Editing Talk:PARAM.PFD

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[https://www.sendspace.com/file/jmo0do pfd_sfo_tools_code by flat_z]
== Sperimental PFD Reader ==


== Sperimental PFD Reader ==
[http://pastie.org/private/hcir9ukjmdqaj3pccs7xw pfd.c]
To compile it just place it inside the ps3tools folder and add '''pfd''' into the makefile  in the last '''TOOLS +=''' line [[User:Deroad|Deroad]] 20:09, 15 July 2012 (MSK)
 
to compile it just place it inside the ps3tools folder and add '''pfd''' into the makefile  in the last '''TOOLS +=''' line
 
[[User:Deroad|Deroad]] 20:09, 15 July 2012 (MSK)


Link: [http://pastie.org/private/hcir9ukjmdqaj3pccs7xw pfd.c]
----


== Other Sources ==
The guys at http://us.xploder.net are the first ones that reversed the .PFD structure/encryption/signing
*Xploder PS3
The guys at http://us.xploder.net are the first ones that reversed the .PFD structure/encryption/signing. By reversing what this disc does we can understand the decryption method


His "Xploder PS3 Cheats System" (is a disc intended to be used in PC) is able to decrypt and reencrypt .PFD files in a PC
His "Xploder PS3 Cheats System" (is a disc intended to be used in PC) is able to decrypt and reencrypt .PFD files in a PC
Line 14: Line 15:
In difference with the previous cheat hacks as (Code Freak, PS3UserCheat, E3 GoldenFinger, P3Go Cheat, PS3 Cheat Enabler) this old methods depends of a dongle that patches the firmware to bypass the .PFD checks
In difference with the previous cheat hacks as (Code Freak, PS3UserCheat, E3 GoldenFinger, P3Go Cheat, PS3 Cheat Enabler) this old methods depends of a dongle that patches the firmware to bypass the .PFD checks


==Example Files==
 
By reversing what this disc does we can understand the decryption method
 
----


Just a collection of PARAM (.bin .pfd .sfo .tpf) files: http://www.mirrorcreator.com/files/0OAXGOHN/PARAM.rar_links
Just a collection of PARAM (.bin .pfd .sfo .tpf) files: http://www.mirrorcreator.com/files/0OAXGOHN/PARAM.rar_links
Line 20: Line 24:




==PARAM.PFD Structure generation process==
*This is more than speculation, is a representation of how mirror's edge PARAM.PFD was generated, and how the index numbers are used to "jump" to the next one. I did this table weeks ago, and there was something wrong i realized at the end but thanks to it i understood how the PARAM.PFD is generated using timestamps, probably the table is wrong (because the mirror's edge file im using as example has been updated several times by his owner) but we need to use something like this to order them also it can help others


From files timestamps----->to----->PARAM.PFD


Last time modifyed timestamp
 
==This is a VERY USEFUL game save==
http://db.gamefaqs.com/console/ps3/save/mirror_s_edge.zip
 
The structure of this PARAM.PFD can be considered "rare", and is perfect to be used for explains and to understand how it works, the structure contains all the "problems" not present in "standard" files that can be considered unknown... there are other game saves that can be used (MotoGP10, Heavy rain)... but the list of protected files in heavy rain is HUGE (use this file if you are coding an app as a "stress test", but not for examples)
 
From now on... lest use the PARAM.PFD from "mirror's edge "game save" for the examples in the main page
 
