make_rif.c

#include <lv2/libc.h>
#include <lv2/io.h>
#include <lv2/error.h>
#include <lv2/security.h>
#include <lv2/ctrl.h>
#include "common.h"
#include "mappath.h"
#include "modulespatch.h"
#include "ps3mapi_core.h"
#include "make_rif.h"

#define ACCOUNTID                       1
#define READ                            0

#define XREGISTRY_FILE                  "/dev_flash2/etc/xRegistry.sys"

static uint8_t empty[0x10] =
{
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};


unsigned char RAP_KEY[] =  { 0x86, 0x9F, 0x77, 0x45, 0xC1, 0x3F, 0xD8, 0x90, 0xCC, 0xF2, 0x91, 0x88, 0xE3, 0xCC, 0x3E, 0xDF };
unsigned char RAP_PBOX[] = { 0x0C, 0x03, 0x06, 0x04, 0x01, 0x0B, 0x0F, 0x08, 0x02, 0x07, 0x00, 0x05, 0x0A, 0x0E, 0x0D, 0x09 };
unsigned char RAP_E1[] =   { 0xA9, 0x3E, 0x1F, 0xD6, 0x7C, 0x55, 0xA3, 0x29, 0xB7, 0x5F, 0xDD, 0xA6, 0x2A, 0x95, 0xC7, 0xA5 };
unsigned char RAP_E2[] =   { 0x67, 0xD4, 0x5D, 0xA3, 0x29, 0x6D, 0x00, 0x6A, 0x4E, 0x7C, 0x53, 0x7B, 0xF5, 0x53, 0x8C, 0x74 };

uint32_t userID;
uint8_t skip_existing_rif = 0;
uint8_t account_id[0x10];

static int xreg_data(char *value)
{
    int fd, result = -1;
    uint16_t offset = 0;
    uint64_t read, seek;

    if(cellFsOpen(XREGISTRY_FILE, CELL_FS_O_RDWR, &fd, 0666, NULL, 0) != SUCCEEDED)
        return result;

    char *buffer = malloc(0x2A);

    if(!buffer)
        return result;

    // Get offset
    for(int i = 0; i < 0x10000; i++)
    {
        cellFsLseek(fd, i, SEEK_SET, &seek);
        cellFsRead(fd, buffer, 0x31 + 1, &read);

        // Found offset
        if(strcmp(buffer, value) == 0)
        {
            offset = i - 0x15;
            uint8_t *data = NULL;

            // Search value from value table
            for(int i = 0x10000; i < 0x15000; i++)
            {
                data = (uint8_t *) malloc(0x17);

                if(!data)
                {
                    free(buffer);
                    return result;
                }

                cellFsLseek(fd, i, SEEK_SET, &seek);
                cellFsRead(fd, data, 0x17, &read);

                // Found value
                if (memcmp(data, &offset, 2) == 0 && data[4] == 0x00 && data[5] == 0x11 && data[6] == 0x02)
                {
                    result = 0;

                    memcpy(&account_id, data + 7, 0x10);

                    if(memcmp(data + 7, empty, 0x10) != SUCCEEDED)
                        result = 1;

                    free(data);
                    free(buffer);
                    cellFsClose(fd);

                    return result;
                }

                free(data);
            }
        }
    }

    free(buffer);
    cellFsClose(fd);

    return result;
}

static void get_rif_key(unsigned char* rap, unsigned char* rif)
{
    int i;
    int round;

    unsigned char key[0x10];
    unsigned char iv[0x10];
    memset(key, 0, 0x10);
    memset(iv, 0, 0x10);

    // Initial decrypt.
    aescbccfb_dec(key, rap, 0x10, RAP_KEY, 0x80, iv);
    memset(iv, 0, 0x10);

    // rap2rifkey round.
    for (round = 0; round < 5; ++round)
    {
        for (i = 0; i < 16; ++i)
        {
            int p = RAP_PBOX[i];
            key[p] ^= RAP_E1[p];
        }

        for (i = 15; i >= 1; --i)
        {
            int p = RAP_PBOX[i];
            int pp = RAP_PBOX[i - 1];
            key[p] ^= key[pp];
        }

        int o = 0;

        for (i = 0; i < 16; ++i)
        {
            int p = RAP_PBOX[i];
            unsigned char kc = key[p] - o;
            unsigned char ec2 = RAP_E2[p];
            if (o != 1 || kc != 0xFF)
            {
                o = kc < ec2 ? 1 : 0;
                key[p] = kc - ec2;
            }
            else if (kc == 0xFF)
                key[p] = kc - ec2;
            else
                key[p] = kc;
        }
    }

    memcpy(rif, key, 0x10);
}

static void read_act_dat_and_make_rif(uint8_t *rap, uint8_t *act_dat, const char *content_id, const char *rif_path)
{
    int fd;

