CommonETicket - Revision history

3dsguy: Redirected page to Ticket

2013-04-25T03:06:07Z

Redirected page to Ticket

← Older revision		Revision as of 07:06, 25 April 2013
Line 1:		Line 1:
	~~[[Category:File formats]]~~		#REDIRECT [[Ticket]]
	~~'''CommonETicket''' (for short, '''cetk''') is a format as a ticket used to store an encrypted titlekey (using 128-Bit AES-CBC). This format seems to be identical to DSi/Wii tickets.~~

	~~== Structure ==~~

	~~All of the data in the file is represented in Big Endian.~~

	~~=== Content ===~~
	~~{\| class="wikitable"~~
	~~\| align="center" style="background:#f0f0f0;"\|'''Offset'''~~
	~~\| align="center" style="background:#f0f0f0;"\|'''Size'''~~
	~~\| align="center" style="background:~~#~~f0f0f0;"\|'''Description'''~~
	\|-
	~~\| 0x000\|\|0x4\|\|Signature Type~~
	\|-
	~~\| 0x004\|\|0x100\|\|Signature~~
	\|-
	~~\| 0x104\|\|0x3C\|\|Signature Padding, aligning end of signature to 0x40 bytes~~
	\|-
	~~\| 0x140\|\|0x40\|\|Issuer~~
	\|-
	~~\| 0x180\|\|0x3C\|\|ECDH data for console-unique eShop tickets.~~
	\|-
	~~\| 0x1BC\|\|0x3\|\|Unknown, first u8 is 0x01.~~
	\|-
	~~\| 0x1BF\|\|0x10\|\|Encrypted TitleKey~~
	\|-
	~~\| 0x1CF\|\|0x1\|\|Unknown~~
	\|-
	~~\| 0x1D0\|\|0x8\|\|TicketID~~
	\|-
	~~\| 0x1D8\|\|0x4\|\|Ticket consoleID~~
	\|-
	~~\| 0x1DC\|\|0x8\|\|TitleID~~
	\|-
	~~\| 0x1E4\|\|0x2\|\|Unknown~~
	\|-
	~~\| 0x1E6\|\|0x2\|\|Ticket title version, this title version is also stored in the~~ [[~~TMD]].~~
	\|-
	~~\| 0x1E8\|\|0x8\|\|Unused~~
	\|-
	~~\| 0x1F0\|\|0x1\|\|Unused~~
	\|-
	~~\| 0x1F1\|\|0x1\|\|~~Ticket ~~common [[AES\|keyY]] index, usually 0x1 for retail system titles.~~
	\|-
	~~\| 0x1F2\|\|0xB2\|\|Unused~~
	\|-
	~~\| 0x2A4\|\|0x30\|\|Unknown~~
	\|-
	~~\| 0x2D4\|\|0x7C\|\|Unused~~
	\|}

	~~The Signature Type is the same const as that in [[TMD]].~~

	The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)

	~~== Certificate Chain ==~~
	~~Tickets retrieved from CDN/SOAP have a [[Certificates\|certificate]] chain appended at the end of the file. There are two certificates in this chain:~~

	~~{\| class="wikitable" border="1"~~
	\|-
	~~! CERTIFICATE~~
	~~! SIGNATURE TYPE~~
	~~! RETAIL CERT NAME~~
	~~! DEBUG CERT NAME~~
	~~! DESCRIPTION~~
	\|-
	~~\| Ticket~~
	~~\| RSA-2048~~
	~~\| XS0000000c~~
	~~\| XS00000009~~
	~~\| Used to verify the Ticket signature~~
	\|-
	~~\| CA~~
	~~\| RSA-4096~~
	~~\| CA00000003~~
	~~\| CA00000004~~
	~~\| Used to verify the Ticket Certificate~~
	\|}

	~~The CA certificate is issued by 'Root', the public key for which is stored in NATIVE_FIRM.~~

	~~== Some facts==~~
	* '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] ~~URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetCommonETicket''.~~

3dsguy at 08:04, 24 April 2013

2013-04-24T06:04:34Z

← Older revision		Revision as of 10:04, 24 April 2013
Line 16:		Line 16:
	\| 0x004\|\|0x100\|\|Signature		\| 0x004\|\|0x100\|\|Signature
	\|-		\|-
	\| 0x104\|\|0x3C\|\|Padding ~~modulo 64~~		\| 0x104\|\|0x3C\|\|Signature Padding, aligning end of signature to 0x40 bytes
	\|-		\|-
	\| 0x140\|\|0x40\|\|Issuer		\| 0x140\|\|0x40\|\|Issuer
Line 51:		Line 51:
	\|}		\|}

	The Signature Type is the same const as that in [[TMD]].		The Signature Type is the same const as that in [[TMD]].

	The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)		The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)

3dsguy: /* Certificate Chain */

2013-04-23T08:24:48Z

Certificate Chain

← Older revision		Revision as of 12:24, 23 April 2013
Line 56:		Line 56:

	== Certificate Chain ==		== Certificate Chain ==
	Tickets retrieved from CDN/SOAP have a ~~Certificate~~ chain appended at the end~~, outside~~ of the ~~ticket structure(offset 0x350/0x450 depending on the size of the ticket signature)~~. There are two certificates in this chain:		Tickets retrieved from CDN/SOAP have a [[Certificates\|certificate]] chain appended at the end of the file. There are two certificates in this chain:

	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"

3dsguy at 15:36, 21 April 2013

2013-04-21T13:36:17Z

@@ Line 51: / Line 51: @@
 |}
-The Signature Type is the same const as that in [[TMD]]. The certificate chain is located at offset 0x350 for tickets from CDN/SOAP, however this cert-chain is removed once the ticket is installed to NAND.
+The Signature Type is the same const as that in [[TMD]].
 The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)
 == Some facts==
 * '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetCommonETicket''.

