Difference between revisions of "Ticket"

From WiiBrew
Jump to navigation Jump to search
(Added links of the encryption algorithms)
(Fixed incorrect offset and clarified some text.)
Line 1: Line 1:
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] key, the Title ID of the data and are followed by a [[certificate chain]].
+
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] key and the Title ID of the data followed by a [[certificate chain]].
So far I have only seen tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
+
So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
  
 
=== File structure ===  
 
=== File structure ===  
Line 23: Line 23:
 
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" | 0x1bf
 
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" | 0x1bf
 
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 16
 
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 16
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | Encrypted Title key
+
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | Encrypted title key
 
|- style="background-color: #ddd;"
 
|- style="background-color: #ddd;"
 
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" | 0x1dc
 
| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" | 0x1dc
Line 34: Line 34:
 
|}
 
|}
  
To get the title key decrypt the 16 bytes at offset 0x1dc using the master key and the Title ID as IV.
+
To get the title key decrypt the 16 bytes at offset 0x1bf with the master key using the Title ID (offset 0x1dc) as the initialization vector.
  
 
{{Languages|Ticket}}
 
{{Languages|Ticket}}

Revision as of 21:29, 16 May 2008

Tickets are found in many encrypted files used by the Wii (e.g. WAD Files or Wiidiscs). They contain the encrypted AES key and the Title ID of the data followed by a certificate chain. So far only tickets with RSA-2048 signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)

File structure

Start Length Description
0x000 4 Signature type (always 0x10001 for RSA-2048 (to be confirmed))
0x005 256 Signature by a certificate's key (everything after this field is covered by this signature)
0x140 64 Signature issuer
0x1bf 16 Encrypted title key
0x1dc 8 Title ID / Initialization Vector (IV) used for AES-CBC encryption
0x222 32 Always 0xFF (?)

To get the title key decrypt the 16 bytes at offset 0x1bf with the master key using the Title ID (offset 0x1dc) as the initialization vector.