===Header===
 
 
{| class="wikitable"
|-
! Offset !! Size !! Value !! Description
|-
| 0x00 || 0x08 bytes || PFDB || Magic value in ASCII
|-
| 0x08 || 0x08 bytes || 00000000 00000003 || constant
|-
| 0x10 || 0x10 bytes || 69152C97 812B25C5 2AD4FA18 E4B816A8 || key to en/decrypt
|-
| 0x20 || 0x14 bytes || 7C1F5C28 A7EE4D39 22ADC828 E6CD7888 980F33B6 || encrypted, decrypted by vtrm
|-
| 0x34 || 0x14 bytes || 2394EEE9 9706774E 71912413 A7CFDBE5 E38E8D0C || encrypted, decrypted by vtrm
|-
| 0x48 || 0x14 bytes || 5BCF8807 FCB7B59C 4C5A3D98 3904B6CE EDE27152 || encrypted, decrypted by vtrm
|-
| 0x5C || 0x04 bytes || AA9C2F85 || padding, encrypted by vtrm
|-
| 0x60 || 0x08 bytes || 0000000000000039 || Number of reserved entries in the '''X table''' & '''Y table''' (57 in decimal)
|-
| 0x68 || 0x08 bytes || 0000000000000072 || Number of reserved entries in the '''Protected files table''' (114 in decimal)
|-
| 0x70 || 0x08 bytes || 0000000000000021 || Number of used entries in the '''Protected files table''' (33 in decimal)
|-
|}
 
 
===X table===
 
00000070                          00 00 00 00 00 00 00 72          .......r|
00000080  00 00 00 00 00 00 00 '''01'''  00 00 00 00 00 00 00 72  |...............r|
00000090  00 00 00 00 00 00 00 '''0C'''  00 00 00 00 00 00 00 72  |...............r|
000000a0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''1F'''  |.......r........|
000000b0  00 00 00 00 00 00 00 '''10'''  00 00 00 00 00 00 00 '''1B'''  |................|
000000c0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''14'''  |.......r........|
000000d0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
000000e0  00 00 00 00 00 00 00 '''0B'''  00 00 00 00 00 00 00 '''0D'''  |................|
000000f0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
00000100  00 00 00 00 00 00 00 '''15'''  00 00 00 00 00 00 00 '''19'''  |................|
00000110  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''13'''  |.......r........|
00000120  00 00 00 00 00 00 00 '''17'''  00 00 00 00 00 00 00 72  |...............r|
00000130  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''0E'''  |.......r........|
00000140  00 00 00 00 00 00 00 '''11'''  00 00 00 00 00 00 00 72  |...............r|
00000150  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''18'''  |.......r........|
00000160  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
00000170  00 00 00 00 00 00 00 '''1A'''  00 00 00 00 00 00 00 '''12'''  |................|
00000180  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
00000190  00 00 00 00 00 00 00 '''04'''  00 00 00 00 00 00 00 72  |...............r|
000001a0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''1C'''  |.......r.......r|
000001b0  00 00 00 00 00 00 00 '''07'''  00 00 00 00 00 00 00 72  |...............r|
000001c0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
000001d0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
000001e0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''03'''  |.......r........|
000001f0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
00000200  00 00 00 00 00 00 00 '''1D'''  00 00 00 00 00 00 00 72  |...............r|
00000210  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''20'''  |.......r........|
00000220  00 00 00 00 00 00 00 '''0F'''  00 00 00 00 00 00 00 72  |...............r|
00000230  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''1E'''  |.......r........|
 
In this table there are 25 entries "indexed"
 
{| class="wikitable"
|-
! Position in table !! Virtual Index ID
|-
| 1 || {{No}}
|-
| 2 || 0x01
|-
| 3 || {{No}}
|-
| 4 || 0x0C
|-
| 5 || {{No}}
|-
| 6 || {{No}}
|-
| 7 || 0x1F
|-
| 8 || 0x10
|-
| 9 || 0x1B
|-
| 10 || {{No}}
|-
| 11 || 0x14
|-
| 12 || {{No}}
|-
| 13 || {{No}}
|-
| 14 || 0x0B
|-
| 15 || 0x0D
|-
| 16 || {{No}}
|-
| 17 || {{No}}
|-
| 18 || 0x15
|-
| 19 || 0x19
|-
| 20 || {{No}}
|-
| 21 || 0x13
|-
| 22 || 0x17
|-
| 23 || {{No}}
|-
| 24 || {{No}}
|-
| 25 || 0x0E
|-
| 26 || 0x11
|-
| 27 || {{No}}
|-
| 28 || {{No}}
|-
| 29 || 0x18
|-
| 30 || {{No}}
|-
| 31 || {{No}}
|-
| 32 || 0x1A
|-
| 33 || 0x12
|-
| 34 || {{No}}
|-
| 35 || {{No}}
|-
| 36 || 0x04
|-
| 37 || {{No}}
|-
| 38 || {{No}}
|-
| 39 || 0x1C
|-
| 40 || 0x07
|-
| 41 || {{No}}
|-
| 42 || {{No}}
|-
| 43 || {{No}}
|-
| 44 || {{No}}
|-
| 45 || {{No}}
|-
| 46 || {{No}}
|-
| 47 || 0x03
|-
| 48 || {{No}}
|-
| 49 || {{No}}
|-
| 50 || 0x1D
|-
| 51 || {{No}}
|-
| 52 || {{No}}
|-
| 53 || 0x20
|-
| 54 || 0x0F
|-
| 55 || {{No}}
|-
| 56 || {{No}}
|-
| 57 || 0x1E
|-
|}
 
