Merge pull request #4181 from wwylele/cia-crypto

Add encrypted CIA support
This commit is contained in:
Weiyi Wang 2018-10-01 14:23:35 -04:00 committed by GitHub
commit 5fb3137bdc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 272 additions and 51 deletions

View file

@ -50,6 +50,7 @@ add_library(core STATIC
file_sys/archive_source_sd_savedata.h file_sys/archive_source_sd_savedata.h
file_sys/archive_systemsavedata.cpp file_sys/archive_systemsavedata.cpp
file_sys/archive_systemsavedata.h file_sys/archive_systemsavedata.h
file_sys/cia_common.h
file_sys/cia_container.cpp file_sys/cia_container.cpp
file_sys/cia_container.h file_sys/cia_container.h
file_sys/directory_backend.h file_sys/directory_backend.h
@ -68,6 +69,8 @@ add_library(core STATIC
file_sys/romfs_reader.h file_sys/romfs_reader.h
file_sys/savedata_archive.cpp file_sys/savedata_archive.cpp
file_sys/savedata_archive.h file_sys/savedata_archive.h
file_sys/ticket.cpp
file_sys/ticket.h
file_sys/title_metadata.cpp file_sys/title_metadata.cpp
file_sys/title_metadata.h file_sys/title_metadata.h
frontend/applets/default_applets.cpp frontend/applets/default_applets.cpp

View file

@ -0,0 +1,40 @@
// Copyright 2018 Citra Emulator Project
// Licensed under GPLv2 or any later version
// Refer to the license.txt file included.
#pragma once
#include "common/assert.h"
#include "common/common_types.h"
namespace FileSys {
enum TMDSignatureType : u32 {
Rsa4096Sha1 = 0x10000,
Rsa2048Sha1 = 0x10001,
EllipticSha1 = 0x10002,
Rsa4096Sha256 = 0x10003,
Rsa2048Sha256 = 0x10004,
EcdsaSha256 = 0x10005
};
inline u32 GetSignatureSize(u32 signature_type) {
switch (signature_type) {
case Rsa4096Sha1:
case Rsa4096Sha256:
return 0x200;
case Rsa2048Sha1:
case Rsa2048Sha256:
return 0x100;
case EllipticSha1:
case EcdsaSha256:
return 0x3C;
}
UNREACHABLE();
return 0;
}
} // namespace FileSys

View file

@ -124,6 +124,11 @@ Loader::ResultStatus CIAContainer::LoadHeader(const std::vector<u8>& header_data
return Loader::ResultStatus::Success; return Loader::ResultStatus::Success;
} }
Loader::ResultStatus CIAContainer::LoadTicket(const std::vector<u8>& ticket_data,
std::size_t offset) {
return cia_ticket.Load(ticket_data, offset);
}
Loader::ResultStatus CIAContainer::LoadTitleMetadata(const std::vector<u8>& tmd_data, Loader::ResultStatus CIAContainer::LoadTitleMetadata(const std::vector<u8>& tmd_data,
std::size_t offset) { std::size_t offset) {
return cia_tmd.Load(tmd_data, offset); return cia_tmd.Load(tmd_data, offset);
@ -139,6 +144,10 @@ Loader::ResultStatus CIAContainer::LoadMetadata(const std::vector<u8>& meta_data
return Loader::ResultStatus::Success; return Loader::ResultStatus::Success;
} }
const Ticket& CIAContainer::GetTicket() const {
return cia_ticket;
}
const TitleMetadata& CIAContainer::GetTitleMetadata() const { const TitleMetadata& CIAContainer::GetTitleMetadata() const {
return cia_tmd; return cia_tmd;
} }

