7. Inter-driver communication – Keychip Commands

The following is the list of all commands supported by hdd.sys and ssd.sys as part of the keychip command IOCTL.

Many of these commands cannot be used through fdd.sys, and this is noted on each command.

7.1 Command 0 - SessionOpen

Begin an authentication session with the keychip. This command must always be the first command transmitted.

7.2 Command 1 - SessionClose

Terminate an existing authentication session.

7.3 Command 2 - AuthStart

Begin authentication against the keychip. The arguments to this command vary depending on which low-level driver is being used.

7.3.1 ssd.sys

Default values:

7.3.2 hdd.sys

Default values:

9fd0a43a697329c54baec33cf07303bb25f4eb0f366b214633d48abf639c1057
55bd87f4071a20e5a139dcf283c86de5e4d13da34a023e21ac1b27a452c49044
97e625c32f6f9762bb80235d11d592965ea6f5839586c3066f2079e70c96055a
fc5a7fc25789b54db0833d3625b8dae173a127a681cce210103bb72fd0205cd3
f024c1bb26e261664d638390f8ef7d512dcf2bc72a826eec413f233788ba1309
264018efdbd8cb748e08917c992a67b7b2c0357e45ab9c9e51cf308efcc0256f
28999b079bbb3adf67d7221a1de8f3f587a1a49662e0dfe6f5fa557351f04779
3fce52641d2c7dc6b0eaba8ae529d1dff4dc793bb82994cb49b6e4efd80f142b

7.4 Command 3 - HmacChange

Change the currently used HMAC authentication key. Payload is the new 20-byte key.

7.5 Command 4 - CKeyChange

Change the currently used AES keys for communication. Payload is the new 16-byte key and the new 16-byte IV.

7.6 Command 5 - LvGet

Get the current authentication level. The response is a single byte.

For A7, 2 is the maximum authentication level, for N2 it is 3. This level must be achieved by means of AuthStart before most commands can be used.

7.7 Command 6 - ErrorGet

Get the last error the keychip encountered. The response is a big endian short.

7.8 Command 7 - VerGet

Get the keychip firmware version. The response is a big endian short.

The following are all known firmware versions:

7.9 Command 8 - KeychipInfoWrite

Write new keychip information. This command is unavailable on shipped keychips. The request is the new 96-byte information.

7.10 Command 9 - KeychipInfoRead

Read the keychip information. The response is the 96-byte information blob.

7.11 Command 10 - GkeyWrite

Write new game key. This command is unavailable on shipped keychips. The request is the new 16-byte game key and 16-byte IV.

7.12 Command 11 - GkeyEnc

Encrypt data using the game key. The request is a single byte indicating if the encryption state should be reset using the IV, followed by 16-bytes of data to encrypt, and the response is the 16-bytes of data, encrypted.

7.13 Command 12 - GkeyDec

Decrypt data using the game key. The request is a single byte indicating if the encryption state should be reset using the IV, followed by 16-bytes of data to encrypt, and the response is the 16-bytes of data, decrypted.

7.14 Command 13 - SFlagWrite

Set the shipping flag on the keychip. This command is unavailable on shipped keychips. There is no request or response payload.

7.15 Command 14 - EepromInit

Reset all internal EEPROM on the keychip. This command is unavailable on shipped keychips. There is no request or response payload.

7.16 Command 15 - LvEnable

Re-enable a keychip that has been locked out due to too many invalid packets. This command is unavailable on shipped keychips. There is no request or response payload.

This command will raise the auth level from -1 to 0.

7.17 Command 16 - PrivateKeyModulusWrite

Write the private modulus used for authentication data decryption. This command is unavailable on shipped keychips. The request is the 256-byte modulus.

7.18 Command 17 - PrivateKeyExponentWrite

Write the private exponent used for authentication data decryption. This command is unavailable on shipped keychips. The request is the 256-byte exponent.

7.19 Command 18 - UDataWrite

Write the udata block on the keychip. This command is unavailable on shipped keychips. The request is the 16-byte udata.

7.20 Command 19 - UDataRead

Read the udata block on the keychip. The response is the 16-byte udata.

7.21 Command 20 - StorageWrite

Write to secure storage on the keychip. The request is a big endian uint16 count of bytes, a big endian uint16 offset into storage, and then the data to write.

A maximum of 256 bytes can be written at once, due to hardware limitations.

The A7 keychip supports 10240 bytes of storage, and every written byte must be contained within this region.

7.22 Command 21 - StorageRead

Write to secure storage on the keychip. The request is a big endian uint16 count of bytes, and a big endian uint16 offset into storage. The response is the requested data.

A maximum of 192 bytes can be read at once, due to hardware limitations.

The A7 keychip supports 10240 bytes of storage, and every read byte must be contained within this region.

7.23 Command 22 - RandomGet

Retrieve a 16-byte random value from the keychip. This value is generated using a cryptographically secure algorithm.

7.24 Command 23 - PlayCountIncrement

Increment the play counter on the keychip by one. There is no way to decrement this counter besides EepromInit.

7.25 Command 24 - PlayCountRead

Retrieve the current play counter. The response is a big endian uint32.

7.26 Command 25 - TraceDataInfoWrite

Write tracedata metadata to the keychip. The request payload is the new 16-byte metadata.

7.27 Command 26 - TraceDataInfoRead

Retrieve tracedata from the keychip. The response is the 16-byte metadata.

7.28 Command 27 - StorageSizeGet

Retrieve the maximum size of keychip storage. The response is a big endian uint16.

7.29 Command 28 -

7.30 Command 29 -

7.31 Command 30 - ALKeyAuthServerWrite

Write the server key for Auth 2.0. This command is unavailable on shipped keychips. The request payload is the new 16-byte key.

7.32 Command 31 - ALKeyAuthKeychipWrite

Write the keychip key for Auth 2.0. This command is unavailable on shipped keychips. The request payload is the new 16-byte key.

7.33 Command 32 - ALKeyALLNetAuthWrite

Write the ALL.Net key for Auth 2.0. This command is unavailable on shipped keychips. The request payload is the new 16-byte key.

7.34 Command 33 - ALKeychipIDWrite

Write the keychip ID for Auth 2.0. This command is unavailable on shipped keychips. The request payload is the new 11-byte keychip ID in compressed format.

7.35 Command 34 - ALStart

Begin Auth 2.0 authentication. The payload for this command should be 64 bytes directly proxied from the Auth 2.0 server.

7.36 Command 35 - ALPacket

Conclude Auth 2.0 authentication. The payload for this command should be 64 bytes directly proxied from the Auth 2.0 server.