===Protected files table===
 
And the other 8 "indexed" are in this table
 
{| class="wikitable"
|-
! Position in table !! Virtual Index ID !! File Name !! Unknown !! Certificate !! File Size
|-
| 1 || {{No}} || PARAM.SFO || 00568CD8 || longer than others || 00000AB0
|-
| 2 || {{No}} || SAVTOC0.BIN || 00568CD8 || || 0000058C
|-
| 3 || {{No}} || SAV33.BIN || 00568CD8 || || 00000584
|-
| 4 || {{No}} || SAV14.BIN || 00568CD8 || || 00009543
|-
| 5 || {{No}} || SAV3.BIN || 00568CD8 || || 0000848F
|-
| 6 || {{No}} || SAV22.BIN || 00568CD8 || || 00008221
|-
| 7 || {{No}} || SAV21.BIN || 00568CD8 || || 00009D66
|-
| 8 || {{No}} || SAV13.BIN || 00568CD8 || || 00009EF5
|-
| 9 || {{No}} || SAV5.BIN || 00568CD8 || || 0000CD1B
|-
| 10 || {{No}} || SAV6.BIN || 00568CD8 || || 0000B3AF
|-
| 11 || {{No}} || SAV7.BIN || 00568CD8 || || 00008266
|-
| 12 || {{No}} || SAV8.BIN || 00568CD8 || || 00007618
|-
| 13 || {{No}} || SAV16.BIN || 00568CD8 || || 0000B95A
|-
| 14 || 0x06 || SAV0.BIN || 00568CD8 || || 00009F4D
|-
| 15 || {{No}} || SAV19.BIN || 00568CD8 || || 0000A11B
|-
| 16 || {{No}} || SAV15.BIN || 00568CD8 || || 0000CC00
|-
| 17 || {{No}} || SAV20.BIN || 00568CD8 || || 000109F0
|-
| 18 || {{No}} || SAV11.BIN || 00568CD8 || || 00009C0A
|-
| 19 || {{No}} || SAV12.BIN || 00568CD8 || || 0000948D
|-
| 20 || {{No}} || SAV9.BIN || 00568CD8 || || 0000C712
|-
| 21 || {{No}} || SAV17.BIN || 00568CD8 || || 0000E4FD
|-
| 22 || 0x02 || SAV18.BIN || 00568CD8 || || 0000AE4D
|-
| 23 || {{No}} || SAV2.BIN || 00568CD8 || || 0000CD55
|-
| 24 || 0x05 || SAV1.BIN || 00568CD8 || || 000098B3
|-
| 25 || 0x16 || SAV23.BIN || 00568CD8 || || 00004FBE
|-
| 26 || {{No}} || SAV10.BIN || 00568CD8 || || 0000ADBD
|-
| 27 || {{No}} || SAV35.BIN || 00568CD8 || || 00008E2E
|-
| 28 || 0x00 || SAVTOC1.BIN || 00568CD8 || || 00000108
|-
| 29 || {{No}} || SAV36.BIN || 00568CD8 || || 00009CBE
|-
| 30 || 0x08 || SAV26.BIN || 00568CD8 || || 0000B4D7
|-
| 31 || 0x09 || SAV27.BIN || 00568CD8 || || 00009FD1
|-
| 32 || 0x0A || SAV28.BIN || 00568CD8 || || 00007D73
|-
| 33 || {{No}} || SAV38.BIN || 00568CD8 || || 0000D401
|-
| Up to 114 || {{No}} || {{No}} || {{No}} || {{No}} || {{No}}
|-
|}
 
