├── PS-ConsoleId-wiki.txt ├── README.md └── ps-console-id-tool ├── EXAMPLE_WITH_FAKE_CID.BAT ├── Makefile ├── main.c ├── main.o ├── ps-console-id-tool.exe └── types.h /PS-ConsoleId-wiki.txt: -------------------------------------------------------------------------------- 1 | // Warning: ConsoleId is stored in big-endian (major at left, minor at right). 2 | 3 | // Bitfield structure adapted for little-endian machines (unsure if working on big-endian machines) 4 | typedef struct SceConsoleId { 5 | uint16_t unknown; // {0, 0}, maybe magic 6 | uint16_t company_code; // {0, 1} 7 | uint16_t product_code; 8 | uint16_t product_sub_code; 9 | uint8_t serial_no_major: 2; 10 | uint8_t factory_code: 6; 11 | uint8_t serial_no_middle; 12 | uint16_t serial_no_minor; 13 | uint32_t random_stamp; 14 | } SceConsoleId; 15 | 16 | // Bitfield structure adapted for little-endian machines (unsure if working on big-endian machines) 17 | typedef struct SceConsoleIdPspDiag { 18 | uint16_t unknown; // {0, 0}, maybe magic 19 | uint16_t company_code; // {0, 1} 20 | uint16_t product_code; 21 | uint16_t product_sub_code; 22 | uint8_t ps_flags_major: 2; 23 | uint8_t factory_code: 6; 24 | uint8_t serial_no_major: 2; 25 | uint8_t ps_flags_minor: 6; 26 | uint16_t serial_no_minor; 27 | uint32_t random_stamp; 28 | } SceConsoleIdPspDiag; 29 | 30 | // Structure for systems that do not support bitfield structures. second_half has to be parsed manually with bit-shifts. 31 | typedef struct SceConsoleIdSimplified { 32 | uint16_t unknown; // {0, 0}, maybe magic 33 | uint16_t company_code; // {0, 1} 34 | uint16_t product_code; 35 | uint16_t product_sub_code; 36 | uint8_t second_half[8]; 37 | } SceConsoleIdSimplified; 38 | 39 | typedef struct ScePsCode { 40 | uint16_t company_code; // {0, 1} 41 | uint16_t product_code; 42 | uint16_t product_sub_code; 43 | uint16_t factory_code; 44 | } ScePsCode; 45 | 46 | // "Magics" for easier memory dumps analysis, considering that Company Code is always 1 47 | uint8_t consoleid_magic[4] = {0, 0, 0, 1}; 48 | uint8_t pscode_magic[4] = {0, 1}; 49 | 50 | /* Product Code in PsCode spoofing on Consumer PS Vita results 51 | * 0x100 -- IsTest, no red message, no expiration date 52 | * 0x101 -- IsTool, battery backup has failed red message, activated 32000+ days 53 | * 0x102 -- IsDEX, expiration red message, expired date 54 | * 0x103 -- Health warning on boot 55 | * 0x104 -- Health warning on boot 56 | * 0x105 -- Epilepsy warning on boot 57 | * 0x106 -- Health warning on boot 58 | * 0x107 -- Epilepsy warning on boot 59 | * 0x108 -- Health warning on boot 60 | * 0x109 -- Epilepsy warning on boot 61 | * 0x10A -- Health warning on boot // checked on PCH-2006 62 | * 0x10B -- ?? 63 | * 0x10C -- Epilepsy warning on boot // checked on PCH-1008 and PCH-1108 64 | * 0x10D -- ?? 