3dsguy: /* Content */

2013-04-19T13:29:37Z

Content

← Older revision		Revision as of 17:29, 19 April 2013
Line 45:		Line 45:
	\|-		\|-
	\| 0x1F2\|\|0xB2\|\|Unused		\| 0x1F2\|\|0xB2\|\|Unused
			\|-
			\| 0x2A4\|\|0x30\|\|Unknown
			\|-
			\| 0x2D4\|\|0x7C\|\|Unused
	\|}		\|}

	The Signature Type is the same const as that in [[TMD]]. The certificate chain is located at offset ~~0x2A4~~ for tickets from CDN/SOAP, however this cert-chain is removed once the ticket is installed to NAND.		The Signature Type is the same const as that in [[TMD]]. The certificate chain is located at offset 0x350 for tickets from CDN/SOAP, however this cert-chain is removed once the ticket is installed to NAND.

	The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)		The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)

Yellows8 at 05:24, 6 April 2013

2013-04-06T03:24:21Z

← Older revision		Revision as of 07:24, 6 April 2013
Line 36:		Line 36:
	\| 0x1E4\|\|0x2\|\|Unknown		\| 0x1E4\|\|0x2\|\|Unknown
	\|-		\|-
	\| 0x1E6\|\|0x2\|\|Ticket version		\| 0x1E6\|\|0x2\|\|Ticket title version, this title version is also stored in the [[TMD]].
	\|-		\|-
	\| 0x1E8\|\|0x8\|\|Unused		\| 0x1E8\|\|0x8\|\|Unused

Yellows8 at 21:02, 31 March 2013

2013-03-31T19:02:46Z

← Older revision		Revision as of 23:02, 31 March 2013
Line 48:		Line 48:

	The Signature Type is the same const as that in [[TMD]]. The certificate chain is located at offset 0x2A4 for tickets from CDN/SOAP, however this cert-chain is removed once the ticket is installed to NAND.		The Signature Type is the same const as that in [[TMD]]. The certificate chain is located at offset 0x2A4 for tickets from CDN/SOAP, however this cert-chain is removed once the ticket is installed to NAND.

			The titlekey is decrypted by using the [[AES]] engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)

	== Some facts==		== Some facts==
	* '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetCommonETicket''.		* '''CETK''' can be fetched through HTTP using the link to default update server, using the title's [[TMD]] URL where "cetk" is used instead of "tmd" for the URL. The 3DS NIM module retrieves system tickets via SOAP request ''GetCommonETicket''.

Yellows8 at 19:57, 26 March 2013

2013-03-26T18:57:50Z

Show changes

Syphurith: Add link to TMD

2013-03-26T15:03:51Z

Add link to TMD

← Older revision		Revision as of 18:03, 26 March 2013
Line 1:		Line 1:
	[[Category:File formats]]		[[Category:File formats]]
	'''CommonETicket''' (for short, '''cetk''') is a format used to store an encrypted titlekey (using 128-Bit AES-CBC).		'''CommonETicket''' (for short, '''cetk''') is a format as a ticket used to store an encrypted titlekey (using 128-Bit AES-CBC).

	== Notice ==		== Notice ==
Line 108:		Line 108:
	\| 0xA1C\|\|52\|\|Padding		\| 0xA1C\|\|52\|\|Padding
	\|}		\|}
	The Signature Type is the same const as that in TMD.		The Signature Type is the same const as that in [[TMD]].

	== Some facts==		== Some facts==
	* '''CETK''' can be fetched through HTTP using the link to default update server, with only one word different from those of [[TMD]]s, while the 3ds use ''GetCommonETicket'' function (with SOAP).		* '''CETK''' can be fetched through HTTP using the link to default update server, with only one word different from those of [[TMD]]s, while the 3ds use ''GetCommonETicket'' function (with SOAP).
	* However only 3 cetk files has been discovered (those of Firmware Titles). Diff those files you will see there is only a few differences. The files seem to be '''just the same''' except those segments : 0x04-0x104,0x1BF-0x1CF,0x1D2-0x1D8,0x1DC-0x1E4,0x1E4-0x1E8.		* However only 3 cetk files has been discovered (those of Firmware Titles). Diff those files you will see there is only a few differences. The files seem to be '''just the same''' except those segments : 0x04-0x104,0x1BF-0x1CF,0x1D2-0x1D8,0x1DC-0x1E4,0x1E4-0x1E8.

Syphurith: Add Link to TMD

2013-03-26T15:01:46Z

Add Link to TMD

← Older revision		Revision as of 18:01, 26 March 2013
Line 111:		Line 111:

	== Some facts==		== Some facts==
	* '''CETK''' can be fetched through HTTP using the link to default update server, with only one word different from those of ~~TMDs~~, while the 3ds use GetCommonETicket function (with SOAP).		* '''CETK''' can be fetched through HTTP using the link to default update server, with only one word different from those of [[TMD]]s, while the 3ds use ''GetCommonETicket'' function (with SOAP).
	* However only 3 cetk files has been discovered (those of Firmware Titles). Diff those files you will see there is only a few differences. The files seem to be '''just the same''' except those segments : 0x04-0x104,0x1BF-0x1CF,0x1D2-0x1D8,0x1DC-0x1E4,0x1E4-0x1E8.		* However only 3 cetk files has been discovered (those of Firmware Titles). Diff those files you will see there is only a few differences. The files seem to be '''just the same''' except those segments : 0x04-0x104,0x1BF-0x1CF,0x1D2-0x1D8,0x1DC-0x1E4,0x1E4-0x1E8.