Difference between revisions of "Ticket"
Jump to navigation
Jump to search
| Line 36: | Line 36: | ||
To get the title key decrypt the 16 bytes at offset 0x1bf with the master key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero). | To get the title key decrypt the 16 bytes at offset 0x1bf with the master key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero). | ||
| + | <b>TO CONFIRM:</b> xt5 has said on HackMii that offset 0x1F1 is used in Korean Wiis to use a different common key. Can someone confirm/update? | ||
{{Languages|Ticket}} | {{Languages|Ticket}} | ||
Revision as of 14:41, 22 June 2008
Tickets are found in many encrypted files used by the Wii (e.g. WAD Files or Wiidiscs). They contain the encrypted AES key and the Title ID of the data followed by a certificate chain. So far only tickets with RSA-2048 signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
File structure
| Start | Length | Description |
| 0x000 | 4 | Signature type (always 0x10001 for RSA-2048 (to be confirmed)) |
| 0x005 | 256 | Signature by a certificate's key (everything after this field is covered by this signature) |
| 0x140 | 64 | Signature issuer |
| 0x1bf | 16 | Encrypted title key |
| 0x1dc | 8 | Title ID / Initialization Vector (IV) used for AES-CBC encryption |
| 0x222 | 32 | Always 0xFF (?) |
To get the title key decrypt the 16 bytes at offset 0x1bf with the master key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero).
TO CONFIRM: xt5 has said on HackMii that offset 0x1F1 is used in Korean Wiis to use a different common key. Can someone confirm/update?