65 | * 0x10E+ -- error message in japanese (error C1-13819-2) certainly related to the Registry Manager 66 | */ 67 | 68 | /* Product Code (wrongly called Target Id) 69 | 70 | Quick determination: 71 | 00 0X = PSP 72 | 00 8X = PS3 73 | 01 0X = PS Vita 74 | 01 8X = PS4 75 | 76 | XX X0 = Test 77 | XX X1 = Tool 78 | XX X2 = DEX 79 | XX X3 or higher = CEX (specific to console selling region) 80 | 81 | 82 | PSP Product Code 83 | 0x00 // Test - Prototype / Test unit - Kicho & Dencho Program default value 84 | 0x01 // Tool - DevKit / Development Tool - Development Tool DEM-1000, DTP-T1000 85 | 0x02 // DEX - TestKit / Testing Kit - Testing Tool DTP-H1500 86 | 0x03 // CEX - Japan 87 | 0x04 // CEX - North America 88 | 0x05 // CEX - Europe/East/Africa 89 | 0x06 // CEX - Korea 90 | 0x07 // CEX - Great Britain/United Kingdom 91 | 0x08 // CEX - Mexico/Latin America 92 | 0x09 // CEX - Australia/New Zeland 93 | 0x0A // CEX - Hong Kong/Singapore 94 | 0x0B // CEX - Taiwan 95 | 0x0C // CEX - Russia 96 | 0x0D // CEX - China 97 | 0x0E // AVTOOL - AV Testing Tool DTP-L1500 98 | 99 | PS3 Product Code 100 | 0x80 // Test - AVTest / DECHS (TEST) 101 | 0x81 // Tool - SD System Debugger / DECR Reference Tool / DECR (TOOL) 102 | 0x82 // DEX - Debug / DECH (DEX) - DECH-XXXX - DEH-FH1500J-A from mid April 2008 103 | 0x83 // CEX - Consumer or Shop Kiosk - Japan (J1) 104 | 0x84 // CEX - Consumer or Shop Kiosk - USA (UC2) 105 | 0x85 // CEX - Consumer or Shop Kiosk - Europe (CEL) 106 | 0x86 // CEX - Consumer or Shop Kiosk - Korea (KR2) 107 | 0x87 // CEX - Consumer or Shop Kiosk - United Kingdom (CEK) 108 | 0x88 // CEX - Consumer or Shop Kiosk - Mexico (MX2) 109 | 0x89 // CEX - Consumer or Shop Kiosk - Australia/New Zealand (AU3) 110 | 0x8A // CEX - Consumer or Shop Kiosk - South Asia (E12) 111 | 0x8B // CEX - Consumer or Shop Kiosk - Taiwan (TW1) 112 | 0x8C // CEX - Consumer or Shop Kiosk - Russia (RU3) 113 | 0x8D // CEX - Consumer or Shop Kiosk - China (never released) (CN9) 114 | 0x8E // CEX - Consumer or Shop Kiosk - Hong Kong (HK5) 115 | 0x8F // CEX - Consumer or Shop Kiosk - Brazil (BR2) 116 | 0xA0 // ARC - Arcade 117 | 118 | PS Vita Product Code 119 | 0x100 // Test - Prototype / Test unit 120 | 0x101 // Tool - DevKit / Development Tool Kit - PDEL / DEM 121 | 0x102 // DEX - TestKit / Testing Kit - PTEL 122 | 0x103 // CEX - Consumer - J1 - Japan 123 | 0x104 // CEX - Consumer - UC2 - North America 124 | 0x105 // CEX - Consumer - CEL - Europe/East/Africa // PCH-xx04 125 | 0x106 // CEX - Consumer - KR2 - South Korea 126 | 0x107 // CEX - Consumer - CEK - Great Britain/United Kingdom // PCH-xx03, VTE-1016 127 | 0x108 // CEX - Consumer - MX2 - Mexico/Latin America 128 | 0x109 // CEX - Consumer - AU3 - Australia/New Zealand 129 | 0x10A // CEX - Consumer - E12 - Hong Kong/Macao/Singapore/Malaysia 130 | 0x10B // CEX - Consumer - TW1 - Taiwan 131 | 0x10C // CEX - Consumer - RU3 - Russia 132 | 0x10D // CEX - Consumer - CN9 - China - added in 2015 133 | 134 | PS Vita Region Code for PCH-XXxx (CEX): 135 | See https://playstationdev.wiki/psvitadevwiki/index.php?title=SKU_Models#Region_Code. 136 | 137 | PS4 Product Code 138 | 0x180 // Test - Prototype / Test / Diag unit 139 | 0x181 // Tool - DevKit / Development Tool Kit 140 | 0x182 // DEX - TestKit / Testing Kit 141 | 0x183 // CEX - Consumer JAPAN 142 | 0x184 // CEX - Consumer USA - CUH-xx15 143 | 0x185 // CEX - Consumer EUROPE 144 | 0x186 // CEX - Consumer KOREA 145 | 0x187 // CEX - Consumer UK - CUH-xx16 146 | 0x188 // CEX - Consumer MEXICO 147 | 0x189 // CEX - Consumer AUSTRALIA - CUH-xx02 148 | 0x18A // CEX - Consumer SOUTH ASIA 149 | 0x18B // CEX - Consumer TAIWAN 150 | 0x18C // CEX - Consumer RUSSIA 151 | 0x18D // CEX - Consumer CHINA 152 | 0x18E // CEX - Consumer HK 153 | 0x18F // CEX - Consumer BRAZIL 154 | 0x190 // CEX - Consumer ?region? 155 | 0x191 // CEX - Consumer ?region? 156 | 0x1A0 // ARCADE - Kratos 157 | */ 158 | 159 | /* Product Sub Code (Model revision) 160 | 161 | PSP Product Sub Code 162 | 0x01 // Motherboard TA-079 / TA-081 (PSP-10XX 01g) min FW 1.00, Motherboard TMU-002 (DTP-L1500 / DTP-H1500) 163 | 0x02 // Motherboard TA-082 / TA-086 (PSP-10XX 01g) min FW 1.00 164 | 0x03 // Motherboard TA-085 / TA-088 (PSP-20XX 02g) min FW: 3.60 (TA-085v1), 3.95(TA-088v1 or v2) 4.01 (TA-088v3) 165 | 0x04 // Motherboard TA-090 / TA-092 (PSP-30XX 03g) min FW: 4.20, 4.21, 5.03 166 | 0x05 // Motherboard TA-091 (PSP-N10XX 05g) min FW 5.70 167 | 0x06 // Motherboard TA-093 (PSP-30XX 04g) min FW: 5.70, 6.20 (TA-093v2) 168 | 0x07 // Motherboard TA-094 (PSP-N10XX 05g), only exists as prototype 169 | 0x08 // Motherboard TA-095 (PSP-30XX 07g and 09g) min: FW 5.70, 6.30, 6.39 (TA-095v2 07g and 09g), ?6.60 (09g)?, sold notably in Hong-Kong/Singapore 170 | 0x09 // Motherboard TA-096 / TA-097 (PSP-E10XX 11g) min FW: 6.50 (TA-096), 6.60 (TA-097) 171 | 172 | PS3 Product Sub Code 173 | 0x01 // Motherboard TMU-520 (DECR-1000(A/J), DEH-Z1010), Motherboard COK-001 (DECHSA00A/J, CECHAxx), all DEH/CBEH consoles until CECHAxx, Motherboard TMU-510 (old DEH) 174 | 0x02 // Motherboard COK-001 - CECHBxx 175 | 0x03 // Motherboard COK-002 - CECHCxx 176 | 0x04 // Motherboard COK-002 or COK-002W (CECHExx), Motherboard COK-002 (GECR-1100) 177 | 0x05 // Motherboard SEM-001 - CECHGxx 178 | 0x06 // Motherboard DIA-001 - CECHHxx 179 | 0x07 // Motherboard DIA-002 - CECHJxx, CECHKxx 180 | 0x08 // Motherboard VER-001 - CECHLxx, CECHMxx, CECHPxx, CECHQxx, GECR-1500, Motherboard VERTIGO-02 in DEH-FH1500J-A from mid April 2008 181 | 0x09 // Motherboard DYN-001 - CECH-20xx, Motherboard DEB-001 (DECR-1400) 182 | 0x0A // Motherboard SUR-001 - CECH-21xx 183 | 0x0B // Motherboard JTP-001 or JSD-001 - CECH-25xx 184 | 0x0C // Motherboard KTE-001 - CECH-30xx 185 | 0x0D // ?Motherboard MPX-001 or MSX-001 or NPX-001 - CECH-40xxB/C v1? 186 | 0x0E // ?Motherboard MPX-001 or MSX-001 or NPX-001 - CECH-40xxA v1? 187 | 0x0F // ?Motherboard PPX-001 - CECH-40xxB/C v2? 188 | 0x10 // ?Motherboard PPX-001 - CECH-40xxA v2? 