Changes

Jump to navigation Jump to search
754 bytes added ,  15:04, 7 February 2019
m
no edit summary
Tickets are found in many encrypted files used by the Wii (e.g. [[WAD Files]] or [[Wiidisc|Wiidiscs]]s). They contain the encrypted [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] "title key" and the Title ID of the data and are signed by a certificate from a [[certificate chain]] (which usually is the same for all titles and stored somewhere on the NAND).So far only tickets with [http://en.wikipedia.org/wiki/RSA_numbers#RSA-2048 RSA-2048] signatures have been seen. (Discs will only work with those signatures because the size of partition ticket is always 0x2a4)
=== File structure ===
{| class="wikitable"
|-
| 0x0103
| 0x100
| Signature by a certificate's key (everything after this field is covered by this signature)
|-
| 0x0104
| 0x013f0x013F| 0x3b0x3C| Padding (Always 0- everything after this field is covered by the above signature)
|-
| 0x0140
| 0x017f0x017F
| 0x40
| Signature issuer
|-
| 0x0180
| 0x01be0x01BB| 0x3f0x3C| Unknown (0ECDH data, unless it is a VC game)used to generate one-time key during install of console specific titles
|-
| 0x01bf0x01BC| 0x01ce0x01BE| 0x03| Unused/Padding|-| 0x01BF| 0x01CE
| 0x10
| Encrypted title key
|-
| 0x01cf0x01CF| 0x01db0x01CF| 0x0d0x01
| Unknown
|-
| 0x01dc0x01D0| 0x01e30x01D7| 0x08| ticket_id (used as IV for title key decryption of console specific titles) |-| 0x01D8| 0x01DB| 0x04| Console ID|-| 0x01DC| 0x01E3
| 0x08
| Title ID / [http://en.wikipedia.org/wiki/Initialization_Vector Initialization Vector] (IV) used for AES-[http://en.wikipedia.org/wiki/Cipher_Block_Chaining#Cipher-block_chaining_.28CBC.29 CBC] encryption
|-
| 0x01e40x01E4| 0x01f00x01E5| 0x0d0x02| Unknown, mostly 0xFFFF|-| 0x01E6| 0x01E7| 0x02| Ticket title version|-| 0x01E8| 0x01EB| 0x04| Permitted Titles Mask|-| 0x01EC| 0x01EF| 0x04| Permit mask. The current disc title is ANDed with the inverse of this mask to see if the result matches the Permitted Titles Mask.|-| 0x01F0| 0x01F0| 0x01| Title Export allowed using PRNG key (1 = allowed, 0 = not allowed)
|-
| 0x01f10x01F1| 0x01f10x01F1
| 0x01
| Common Key index (2 = [http://wiiubrew.org/wiki/WiiMode Wii U Wii mode], 1 = Korean Common key, 0 = "normal" Common key)
|-
| 0x01f20x01F2
| 0x0221
| 0x30
|-
| 0x0222
| 0x02410x0261| 0x200x40| Always 0xFF Content access permissions (?one bit for each content)
|-
| 0x02420x0262| 0x02430x0263
| 0x02
| Padding (Always 0)
|-
| 0x02440x0264| 0x02470x0267
| 0x04
| Enable time limit (1 = Enabled, 0 = Disabled)
|-
| 0x02480x0268| 0x024b0x026B
| 0x04
| Time limit (Seconds)
|-
| 0x024c0x026C| 0x02a30x02A3| 0x580x38| Padding 7 more time_limit structs as above (Always 0{int enable, seconds})
|}
To get the title key decrypt the 16 bytes at offset 0x1bf with the Common Key using the Title ID (offset 0x1dc) as the initialization vector (the last 8 bytes of the IV should be zero).
 
[[Category:File formats]]
91

edits

Navigation menu