This is a continuation of the PS3MCA-TOOL 1.4 modified by l_oliveira to add support for arcade magicgate, as well as other cool features like KELF Card Unbinding
the sintax of the program is rather simple
ps3mca.exe command arguments...The following commands are avaialable:
| Command | alternative name | parameters | Purpose | notes |
|---|---|---|---|---|
--mc-info |
-i |
Get memory card information | ||
--mc-free |
-f |
Calculate Free Size on card | ||
--mc-image-ecc |
-imgecc |
<output filepath> |
Dump memory card page by page with ECC data | |
--mc-unformat |
unformat the card | Harmful to SC2 Conquest cards | ||
--mc-format |
Format the card | Harmful to SC2 Conquest cards | ||
--list |
-ls |
<mc path> |
list contents of directory (use . for card root) |
|
--extract-file |
-x |
<mc filepath> <output filepath> |
pull file from card into the PC | |
--inject-file |
-in |
<input filepath> <mc filepath> |
put file from the PC into the card | Harmful to SC2 Conquest cards |
--make-directory |
-mkdir |
<mc path> |
Create folder inside the card | |
--remove-directory |
-rmdir |
<mc path> |
Remove folder from the card | |
--remove |
-rm |
<mc filepath> |
remove file from the card | |
--file-crosslink |
-cl |
<real mc filepath> <dummy mc filepath> |
file crosslinking | Introduces FS controlled corruption!, Harmful to SC2 Conquest cards |
--content-key |
-ck |
<disk kelf filepath> |
Binds KELF file to the card and shows the final Kbit and Kc | |
--sign-kelf |
-k |
<disk kelf filepath> <card kelf filepath> |
Binds KELF file to the card and writes as a new file | |
--unsign-kelf |
-u |
<card kelf filepath> <disk kelf filepath> |
Unbinds a KELF from the current memorycard | Needs the memory card connected |
Note
Although we specify wich features are harmful to the conquest cards. ps3mca will refuse to run these commands if a conquest card is identified
- Usage of external mg keys instead of Builtin allow the user to change the desired keys on the fly, instead of having several versions of ps3mca around
- Support for detection of the SoulCalibur2 Conquest card: PS3MCA will let you know if card is a conquest card, and will lock you from using features harmful to the card (eg: unformat, format, crosslink, and any filesystem related feature)
- Configurable verbosity: a configurable verbosity level. you can choose to keep ps3mca silent as usual (verbosity 0) or use higher levels to obtain useful information of the process
[ps3mca]
#name of another section inside this file with all the keys...
mgkey=retail
# (integer): verbosity level
verbose=
[retail]
#keys here
[developer]
#keys here
[arcade]
#keys here
[prototype]
#keys herekeys will be available under the following names
| original name | alternative name (kelftool) | size (bytes) |
|---|---|---|
MC_CARDKEY_MATERIAL_1 |
MG_CARDIV_0 |
8 |
MC_CARDKEY_HASHKEY_1 |
MG_CARDKEY_0 |
16 |
MC_CARDKEY_MATERIAL_2 |
MG_CARDIV2_0 |
8 |
MC_CARDKEY_HASHKEY_2 |
MG_CARDKEY2_0 |
16 |
MC_CHALLENGE_MATERIAL |
MG_CHALLENGE_IV |
8 |
MG_KBIT_MATERIAL |
MG_KBIT_IV |
8 |
MG_KC_MATERIAL |
MG_KC_IV |
8 |
MG_KBIT_MASTER_KEY |
- | 16 |
MG_KC_MASTER_KEY |
- | 16 |
lets say a key value is:
uint8_t MC_CARDKEY_MATERIAL_1[8] = {0x00, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}you will write it down on the INI this way:
MC_CARDKEY_MATERIAL_1=0099AABBCCDDEEFFVerbosity is handled by a number, the higher it is, the more info you'll get on the log (higher numbers include the logging from smaller numbers)
- 1: minimal logging (recommended)
- 2: during card auth, log the values of the Memory card
CardIV,CardMaterialandCardNonce. also logs kbit and kc encryption values during KELF Binding and un-binding - 3: during card auth, log the values of mechacon challenges, card challenge responses and session key
- 11: print the keys chosen on the INI
Starting with ps3mca-tool 1.5.1.0 a new config value can be passed to individual keystores. this value specifies the magicgate key to be requested into the card, and goes by this name on the ini: keychange_param. a number from 0 to 3 must be assigned to it depending on the keyset
I will not explain in depth the meaning of this. but it should look like this
[retail]
keychange_param=1
;YOUR KEYS HERE
[developer]
keychange_param=0
;YOUR KEYS HERE
[arcade]
;YOUR KEYS HERE
[prototype]
;YOUR KEYS HERE
[arcade2]
keychange_param=3
;YOUR KEYS HERETo make it simpler, these are the values and their meaning:
| Number | description |
|---|---|
0 |
requests DEX key |
1 |
requests CEX key (this one is used by normal PS2s) |
2 |
requests unknown key |
3 |
requests alternative arcade key. this one is used by original cards plugged into the second port of arcade ps2 |
- The DLL used comes from https://github.com/mcuee/libusb-win32
- the driver is https://sourceforge.net/projects/libusbk/
the DLL is already bundled (on the original package, inside amd64 dir)
[ps3mca]
mgkey=retail
verbose=4
[retail]
keychange_param=1
MC_CARDKEY_MATERIAL_1=...
MC_CARDKEY_HASHKEY_1=...
MC_CARDKEY_MATERIAL_2=...
MC_CARDKEY_HASHKEY_2=...
MC_CHALLENGE_MATERIAL=...
MG_KBIT_MATERIAL=...
MG_KC_MATERIAL=...
MG_KBIT_MASTER_KEY=...
MG_KC_MASTER_KEY=...
[arcade]
MC_CARDKEY_MATERIAL_1=...
MC_CARDKEY_HASHKEY_1=...
MC_CARDKEY_MATERIAL_2=...
MC_CARDKEY_HASHKEY_2=...
MC_CHALLENGE_MATERIAL=...
MG_KBIT_MATERIAL=...
MG_KC_MATERIAL=...
MG_KBIT_MASTER_KEY=...
MG_KC_MASTER_KEY=...
[arcade2]
keychange_param=3
MC_CARDKEY_MATERIAL_1=...
MC_CARDKEY_HASHKEY_1=...
MC_CARDKEY_MATERIAL_2=...
MC_CARDKEY_HASHKEY_2=...
MC_CHALLENGE_MATERIAL=...
MG_KBIT_MATERIAL=...
MG_KC_MATERIAL=...
MG_KBIT_MASTER_KEY=...
MG_KC_MASTER_KEY=...
[developer]
keychange_param=0
MC_CARDKEY_MATERIAL_1=...
MC_CARDKEY_HASHKEY_1=...
MC_CARDKEY_MATERIAL_2=...
MC_CARDKEY_HASHKEY_2=...
MC_CHALLENGE_MATERIAL=...
MG_KBIT_MATERIAL=...
MG_KC_MATERIAL=...
MG_KBIT_MASTER_KEY=...
MG_KC_MASTER_KEY=...
[prototype]
MC_CARDKEY_MATERIAL_1=...
MC_CARDKEY_HASHKEY_1=...
MC_CARDKEY_MATERIAL_2=...
MC_CARDKEY_HASHKEY_2=...
MC_CHALLENGE_MATERIAL=...
MG_KBIT_MATERIAL=...
MG_KC_MATERIAL=...
MG_KBIT_MASTER_KEY=...
MG_KC_MASTER_KEY=...