | 0x01e4 | 8 | Title ID / Initialization Vector (IV) used for AES-CBC encryption |
| 0x01e4 | 0x01f1 | 13 | Unknown |
| 0x01f1 | 0x01f2 | 1 | Common Key index (1 = Korean Common key, 0 = "normal" Common key) |
| 0x01f2 | 0x0222 | 48 | Unknown. Is all 0 for non-VC, for VC, all 0 except last byte is 1. |
| 0x0222 | 0x0242 | 32 | Always 0xFF (?) |
| 0x0242 | 0x0244 | 2 | Padding (Always 0) |
| 0x0244 | 0x0248 | 4 | Enable time limit (1 = Enabled, 0 = Disabled) |
| 0x0248 | 0x024a | 4 | Time limit (Seconds) |
| 0x024a | 0x02a4 | 90 | Padding (Always 0) |
To get the title key decrypt the 16 bytes at offset 0x1bf with the Common Key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero).