User:Master-bob/MACS - Revision history

Master-bob: /* REQ-BODY */

2019-01-23T16:23:33Z

‎REQ-BODY

Master-bob at 16:20, 23 January 2019

2019-01-23T16:20:37Z

Master-bob: /* Nonce HMAC Key */

2019-01-23T04:18:58Z

‎Nonce HMAC Key

Master-bob: /* PA-XBOX-CLIENT-VERSION */

2019-01-22T04:39:18Z

‎PA-XBOX-CLIENT-VERSION

Master-bob: /* PA-ENC-TIMESTAMP */

2019-01-22T04:38:40Z

‎PA-ENC-TIMESTAMP

Master-bob: /* Building the Response */

2019-01-22T04:35:46Z

‎Building the Response

Master-bob: /* PA-PAC-REQUEST-EX */

2019-01-22T04:24:15Z

‎PA-PAC-REQUEST-EX

Master-bob: /* PA-PAC-REQUEST-EX */

2019-01-22T04:22:36Z

‎PA-PAC-REQUEST-EX

Master-bob: /* The Machine Account */

2019-01-22T04:12:58Z

‎The Machine Account

Master-bob: /* The Machine Account */

2019-01-22T04:11:36Z

‎The Machine Account

@@ Line 62: / Line 62: @@
 ===REQ-BODY===
-The remainder of the Kerberos ticket. '''Bold''' indicates the data are used for response building.
+The remainder of the Kerberos request. '''Bold''' indicates the data are used for response building.
 * Padding - 0

@@ Line 22: / Line 22: @@
      // decrypt the EEPROM to get the correct hdd key
-     rc4_key = HMAC-SHA1 of the hdd_key using a magical key
+     rc4_key = SHA1-HMAC of the hdd_key using "60 59 E8 2E DF BF 7F D3 23 35 74 2A 64 8B B1 2C"
      decrypted_online_key = rc4 of online_key using rc4_key
@@ Line 38: / Line 38: @@
                  INTEGER 14
-and 14 correlate to PAC_CLIENT_IDENTITY and PAC_COMPOUND_IDENTITY, respectively, and are used to tell the server to include a PUID PAC (20) in the response.
+and 14 correlate to PAC_CLIENT_IDENTITY and PAC_COMPOUND_IDENTITY, respectively, and are used to tell the server to include a PUID PAC (20) in the response. Not sure if it's actually needed for AS-REP.
 ====PA-XBOX-PRE-PRE-AUTH====
@@ Line 47: / Line 47: @@
 * currentTime - the current time, sent as a FILETIME
 * PPA1 - SHA1-HMAC of the principal name (the Xbox serial number) using the principal key (the online key)
-* SPPA2atT - computed as follows
+* SPPA2atT
-** SPPA1 - SHA1(PPA1)
+** SPPA1 - SHA1 of PPA1
-** PPA2 - First 8 bytes of SHA1-HMAC of PrincipalName appended to PrincipalName using the principal key
+** PPA2 - First 8 bytes of SHA1-HMAC of ths serial number appended to the serial number using the principal key
 ** SPPA2atT - SHA1 of PPA2 appended to the current time
@@ Line 59: / Line 59: @@
 * signature - a 20 byte array used to verify the encryption key generated for the response
 * version - null terminated string with information about the application sending the request
-** XboxVersion=1.00.5849.3 Title=0xFFFE0000 TitleVersion=408857856 - Xbox Live Dashboard 5849
+** Xbox Live Dashboard 5849 - XboxVersion=1.00.5849.3 Title=0xFFFE0000 TitleVersion=408857856
 ===REQ-BODY===
@@ Line 70: / Line 70: @@
 * sname - krbtgt@MACS.XBOX.COM
 * till - 2037-09-13 02:48:05 (UTC)
-* '''nonce - a randomly generated number'''
+* nonce - a randomly generated number
 * '''etype - RC4-HMAC-MD5'''
@@ Line 79: / Line 79: @@
 The following is how the machine account is built ''for transfer''. It is stored in a different fashion.
-     ULONGLONG userID;
+     ULONGLONG uniqueID;
      CHAR gamertag[16];  // SN.XXXXXXXXXXXX (the console serial number)
      CHAR domain[20];    // xbox.com
@@ Line 89: / Line 89: @@
      temp_key = MD5-HMAC of the null terminated string "signaturekey" using the online key
-     salted_nonce = MD5 of "02 04 00 00 00 00 00 00"
+     salted_nonce = "5F F3 28 92 13 8C 9C 4B 05 84 9A 3C 10 1A DB 5D" // MD5 of "02 04 00 00 00 00 00 00"
      nonce_hmac_key = MD5-HMAC of salted_nonce using temp_key
@@ Line 98: / Line 98: @@
 ===Encryption===
-The machine account is encrypted with the nonce HMAC key and salt 1203 using RC4-HMAC-MD5. The encrypted bytes are packed as a Kerberos EncrpytedData object into a PA-DATA TYPE 203 preauthentication header in the AS-REP.
+The machine account is encrypted with the nonce HMAC key and salt 1203 using RC4-HMAC-MD5. The encrypted bytes are packed as a Kerberos EncryptedData object into a PA-DATA TYPE 203 preauthentication header in the AS-REP.
 ==AS-REP==