View file

@ -10,6 +10,7 @@
#include <vector> #include <vector>
#include "common/common_types.h" #include "common/common_types.h"
#include "common/swap.h" #include "common/swap.h"
#include "core/file_sys/ticket.h"
#include "core/file_sys/title_metadata.h" #include "core/file_sys/title_metadata.h"
namespace Loader { namespace Loader {
@ -44,9 +45,11 @@ public:
// Load parts of CIAs (for CIAs streamed in) // Load parts of CIAs (for CIAs streamed in)
Loader::ResultStatus LoadHeader(const std::vector<u8>& header_data, std::size_t offset = 0); Loader::ResultStatus LoadHeader(const std::vector<u8>& header_data, std::size_t offset = 0);
Loader::ResultStatus LoadTicket(const std::vector<u8>& ticket_data, std::size_t offset = 0);
Loader::ResultStatus LoadTitleMetadata(const std::vector<u8>& tmd_data, std::size_t offset = 0); Loader::ResultStatus LoadTitleMetadata(const std::vector<u8>& tmd_data, std::size_t offset = 0);
Loader::ResultStatus LoadMetadata(const std::vector<u8>& meta_data, std::size_t offset = 0); Loader::ResultStatus LoadMetadata(const std::vector<u8>& meta_data, std::size_t offset = 0);
const Ticket& GetTicket() const;
const TitleMetadata& GetTitleMetadata() const; const TitleMetadata& GetTitleMetadata() const;
std::array<u64, 0x30>& GetDependencies(); std::array<u64, 0x30>& GetDependencies();
u32 GetCoreVersion() const; u32 GetCoreVersion() const;
@ -99,6 +102,7 @@ private:
Header cia_header; Header cia_header;
Metadata cia_metadata; Metadata cia_metadata;
Ticket cia_ticket;
TitleMetadata cia_tmd; TitleMetadata cia_tmd;
}; };

View file

@ -0,0 +1,56 @@
// Copyright 2018 Citra Emulator Project
// Licensed under GPLv2 or any later version
// Refer to the license.txt file included.
#include <algorithm>
#include <cryptopp/aes.h>
#include <cryptopp/modes.h>
#include "common/alignment.h"
#include "core/file_sys/cia_common.h"
#include "core/file_sys/ticket.h"
#include "core/hw/aes/key.h"
#include "core/loader/loader.h"
namespace FileSys {
Loader::ResultStatus Ticket::Load(const std::vector<u8> file_data, std::size_t offset) {
std::size_t total_size = static_cast<std::size_t>(file_data.size() - offset);
if (total_size < sizeof(u32))
return Loader::ResultStatus::Error;
std::memcpy(&signature_type, &file_data[offset], sizeof(u32));
// Signature lengths are variable, and the body follows the signature
u32 signature_size = GetSignatureSize(signature_type);
// The ticket body start position is rounded to the nearest 0x40 after the signature
std::size_t body_start = Common::AlignUp(signature_size + sizeof(u32), 0x40);
std::size_t body_end = body_start + sizeof(Body);
if (total_size < body_end)
return Loader::ResultStatus::Error;
// Read signature + ticket body
ticket_signature.resize(signature_size);
memcpy(ticket_signature.data(), &file_data[offset + sizeof(u32)], signature_size);
memcpy(&ticket_body, &file_data[offset + body_start], sizeof(Body));
return Loader::ResultStatus::Success;
}
boost::optional<std::array<u8, 16>> Ticket::GetTitleKey() const {
HW::AES::InitKeys();
std::array<u8, 16> ctr{};
std::memcpy(ctr.data(), &ticket_body.title_id, sizeof(u64));
HW::AES::SelectCommonKeyIndex(ticket_body.common_key_index);
if (!HW::AES::IsNormalKeyAvailable(HW::AES::KeySlotID::TicketCommonKey)) {
return boost::none;
}
auto key = HW::AES::GetNormalKey(HW::AES::KeySlotID::TicketCommonKey);
auto title_key = ticket_body.title_key;
CryptoPP::CBC_Mode<CryptoPP::AES>::Decryption{key.data(), key.size(), ctr.data()}.ProcessData(
title_key.data(), title_key.data(), title_key.size());
return title_key;
}
} // namespace FileSys

