IDPS

Description

The IDPS, also named ConsoleId or PSID, is a sequence of 16 bytes which is used as a unique per-console identifier for PlayStation consoles. The IDPS is stored and certified in EID. It is used for online tasks and for cryptography.

People used to zerofill their IDPS (e.g. F*ckPSN) to avoid their console being banned or to return to PSN with a banned console. This vulnerability was patched by Sony. See Vulnerability#Any_ConsoleId_accepted_for_connection_to_PSN.

Structure

00000000 00 00 00 01 00 89 00 0B 14 00 EF DD CA 25 52 66 .....‰....ïÝÊ%Rf                        ⇑ ⇑   ⇑ ⇑                  Product Code  Product Sub Code 

• 1st and 2nd bytes represent the magic (always 00 00)
• 3rd and 4th bytes represent the Company (usually SCE)
• 5th and 6th bytes represent the Product Code
• 7th and 8th bytes represent the Product Sub Code
• remaining 8 bytes are parsed by bits not by bytes (see IDPS#IDPS second half)

00 00 <- Unknown 00 01 <- Company (SCE) 00 89 <- Product Code: PS3, CEX, oceania 00 0B <- Product Sub Code: CECH-25xx (25xx series) 14 00 EF DD CA 25 52 66 <- Second half: factory code 5, no Ps Flag, serial number 61405, random stamp CA 25 52 66 

Dummy PSP IDPS in Kicho & Dengo Program

0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x07, 0xFF, 0x03, 0xFF, 0xFF, 0xFF, 0xD7, 0xC3, 0xE5, 0x5A

Found in PSP Kicho & Dengo Tool flashData.prx.

Dummy Reference Tool IDPS

0x00, 0x00, 0x00, 0x01, 0x00, 0x81, 0x00, 0x01, 0x03, 0xFF, 0xFF, 0xFF, 0x18, 0x43, 0xC1, 0x4D

This is the dummy IDPS that is used by PS3 Reference Tool aim_iso when IDPS fails to be obtained from flash. That IDPS belongs to a Reference Tool DECR-1000A. The Reference Tool IDPS from above is static. PS3 CEX 3.55 does not have it.

Source: rms' blogtext.

Dummy PSP Emulator IDPS

0x00, 0x00, 0x00, 0x01, 0x00, 0x81, 0x00, 0x01, 0x0C, 0x40, 0x00, 0xB1, 0x0E, 0x69, 0x69, 0x78

Found in emulator_drm.sprx (iso self inside).

IDPS second half

• Byte 8 bits 0-5: Factory Code
• Byte 8 bits 6-7 and bytes 9-10-11: Serial Number
• Byte 8 bits 6-7 and byte 9 bits 0-5: Ps Flags on PSP with Diag Factory Code
• Bytes 12-15: Random Stamp (guessed name). 3 theories: 1) totally random number, 2) hash of previous bytes (then there would exist at least 3 keysets), 3) encrypted timestamp.

IDPS Regex

Based on 16 millions of PS3 IDPS dumps, on other PS consoles dumps and on IDPS structure.

0{7}10[012][089A][0123456789ABCDEF]00[0123456789ABCDEF]{18}

Restricted to PS3:

0{7}100[89A][0123456789ABCDEF]00[0123456789ABCDEF]{18}

Location

Serial flash

The PS3 IDPS can be found in serial flash, precisely in EID0 and EID5. See Flash (NAND @ 0x80870 / NOR @ 0x2F070).

Network (PSN connections)

See Vulnerabilities#IDPStealer.

Obtaining IDPS of a PS3

Via CFW

Evilnat's CFWs display the IDPS via a notification when going to a custom XMB menu.

There are homebrews to dump or even spoof your PS3 IDPS.

PS3 Model Detection

Source: http://www.ps3hax.net/2011/01/homebrew-app-ps3-model-detection/]

Dumping PS3 Model Data: - PS3 System Target ID: 0x85	(Retail - Europe) - PS3 Motherboard Revision: 0x0B	(JTP-001 Motherboard, Revision 1) - PS3 BD-Laser Revision: 0x04	(KES-400, SACD supported) Probable Model: CECH-2504A Raw Model Data: Byte 0:	0x00 Byte 1:	0x01 Byte 2:	0x00 Byte 3:	0x85 Byte 4:	0x00 Byte 5:	0x0B Byte 6:	0x00 Byte 7:	0x04 

Notes:

• '7th byte of IDPS' is not Bluray Drive (it was misunderstood at that time). You can see it in the example where it names incorrectly a CECH-25xx as Super Audio CD compatible with a KES-400 laserslide (which in real life has either KES-460A or KES-470A without daughterboard (swap can be done without remarry).
• Also, it named bytes 0-2 "Byte 0", byte 3 "Byte 1", byte 4 "Byte 2", byte 5 "Byte 3", byte 6 "Byte 4", byte 7 "Byte 5", byte 8 "Byte 6", byte 9 "Byte 7" etc.

IDPS Viewer

Source: link

• Displays the IDPS
• Shows Product Code
• Displays Motherboard revision
• Save IDPS (16 bytes from EID) into dev_hdd0/IDPS.bin file

multiMAN

IDPS is displayed under setting information in the multiMAN homebrew.

Via HEN

With PS3Xploit, dump the Serial Flash via software and search inside.

Via Network

See Vulnerabilities#IDPStealer.

Via bruteforce

You can verify the IDPS of a PS3 console through 2 ways: PARAM.SFO of savedata or HDD backup from PS3 Backup Utility. You would need to bruteforce about 7 bytes, if you know the PS3 model.

Problem: "My old PS3 received the YLOD, however I have a hard disk drive backup of it, but I no longer have the actual unit, and I do have a new PS3. I want to recover all my data to my new PS3, but I need to be able to dump all the data from archive2.dat to create a fresh HDD backup with all the data to restore to my new PS3 unit. So I need to crack the IDPS used to encrypt the backup."

Solution (to test) by zecoxao: "Bruteforce the IDPS from the IDPS hash of a PARAM.SFO file (second hash iirc). You select your region and model and only have to bruteforce the last six bytes. If the scene could establish some kind of standard or bruteforce blueprint, like a blank PARAM.SFO of the PS3 SingStar application, which should look the same on every console, someone could even work on a rainbow table for IDPS. The easiest would be PARAM.SFO of savedata, by manually verifying a certain sha1-hmac made from the file PARAM.PFD with IDPS as key. I was just looking into that and made a small PoC in C#, which bruteforces my PS3 IDPS. But even with all optimizations (especially for C#) and running on all cores with parallelization it is not really that fast. Moreover, I even cheated and only bruteforced the last six bytes of my known IDPS. It is currently still running... Using openCL would help, because graphic cards are naturally faster than CPUs. Currently looking into that, but I never worked with openCL before and cannot even find a hmac/sha1 kernel for openCL. Like nobody every did that before ... ;) useful?"

See also

PS ConsoleId wiki by CelesteBlue