Ticket
An iQue Ticket is used to store data about a piece of content, such as the size, hash and ID. It's used as part of the SKSA (for info about the SA1/SA2) and also used as part of the [Title Data] structure (for info about the game title).
Each ticket is signed via RSA-2048 using a CP (content protection?) certificate.
Format
The ticket format is similar to a Wii ticket, though it seems the structure was reworked sometime between the iQue and Wii.
It's assumed that the title key needed to decrypt an SA / .app is part of the structure, though likely encrypted with a common-key that's yet to be dumped from the console.
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x8 | bytes | Unknown (always 0?) |
| 0x8 | 0x4 | int32 | Unknown (always 1?) |
| 0xC | 0x4 | uint32 | Content Size |
| 0x10 | 0x4 | int32 | Unknown (0 for tickets, 1 for SA?) |
| 0x14 | 0x10 | bytes | Unknown (possible title-key) |
| 0x24 | 0x14 | bytes | Content hash (hash of the decrypted content) |
| 0x38 | 0x10 | bytes | Unknown (very possible title-key) |
| 0x48 | 0x4 | int32 | Unknown (2 for game tickets, 0 for SA/iQue Club ticket?) |
| 0x4C | 0x4 | int32 | Unknown (0 for games, 0x13 for iQue Club, 0x1F7/0x1B3 for SA) |
| 0x50 | 0x4 | int32 | Unknown (0x4000 for games, 0x6001 for iQue Club, -1 for normal SAs, 0xE01 for weird SAs?) |
| 0x54 | 0x4 | int32 | Unknown (always 0?) |
| 0x58 | 0x40 | chars | Authority (cert used to sign ticket) |
| 0x98 | 0x4 | uint32 | Content ID (can't be higher than 99999999, if (cid / 0x64) % 0xA == 9, this is a game manual?) |
| 0x9C | 0x10 | bytes | Unknown (possible title-key - contents change between devices, but signature remains the same???) |
| 0xAC | 0x100 | bytes | RSA-2048 signature |
In different SAs which seem to have matching bytes in the encrypted data, the field at 0x38 seems to be the only constant between them, likely our best suspect for the title-key.