View file

@ -0,0 +1,58 @@
// Copyright 2018 Citra Emulator Project
// Licensed under GPLv2 or any later version
// Refer to the license.txt file included.
#pragma once
#include <array>
#include <string>
#include <vector>
#include <boost/optional.hpp>
#include "common/common_funcs.h"
#include "common/common_types.h"
#include "common/swap.h"
namespace Loader {
enum class ResultStatus;
}
namespace FileSys {
class Ticket {
public:
#pragma pack(push, 1)
struct Body {
std::array<u8, 0x40> issuer;
std::array<u8, 0x3C> ecc_public_key;
u8 version;
u8 ca_crl_version;
u8 signer_crl_version;
std::array<u8, 0x10> title_key;
INSERT_PADDING_BYTES(1);
u64_be ticket_id;
u32_be console_id;
u64_be title_id;
INSERT_PADDING_BYTES(2);
u16_be ticket_title_version;
INSERT_PADDING_BYTES(8);
u8 license_type;
u8 common_key_index;
INSERT_PADDING_BYTES(0x2A);
u32_be eshop_account_id;
INSERT_PADDING_BYTES(1);
u8 audit;
INSERT_PADDING_BYTES(0x42);
std::array<u8, 0x40> limits;
std::array<u8, 0xAC> content_index;
};
static_assert(sizeof(Body) == 0x210, "Ticket body structure size is wrong");
#pragma pack(pop)
Loader::ResultStatus Load(const std::vector<u8> file_data, std::size_t offset = 0);
boost::optional<std::array<u8, 16>> GetTitleKey() const;
private:
Body ticket_body;
u32_be signature_type;
std::vector<u8> ticket_signature;
};
} // namespace FileSys

View file

@ -7,6 +7,7 @@
#include "common/alignment.h" #include "common/alignment.h"
#include "common/file_util.h" #include "common/file_util.h"
#include "common/logging/log.h" #include "common/logging/log.h"
#include "core/file_sys/cia_common.h"
#include "core/file_sys/title_metadata.h" #include "core/file_sys/title_metadata.h"
#include "core/loader/loader.h" #include "core/loader/loader.h"
@ -15,24 +16,6 @@
namespace FileSys { namespace FileSys {
static u32 GetSignatureSize(u32 signature_type) {
switch (signature_type) {
case Rsa4096Sha1:
case Rsa4096Sha256:
return 0x200;
case Rsa2048Sha1:
case Rsa2048Sha256:
return 0x100;
case EllipticSha1:
case EcdsaSha256:
return 0x3C;
}
return 0;
}
Loader::ResultStatus TitleMetadata::Load(const std::string& file_path) { Loader::ResultStatus TitleMetadata::Load(const std::string& file_path) {
FileUtil::IOFile file(file_path, "rb"); FileUtil::IOFile file(file_path, "rb");
if (!file.IsOpen()) if (!file.IsOpen())
@ -188,6 +171,12 @@ u64 TitleMetadata::GetContentSizeByIndex(u16 index) const {
return tmd_chunks[index].size; return tmd_chunks[index].size;
} }
std::array<u8, 16> TitleMetadata::GetContentCTRByIndex(u16 index) const {
std::array<u8, 16> ctr{};
std::memcpy(ctr.data(), &tmd_chunks[index].index, sizeof(u16));
return ctr;
}
void TitleMetadata::SetTitleID(u64 title_id) { void TitleMetadata::SetTitleID(u64 title_id) {
tmd_body.title_id = title_id; tmd_body.title_id = title_id;
} }

View file

@ -19,15 +19,6 @@ enum class ResultStatus;
namespace FileSys { namespace FileSys {
enum TMDSignatureType : u32 {
Rsa4096Sha1 = 0x10000,
Rsa2048Sha1 = 0x10001,
EllipticSha1 = 0x10002,
Rsa4096Sha256 = 0x10003,
Rsa2048Sha256 = 0x10004,
EcdsaSha256 = 0x10005
};
enum TMDContentTypeFlag : u16 { enum TMDContentTypeFlag : u16 {
Encrypted = 1 << 0, Encrypted = 1 << 0,
Disc = 1 << 2, Disc = 1 << 2,
@ -108,6 +99,7 @@ public:
u32 GetContentIDByIndex(u16 index) const; u32 GetContentIDByIndex(u16 index) const;
u16 GetContentTypeByIndex(u16 index) const; u16 GetContentTypeByIndex(u16 index) const;
u64 GetContentSizeByIndex(u16 index) const; u64 GetContentSizeByIndex(u16 index) const;
std::array<u8, 16> GetContentCTRByIndex(u16 index) const;
void SetTitleID(u64 title_id); void SetTitleID(u64 title_id);
void SetTitleType(u32 type); void SetTitleType(u32 type);

