Changes

Jump to navigation Jump to search
792 bytes added ,  15:04, 7 February 2019
m
no edit summary
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]s). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key" and the Title ID of the data and are signed by a certificate from a [[certificate chain]] (which usually is the same for all titles and stored somewhere on the NAND).So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
=== File structure ===
{| class="wikitable"
|-
|-
| 0x0000
| 0x00040x0003| 40x04
| Signature type (always 0x10001 for RSA-2048)
|-
| 0x0004
| 0x01040x0103| 2560x100| Signature by a certificate's key (everything after this field is covered by this signature)
|-
| 0x0104
| 0x01400x013F| 600x3C| Padding (Always 0- everything after this field is covered by the above signature)
|-
| 0x0140
| 0x01800x017F| 640x40
| Signature issuer
|-
| 0x0180
| 0x01bf0x01BB| 630x3C| Unknown (0ECDH data, unless it is a VC game)used to generate one-time key during install of console specific titles
|-
| 0x01bf0x01BC| 0x01cf0x01BE| 160x03| Unused/Padding|-| 0x01BF| 0x01CE| 0x10
| Encrypted title key
|-
| 0x01cf0x01CF| 0x01dc0x01CF| 160x01
| Unknown
|-
| 0x01dc0x01D0| 0x01e40x01D7| 80x08| ticket_id (used as IV for title key decryption of console specific titles) |-| 0x01D8| 0x01DB| 0x04| Console ID|-| 0x01DC| 0x01E3| 0x08
| Title ID / [http://en.wikipedia.org/wiki/Initialization_Vector Initialization Vector] (IV) used for AES-[http://en.wikipedia.org/wiki/Cipher_Block_Chaining#Cipher-block_chaining_.28CBC.29 CBC] encryption
|-
| 0x01e40x01E4| 0x01f10x01E5| 130x02| Unknown, mostly 0xFFFF|-| 0x01E6| 0x01E7| 0x02| Ticket title version|-| 0x01E8| 0x01EB| 0x04| Permitted Titles Mask|-| 0x01EC| 0x01EF| 0x04| Permit mask. The current disc title is ANDed with the inverse of this mask to see if the result matches the Permitted Titles Mask.|-| 0x01F0| 0x01F0| 0x01| Title Export allowed using PRNG key (1 = allowed, 0 = not allowed)
|-
| 0x01f10x01F1| 0x01f20x01F1| 10x01| Common Key index (2 = [http://wiiubrew.org/wiki/WiiMode Wii U Wii mode], 1 = Korean Common key, 0 = "normal" Common key)
|-
| 0x01f20x01F2| 0x02220x0221| 480x30
| Unknown. Is all 0 for non-VC, for VC, all 0 except last byte is 1.
|-
| 0x0222
| 0x02420x0261| 320x40| Always 0xFF Content access permissions (?one bit for each content)
|-
| 0x02420x0262| 0x02440x0263| 20x02
| Padding (Always 0)
|-
| 0x02440x0264| 0x02480x0267| 40x04
| Enable time limit (1 = Enabled, 0 = Disabled)
|-
| 0x02480x0268| 0x024a0x026B| 40x04
| Time limit (Seconds)
|-
| 0x024a0x026C| 0x02a40x02A3| 900x38| Padding 7 more time_limit structs as above (Always 0{int enable, seconds})
|}
To get the title key decrypt the 16 bytes at offset 0x1bf with the Common Key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero).
 
[[Category:File formats]]
91

edits

Navigation menu