189 | 0x11 // ?Motherboard PQX-001 - CECH-42xxB/C? 190 | 0x12 // ?Motherboard PQX-001 - CECH-42xxA? 191 | 0x13 // ?Motherboard RTX-001 - CECH-43xxB/C? 192 | 0x14 // ?Motherboard RTX-001 - CECH-43xxA? 193 | ???? // Motherboard REX-001 (2014 week 30) - CECH-43xx?A/B/C? 194 | 0x8F // Unknown DEX Motherboard - Forces arcade HDD keyset. 195 | 0x90 // Unknown DEX Motherboard - Forces arcade HDD keyset. 196 | 197 | PS Vita Product Sub Code 198 | 0x02 // Prototype CEX - never seen on any device yet except in the OS. Maybe CEM-3000E3. 199 | 0x03 // Prototype DevKit (Tool DVT1) - Motherboard IRT-001 (0-835-167-02) (Prototype DevKit DVT1 internal System Debugger DEM-3000G) 200 | 0x04 // Prototype DevKit - never seen on any device yet except in the OS. Special DevKit forever activated. 201 | 0x05 // Prototype DevKit (Tool DVT2) - Motherboard IRT-001 (0-835-167-04) (Prototype DevKit DVT2 internal System Debugger DEM-3000H) 202 | 0x07 // Prototype CEX - never seen on any device yet except in the OS. 203 | 0x09 // Prototype DevKit - Motherboard IRT-002 (Tool NEW EVT1 DEM-3000K). Maybe also DEM-3000JEC. 204 | 0x0A // Prototype DEX - CEM-3000NE2 with min FW 0.990. 205 | 0x0B // Prototype DevKit - Motherboard IRT-002 (0-851-973-06) (Tool NEW DVT1 DEM-3000L) - Prototype DEX - Motherboard IRS-002 (CEM-3000ND1) with min FW 0.996 206 | 0x0C // Prototype - never seen on any device yet except in the OS. 207 | 0x0D // Prototype DevKit - Motherboard IRT-002 (0-851-973-07) (Tool NEW DVT2 DEM-3000P) - factory FW 0.996 208 | 0x0E // Prototype - never seen. 209 | 0x0F // Prototype CEX - Motherboard IRS-002 (0-845-846-U10) (CEM-3000NP1) - Prototype DevKit - Motherboard IRT-002 (0-851-973-10) (Prototype DevKit DEM-3000JEC) - Prototype TestKit - Motherboard IRS-002 (1-883-949-11) (TEFV-1000PV1). 210 | 0x10 // FAT - Motherboard IRS-002 (1-883-949-11) (PCH-10XX / PCH-11XX / TestKit PTEL-10XX) or Motherboard IRT-002 (1-884-714-11) (DevKit PDEL-10XX) - factory FW 1.00 or 1.03 211 | 0x11 // FAT - Motherboard IRS-1001 (?1-886-596-11?) (PCH-11XX) factory FW 1.81, min FW 1.80, 2012-09 212 | 0x12 // FAT - Motherboard IRS-1001 (1-886-596-11) (PCH-10XX) factory FW 1.81, min FW 1.80, 2012-09 213 | 0x14 // SLIM - Motherboard USS-1001 (1-887-458-11) (PCH-20XX / TestKit PTEL-20XX) - factory FW 2.50, 2013-06 214 | 0x18 // SLIM - Motherboard USS-1002 (1-894-783-11) (PCH-20XX / TestKit PTEL-20XX) - factory FW 3.50 or 3.65, 2015-05 215 | 0x201 // PS TV - Motherboard DOL-1001 (1-888-648-21) (VTE-10XX) - factory FW 2.60 (?or 2.50?) white units 2013-10, factory FW 3.20 black units year 2014 216 | 0x202 // PS TV - Motherboard DOL-1002 (1-???-???-??) (VTE-10XX) - factory FW 3.30 black units year 2015 217 | 0x408 // PS TV DevKit (Tool) - never seen on any device yet except in the OS. 218 | 0x602 // PS TV Prototype TestKit (Dolce DVT WLAN DEX) - Motherboard DOL-1001 (0-DOL-001-U3A) (CEM-3000P01 / THV-1000 D1) - factory FW 2.50, white color 219 | 220 | PS4 Product Sub Code 221 | // SA%c-%c%02x%s%s 222 | // HAC-%c%02x%s 223 | // NV%c-%c%02x%s%s 224 | // ALPHA-%c%02x 225 | // (GKO) 226 | // -BEP 227 | // -BAP 228 | // -BEO 229 | // -BAO 230 | // -BEOT 231 | ?0x01? // Motherboard SYRUP-11 - SRP-11 (0-000-000-11) 2012 week ?31? - Prototype DevKit 232 | // Motherboard SYRUP-12? 