*Note about the "virtual index"
The addition of the "indexed" entries in this 2 tables makes the total of '''33 protected files'''... are "indexed" by spreading his ID numbers between "X table" and "protected files table"
 
Ok... more tables... this is the "virtual index" that we have if we place all the entries from the 2 tables together, and ordered by his ID number. This makes a total of 33 "indexed files":


{| class="wikitable"
{| class="wikitable"
|-
|-
! Timestamp !! File Name (by timestamp) !! Next jump offset from Xtable !! Next jump offset from Filetable !! Generated table
! Virtual Index ID !! Placement/position !! File Name
|-
|-
| rowspan="2" style="background-color:#DDDDDD;" | 2009/06/14 7:20:12 || PARAM.SFO || 0x72 + 0x01 || {{no}} || PARAM.SFO
| 0x00 || protected files table / position 28 || SAVTOC1.BIN
|-
|-
| SAVTOC0.BIN || 0x72 + 0x0C || {{no}} || SAVTOC0.BIN
| 0x01 || X table / position 2 || {{No}}
|-
|-
| rowspan="12" style="background-color:#DDDDDD;" | 2009/06/14 7:20:14 || SAV0.BIN || ?? || 0x06 || SAV33.BIN  
| 0x02 || protected files table / position 22 || SAV18.BIN  
|-
|-
| SAV3.BIN || 0x72 + 0x72 + 0x1F || {{no}} || SAV14.BIN
| 0x03 || X table / position 47 || {{No}}
|-
|-
| SAV5.BIN || 0x10 || {{no}} || SAV3.BIN
| 0x04 || X table / position 36 || {{No}}
|-
|-
| SAV6.BIN || 0x1B || {{no}} || SAV22.BIN  
| 0x05 || protected files table / position 24 || SAV1.BIN  
|-
|-
| SAV7.BIN || 0x72 + 0x14 || {{no}} || SAV21.BIN  
| 0x06 || protected files table / position 14 || SAV0.BIN  
|-
|-
| SAV8.BIN || 0x72 + 0x72 + 0x0B || {{no}} || SAV13.BIN
| 0x07 || X table / position 40 || {{No}}
|-
|-
| SAV13.BIN || 0x0D || {{no}} || SAV5.BIN  
| 0x08 || protected files table / position 30 || SAV26.BIN  
|-
|-
| SAV14.BIN || 0x72 + 0x72 + 0x15 || {{no}} || SAV6.BIN  
| 0x09 || protected files table / position 31 || SAV27.BIN  
|-
|-
| SAV16.BIN || 0x19 || {{no}} || SAV7.BIN  
| 0x0A || protected files table / position 32 || SAV28.BIN  
|-
|-
| SAV21.BIN || 0x72 + 0x13 || {{no}} || SAV8.BIN
| 0x0B || X table / position 14 || {{No}}
|-
|-
| SAV22.BIN || 0x17 || {{no}} || SAV16.BIN
| 0x0C || X table / position 4 || {{No}}
|-
|-
| SAV33.BIN || 0x72 + 0x72 + 0x0E || {{no}} || SAV0.BIN
| 0x0D || X table / position 15 || {{No}}
|-
|-
| rowspan="19" style="background-color:#DDDDDD;" | 2009/06/14 7:20:16  || SAV1.BIN || ??? || 0x05 || SAV19.BIN
| 0x0E ||  X table / position 25 || {{No}}
|-
|-
| SAV2.BIN || 0x11 || {{no}} || SAV15.BIN
| 0x0F || X table / position 54 || {{No}}
|-
|-
| SAV9.BIN || 0x72 + 0x72 + 0x18 || {{no}} || SAV20.BIN
| 0x10 || X table / position 8 || {{No}}
|-
|-
| SAV10.BIN || 0x72 + 0x72 + 0x1A || {{no}} || SAV11.BIN
| 0x11 || X table / position 26 || {{No}}
|-
|-
| SAV11.BIN ||0x12 || {{no}} || SAV12.BIN
| 0x12 ||  X table / position 33 || {{No}}
|-
|-
| SAV12.BIN || 0x72 + 0x72 + 0x04 || {{no}} || SAV9.BIN
