negentig.c

   1 #include <openssl/aes.h>
   2 #include <sys/types.h>
   3 #include <sys/stat.h>
   4 #include <time.h>
   5 #include <unistd.h>
   6 #include <stdlib.h>
   7 #include <string.h>
   8 #include <stdio.h>
   9
  10 static int dump_partition_data = 0;
  11
  12 #define SPINNER_SPEED 64
  13
  14 typedef unsigned char u8;
  15 typedef unsigned short u16;
  16 typedef unsigned int u32;
  17 typedef unsigned long long u64;
  18
  19 FILE *disc_fp;
  20
  21 u64 partition_raw_offset;
  22 u64 partition_data_offset;
  23 u64 partition_data_size;
  24 u8 h3[0x18000];
  25
  26 u8 disc_key[16];
  27
  28 static void print_bytes(u8 *x, u32 n)
  29 {
  30         u32 i;
  31
  32         for (i = 0; i < n; i++)
  33                 fprintf(stderr, "%02x", x[i]);
  34 }
  35
  36 static void aes_cbc_dec(u8 *key, u8 *iv, u8 *in, u32 len, u8 *out)
  37 {
  38         AES_KEY aes_key;
  39
  40         AES_set_decrypt_key(key, 128, &aes_key);
  41         AES_cbc_encrypt(in, out, len, &aes_key, iv, AES_DECRYPT);
  42 }
  43
  44 static void decrypt_title_key(u8 *title_key, u8 *title_id)
  45 {
  46         u8 common_key[16];
  47         u8 iv[16];
  48         FILE *fp;
  49
  50         fp = fopen("common-key", "rb");
  51         fread(common_key, 1, 16, fp);
  52         fclose(fp);
  53
  54         memset(iv, 0, sizeof iv);
  55         memcpy(iv, title_id, 8);
  56
  57         aes_cbc_dec(common_key, iv, title_key, 16, disc_key);
  58 }
  59
  60 static u32 be32(u8 *p)
  61 {
  62         return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
  63 }
  64
  65 static u64 be64(u8 *p)
  66 {
  67         return ((u64)be32(p) << 32) | be32(p + 4);
  68 }
  69
  70 static u64 be34(u8 *p)
  71 {
  72         return 4 * (u64)be32(p);
  73 }
  74
  75 static void seek(u64 offset)
  76 {
  77         fseeko(disc_fp, offset, SEEK_SET);
  78 }
  79
  80 static void disc_read(u64 offset, u8 *data, u32 len)
  81 {
  82         seek(offset);
  83         fread(data, 1, len, disc_fp);
  84 }
  85
  86 static void partition_raw_read(u64 offset, u8 *data, u32 len)
  87 {
  88         disc_read(partition_raw_offset + offset, data, len);
  89 }
  90
  91 static void partition_read_block(u64 blockno, u8 *block)
  92 {
  93         u8 raw[0x8000];
  94         u8 iv[16];
  95         u64 offset;
  96
  97         offset = partition_data_offset + 0x8000 * blockno;
  98         partition_raw_read(offset, raw, 0x8000);
  99
 100         // XXX: check H0, H1, H2 here
 101
 102         memcpy(iv, raw + 0x3d0, 16);
 103 //fprintf(stderr, "ky: "); print_bytes(disc_key, 16); fprintf(stderr, "\n");
 104 //fprintf(stderr, "iv: "); print_bytes(iv, 16); fprintf(stderr, "\n");
 105         aes_cbc_dec(disc_key, iv, raw + 0x400, 0x7c00, block);
 106 }
 107
 108 static void partition_read(u64 offset, u8 *data, u32 len)
 109 {
 110         u8 block[0x8000];
 111         u32 offset_in_block;
 112         u32 len_in_block;
 113
 114         while(len) {
 115                 offset_in_block = offset % 0x7c00;
 116                 len_in_block = 0x7c00 - offset_in_block;
 117                 if (len_in_block > len)
 118                         len_in_block = len;
 119                 partition_read_block(offset / 0x7c00, block);
 120                 memcpy(data, block + offset_in_block, len_in_block);
 121                 data += len_in_block;
 122                 offset += len_in_block;
 123                 len -= len_in_block;
 124         }
 125 }
 126
 127 static void spinner(u64 x, u64 max)
 128 {
 129         static u32 spin;
 130         static time_t start_time;
 131         static u32 expected_total;
 132         u32 d;
 133         double percent;
 134         u32 h, m, s;
 135
 136         if (x == 0) {
 137                 start_time = time(0);
 138                 expected_total = 300;
 139         }
 140
 141         if (x == max) {
 142                 fprintf(stderr, "Done.                    \n");
 143                 return;
 144         }
 145
 146         d = time(0) - start_time;
 147
 148         if (d != 0)
 149                 expected_total = (15 * expected_total + d * max / x) / 16;
 150
 151         if (expected_total > d)
 152                 d = expected_total - d;
 153         else
 154                 d = 0;