233 | // Motherboard CAVERN-G01? 234 | // Motherboard CAVERN-T01? 235 | // Motherboard CAVERN-T02? 236 | // Motherboard CAVERN-T03? 237 | // Motherboard CAVERN-T04? 238 | // Motherboard CAVERN-T05? 239 | // Motherboard CAVERN-T06? 240 | // Motherboard CAVERN-K01? 241 | // Motherboard CAVERN-K02? 242 | // Motherboard CAVERN-K03? 243 | 0x05 // Motherboard CAVERN-K04 - CVN-K04 (0-000-000-11) 2012 week 50 - Prototype DevKit DEHT-AW01AK-K5? 244 | // Motherboard CAVERN-K05? 245 | // Motherboard CAVERN-K06? 246 | // Motherboard CAVERN-K11? 247 | // Motherboard CAVERN-K12 - CVN-K12 (0-000-000-15) - Prototype DevKit DUH-D1000xA? 248 | // Motherboard CAVERN-R01? 249 | // Motherboard CAVERN-001 - CVN-001 (1-889-207-12) - DevKit DUH-D1000xA? 250 | // Motherboard SAA-T01? 251 | // Motherboard SAA-T02? 252 | // Motherboard SAA-K01? 253 | // Motherboard SAA-K02? 254 | // Motherboard SAA-K23 (0-000-000-13) - Prototype Consumer CUH-10xx? 255 | // Motherboard SAA-R01? 256 | // Motherboard SAB-K02 (0-000-000-05) - Prototype Consumer CUH-11xx? 257 | 0x10 // Fat chassis A - Motherboard SAA-001 - Consumer CUH-10xx - TestKit DUH-T1000AA 258 | 0x11 // Fat chassis B - Motherboard SAB-001 - Consumer CUH-11xx - TestKit DUH-T1100AA 259 | 0x12 // Fat chassis C - Motherboard SAC-001 - Consumer CUH-12xx - TestKit DUH-T1200AA 260 | 0x13 // Slim chassis D - Motherboard SAD-001 / SAD-002 / SAD-003 - Consumer CUH-20xx - TestKit DUH-T20xx 261 | 0x14 // Slim chassis E - Motherboard SAE-001 / SAE-002 / SAE-003 / SAE-004 - Consumer CUH-21xx 262 | ?0x15? // Slim chassis F - Motherboard SAF-003 / SAF-004 / SAF-006 - Consumer CUH-22xx 263 | // Motherboard T-HAK-NFS-11 (0-361-897-01) - Prototype Pro DevKit DUT-DBW00JK-S0? 264 | 0x210 // Pro DevKit chassis - Motherboard HAC-001 (1-981-411-11) - Pro DevKit DUH-D7000JA with Communication Processor BDT-010 (1-981-412-11) 265 | 0x211 // Pro chassis A - Motherboard NVA-001 - Consumer CUH-70xx (seen on units shipped with FW 3.70-4.70) - Pro TestKit DUH-T70xx 266 | 0x212 // Pro chassis B - Motherboard NVB-003 / NVB-004 - Consumer CUH-71xx 267 | 0x213 // Pro chassis C - Motherboard NVG-001 / NVG-002 - NVG-003 - Consumer CUH-72xx 268 | */ 269 | 270 | /* Factory code 271 | 272 | It is a code representing the factory location. By extension, it also represents if the console has been or is being refurbished/diagnosed, as it is done in a special servicing center. 