| 0x13 || X table / position 21 || {{No}}
|-
|-
| SAV15.BIN || 0x72 + 0x72 + 0x1C || {{no}} || SAV17.BIN
| 0x14 || X table / position 11 || {{No}}
|-
|-
| SAV17.BIN || 0x07 || {{no}} || SAV18.BIN
| 0x15 || X table / position 18 || {{No}}
|-
|-
| SAV18.BIN || ??? || 0x02 || SAV2.BIN  
| 0x16 || protected files table / position 25 || SAV23.BIN  
|-
|-
| SAV19.BIN || 0x72 + 0x72 + 0x72 + 0x72 + 0x72 + 0x72 + 0x03 || {{no}} || SAV1.BIN
| 0x17 || X table / position 22 || {{No}}
|-
|-
| SAV20.BIN || 0x72 + 0x72 + 0x1D || {{no}} || SAV23.BIN
| 0x18 || X table / position 29 || {{No}}
|-
|-
| SAV23.BIN || ??? || 0x16 || SAV10.BIN
| 0x19 || X table / position 19 || {{No}}
|-
|-
| SAV26.BIN || ??? || 0x08 || SAV35.BIN
| 0x1A || X table / position 32 || {{No}}
|-
|-
| SAV27.BIN || ??? || 0x09 || SAVTOC1.BIN
| 0x1B || X table / position 9 || {{No}}
|-
|-
| SAV28.BIN || ??? || 0x0A || SAV36.BIN
| 0x1C || X table / position 39 || {{No}}
|-
|-
| SAV35.BIN || 0x72 + 0x72 + 0x20 || {{no}} || SAV26.BIN
| 0x1D || X table / position 50 || {{No}}
|-
|-
| SAV36.BIN || 0x0F || {{no}} || SAV27.BIN
| 0x1E || X table / position 57 || {{No}}
|-
|-
| SAV38.BIN || 0x72 + 0x72 + 0x1E || {{no}} || SAV28.BIN
| 0x1F || X table / position 7 || {{No}}
|-
|-
| SAVTOC1.BIN || ??? || 0x00 || SAV38.BIN
| 0x20 || X table / position 53 || {{No}}
|-
|-
|}
|}


*The problem is the timestamps of the "protected files" changed when the owner of this game save updated it (we must suppose he did lot of times). Its needed to understand if this update process rebuilds all the tables reasigning the "index nº's" or if the positions of the "protected files" are moved inside "protected files table". Also is needed to verify how new files are added to the "protected files table" when the game generate new ones. To verify all this is needed to begin with a "fresh created" game save, understand how has been built, and compare how it changes after several updates, this is where i stopped ;)
===Y table===
*This means the examples from this mirror's edge game save (downloaded from gamefaq) are not enought to explain how it works, are needed at least 3 different game saves generated by the same user in the same ps3, or in other words... all the examples must be replaced :/
Dont forget this table... uses something similar
**1.- A copy of the folder the first time the game save is generated (copyed from hdd, NOT exported to usb)
**2.- A copy of the folder after a "normal" update (no new files are added to the "protected files table")
**2.- A copy of the folder after a "special" update (new files are added to the "protected files table")
**This completes all the behaviours/functions possibles for PARAM.PFD related with his creation/updates
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Template used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Talk:PARAM.PFD"