Changes

Jump to navigation Jump to search
1,360 bytes added ,  15:04, 7 February 2019
m
no edit summary
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]s). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key" and the Title ID of the data followed and are signed by a certificate from a [[certificate chain]](which usually is the same for all titles and stored somewhere on the NAND).So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
=== File structure ===
{| class="wikitable"
|-
! Start
! End
! Length
! Description
|-
| 0x0000x0000| 40x0003| 0x04
| Signature type (always 0x10001 for RSA-2048)
|-
| 0x0050x0004| 2560x0103| 0x100| Signature by a certificate's key (everything after this field is covered by this signature)
|-
| 0x1400x0104| 640x013F| 0x3C| Padding (Always 0 - everything after this field is covered by the above signature)|-| 0x0140| 0x017F| 0x40
| Signature issuer
|-
| 0x1bf0x0180| 160x01BB| 0x3C| ECDH data, used to generate one-time key during install of console specific titles|-| 0x01BC| 0x01BE| 0x03| Unused/Padding|-| 0x01BF| 0x01CE| 0x10
| Encrypted title key
|-
| 0x1dc0x01CF| 80x01CF| 0x01| Unknown|-| 0x01D0| 0x01D7| 0x08| ticket_id (used as IV for title key decryption of console specific titles) |-| 0x01D8| 0x01DB| 0x04| Console ID|-| 0x01DC| 0x01E3| 0x08
| Title ID / [http://en.wikipedia.org/wiki/Initialization_Vector Initialization Vector] (IV) used for AES-[http://en.wikipedia.org/wiki/Cipher_Block_Chaining#Cipher-block_chaining_.28CBC.29 CBC] encryption
|-
| 0x1f10x01E4| 0x01E5| 0x02| Unknown, mostly 0xFFFF|-| 0x01E6| 0x01E7| 0x02| Ticket title version|-| 0x01E8| 0x01EB| 0x04| Permitted Titles Mask|-| 0x01EC| 0x01EF| 0x04| Permit mask. The current disc title is ANDed with the inverse of this mask to see if the result matches the Permitted Titles Mask.|-| 0x01F0| 0x01F0| 0x01| Title Export allowed using PRNG key (1= allowed, 0 = not allowed)|-| 0x01F1| 0x01F1| 0x01| Common Key index (2 = [http://wiiubrew.org/wiki/WiiMode Wii U Wii mode], 1 = Korean Common key, 0 = "normal" Common key)|-| 0x01F2| 0x0221| 0x30| Unknown. Is all 0 for non-VC, for VC, all 0 except last byte is 1.|-| 0x0222| 0x0261| 0x40| Content access permissions (one bit for each content)
|-
| 0x2220x0262| 320x0263| 0x02| Padding (Always 0xFF (?0)
|-
| 0x2440x0264| 40x0267| 0x04
| Enable time limit (1 = Enabled, 0 = Disabled)
|-
| 0x2480x0268| 40x026B| 0x04
| Time limit (Seconds)
|-
| 0x026C
| 0x02A3
| 0x38
| 7 more time_limit structs as above ({int enable, seconds})
|}
To get the title key decrypt the 16 bytes at offset 0x1bf with the Common Key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero).
 
[[Category:File formats]]
91

edits

Navigation menu