PS3 RE: Hacking the Singstar DLC encryption

Edness

Member
Merge reply here: https://www.psx-place.com/threads/h...cryption-for-backup-custom-songs.28150/page-6
--- --- ---

Hi, it's been a hot minute since my last post, and I've got some good news and maybe some not-as-good news.

The good news is that I've now finally gotten around to finishing adding DLC extraction support, creating native macOS (x86+ARM) builds, as well as open sourcing my tool!

https://github.com/EdnessP/scee-london

Use the -k or --drmkey argument to provide your PS3's Open PSID to decrypt the DLC files.

Now, the not-as-good news is that the DLC keystores are signed with 2048-bit RSA, and to my knowledge we only have the public key available. Presumably the keystores were signed by the SingStore servers before transferring them over.

However, I also have some workarounds in mind:
  1. While keys.edat contains three RSA public keys, seemingly only the first one is used for DLC, because if I "corrupted" it, the game didn't appear to try to switch to the other ones when I was debugging it. (I did see it briefly switch to the 2nd key while debugging the boot sequence, but I'm not sure for what, probably some other stuff.)
    I could maybe generate my own RSA public/private key pair to resign the DLC with, and have that patched into keys.edat, but that would require you to resign all of your DLC even with the correct PSID.

  2. Patching the game's EBOOT.BIN to simply have it skip the DLC signing check. My tool supports raw decrypting and encrypting with -d or --dump, which when encrypting will put all the keystore data in the right place with your provided PSID, but just not RSA sign it.
    But this could mean creating a billion patches for all the different releases of SingStar. Or alternatively, maybe simply patching the plain SingStar App with DLC signature verification disabled, and just have everyone rely on that. AFAIK loading game disc songs should still work even with the app.

  3. Maybe it's possible like with the older games pre-SingStar Ultimate Party/Frozen to load the DLC extracted also from a directory on the PS3 HDD. I vaguely recall back in February when making my previous post seeing the PS3 attempting to access some non-standard DLC file path on the drive, but I didn't look very deep into it.
 
Back
Top