Changes

Jump to navigation Jump to search
291 bytes removed ,  15:04, 7 February 2019
m
no edit summary
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]s). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key " and the Title ID of the data followed and are signed by a certificate from a [[certificate chain]](which usually is the same for all titles and stored somewhere on the NAND).So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
=== File structure === {| styleclass="border-collapse: collapse; padding: 0.2em 0.2em 0.2em 0.2em;wikitable"|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" | '''! Start'''| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | '''! End! Length'''| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | '''! Description'''|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x0000| 0x0000x0003| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 40x04| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | Signature type (always 0x10001 for RSA-2048 (to be confirmed))|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x0004| 0x0050x0103| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 2560x100| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" | Signature by a certificate's key |-| 0x0104| 0x013F| 0x3C| Padding (Always 0 - everything after this field is covered by this the above signature)|- style="background-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x0140| 0x017F| 0x40| 0x140Signature issuer| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 640x0180| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" 0x01BB| Signature issuer0x3C|ECDH data, used to generate one- style="backgroundtime key during install of console specific titles|-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ded;" 0x01BC| 0x01BE| 0x03| 0x1bfUnused/Padding| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 0x01BF| 160x01CE| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" 0x10| Encrypted title key|- style="background| 0x01CF| 0x01CF| 0x01| Unknown|-color: #ddd;"| style="border: 1px solid #ccc; padding: 0.2em; background0x01D0| 0x01D7| 0x08| ticket_id (used as IV for title key decryption of console specific titles) |-color: #ded;" | 0x01D8| 0x01DB| 0x04| 0x1dcConsole ID| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddd;" | 0x01DC| 80x01E3| style="border: 1px solid #ccc; padding: 0.2em; background-color: #edd;" 0x08| Title ID / [http://en.wikipedia.org/wiki/Initialization_Vector Initialization Vector] (IV) used for AES-[http://en.wikipedia.org/wiki/Cipher_Block_Chaining#Cipher-block_chaining_.28CBC.29 CBC] encryption|- style| 0x01E4| 0x01E5| 0x02| Unknown, mostly 0xFFFF|-| 0x01E6| 0x01E7| 0x02| Ticket title version|-| 0x01E8| 0x01EB| 0x04| Permitted Titles Mask|-| 0x01EC| 0x01EF| 0x04| Permit mask. The current disc title is ANDed with the inverse of this mask to see if the result matches the Permitted Titles Mask.|-| 0x01F0| 0x01F0| 0x01| Title Export allowed using PRNG key (1 ="backgroundallowed, 0 = not allowed)|-color| 0x01F1| 0x01F1| 0x01| Common Key index (2 = [http: #ddd;//wiiubrew.org/wiki/WiiMode Wii U Wii mode], 1 = Korean Common key, 0 = "normal"Common key)| style="border: 1px solid #ccc; padding: -| 0x01F2| 0x0221| 0x30| Unknown. Is all 0 for non-VC, for VC, all 0except last byte is 1.2em; background|-| 0x0222| 0x0261| 0x40| Content access permissions (one bit for each content)|-color: #ded;" | 0x0262| 0x0263| 0x2220x02| style="border: 1px solid #ccc; padding: Padding (Always 0.2em; background)|-color: #ddd;" | 0x0264| 0x0267| 320x04| styleEnable time limit (1 ="border: 1px solid #ccc; padding: Enabled, 0.2em; background= Disabled)|-| 0x0268| 0x026B| 0x04| Time limit (Seconds)|-color: #edd;" | 0x026C| 0x02A3| 0x38| Always 0xFF 7 more time_limit structs as above (?{int enable, seconds})
|}
To get the title key decrypt the 16 bytes at offset 0x1bf with the master key Common Key using the Title ID (offset 0x1dc) as the initialization vector(the last 8 bytes of the IV should be zero).
{{Languages|Ticket}}[[Category:File formats]]
91

edits

Navigation menu