View file

@ -6,6 +6,8 @@
#include <cinttypes> #include <cinttypes>
#include <cstddef> #include <cstddef>
#include <cstring> #include <cstring>
#include <cryptopp/aes.h>
#include <cryptopp/modes.h>
#include <fmt/format.h> #include <fmt/format.h>
#include "common/file_util.h" #include "common/file_util.h"
#include "common/logging/log.h" #include "common/logging/log.h"
@ -73,13 +75,31 @@ struct TicketInfo {
static_assert(sizeof(TicketInfo) == 0x18, "Ticket info structure size is wrong"); static_assert(sizeof(TicketInfo) == 0x18, "Ticket info structure size is wrong");
class CIAFile::DecryptionState {
public:
std::vector<CryptoPP::CBC_Mode<CryptoPP::AES>::Decryption> content;
};
CIAFile::CIAFile(Service::FS::MediaType media_type)
: media_type(media_type), decryption_state(std::make_unique<DecryptionState>()) {}
CIAFile::~CIAFile() {
Close();
}
ResultVal<std::size_t> CIAFile::Read(u64 offset, std::size_t length, u8* buffer) const { ResultVal<std::size_t> CIAFile::Read(u64 offset, std::size_t length, u8* buffer) const {
UNIMPLEMENTED(); UNIMPLEMENTED();
return MakeResult<std::size_t>(length); return MakeResult<std::size_t>(length);
} }
ResultVal<std::size_t> CIAFile::WriteTitleMetadata(u64 offset, std::size_t length, ResultCode CIAFile::WriteTicket() {
const u8* buffer) { container.LoadTicket(data, container.GetTicketOffset());
install_state = CIAInstallState::TicketLoaded;
return RESULT_SUCCESS;
}
ResultCode CIAFile::WriteTitleMetadata() {
container.LoadTitleMetadata(data, container.GetTitleMetadataOffset()); container.LoadTitleMetadata(data, container.GetTitleMetadataOffset());
FileSys::TitleMetadata tmd = container.GetTitleMetadata(); FileSys::TitleMetadata tmd = container.GetTitleMetadata();
tmd.Print(); tmd.Print();
@ -108,10 +128,22 @@ ResultVal<std::size_t> CIAFile::WriteTitleMetadata(u64 offset, std::size_t lengt
&app_folder, nullptr, nullptr); &app_folder, nullptr, nullptr);
FileUtil::CreateFullPath(app_folder); FileUtil::CreateFullPath(app_folder);
content_written.resize(container.GetTitleMetadata().GetContentCount()); auto content_count = container.GetTitleMetadata().GetContentCount();
content_written.resize(content_count);
auto title_key = container.GetTicket().GetTitleKey();
if (title_key) {
decryption_state->content.resize(content_count);
for (std::size_t i = 0; i < content_count; ++i) {
auto ctr = tmd.GetContentCTRByIndex(i);
decryption_state->content[i].SetKeyWithIV(title_key->data(), title_key->size(),
ctr.data());
}
}
install_state = CIAInstallState::TMDLoaded; install_state = CIAInstallState::TMDLoaded;
return MakeResult<std::size_t>(length); return RESULT_SUCCESS;
} }
ResultVal<std::size_t> CIAFile::WriteContentData(u64 offset, std::size_t length, const u8* buffer) { ResultVal<std::size_t> CIAFile::WriteContentData(u64 offset, std::size_t length, const u8* buffer) {
@ -143,7 +175,15 @@ ResultVal<std::size_t> CIAFile::WriteContentData(u64 offset, std::size_t length,
if (!file.IsOpen()) if (!file.IsOpen())
return FileSys::ERROR_INSUFFICIENT_SPACE; return FileSys::ERROR_INSUFFICIENT_SPACE;
file.WriteBytes(buffer + (range_min - offset), available_to_write); std::vector<u8> temp(buffer + (range_min - offset),
buffer + (range_min - offset) + available_to_write);
if (tmd.GetContentTypeByIndex(static_cast<u16>(i)) &
FileSys::TMDContentTypeFlag::Encrypted) {
decryption_state->content[i].ProcessData(temp.data(), temp.data(), temp.size());
}
file.WriteBytes(temp.data(), temp.size());
// Keep tabs on how much of this content ID has been written so new range_min // Keep tabs on how much of this content ID has been written so new range_min
// values can be calculated. // values can be calculated.
@ -206,8 +246,12 @@ ResultVal<std::size_t> CIAFile::Write(u64 offset, std::size_t length, bool flush
// The end of our TMD is at the beginning of Content data, so ensure we have that much // The end of our TMD is at the beginning of Content data, so ensure we have that much
// buffered before trying to parse. // buffered before trying to parse.
if (written >= container.GetContentOffset() && install_state != CIAInstallState::TMDLoaded) { if (written >= container.GetContentOffset() && install_state != CIAInstallState::TMDLoaded) {
auto result = WriteTitleMetadata(offset, length, buffer); auto result = WriteTicket();
if (result.Failed()) if (result.IsError())
return result;
result = WriteTitleMetadata();
if (result.IsError())
return result; return result;
} }
@ -295,9 +339,12 @@ InstallStatus InstallCIA(const std::string& path,
Service::AM::CIAFile installFile( Service::AM::CIAFile installFile(
Service::AM::GetTitleMediaType(container.GetTitleMetadata().GetTitleID())); Service::AM::GetTitleMediaType(container.GetTitleMetadata().GetTitleID()));
bool title_key_available = container.GetTicket().GetTitleKey().is_initialized();
for (std::size_t i = 0; i < container.GetTitleMetadata().GetContentCount(); i++) { for (std::size_t i = 0; i < container.GetTitleMetadata().GetContentCount(); i++) {
if (container.GetTitleMetadata().GetContentTypeByIndex(static_cast<u16>(i)) & if ((container.GetTitleMetadata().GetContentTypeByIndex(static_cast<u16>(i)) &
FileSys::TMDContentTypeFlag::Encrypted) { FileSys::TMDContentTypeFlag::Encrypted) &&
!title_key_available) {
LOG_ERROR(Service_AM, "File {} is encrypted! Aborting...", path); LOG_ERROR(Service_AM, "File {} is encrypted! Aborting...", path);
return InstallStatus::ErrorEncrypted; return InstallStatus::ErrorEncrypted;
} }