273 | 274 | Some people called console_id[8] chassis_check and used the formula: factory_code = chassis_check >> 2; 275 | 276 | 0: invalid, static dummy value in PSP Kicho & Dencho Program, static dummy value on Reference Tool PS3s when serial flash is corrupted, one CECH-21xx 277 | 1: Japan manufacture -> many PS3 DevKit and TestKit, some PS3 CECHCxx, PS Vita DEM, PDEL, some CEM (CEM-3000NE2) 278 | 2: China manufacture 1 -> PSP-10XX 01g 279 | 3: China manufacture 2 -> PSP-20XX 02g, PSP-30XX 03g, some PSP-30XX 04g, PSP-30XX 07g and 09g, PSP-N10XX 05g, PS Vita PCH, PS Vita PTEL, all PS TV, many Consumer PS4, all PS4 PRO 280 | 4: China manufacture 3 -> some PSP-30XX 04g, PSP-E10XX 11g, many Consumer PS3 between CECHAxx and CECH-43xx, many PS4 DevKit and TestKit, many Consumer PS4 281 | 5: ?China? -> many Consumer PS3 between CECHGxx and CECH-43xx 282 | 6: Manaus Industrial Pole (PIM) in Brazil since 2013 -> many PS3 Super Slim Brazil with Product Sub Code 0xF, 0x11, 0x13 283 | 35: Japan Diagnosis Center 1 -> detected by OS as Diag/QA on PSP 284 | 36: Japan Diagnosis Center 2 -> detected by OS as Diag on PS Vita CEX JP and PS4 Test 285 | 61: Servicing Center 2 -> ?Consumer PS Vita?, refurbished PS3, PS3 DECR-1000A 286 | 62: Servicing Center 1 (having Kicho & Dencho Program) -> refurbished PSP PSP-10XX 01g 287 | ?63: Servicing Center 0? (value never seen but should exist) 288 | */ 289 | 290 | /* Ps Flags 291 | 292 | On PSP, Ps Flags are 8 bitflags, stored in PSID in the upper bits of serial_no only when PSP has Diag Factory Code (35: Japan Diagnosis Center 1). They are a sort of QA flags. For reference, on PS3 and PS Vita, QA flags are stored in Syscon NVS. Kicho & Dencho Program default PSID has all Ps Flags set. 293 | 294 | There is no evidence of usage of these Ps Flags area in PSID on PS3, PS Vita and PS4 even when the console is Diag. When PSP PSID has Diag Factory Code, there can be only 262,144 serial numbers by chassis and region, instead of 67,108,864 because 8 bits of serial_no are taken by Ps Flags. 295 | */ 296 | 297 | /* ConsoleId Bruteforce 298 | 299 | With all the knowledge acquired on this page, bruteforcing a ConsoleId requires never more than 8 bytes of tries and usually 7 bytes. 300 | 301 | The worst-case size for bruteforce, if one is given enough information about the console (chassis and region), is near of 58 bits (7 bytes and 2 bits) which represents the serial_no and the random_stamp. However, serial_no is incremental and clustered by (Product Code, Product Sub Code) couple (?by Factory Code too?). Moreover, statistics about its maximum value, estimated by the number of consoles sold, can reduce serial_no to 22 bits (about 4 millions of CECH-3001/CECH-3015). So ConsoleId most-optimized worst-case bruteforce is 54 bits (6 bytes and 6 bits) by assuming that the 4 highest bits of serial_no are zeroes and by bruteforcing from low serial_no to high serial_no. 302 | */ 303 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # PS-ConsoleId-wiki 2 | A wiki about ConsoleId (PSID, IDPS), openPSID, PsCode, cookedPSID (hwid), hardware Info of PSP, PS3, PS Vita and PS4. 3 | 4 | Anyone can commit to add more information. 