Skip to content

Instantly share code, notes, and snippets.

@yifanlu yifanlu/E80558325.md
Last active Apr 15, 2018

Embed
What would you like to do?
Vita 3.65 activation investigation (E-80558325)

On 7/29/2017, all hacked Vitas on 3.60 spoofing the latest firmware (3.65) were blocked from console activation. This is particularly odd because the PSN passphrase did not change in 3.65. Additionally with the release of ensō added to the confusion of what happened. Here is the result of a preliminary investigation of the situation.

Upon game activation, the Vita displays an dialog that shows the error number E-80558325. This error number is used in SceNpKdc, which is found in vs0:external/np_kdc.suprx. The error code itself is created when the activation response is received:

v5 = v45 | 0x80558300;

Here, v5 is the return code and v45 is the string error code from the server converted to a number. The request made to Sony's server looks like the following

Content-Type: application/x-www-form-urlencoded
User-Agent: My heart leaps up when I behold A rainbow in the sky
X-I-5-DRM-Version: 1.0

loginid=PSNID&epassword=ENCRYPTEDPASSWORD&platform=psp2&c1=CHALLENGESTRING

The request from a 3.65 stock console has the same headers and loginid and epassword (for the same account) so the only change visible to Sony is the challenge string c1.

The response you get on 3.60 is

HTTP/1.0 200 OK
Server: Apache
X-I-5-DRM-Version: 1.0
X-I-5-DRM-Status: NG; reason=25
Content-Length: 0
Content-Type: application/x-i-5-drm
X-N: S
Date: Sat, 29 Jul 2017 23:01:31 GMT
Connection: keep-alive

Challenge

The challenge string is constructed in SceNpKdc with a call to SceLibKernel_9557D15C. Farther investigation shows that SceLibKernel_9557D15C likely has the following call type:

int sceKernelPcactGetChallenge(int id, const char entropy[32], char challenge[128]);

It is called with id = 0 and entropy set to uninitialized stack space. Tracing this call, you eventually arrive at a kernel function in SceSblGcAuthMgrPcactForDriver with the NID 0xB7AE58B9. This call looks like the following

typedef struct {
    uint8_t length;      // must be 16
    uint8_t unk[15];     // must all be 0
    uint8_t entropy[32]; // from user
} challengeInput_t;

int createPcactChallenge(int id, const challengeInput_t *in, uint64_t *rtc_seconds, char challenge[128], char output[16]);

It appears that data from aimgr_sm.self (F00D) along with in, rtc_seconds (the RTC in seconds), DMAC engine, and maybe other data are entangled together into a 112 byte sized block. Then a 20 byte SHA1-HMAC is computed over the buffer with some key. It is likely that the data itself is unimportant and just has to be random and console unique.

How Sony Blocked Activation

There are at least two possible ways. First is that on 3.65, the random-looking data block has some specific structure that Sony looks for (or some console unique data in this block gives away the fact that the console is on 3.60). Second is that they changed the SHA1-HMAC key. If it is the latter case, then the next step is to find how this key is constructed. It is likely that the key is constructed in F00D and therefore spoofing it would require a F00D hack.

Summary

  • Activation block is unrelated to ensō and Sony likely decided to implement this patch on 7/29 specifically to confuse users.
  • Bypassing this block might be possible with more investigation, but there has to be work done (I won't have the time to do it).
  • If you have a 3.60 Vita that is already activated, you should back up tm0:npdrm/act.dat to your computer as soon as possible!
@joshbradford1994

This comment has been minimized.

Copy link

joshbradford1994 commented Jul 30, 2017

Won't activating it with the epsp bubble installer still work.

@fennectech

This comment has been minimized.

Copy link

fennectech commented Jul 30, 2017

RIP PSN

@fennectech

This comment has been minimized.

Copy link

fennectech commented Jul 30, 2017

Josh no it wont because the epsp bubble installer activates the same way the activate menu does just bypassing the version update We used that when PSN spoofing was gone

@vatomalo

This comment has been minimized.

Copy link

vatomalo commented Jul 30, 2017

Does this mean that when copying a PSV file from the PS3 it also phones home? As PS3 gives the same error code

@Codeman785

This comment has been minimized.

