| View previous topic :: View next topic |
| Author |
Message |
steddy
Joined: 04 Apr 2005
Posts: 139
|
 Posted: Wed May 25, 2005 8:27 am Post subject: Finding where the region code is stored |
 |
|
I have a theory about the movie region. Maybe the unique hardware ID that is stored in DATA2.BIN (see the exploit thread on the Wipeout Downloads) actually tells it the region.
On Windows Mobile devices, the unique hardware ID tells you information such as the the manufacturer and model. Maybe Sony do the same.
The following java code can be compiled and ran on your desktop PC to find the hardware ID.
| Code: | package data2reader;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.File;
import java.io.InputStream;
import java.io.OutputStream;
import net.scee.drm.mypsp.download.hash.SHA1CipherStream;
public class Data2Reader
{
private static final char HEX[] =
{
'0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
'A', 'B', 'C', 'D', 'E', 'F'
};
public static void main (String[] args)
{
boolean bWrite=false;
File data2File=new File(args[0]);
if(args.length==2) {
bWrite=true;
}
long fileLength = data2File.length();
if(fileLength % 276L != 0L)
{
System.out.println("Error: File length not multiple of 276");
System.exit(1);
}
else
{
try
{
InputStream dis = new FileInputStream(data2File);
int nIdent = (int) (fileLength / 276L);
for(int i = 0; (long)i < nIdent; i++)
{
byte[] version = new byte[4];
byte[] hardwareId = new byte[20];
byte[] timeStamp = new byte[4];
byte[] nickName = new byte[208];
byte[] fingerprint = new byte[20];
byte[] key = new byte[20];
dis.read(version);
dis.read(hardwareId);
dis.read(timeStamp);
dis.read(nickName);
dis.read(fingerprint);
dis.read(key);
SHA1CipherStream cipher = new SHA1CipherStream(key);
cipher.xor(version);
cipher.xor(hardwareId);
cipher.xor(timeStamp);
cipher.xor(nickName);
cipher.xor(fingerprint);
System.out.println("Found identity: "+convertToString(nickName));
System.out.println("HardwareID: "+dump(hardwareId));
System.out.println("Version: "+dump(version));
System.out.println("TimeStamp: "+dump(timeStamp));
System.out.println();
if(bWrite==true) {
// Now output the file if required
OutputStream out = new FileOutputStream(args[1]);
out.write(version);
out.write(hardwareId);
out.write(timeStamp);
out.write(nickName);
out.write(fingerprint);
}
}
}
catch (Exception e)
{
System.out.println("Error: "+e);
}
}
}
public static final String convertToString(byte[] input)
{
try
{
int n=0;
while (input[n]!=0) n++;
return new String(input, 0, n, "UTF8");
}
catch(Exception e)
{
return null;
}
}
public static final String dump(byte a[])
{
StringBuffer buf = new StringBuffer();
for(int i = 0; i < a.length; i++)
{
buf.append(HEX[a[i] >> 4 & 0xf]);
buf.append(HEX[a[i] & 0xf]);
}
return buf.toString();
}
}
|
As you can see its a modification of the code presented by piercer in the PSP Download Agent thread. It requires the jar file libraries provided in the following download from Sony:
https://www.yourpsp.com/download/static/downloadapplet/MyPSPAppletS.jar
Pass in the DATA2.BIN that is created when a profile is loaded or created in Wipeout Pure for the first parameter.
If we can get a few people from different regions to do this we may be able to spot a pattern. My only concern is, is there any risk in posting hardware ID's here? Do any of the mods care to comment on this?
Steddy |
|
| Back to top |
|
 |
steddy
Joined: 04 Apr 2005
Posts: 139
|
| Posted: Sat May 28, 2005 12:19 am Post subject: |
|
|
Come on guys... somebody help me out with this.
Since I have had no response from the Dev's I will post the details for my Two PSP's:
1.5 JAP PSP (upgraded from 1.0):
Found identity: PSPsteddy
HardwareID: 64262ABAFD618B8611C13DED5D49B2CF96B22BE7
Version: 01000000
TimeStamp: 12AA7C0A
1.0 JAP PSP:
Found identity: PSP114
HardwareID: 610AC0F19FC1A95B4657484B964A2A3E24BDD88B
Version: 01000000
TimeStamp: CDD5C60A
They do look pretty random, but the first digit is the same. Could the 6 be the device region identifier. Remeber it doesn't have to be 2, its how its converted that matters. Also note the version is the same across both. I wonder if thats related to the original firmware version.
Steddy
PS if you can get this compiled and you have an FTP you'd like me to drop it on, then just say. |
|
| Back to top |
|
|
zigzag
Joined: 26 Jan 2005
Posts: 129
|
| Posted: Sat May 28, 2005 1:21 pm Post subject: |
|
|
| Why do you think the region code is in the hardware id as a digit? It can easily be some sort of decodable set of numbers, likely much like a serial number. |
|
| Back to top |
|
|
steddy
Joined: 04 Apr 2005
Posts: 139
|
| Posted: Sat May 28, 2005 5:31 pm Post subject: |
|
|
Because on a lot of systems I have worked on, it is.
All Windows CE devices that support a hardware ID use it to encode information such as the Device manufacturer and model number. If it isn't in the hardware ID which we know to be unique, where is it?
Only people trying this code out and posting the results will tell us if this is the case.
Steddy |
|
| Back to top |
|
|
Squall333
Joined: 28 Apr 2005
Posts: 91
|
| Posted: Sun May 29, 2005 7:35 am Post subject: |
|
|
| How do we do this do we need wipeout ot a 1.0 psp not much instuctions to go by |
|
| Back to top |
|
|
steddy
Joined: 04 Apr 2005
Posts: 139
|
| Posted: Sun May 29, 2005 7:54 am Post subject: |
|
|
You need to compile the source above to a JAR file with the Sun Java compiler, then run the JAR with the DATA2.BIN created by Wipeout Pure (/PSP/SAVES/PPCD00001DLS001 on the memory card) as the first parameter.
The compiled JAR file referenced above from yourpsp.com will need to be present UNDERNEATH the directory where you place the data2reader.class file for compilation.
Steddy |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