    if(cellFsOpen(rif_path, CELL_FS_O_WRONLY | CELL_FS_O_CREAT | CELL_FS_O_TRUNC, &fd, 0666, NULL, 0) == SUCCEEDED)
    {
        uint8_t idps_const[0x10]    = { 0x5E, 0x06, 0xE0, 0x4F, 0xD9, 0x4A, 0x71, 0xBF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };
        uint8_t rif_key_const[0x10] = { 0xDA, 0x7D, 0x4B, 0x5E, 0x49, 0x9A, 0x4F, 0x53, 0xB1, 0xC1, 0xA1, 0x4A, 0x74, 0x84, 0x44, 0x3B };

        uint8_t *rif = ALLOC_RIF_BUFFER;
        uint8_t *key_index = rif + 0x40;
        uint8_t *rif_key = rif + 0x50;
        memset(rif, 0, 0x70);

        get_rif_key(rap, rif_key); //convert rap to rifkey (klicensee)

        uint8_t *iv = rif + 0x60;
        aescbccfb_enc(idps_const, idps_const, 0x10, (void*)PS3MAPI_IDPS_2, IDPS_KEYBITS, iv);

        uint8_t *act_dat_key = rap;
        memcpy(act_dat_key, act_dat + 0x10, 0x10);

        memset(iv, 0, 0x10);
        aescbccfb_dec(act_dat_key, act_dat_key, 0x10, idps_const, IDPS_KEYBITS, iv);

        memset(iv, 0, 0x10);
        aescbccfb_enc(rif_key, rif_key, 0x10, act_dat_key, ACT_DAT_KEYBITS, iv);

        memset(iv, 0, 0x10);
        aescbccfb_enc(key_index, key_index, 0x10, rif_key_const, RIF_KEYBITS, iv);

        const uint32_t version_number = 1;
        const uint32_t license_type = 0x00010002;
        const uint64_t timestamp = 0x000001619BF6DDCA;
        const uint64_t expiration_time = 0;

        memcpy(rif,        &version_number,  4); // 0x00 version_number
        memcpy(rif + 0x04, &license_type,    4); // 0x04 license_type
        memcpy(rif + 0x08, act_dat + 0x8,    8); // 0x08 account_id
        memcpy(rif + 0x10, content_id,    0x24); // 0x10 content_id
                                                 // 0x40 encrypted key index (Used for choosing act.dat key)
                                                 // 0x50 encrypted rif_key
        memcpy(rif + 0x60, &timestamp,       8); // 0x60 timestamp
        memcpy(rif + 0x68, &expiration_time, 8); // 0x68 expiration time

        uint64_t size;
        memset(rif + 0x70, 0x11, 0x28);          // 0x70 ECDSA Signature
        cellFsWrite(fd, rif, 0x98, &size);
        cellFsClose(fd);
    }
}

int create_act_dat(const char *userid)
{
    int fd;
    uint64_t size;
    char full_path[120], exdata_dir[120];
    CellFsStat stat;

    //DPRINTF("Creating act.dat for userID %s...\n", userid);

    uint8_t timedata[0x10] =
    {
        0x00, 0x00, 0x01, 0x2F, 0x3F, 0xFF, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    };

    const uint64_t header = 0x0000000100000002;

    uint64_t accountID = (uint64_t)strtoull((const char*)account_id, NULL, 16);
    accountID = SWAP64(accountID);

    uint8_t *actdat = malloc(0x1038);

    if(!actdat)
        return 1;

    memset(actdat, 0x11, 0x1038);
    memcpy(actdat, &header, 8);
    memcpy(actdat + 8, &accountID, 8);
    memcpy(actdat + 0x870, timedata, 0x10);

    sprintf(exdata_dir, "/dev_hdd0/home/%s/exdata", userid);

    if(cellFsStat(exdata_dir, &stat) != SUCCEEDED)
        cellFsMkdir(exdata_dir, 0777);

    sprintf(full_path, "%s/act.dat", exdata_dir);

    cellFsOpen(full_path, CELL_FS_O_WRONLY | CELL_FS_O_CREAT | CELL_FS_O_TRUNC, &fd, 0666, NULL, 0);
    cellFsWrite(fd, actdat, 0x1038, &size);
    cellFsClose(fd);

    free(actdat);

    return SUCCEEDED;
}

void make_rif(const char *path)
{
    char buffer[120];
    int path_len = strlen(path);

    if(!strncmp(path, "/dev_hdd0/home/", 15) && !strcmp(path + path_len - 4, ".rif"))
    {
        int act_dat_found = 0;
        int fd;
        CellFsStat stat;