View file

@ -6,6 +6,7 @@
#include <array> #include <array>
#include <functional> #include <functional>
#include <memory>
#include <string> #include <string>
#include <vector> #include <vector>
#include "common/common_types.h" #include "common/common_types.h"
@ -58,13 +59,12 @@ using ProgressCallback = void(std::size_t, std::size_t);
// A file handled returned for CIAs to be written into and subsequently installed. // A file handled returned for CIAs to be written into and subsequently installed.
class CIAFile final : public FileSys::FileBackend { class CIAFile final : public FileSys::FileBackend {
public: public:
explicit CIAFile(Service::FS::MediaType media_type) : media_type(media_type) {} explicit CIAFile(Service::FS::MediaType media_type);
~CIAFile() { ~CIAFile();
Close();
}
ResultVal<std::size_t> Read(u64 offset, std::size_t length, u8* buffer) const override; ResultVal<std::size_t> Read(u64 offset, std::size_t length, u8* buffer) const override;
ResultVal<std::size_t> WriteTitleMetadata(u64 offset, std::size_t length, const u8* buffer); ResultCode WriteTicket();
ResultCode WriteTitleMetadata();
ResultVal<std::size_t> WriteContentData(u64 offset, std::size_t length, const u8* buffer); ResultVal<std::size_t> WriteContentData(u64 offset, std::size_t length, const u8* buffer);
ResultVal<std::size_t> Write(u64 offset, std::size_t length, bool flush, ResultVal<std::size_t> Write(u64 offset, std::size_t length, bool flush,
const u8* buffer) override; const u8* buffer) override;
@ -86,6 +86,9 @@ private:
std::vector<u8> data; std::vector<u8> data;
std::vector<u64> content_written; std::vector<u64> content_written;
Service::FS::MediaType media_type; Service::FS::MediaType media_type;
class DecryptionState;
std::unique_ptr<DecryptionState> decryption_state;
}; };
/** /**