Copy link

Codeman785 commented Jul 30, 2017

So I bought a 3.60 motherboard from aliexpress and I wasn't going to install it until I received one of yifan lu's sd card readers. But should i install my motherboard right now and back up tm0:npdrm/act.dat? Sorry but what exactly is that^. Does that mean just back up all of my data through the Ps vita content manager assitant?

@StepS-

This comment has been minimized.

Copy link

StepS- commented Jul 30, 2017

@Codeman785 It's the file that is responsible for activation on your device. You can navigate to tm0:npdrm from your vitashell, USB or ftp browser.
The CMA backup is only to backup your ur0 and ux0 (as far as I know).

@Rufis01

This comment has been minimized.

Copy link

Rufis01 commented Jul 30, 2017

Before trying to get back PSN spoofing we should find a way to trick the vita so it thinks it's activated (shouldn't be too hard, right?), so people can use it.

@StepS-

This comment has been minimized.

Copy link

StepS- commented Jul 30, 2017

Before trying to get back PSN spoofing we should find a way to trick the vita so it thinks it's activated (shouldn't be too hard, right?), so people can use it.

Tricking the vita into thinking it's activated is not a problem. The problem is being able to decrypt the games you own. The activation file contains vital information required to decrypt and run the DRM software. This is cryptography, and not a single magic flip.

There's one thing that can be done though (and should have been long ago, according to some molecule comments). Running pspemu directly instead of hijacking a legit PSP game. That is definitely possible and should've been the design of Adrenaline. Someone might want to work on that now, in light of these events. Edit: Comment by TheFloW: https://www.reddit.com/r/vitahacks/comments/6qi4d8/why_does_adrenalin_require_activation_cpu/dkxkt7s/

@MRGhidini

This comment has been minimized.

Copy link

MRGhidini commented Jul 30, 2017

Backup needs more files
You need:
vd0_registry/system.dreg
vd0_registry/system.ireg
tm0_npdrm/act.dat

@passi0509

This comment has been minimized.

Copy link

passi0509 commented Jul 31, 2017

Is there any way to activate the vita for now to use Adrenaline?
Just got my vita on sunday..

@NataliePequeno

This comment has been minimized.

Copy link

NataliePequeno commented Jul 31, 2017

RIP me. I just had a USB die on me and I thought it'd be best to just format the system and start again >.> DAMN. I could have backed it up if I knew activation was blocked lol

@passi0509, afraid not. Until someone figures out how to activate again, Easy Installer will not work.

@machacream

This comment has been minimized.

Copy link

machacream commented Jul 31, 2017

Actually easy installer worked, but adrenaline is giving an error when it launched after a successful install.
I copied the 3 files (act.dat system.dreg system.ireg) off vita2001 running adrenaline, and put it on a fresh henkaku vita1101.
With these, I was actually able to install epsp bubble and adrenaline
The problem is I get c0-9255-1 when adrenaline is launched, and I've been asking around what this mean and how to fix it.
Possible license file in pspemu folder needs to be copied as well?

@StepS-

This comment has been minimized.

Copy link

StepS- commented Jul 31, 2017

@machacream The issue is that act.dat is console-specific. It will not work on another vita hardware if copied. The activation must be done on the same hardware. The error you're getting basically means that the console is unable to decrypt (and run) the required game.

@metal-velcro

This comment has been minimized.

Copy link

metal-velcro commented Aug 1, 2017

Would a cma backup from 3.65 and 3.60 be of any use? From the same system of course. I'll leave it unedited as I trust Yifanlu and team molecule. If it will help please let me know. @atreyu187 on Twitter and psx-place as well as psx-scene and wololo

@IrealiTY

This comment has been minimized.

Copy link

IrealiTY commented Aug 1, 2017

My system was already activated. Launched my Vita after a while and wanted to download a game from the PSN Store and got the same Error as mentioned above.

@twocows

This comment has been minimized.

Copy link

twocows commented Aug 1, 2017

My Vita's 3.60, activated, and completely unhacked; I was waiting for something like F00D before bothering with it. Is it safe to just continue to sit on it for now, or should I hack it ASAP and back up the activation information?

@Joonie86

This comment has been minimized.

Copy link

Joonie86 commented Aug 1, 2017

@twocows, if yifan's right your console won't be affected as long as you're not using henkaku to activate your console.
Try using PS3 / vita updateblocker method see if you can confirm your console can be re-activated.
You can use QCMA to back up your data though. (if you're worried about losing your previous activated data)

@yifanlu

This comment has been minimized.

