act.dat explanation for PS3 and PSP + Restore + Encr. it
============================================
============================================
Were i find it?
==============
The file can bé found in the path below:
/dev_hdd0/home/xxxxxxxx/exdata/act.dat
The rif goes into..
/dev_hdd0/home/xxxxxxxx/exdata/*.rif
When you buy/downlaod a game to ps3 a rif file creates itself on the system and looks like below.
- Contend-ID
- Date and Time of Purchase
- Expiration (such as in the KZ3 MP Beta)
- PSN User Information
** Every file in it will be encrypted in there!
In the act.dat file has the info you see below.
- PSN User
- PSN User 'Tag'
- PSN User Information [authentication details]
The Tag' is able to find in the RIF files aswell, but backwards [for unknown reasons]
** The PS3 allows DRM-Protected files to executed only if their corresponding RIF files match up to the act.dat file.
PSP users are able to find those at dev_flash2
How a ACT and RIF file looks when encrypted?
====================================
act.dat header(encrypted) structure
Name Offset Size Example Remark
Activation Type 0x0 0x4 00000001
Version 0x4 0x4 00000001 1 or 2(current)
Account ID 0x8 0x8 B4 1F 2C 0B DC 1B 43 31 personal PSN account ID
Primary Key Table 0x10 0x800 N.A Used for decrypting rifkeys
Unknown1 0x810 0x40 N.A
Unknown2 0x850 0x10 N.A Digest?
Unknown3 0x860 0x10 N.A Encrypted_data for v.1 / Padding for v.2
Unknown4 0x870 0x10 N.A Encrypted_data for v.1 / Time_Stamp for v.2
Secondary Table 0x880 0x650 N.A
Unknown5 0xED0 0x40 N.A algo is same as for Unknown1?
RSA Signature? 0xF10 0x100 N.A params are unknown
ECDSA Signature 0x1010 0x28 N.A pub=vsh_pub, ctype=0x02(vsh_curves)
[edit]rif file(encrypted) structure
The rif holds the klicensee for both SELF and paid EDAT.
Name Offset Size Example Remark
Version Number 0x0 0x4 00 00 00 01
License Type 0x4 0x4 00 00 00 02
Account ID 0x8 0x8 B4 1F 2C 0B DC 1B 43 31 Used on Rap2Rif header
CONTENT ID 0x10 0x30 UP900-UCUS98721_00-PATAPONPSNDEMO08 Content ID
Encrypted Key Index 0x40 0x10 N.A Used for choosing act.dat key
Encrypted Rifkey 0x50 0x10 N.A Used for decrypt NPDRM self/sprx and edat files
License start time 0x60 0x8 00 00 01 1F C5 16 7B D8 For human readable, convert to decimal and use one Epoch-Unix converter time format online. Should be 0x08 lenght
License expiration time 0x68 0x8 00 00 00 00 00 00 00 00 If zeroed,-, there is no time limit. Used on PS+ for example.
should be 0x08
ECDSA Signature 0x70 0x28 11 Patched in some CFW to allow unsigned. See Rif_Junk on Rap2Rif by Flatz , params are same as for act.dat
Unknown1 0xA0 0x10 N.A Digest?
Unknown2 0xB0 0x10 N.A Another Digest?
Unknown3 0xC0 0x40 N.A Zero bytes / Padding
RSA Signature? 0x100 0x100 N.A Params are unknown
Restore act.dat on the PS3
====================
Now how to exploit it and use it on other systems, like a backup..
Use the restore act.dat after a new ps3 install, format and so on..
It copies it from home/000000XX/exdata/backup/act.dat to "home/000000XX/exdata/"
This works for 00000001 till 00000013, so for the first 13 user accounts on your PS3.
Downloads:
=========
The Pkg to restore
https://mega.nz/#!5QhTnQDS!Sui412LrZ4ZO539V14b33W4ZIUdEeiazruLCxW3lr8g
Original act.dat file
https://mega.nz/#!8FZzWQRa!ydeVIdpkyV_GuOs34_kKt1b0mSsaYbfQFf3nI82gbTg
Rap2Rif source code by Flatz
Rap2Rif Key souce code by Flatz
Usage
DLC Decryption
Last edited:
Previous thread
Next thread
