3dbrew

AES Registers: Difference between revisions

← Older editNewer edit →
→Keyslots: Need to verify this..
Line 186: Line 186:
!  Keyslot
!  Keyslot
!  Description
!  Description
!  Key-data initialized by ARM9 bootrom
!  KeyX
!  Key-data initialized by Process9
!  KeyY
!  Normal-key
!  Old3DS
|-
|-
| 0x00-0x03
| 0x00-0x03
| These are the TWL keyslots, the key-data for these can be set via the REG_AESKEY0-REG_AESKEY3 registers. These keyslots are initialized by NATIVE_FIRM. The console-unique portion of two of these keyslots are only [[CONFIG|initialized]] by NATIVE_FIRM during initial hard-boot.
| TWL keyslots.  
| No
| NATIVE_FIRM hard-boot.
| NATIVE_FIRM hard-boot.
| -
| Yes
| Yes
|-
|-
| 0x0D
| 0x0D
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
| SSL-certificate key. See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom?
| Bootrom?
| -
| Yes
| Yes
| No
|-
|-
| 0x11
| 0x11
| This is used for general normal-key crypto, where the normal-key is set by FIRM. This keyslot is also used by the New3DS [[FIRM]] arm9 binary loader.
| This is used for general normal-key crypto, where the normal-key is set by FIRM. This keyslot is also used by the New3DS [[FIRM]] arm9 binary loader.
| No
| Arm9Loader.
| Yes, when using this keyslot
| Arm9Loader.
| NATIVE_FIRM.
| Yes
|-
|-
| 0x12
| 0x12
| Unused
| Unused
| No
| -
| No
| -
| -
| -
|-
|-
| 0x14
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
| Bootrom???
| NATIVE_FIRM boot.
| -
| Yes
| Yes
| See description
|-
|-
| 0x20..0x23
| 0x20..0x23
| All of these keyslots(initialized by bootrom) are set to the same key-data, which is a regular normal-key. The keyX written to these keyslots before writing the normal-key by the bootrom, is console-unique.
| All of these keyslots are set to the same key-data, which is a regular normal-key. The keyX written to these keyslots before writing the normal-key by the bootrom, is console-unique.
| -
| -
| Bootrom.
| Yes
| Yes
| No
|-
|-
| 0x24
| 0x24
| This is set to a normal-key by bootrom. The keyX written to this keyslot before writing the normal-key by the bootrom, is console-unique.
| This is set to a normal-key by bootrom. The keyX written to this keyslot before writing the normal-key by the bootrom, is console-unique.
| -
| -
| Bootrom.
| Yes
| Yes
| No
|-
|-
| 0x25
| 0x25
| The keyX and keyY initialized by bootrom for this keyslot are console-unique. This keyslot is used for the [[7.0.0-13|v7.0]] [[NCCH]] encryption, the keyX is initialized during NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]]. The keyY/CTR used for this keyslot is the same as keyslot 0x2C.
| [[7.0.0-13|v7.0]] [[NCCH]] key.
| ?
<!--
| See description
The keyX and keyY initialized by bootrom for this keyslot are console-unique.
-->
| NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]].
| NATIVE_FIRM.
| -
| Yes
|-
|-
| 0x26
| 0x26
| Unused
| Unused
| No
| -
| No
| -
| -
| Yes
|-
|-
| 0x27
| 0x27
| Unused
| Unused
| No
| -
| No
| -
| -
| Yes
|-
|-
| 0x28
| 0x28
| This is set to the same normal-key as keyslot 0x24 by bootrom. The keyX written to this keyslot before writing the normal-key by the bootrom, is console-unique(separate from the keyslot 0x24 keyX).
| ?
<!--
The keyX written to this keyslot before writing the normal-key by the bootrom, is console-unique(separate from the keyslot 0x24 keyX).
-->
| -
| -
| Bootrom.
| Yes
| Yes
| No
|-
|-
| 0x2C
| 0x2C
| Used to decrypt [[NCCH|NCCH]], the keyY is set by Process9(see [[NCCH|here]] regarding the keyY). Keyslots 0x2C..0x2F all use the same keyX, set by bootrom.
| [[NCCH|NCCH]] key. Keyslots 0x2C..0x2F all use the same keyX, set by bootrom.
| Yes
| Bootrom.
| Process9.
| -
| Yes
| Yes
|-
|-
| 0x2D
| 0x2D
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
| UDS local-WLAN CCMP key. See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Process9?
| -
| Yes
| Yes
| No
|-
|-
| 0x2E
| 0x2E
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyY is set by NATIVE_FIRM.
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Yes
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
| Yes
|-
|-
| 0x2F
| 0x2F
| Initially this keyslot has the same keyY as keyslot 0x2D, initialized by bootrom. This keyY is initialized during NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]]. This is the keyslot used for calculating v6.0 gamecard savegames' keyYs.
| [[Savegames#6.0.0-11_Savegame_keyY|v6.0]] save key.
| Bootrom.
| Bootrom, then later NATIVE_FIRM.
| -
| Yes
| Yes
| See description
|-
|-
| 0x30-0x33
| 0x30-0x33
| All of these keyslots use the same keyX. The keyY for keyslots 0x32 and 0x33 are set to the same keyY by bootrom. Process9 may write the keyY for all of these keyslots except for 0x32.
| All of these keyslots use the same keyX. The keyY for keyslots 0x32 and 0x33 are set to the same keyY by bootrom. Process9 may write the keyY for all of these keyslots except for 0x32.
| Yes
| Bootrom.
| Bootrom, then later NATIVE_FIRM (??).
| -
| Yes
| Yes
|-
|-
| 0x31
| 0x31
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| APT wrap key. See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]
| Yes
 
NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Bootrom.
| Bootrom, then later NATIVE_FIRM (??).
| -
| Yes
| Yes
|-
|-
| 0x32
| 0x32
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom, then later NATIVE_FIRM (??).
| -
| Yes
| Yes
| No
|-
|-
| 0x34-0x37
| 0x34-0x37
| All four of these keyslots use the same keyX. Keyslots 0x35, 0x36, and 0x37 use the same bootrom keyY. See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]] for keyslot 0x36.
| All four of these keyslots use the same keyX. Keyslots 0x35, 0x36, and 0x37 use the same bootrom keyY. See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]] for keyslot 0x36.
| Bootrom.
| Bootrom, then NATIVE_FIRM for keyslot 0x37.
| -
| Yes
| Yes
| Only for keyslot 0x37
|-
|-
| 0x38-0x3B
| 0x38-0x3B
| All of these keyslots use the same keyX. Keyslot 0x3B uses an unique keyY initialized by bootrom.
| All of these keyslots use the same keyX. Keyslot 0x3B uses an unique keyY initialized by bootrom.
| Bootrom.
| Bootrom.
| -
| Yes
| Yes
| No
|-
|-
| 0x38
| 0x38
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]].
| Bootrom.
| Bootrom, then NATIVE_FIRM (???).
| -
| Yes
| Yes
| No
|-
|-
| 0x39
| 0x39
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
| Yes
| Bootrom.
| Bootrom, then NATIVE_FIRM.
| -
| Yes
| Yes
|-
|-
| 0x3C
| 0x3C
| The keyX for this is unique for this keyslot. The keyY for this initialized by bootrom is the same as keyslot 0x38.
| The keyX for this is unique for this keyslot. The keyY for this initialized by bootrom is the same as keyslot 0x38.
| Bootrom.
| Bootrom.
| -
| Yes
| Yes
| No
|-
|-
| 0x3D
| 0x3D
| This keyslot uses keyY. Used to decrypt title keys in [[Ticket]]. Used by Gateway.
| Common key. Used to decrypt title keys in [[Ticket]]. Used by Gateway.
| Yes
| Bootrom.
| NATIVE_FIRM.
| -
| Yes
| Yes
|-
|-
| 0x3E
| 0x3E
| This keyslot uses an unique keyX/keyY.
| This keyslot uses an unique keyX/keyY.
| Bootrom.
| Bootrom.
| -
| Yes
| Yes
| No
|-
|-
| 0x3F
| 0x3F
| This keyslot uses an unique keyX/keyY.
| This keyslot uses an unique keyX/keyY.
| Bootrom.
| Bootrom.
| -
| Yes
| Yes
| No
|}
|}


Retrieved from "https://www.3dbrew.org/wiki/AES_Registers"