 155
 156         h = d / 3600;
 157         m = (d / 60) % 60;
 158         s = d % 60;
 159         percent = 100.0 * x / max;
 160
 161         fprintf(stderr, "%5.2f%% (%c) ETA: %d:%02d:%02d  \r",
 162                 percent, "/|\\-"[(spin++ / SPINNER_SPEED) % 4], h, m, s);
 163         fflush(stderr);
 164 }
 165
 166 static void do_data(u64 size)
 167 {
 168         u8 data[0x7c00];
 169         u64 offset;
 170         u64 remaining_size;
 171         u32 block_size;
 172         FILE *fp;
 173
 174         size = (size / 0x8000) * 0x7c00;
 175
 176         fp = fopen("###dat###", "wb");
 177
 178         fprintf(stderr, "\nDumping partition contents...\n");
 179         offset = 0;
 180         remaining_size = size;
 181         while (remaining_size) {
 182                 spinner(offset, size);
 183
 184                 block_size = 0x7c00;
 185                 if (block_size > remaining_size)
 186                         block_size = remaining_size;
 187
 188                 partition_read(offset, data, block_size);
 189                 fwrite(data, 1, block_size, fp);
 190
 191                 offset += block_size;
 192                 remaining_size -= block_size;
 193         }
 194         spinner(0, 0);
 195
 196         fclose(fp);
 197 }
 198
 199 static void copy_file(const char *name, u64 offset, u64 size)
 200 {
 201         u8 data[0x80000];
 202         FILE *fp;
 203         u32 block_size;
 204
 205         fp = fopen(name, "wb");
 206
 207         while (size) {
 208                 block_size = sizeof data;
 209                 if (block_size > size)
 210                         block_size = size;
 211
 212                 partition_read(offset, data, block_size);
 213                 fwrite(data, 1, block_size, fp);
 214
 215                 offset += block_size;
 216                 size -= block_size;
 217         }
 218
 219         fclose(fp);
 220 }
 221
 222 static u32 do_fst(u8 *fst, const char *names, u32 i, char *indent, int is_last)
 223 {
 224         u64 offset;
 225         u32 size;
 226         const char *name;
 227         u32 parent;
 228         u32 j;
 229
 230         name = names + (be32(fst + 12*i) & 0x00ffffff);
 231         size = be32(fst + 12*i + 8);
 232
 233         if (i == 0) {
 234                 fprintf(stderr, "/\n");
 235
 236                 for (j = 1; j < size; )
 237                         j = do_fst(fst, names, j, indent, (j == size - 1));
 238
 239                 return size;
 240         }
 241
 242         if (fst[12*i]) {
 243                 parent = be32(fst + 12*i + 4);
 244                 is_last = (be32(fst + 12*parent + 8) == size);
 245         }
 246
 247         fprintf(stderr, "%s%c-- %s", indent, "|+"[is_last], name);
 248
 249         if (fst[12*i]) {
 250                 mkdir(name, 0777);
 251                 chdir(name);
 252
 253                 fprintf(stderr, "\n");
 254
 255                 if (is_last)
 256                         strcat(indent, "    ");
 257                 else
 258                         strcat(indent, "|   ");
 259
 260                 for (j = i + 1; j < size; )
 261                         j = do_fst(fst, names, j, indent, (j == size - 1));
 262
 263                 indent[strlen(indent) - 4] = 0;
 264
 265                 chdir("..");
 266
 267                 return size;
 268         } else {
 269                 offset = be34(fst + 12*i + 4);
 270
 271                 fprintf(stderr, " @ %09llx, size %08x\n", offset, size);
 272
 273                 copy_file(name, offset, size);
 274
 275                 return i + 1;
 276         }
 277 }
 278
 279 static void do_files(void)
 280 {
 281         u8 b[0x480]; // XXX: determine actual header size
 282         u64 dol_offset;
 283         u64 fst_offset;
 284         u32 fst_size;
 285         u8 *fst;
 286         char indent[999];
 287         u32 n_files;
 288
 289         partition_read(0, b, sizeof b);
 290
 291         fprintf(stderr, "Title id: %c%c%c%c\n", b[0], b[1], b[2], b[3]);
 292         fprintf(stderr, "Group id: %c%c\n", b[4], b[5]);
 293         fprintf(stderr, "Name: %s\n", b + 0x20);
 294         fprintf(stderr, "\n");
 295
 296         dol_offset = be34(b + 0x0420);
 297         fst_offset = be34(b + 0x0424);