5 | 6 | ## Quick description of the IDs 7 | 8 | ### Console ID (PSID, IDPS) 9 | 10 | to document 11 | 12 | ### OpenPSID 13 | 14 | to document 15 | 16 | ### Ps Code 17 | 18 | to document 19 | 20 | ### CookePSID (hwid) 21 | 22 | to document 23 | 24 | ### Hardware Info 25 | 26 | to document 27 | 28 | ## More infos 29 | 30 | Interesting pages to consult to get more information (even though it can be outdated): 31 | 32 | ### PS3 33 | * http://www.psdevwiki.com/ps3/IDPS 34 | * http://www.psdevwiki.com/ps3/Talk:IDPS 35 | 36 | ### PSVita 37 | * https://playstationdev.wiki/psvitadevwiki/index.php?title=ConsoleId 38 | * https://playstationdev.wiki/psvitadevwiki/index.php?title=Talk:ConsoleId 39 | -------------------------------------------------------------------------------- /ps-console-id-tool/EXAMPLE_WITH_FAKE_CID.BAT: -------------------------------------------------------------------------------- 1 | ps-console-id-tool.exe 000000010084000C133DA248E195FC34 2 | cmd -------------------------------------------------------------------------------- /ps-console-id-tool/Makefile: -------------------------------------------------------------------------------- 1 | CC = gcc 2 | CFLAGS = -Wall -g 3 | TARGET = ps-console-id-tool 4 | OBJS = main.o 5 | 6 | ifeq ($(DEBUG), 1) 7 | CFLAGS+=-g -O0 8 | else 9 | CFLAGS+=-O2 10 | endif 11 | 12 | all: $(TARGET) 13 | 14 | $(TARGET): $(OBJS) 15 | $(CC) $(CFLAGS) -o $@ $(OBJS) -L -lz -llibz 16 | 17 | clean: 18 | $(RM) *.o $(TARGET) *.exe *.exe.stackdump 19 | -------------------------------------------------------------------------------- /ps-console-id-tool/main.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #include "types.h" 8 | 9 | 10 | // Bitfield structure adapted for little-endian machines (unsure if working on big-endian machines) 11 | typedef struct SceConsoleId { 12 | uint16_t unknown; // {0, 0}, maybe magic 13 | uint16_t company_code; // {0, 1} 14 | uint16_t product_code; 15 | uint16_t product_sub_code; 16 | uint8_t serial_no_major: 2; 17 | uint8_t factory_code: 6; 18 | uint8_t serial_no_middle; 19 | uint16_t serial_no_minor; 20 | uint32_t random_stamp; 21 | } SceConsoleId; 22 | 23 | int cid_text_to_cid_hex(const char *cid_text, uint8_t* buffer) { 24 | uint8_t i = 0; 25 | char temp_byte_string[2]; 26 | for (; i < 32; i += 2) { 27 | snprintf(temp_byte_string, 2, "%c", cid_text[i]); 28 | snprintf(temp_byte_string+1, 2, "%c", cid_text[i+1]); 29 | buffer[i/2] = strtol(temp_byte_string, NULL, 16); 30 | } 31 | return i; 32 | } 33 | 34 | int read_byte(FILE *fp, int offset, char *buf) { 35 | int prev = ftell(fp); 36 | fseek(fp, offset, SEEK_SET); 37 | int r = fread(buf, sizeof(char), 1, fp); 38 | fseek(fp, prev, SEEK_SET); // go back to where we were 39 | return r; 40 | } 41 | 42 | int main (int argc, char *argv[]) { 43 | char cid_text[32]; 44 | memset(cid_text, 'Z', 32); 45 | memcpy(&cid_text, argv[1], 32); 46 | uint8_t cid_hex[16]; 47 | memset(cid_hex, 'Z', 16); 48 | cid_text_to_cid_hex(cid_text, cid_hex); 49 | ///////////////////////////////////////////////////////////////////// 50 | printf("Checking input ConsoleId...