        DPRINTF("open_path_hook: %s (looking for rap)\n", path);

        char *content_id = ALLOC_CONTENT_ID;
        memset(content_id, 0, 0x25);
        strncpy(content_id, strrchr(path, '/') + 1, 0x24);

        char *rap_path = ALLOC_PATH_BUFFER;

        uint8_t is_ps2_classic = !strncmp(content_id, "2P0001-PS2U10000_00-0000111122223333", 0x24);
        uint8_t is_psp_launcher = !strncmp(content_id, "UP0001-PSPC66820_00-0000111122223333", 0x24);

        char userid[8];
        strncpy(userid, path + 15, 8);
        userid[8] = '\0';

        if(!is_ps2_classic && !is_psp_launcher)
        {
            CellFsStat stat;
            const char *ext = "rap";

            // Support for rap and RAP extension (By aldostools)
            for(uint8_t i = 0; i < 2; i++)
            {
                sprintf(rap_path, "/dev_usb000/exdata/%36s.%s", content_id, ext);

                if(cellFsStat(rap_path, &stat) != SUCCEEDED)
                    rap_path[10] = '1'; //dev_usb001
                if(cellFsStat(rap_path, &stat) != SUCCEEDED)
                    sprintf(rap_path, "/dev_hdd0/exdata/%36s.%s", content_id, ext);

                if(cellFsStat(rap_path, &stat) != SUCCEEDED)
                    ext = "RAP";
                else
                    break;
            }
        }

        char rap_bin_dir[120];
        sprintf(rap_bin_dir, "/dev_hdd0/home/%s/exdata/rap.bin", userid);
        cellFsStat(rap_bin_dir, &stat);

        if(is_ps2_classic || is_psp_launcher || cellFsOpen((!rap_mode) ? rap_path : rap_bin_dir, CELL_FS_O_RDONLY, &fd, 0666, NULL, 0) == SUCCEEDED)
        {
            uint64_t nread = 0;
            uint8_t rap[0x10] = { 0xF5, 0xDE, 0xCA, 0xBB, 0x09, 0x88, 0x4F, 0xF4, 0x02, 0xD4, 0x12, 0x3C, 0x25, 0x01, 0x71, 0xD9 };

            if(!is_ps2_classic && !is_psp_launcher)
            {
                if(!rap_mode)
                {
                    DPRINTF("rap_path: %s output: %s\n", rap_path, path);
                    cellFsRead(fd, rap, 0x10, &nread);
                }
                else
                {
                    // rap2bin-bin2rap by esc0rtd3w
                    // All credits goes to him
                    int MAGIC_NUMBER = 0xFAF0FAF0;
                    uint8_t buffer[0x50];

                    //DPRINTF("loading license from rap.bin...\n");

                    while(cellFsRead(fd, buffer, 0x50, &nread) == SUCCEEDED)
                    {
                        if((int)!nread)
                            break;

                        if(memcmp(buffer, &MAGIC_NUMBER, 4) == SUCCEEDED)
                        {
                            if(memcmp(buffer + 0x10, content_id, 0x24) == SUCCEEDED)
                            {
                                memcpy(rap, buffer + 0x40, 0x10);
                                DPRINTF("loaded license from rap.bin for %s\n", content_id);
                                break;
                            }
                        }
                    }
                }

                cellFsClose(fd);
            }

            // Search act.dat in home dirs
            for(int i = 1; i < 100; i++)
            {
                sprintf(buffer, ACTDAT_PATH, i);

                if(cellFsStat(buffer, &stat) == SUCCEEDED)
                {
                    //DPRINTF("Found act.dat in %08d\n", i);
                    act_dat_found = 1;
                    break;
                }
            }

            sprintf(buffer, ACCOUNTID_VALUE, userid);

            if(!act_dat_found && xreg_data(buffer))
                create_act_dat(userid);

            act_dat_found = 0;

            // Skip the creation of rif license if it already exists - By aldostool
            if(skip_existing_rif && cellFsStat(path, &stat) == SUCCEEDED)
                return;

            char *act_path = ALLOC_PATH_BUFFER;
            memset(act_path, 0, 0x50);
            strncpy(act_path, path, strrchr(path, '/') - path);
            strcpy(act_path + strlen(act_path), "/act.dat\0");

            DPRINTF("act_path: %s content_id: %s\n", act_path, content_id);

            if(cellFsOpen(act_path, CELL_FS_O_RDONLY, &fd, 0666, NULL, 0) == SUCCEEDED)
            {
                uint8_t *act_dat = ALLOC_ACT_DAT;
                cellFsRead(fd, act_dat, 0x20, &nread); // size: 0x1038 but only first 0x20 are used to make rif
                cellFsClose(fd);

                if(nread == 0x20)
                {
                    char *rif_path = ALLOC_PATH_BUFFER;
                    sprintf(rif_path, "/%s", path);
                    read_act_dat_and_make_rif(rap, act_dat, content_id, rif_path);
                }
            }
        }
    }
}