Page 1 of 4

Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 1:39 am
by Proxima
Here's a sample program to calculate the title update download links. These links are similar to PS3, but have been updated on the Vita to include an HMAC-SHA256 of the title as part of the path.

The HMAC key is:

Code: Select all

E5E278AA1EE34082A088279C83F9BBC806821C52F2AB5D2B4ABD995450355114
Below is a little C function for generating the links for a title id (game updates). Just use a standard implementation of HMAC-SHA256 from anywhere (Apple, OpenSSL, somewhere on github, etc).

Code: Select all

// Generate Title Update download links for Vita
int main(void) {

	unsigned char key[32] =
	{
	    0xE5, 0xE2, 0x78, 0xAA, 0x1E, 0xE3, 0x40, 0x82, 0xA0, 0x88, 0x27, 0x9C, 0x83, 0xF9, 0xBB, 0xC8,
	    0x06, 0x82, 0x1C, 0x52, 0xF2, 0xAB, 0x5D, 0x2B, 0x4A, 0xBD, 0x99, 0x54, 0x50, 0x35, 0x51, 0x14, 
	} ;

	char title[0x10];															
	char uniqdata[0x20];
	unsigned char result[0x20];
	int i;													
											
	memset(uniqdata,0,0x20);
	memset(result,0,0x20);
	memset(title,0,0x10);
	
	printf("Enter title id name (PCSA00000):"); scanf("%s", title);

	sprintf(uniqdata,"np_%s", title );
	
	// use a standard implementation of a sha256 hmac
	hmac_sha256(key,0x20,uniqdata,strlen(uniqdata),result);
	
	printf("https://gs-sec.ww.np.dl.playstation.net/pl/np/%s/", title);
	for(i=0;i<0x20;i++) {
		printf("%02x", result[i]);
	}
	printf("/%s-ver.xml\n", title);
	
	return 0;
}
// Test Example
// Enter title id name (PCSA00000):PCSA00007
// https://gs-sec.ww.np.dl.playstation.net/pl/np/PCSA00007/86d7c3b64d554b9639c5ad69aac20e16ea34c2f513d412f38329257f4ad15782/PCSA00007-ver.xml
Enjoy!

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 2:24 am
by yifanlu
Great job as always. Unfortunally most kids won't understand the implications as they are too busy fighting about some pool game on the PSP.

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 2:56 am
by ANU815
Not all of us are worrying about that pool game. Especially those of us stubbornly holding onto 3.18. If I interpret correctly, does this mean we may be able to update our games without updating firmware? Using these custom direct links and package manager?

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 3:36 am
by HarmfulMushroom
ANU815 wrote:Not all of us are worrying about that pool game. Especially those of us stubbornly holding onto 3.18. If I interpret correctly, does this mean we may be able to update our games without updating firmware? Using these custom direct links and package manager?
You could always update your games without upgrading firmware, you don't need to be connected to PSN to do so.

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 9:39 am
by EchoDev
If we could manipulate https data to the vita we prolly could feed it our own pkg files right? :lol: Change the pkg file to a different one from the Sony servers to see if it accepts it.

Does anyone know how the sha1sum is calculated in the xml file? It does not seem to be a standard sha1 calculation.

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 10:13 am
by mr.gas
that's great

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 11:37 am
by John V. North
Can someone explain what exactly can we do with it and what it can lead to?

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 3:04 pm
by Omega2058
Nice, thanks for sharing.

Re: Calculating title update download links with HMAC key

Posted: Mon Aug 31, 2015 6:15 pm
by npt
Very nicely done.

-npt

Re: Calculating title update download links with HMAC key

Posted: Thu Sep 03, 2015 12:37 am
by MooMooMan
EchoDev wrote:If we could manipulate https data to the vita we prolly could feed it our own pkg files right? :lol: Change the pkg file to a different one from the Sony servers to see if it accepts it.

Does anyone know how the sha1sum is calculated in the xml file? It does not seem to be a standard sha1 calculation.
I am willing to bet my manhood that what you are proposing is very difficult at the moment, or down right impossible.

If it were that easy, all you would need to do is set up a router to search for a specific https connection, and reroute it to another site, or better yet, your own home server with the files you need.

The idea is nice though, I wonder if something will ever come of it. I guess all we need is the keys? I don't know, I only code in JavaScript. Lol