\n"); 51 | if (cid_hex[15] == 0) {// We check if 32 bytes have well been read. 52 | printf("Usage ps-console-id-tool.exe 00000000000000000000000000000000\nPlease verify that the CID in input is 32 character long.\n"); 53 | } else { 54 | printf("ConsoleId:\n"); 55 | for (int j = 0; j < 16; ++j) 56 | printf("%02X", cid_hex[j]); 57 | printf("\n"); 58 | ///////////////////////////////////////////////////////////////////// 59 | printf("Structure (displayed in big endian):\n"); 60 | SceConsoleId *cid = (SceConsoleId *)&cid_hex; 61 | printf("Unknown: 0x%04X\n", be16((u8 *)&(cid->unknown))); 62 | printf("Company Code: %d\n", be16((u8 *)&(cid->company_code))); 63 | printf("Product Code: 0x%04X\n", be16((u8 *)&(cid->product_code))); 64 | printf("Product Sub Code: 0x%04X\n", be16((u8 *)&(cid->product_sub_code))); 65 | printf("Factory Code: %d\n", cid->factory_code); 66 | uint32_t serial_no = (cid->serial_no_major << 24) | (cid->serial_no_middle << 16) | be16((u8 *)&(cid->serial_no_minor)); 67 | printf("Serial Number: %d\n", serial_no); 68 | printf("Random Stamp: 0x%08X\n", be32((u8 *)&(cid->random_stamp))); 69 | } 70 | printf("Finished\n"); 71 | return 0; 72 | } -------------------------------------------------------------------------------- /ps-console-id-tool/main.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TeamFAPS/PS-ConsoleId-wiki/048c5b18400dd1a3c16bb26b3042739268fc4111/ps-console-id-tool/main.o -------------------------------------------------------------------------------- /ps-console-id-tool/ps-console-id-tool.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TeamFAPS/PS-ConsoleId-wiki/048c5b18400dd1a3c16bb26b3042739268fc4111/ps-console-id-tool/ps-console-id-tool.exe -------------------------------------------------------------------------------- /ps-console-id-tool/types.h: -------------------------------------------------------------------------------- 1 | #ifndef TYPES_H__ 2 | #define TYPES_H__ 3 | #include 4 | 5 | typedef uint64_t u64; 6 | typedef uint32_t u32; 7 | typedef uint16_t u16; 8 | typedef uint8_t u8; 9 | 10 | static inline u8 be8(u8 *p) 11 | { 12 | return *p; 13 | } 14 | 15 | static inline u16 be16(u8 *p) 16 | { 17 | u16 a; 18 | 19 | a = p[0] << 8; 20 | a |= p[1]; 21 | 22 | return a; 23 | } 24 | 25 | static inline u32 be32(u8 *p) 26 | { 27 | u32 a; 28 | 29 | a = p[0] << 24; 30 | a |= p[1] << 16; 31 | a |= p[2] << 8; 32 | a |= p[3] << 0; 33 | 34 | return a; 35 | } 36 | 37 | static inline u64 be64(u8 *p) 38 | { 39 | u32 a, b; 40 | 41 | a = be32(p); 42 | b = be32(p + 4); 43 | 44 | return ((u64)a<<32) | b; 45 | } 46 | 47 | static inline void wbe16(u8 *p, u16 v) 48 | { 49 | p[0] = v >> 8; 50 | p[1] = v; 51 | } 52 | 53 | static inline void wbe32(u8 *p, u32 v) 54 | { 55 | p[0] = v >> 24; 56 | p[1] = v >> 16; 57 | p[2] = v >> 8; 58 | p[3] = v; 59 | } 60 | 61 | static inline void wbe64(u8 *p, u64 v) 62 | { 63 | wbe32(p + 4, v); 64 | v >>= 32; 65 | wbe32(p, v); 66 | } 67 | 68 | 69 | #endif --------------------------------------------------------------------------------