Copy link
Owner Author

yifanlu commented Aug 3, 2017

  1. QCMA/CMA does not back up activation.
  2. I'm pretty sure PS3 activation still needs the challenge from the Vita... in which it'll give the same error.
@ANU815

This comment has been minimized.

Copy link

ANU815 commented Aug 4, 2017

@yifanlu

  1. Are you sure about that? There must be some sort of activation retained in QCMA backups. This is evident when you transfer a backed up game from your PC back to the Vita through content manager to "reactivate" it. This was used heavily when customizing PSP pboots was a thing.
  2. I can confirm that any and all known PS3 methods give the exact same 80558325 error unfortunately...
@TheRadziu

This comment has been minimized.

Copy link

TheRadziu commented Aug 11, 2017

@yifanlu
Sony is messing with their servers again, now 3.60 users are getting Bad Response Error while trying to ENTER PSS or account related settings.
PSN (trophies,party,online gaming) still works fine.

@ctonysailor

This comment has been minimized.

Copy link

ctonysailor commented Aug 13, 2017

hello guys, has anyone bypass the activation e-80558325 error code? if yes, please reply me asap...i cant wait to activate my vita

@shenron

This comment has been minimized.

Copy link

shenron commented Aug 14, 2017

There is an offline activator, BUT ! It's not a solution to download/play your purchased games. Only to install adrenaline.

https://www.reddit.com/r/vitahacks/comments/6tisan/mltactivator_offline_vita_activator/

@ctonysailor

This comment has been minimized.

Copy link

ctonysailor commented Aug 14, 2017

it worked! thank you shenron

@ssshhhlurppp

This comment has been minimized.

Copy link

ssshhhlurppp commented Aug 18, 2017

as long as you backup your ok

@NannOo

This comment has been minimized.

Copy link

NannOo commented Aug 28, 2017

Is there a way to activate PS Vista without using offline activator?

@shenron

This comment has been minimized.

Copy link

shenron commented Aug 28, 2017

No. If you want to activate your ps vita only for adrenaline maybe in September a new version will be released: https://mobile.twitter.com/theflow0/status/893155643422539776

Else, wait and see ...

@mynameistc

This comment has been minimized.

Copy link

mynameistc commented Sep 5, 2017

Thanks to TheFlow the individual has released Adrenaline as a VPK. Activation is no longer needed. :)
https://github.com/TheOfficialFloW/Adrenaline

@shenron

This comment has been minimized.

Copy link

shenron commented Sep 5, 2017

It's very cool ! But the activation is still mandatory if you want to play with your legit digital games :(

@Elolawyn

This comment has been minimized.

Copy link

Elolawyn commented Sep 7, 2017

I have 1 doubt. I have tried to backup those files but i couldn't find act.dat. I could only back up vd0:/registry/system.dreg, vd0:/registry/system.ireg and myprofile.dat. I have no problem with not being able to play PSP or original games but I want to use QCMA, is there a problem? By the way, even If I couldn't find that file, I'm still able to use QCMA and on PS Vita settings screen it says that is linked to my account but I have sign out. So..., what's up with my Vita? Is It not activated?

@derivativetaste

This comment has been minimized.

Copy link

derivativetaste commented Nov 12, 2017

It should be noted that preserving and restoring the act.dat, and the registry files after a format/system restore is not enough to reactivate the console, it seems the system isn't fully activated and is challenged, resulting in not being able to download titles from the PSN Store.

@TheRadziu

This comment has been minimized.

Copy link

TheRadziu commented Nov 15, 2017

it seems the system isn't fully activated and is challenged, resulting in not being able to download titles from the PSN Store.

You can't do it even on 'fully' activated console. Content activation is also blocked on 3.60, thats the sony's way to push us into the piracy.
Oh the irony.

@Kekskruemel

This comment has been minimized.

Copy link

Kekskruemel commented Nov 26, 2017

Is there any way to change the idps with one from an activated console of which we have the activation files ?

@JuanLuisMarin

This comment has been minimized.

Copy link

JuanLuisMarin commented Dec 26, 2017

hello, I bought a PS VITA, I updated it to Firmware 3.18 and when trying to transfer PSP games from the ps3 I get the error E-80558325, apparently the problem is general with all versions less than or equal to 3.60, does anyone know if there is any solution?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.