@@ Line 89: / Line 89: @@
      temp_key = MD5-HMAC of the null terminated string "signaturekey" using the online key
-     md5_ctx = MD5 of the salt (1026) as a ULONG and the nonce as a DWORD
+     salted_nonce = MD5 of "02 04 00 00 00 00 00 00"
-     nonce_hmac_key = MD5-HMAC of md5_ctx using temp_key
+     nonce_hmac_key = MD5-HMAC of salted_nonce using temp_key
 The key can be verified using the PA-XBOX-CLIENT-VERSION preauth:

@@ Line 59: / Line 59: @@
 * signature - a 20 byte array used to verify the encryption key generated for the response
 * version - null terminated string with information about the application sending the request
-** XboxVersion=1.00.5849.3 Title=0xFFFE0000 TitleVersion=408857856
+** XboxVersion=1.00.5849.3 Title=0xFFFE0000 TitleVersion=408857856 - Xbox Live Dashboard 5849
 ===REQ-BODY===
 The remainder of the Kerberos ticket. '''Bold''' indicates the data are used for response building.

@@ Line 21: / Line 21: @@
 The online key is stored in an encrypted form on the Xbox's [[EEPROM]]. The key is decrypted using:
      rc4_key = HMAC-SHA1 of the hdd_key using a magical key
      decrypted_online_key = rc4 of online_key using rc4_key

@@ Line 94: / Line 94: @@
      test_signature = SHA1-HMAC of the version_string using the nonce_hmac_key
      // if both signatures match, the key was generated correctly
 ==AS-REP==

@@ Line 27: / Line 27: @@
 PA-DATA TYPE 131
-This is an Xbox modification to custom Microsoft (PA-PAC-REQUEST) addition to Kerberos, used to define what the client expects in the response. This is encoded in ASN.1 (method of packing data structures into bytes, used by Kerberos). All AS-REQs contain the following data in this section:
+This is an Xbox modification to a custom Microsoft (PA-PAC-REQUEST) addition to Kerberos, used to define what the client expects in the response. This is encoded in ASN.1 (method of packing data structures into bytes, used by Kerberos). All AS-REQs contain the following data in this section:
      SEQUENCE (2 elem)
@@ Line 37: / Line 37: @@
                  INTEGER 14
-and 14 correlate to PAC_CLIENT_IDENTITY and PAC_COMPOUND_IDENTITY, respectively, and are used to tell the server to include a PUID PAC (20) in the response
+and 14 correlate to PAC_CLIENT_IDENTITY and PAC_COMPOUND_IDENTITY, respectively, and are used to tell the server to include a PUID PAC (20) in the response.
 ====PA-XBOX-PRE-PRE-AUTH====

← Older revision		Revision as of 04:11, 22 January 2019
Line 75:		Line 75:

	===The Machine Account===		===The Machine Account===
		+	The following is how the machine account is built ''for transfer''. It is stored in a different fashion.
		+
		+	ULONGLONG userID;
		+	CHAR gamertag[16]; // SN.XXXXXXXXXXXX
		+	CHAR domain[20]; // xbox.com
		+	CHAR realm[24]; // passport.net
		+	BYTE key[16];

	===Nonce HMAC Key===		===Nonce HMAC Key===