View file

@ -25,26 +25,26 @@ struct KeySlot {
boost::optional<AESKey> y; boost::optional<AESKey> y;
boost::optional<AESKey> normal; boost::optional<AESKey> normal;
void SetKeyX(const AESKey& key) { void SetKeyX(boost::optional<AESKey> key) {
x = key; x = key;
if (y && generator_constant) { GenerateNormalKey();
GenerateNormalKey();
}
} }
void SetKeyY(const AESKey& key) { void SetKeyY(boost::optional<AESKey> key) {
y = key; y = key;
if (x && generator_constant) { GenerateNormalKey();
GenerateNormalKey();
}
} }
void SetNormalKey(const AESKey& key) { void SetNormalKey(boost::optional<AESKey> key) {
normal = key; normal = key;
} }
void GenerateNormalKey() { void GenerateNormalKey() {
normal = Lrot128(Add128(Xor128(Lrot128(*x, 2), *y), *generator_constant), 87); if (x && y && generator_constant) {
normal = Lrot128(Add128(Xor128(Lrot128(*x, 2), *y), *generator_constant), 87);
} else {
normal = boost::none;
}
} }
void Clear() { void Clear() {
@ -55,6 +55,7 @@ struct KeySlot {
}; };
std::array<KeySlot, KeySlotID::MaxKeySlotID> key_slots; std::array<KeySlot, KeySlotID::MaxKeySlotID> key_slots;
std::array<boost::optional<AESKey>, 6> common_key_y_slots;
AESKey HexToKey(const std::string& hex) { AESKey HexToKey(const std::string& hex) {
if (hex.size() < 32) { if (hex.size() < 32) {
@ -102,6 +103,16 @@ void LoadPresetKeys() {
continue; continue;
} }
std::size_t common_key_index;
if (std::sscanf(name.c_str(), "common%zd", &common_key_index) == 1) {
if (common_key_index >= common_key_y_slots.size()) {
LOG_ERROR(HW_AES, "Invalid common key index {}", common_key_index);
} else {
common_key_y_slots[common_key_index] = key;
}
continue;
}
std::size_t slot_id; std::size_t slot_id;
char key_type; char key_type;
if (std::sscanf(name.c_str(), "slot0x%zXKey%c", &slot_id, &key_type) != 2) { if (std::sscanf(name.c_str(), "slot0x%zXKey%c", &slot_id, &key_type) != 2) {
@ -165,5 +176,9 @@ AESKey GetNormalKey(std::size_t slot_id) {
return key_slots.at(slot_id).normal.value_or(AESKey{}); return key_slots.at(slot_id).normal.value_or(AESKey{});
} }
void SelectCommonKeyIndex(u8 index) {
key_slots[KeySlotID::TicketCommonKey].SetKeyY(common_key_y_slots.at(index));
}
} // namespace AES } // namespace AES
} // namespace HW } // namespace HW

View file

@ -28,6 +28,9 @@ enum KeySlotID : std::size_t {
// AES keyslot used for APT:Wrap/Unwrap functions // AES keyslot used for APT:Wrap/Unwrap functions
APTWrap = 0x31, APTWrap = 0x31,
// AES keyslot used for decrypting ticket title key
TicketCommonKey = 0x3D,
MaxKeySlotID = 0x40, MaxKeySlotID = 0x40,
}; };
@ -45,5 +48,7 @@ void SetNormalKey(std::size_t slot_id, const AESKey& key);
bool IsNormalKeyAvailable(std::size_t slot_id); bool IsNormalKeyAvailable(std::size_t slot_id);
AESKey GetNormalKey(std::size_t slot_id); AESKey GetNormalKey(std::size_t slot_id);
void SelectCommonKeyIndex(u8 index);
} // namespace AES } // namespace AES
} // namespace HW } // namespace HW