 298         fst_size = be34(b + 0x0428);
 299
 300         fprintf(stderr, "\tDOL @ %09llx\n", dol_offset);
 301         fprintf(stderr, "\tFST @ %09llx (size %08x)\n", fst_offset, fst_size);
 302
 303         copy_file("###apl###", 0x2440, dol_offset - 0x2440); // XXX: wrong way to get this size, there is a header
 304         copy_file("###dol###", dol_offset, fst_offset - dol_offset); // XXX: similar, perhaps
 305
 306         fst = malloc(fst_size);
 307         partition_read(fst_offset, fst, fst_size);
 308         n_files = be32(fst + 8);
 309
 310         fprintf(stderr, "%d entries\n", n_files);
 311
 312         indent[0] = 0;
 313         if (n_files > 1)
 314                 do_fst(fst, (char *)fst + 12*n_files, 0, indent, 0);
 315
 316         free(fst);
 317 }
 318
 319 static void do_partition(void)
 320 {
 321         u8 b[0x02c0];
 322         u64 title_id;
 323         u32 tmd_offset;
 324         u64 tmd_size;
 325         u32 cert_size;
 326         u64 cert_offset;
 327         u64 h3_offset;
 328         char dirname[] = "title-0000000000000000";
 329
 330         partition_raw_read(0, b, 0x02c0);
 331
 332         decrypt_title_key(b + 0x01bf, b + 0x01dc);
 333
 334         title_id = be64(b + 0x01dc);
 335
 336         fprintf(stderr, "\ttitle id = %016llx\n", title_id);
 337
 338         // XXX: we should check the cert chain here, and read the tmd
 339
 340         tmd_offset = be32(b + 0x02a4);
 341         tmd_size = be34(b + 0x02a8);
 342         cert_size = be32(b + 0x02ac);
 343         cert_offset = be34(b + 0x02b0);
 344         h3_offset = be34(b + 0x02b4);
 345         partition_data_offset = be34(b + 0x02b8);
 346         partition_data_size = be34(b + 0x02bc);
 347
 348         fprintf(stderr, "\ttmd offset  =  %08x\n", tmd_offset);
 349         fprintf(stderr, "\ttmd size    = %09llx\n", tmd_size);
 350         fprintf(stderr, "\tcert size   =  %08x\n", cert_size);
 351         fprintf(stderr, "\tcert offset = %09llx\n", cert_offset);
 352         fprintf(stderr, "\tdata offset = %09llx\n", partition_data_offset);
 353         fprintf(stderr, "\tdata size   = %09llx\n", partition_data_size);
 354
 355         partition_raw_read(h3_offset, h3, 0x18000);
 356
 357         // XXX: check h3 against h4 here
 358
 359         snprintf(dirname, sizeof dirname, "%016llx", title_id);
 360
 361         mkdir(dirname, 0777);
 362         chdir(dirname);
 363
 364         if (dump_partition_data)
 365                 do_data(partition_data_size);
 366
 367         do_files();
 368
 369         chdir("..");
 370 }
 371
 372 static void do_disc(void)
 373 {
 374         u8 b[0x100];
 375         u64 partition_offset[32]; // XXX: don't know the real maximum
 376         u32 n_partitions;
 377         u32 i;
 378
 379         disc_read(0, b, sizeof b);
 380
 381         fprintf(stderr, "Title id: %c%c%c%c\n", b[0], b[1], b[2], b[3]);
 382         fprintf(stderr, "Group id: %c%c\n", b[4], b[5]);
 383         fprintf(stderr, "Name: %s\n", b + 0x20);
 384         fprintf(stderr, "\n");
 385
 386         disc_read(0x40000, b, sizeof b);
 387         n_partitions = be32(b);
 388
 389         disc_read(be34(b + 4), b, sizeof b);
 390         for (i = 0; i < n_partitions; i++)
 391                 partition_offset[i] = be34(b + 8 * i);
 392
 393         fprintf(stderr, "%d partitions:\n", n_partitions);
 394         for (i = 0; i < n_partitions; i++)
 395                 fprintf(stderr, "\tpartition #%d @ %09llx\n", i,
 396                         partition_offset[i]);
 397
 398         for (i = 0; i < n_partitions; i++) {
 399                 fprintf(stderr, "\nDoing partition %d...\n", i);
 400                 fprintf(stderr, "--------------------------------\n");
 401
 402                 partition_raw_offset = partition_offset[i];
 403                 do_partition();
 404
 405                 //break; // XXX SII: for testing
 406         }
 407 }
 408
 409 int main(int argc, char **argv)
 410 {
 411         if (argc != 2) {
 412                 fprintf(stderr, "Usage: %s <disc file>\n", argv[0]);
 413                 return 1;
 414         }
 415
 416         disc_fp = fopen(argv[1], "rb");
 417
 418         do_disc();
 419
 420         fclose(disc_fp);
 421
 422         return 0;
 423 }