I've been also looking into libcrypt recently (that is, unsuccessfully trying to figure out how the keys were generated). The above source code does only contain the decryption stuff, not the key generator for encryption.
The .doc files in the source code are slightly interesting: The keys were apparently generated by Sony (using some secret mechanism), and the sector numbers appear to have been submitted on paper forms (instead of storing them in a hidden cdrom file or the like).
Keys and Gamecodes
Below are some potentially interesting keys/gamecodes taken from
http://web.archive.org/web/202207101840 ... om_Patches
Code: Select all
gamecode (=hex) key (=binary)
SCES-01700 (=6A4h) 4717h (=0100011100010111b) ;\increasing gamecodes
SCES-01702 (=6A6h) 672Ah (=0110011100101010b) ;/
SLES-02700 (=A8Ch) 27D8h (=0010011111011000b) ; SLES-02704 (=A90h) 711Eh (=0111000100011110b) ;
SLES-02705 (=A91h) 4AADh (=0100101010101101b) ; increasing gamecodes
SLES-02706 (=A92h) 1EB1h (=0001111010110001b) ;
SLES-02707 (=A93h) AD31h (=1010110100110001b) ;
SLES-02708 (=A94h) 5EC4h (=0101111011000100b) ;/
SLES-00017 (=011h) E2B8h (=1110001010111000b) ;-small gamecode
SLES-02723 (=AA3h) 0FF0h (=0000111111110000b) ;-somewhat interesting key
SLES-03606 (=E16h) 0000h (=0000000000000000b) ;-unencrypted
SCES-02029 (=7EDh) 26B6h (=0010011010110110b) ;\similar keys
SLES-02209 (=8A1h) 26D6h (=0010011011010110b) ;/
SLES-03245 (=CADh) 05D7h (=0000010111010111b) ;\similar keys
SLES-02831 (=B0Fh) 05DEh (=0000010111011110b) ;/
SLES-03241 (=CA9h) 7B82h (=0111101110000010b) ;\same key
SLES-03243 (=CABh) 7B82h (=0111101110000010b) ;/
SCED-01979 (=7BBh) 0D9Dh (=0000110110011101b) ;\SCED and SCES with same key
SCES-01979 (=7BBh) 0D9Dh (=0000110110011101b) ;/
SCES-02835 (=B13h) 369Ah (=0011011010011010b) ;v1.0 ;\same gamecode, but
SCES-02835 (=B13h) DD11h (=1101110100010001b) ;v1.1 ;/different keys
SLES-02081 (=0821h) 6837h (=0110100000110111b) ; SLES-12081 (=2F31h) 6837h (=0110100000110111b) ; multidisc same key
SLES-22081 (=5641h) 6837h (=0110100000110111b) ;
SLES-32081 (=7D51h) 6837h (=0110100000110111b) ;/
SLES-02969 (=0B99h) EC61h (=1110110001100001b) ; SLES-12969 (=32A9h) 645Bh (=0110010001011011b) ; multidisc different keys
SLES-22969 (=59B9h) 6636h (=0110011000110110b) ;
SLES-32969 (=80C9h) E8C3h (=1110100011000011b) ;/
That looks quite random to me - or can anybody spot a pattern?
Random Seed
They
might have simply used the gamecode as random seed. But I see no relation in the above table. And the .doc files are claiming that they could assign different keys to different pressings of the same game (though they seem to have almost never done that, and even then, it doesn't completely rule out using the gamecode as default seed).
Other than that, they might have used a 'real random' number (if it's crudely based on date/time then there might be some relation to increasing seeds for keys generated on the same day), or perhaps they've used something like the ISO volume descriptor or root directory content as random seed.
Random Generator
One known rule is that the 16bit keys do always contain eight "0" bits and eight "1" bits. Which might be done as so:
- Bit inversion (eg. keys 05D7h and 05DEh would imply bit0 being inverse of bit3, but there are also keys with bit0=bit3, so it must be more complicated than that).
- Bit swapping (eg. using 00FFh as initial value and then randomly swapping bits around).
- Random bit setting (setting eight random bit numbers, and retrying other bit numbers if that bit was already set).
Key Ganerator Versions
Older games are using one single key for multidisc games, newer ones are using different keys for each disc. So they did apparently change the random seed and/or random generator at some point.
If you should find a pattern that works for some keys, don't be confused if it doesn't work for all other keys.