Talk:PARAM.PFD
Sperimental PFD Reader
to compile it just place it inside the ps3tools folder and add pfd into the makefile in the last TOOLS += line
Deroad 20:09, 15 July 2012 (MSK)
The guys at http://us.xploder.net are the first ones that reversed the .PFD structure/encryption/signing
His "Xploder PS3 Cheats System" (is a disc intended to be used in PC) is able to decrypt and reencrypt .PFD files in a PC
In difference with the previous cheat hacks as (Code Freak, PS3UserCheat, E3 GoldenFinger, P3Go Cheat, PS3 Cheat Enabler) this old methods depends of a dongle that patches the firmware to bypass the .PFD checks
By reversing what this disc does we can understand the decryption method
Just a collection of PARAM (.bin .pfd .sfo .tpf) files: http://www.mirrorcreator.com/files/0OAXGOHN/PARAM.rar_links
This is a VERY USEFUL game save
http://db.gamefaqs.com/console/ps3/save/mirror_s_edge.zip
The structure of this PARAM.PFD can be considered "rare", and is perfect to be used for explains and to understand how it works, the structure contains all the "problems" not present in "standard" files that can be considered unknown... there are other game saves that can be used (MotoGP10, Heavy rain)... but the list of protected files in heavy rain is HUGE (use this file if you are coding an app as a "stress test", but not for examples)
From now on... lest use the PARAM.PFD from "mirror's edge "game save" for the examples in the main page
Header
Offset | Size | Value | Description |
---|---|---|---|
0x00 | 0x08 bytes | PFDB | Magic value in ASCII |
0x08 | 0x08 bytes | 00000000 00000003 | constant |
0x10 | 0x10 bytes | 69152C97 812B25C5 2AD4FA18 E4B816A8 | key to en/decrypt |
0x20 | 0x14 bytes | 7C1F5C28 A7EE4D39 22ADC828 E6CD7888 980F33B6 | encrypted, decrypted by vtrm |
0x34 | 0x14 bytes | 2394EEE9 9706774E 71912413 A7CFDBE5 E38E8D0C | encrypted, decrypted by vtrm |
0x48 | 0x14 bytes | 5BCF8807 FCB7B59C 4C5A3D98 3904B6CE EDE27152 | encrypted, decrypted by vtrm |
0x5C | 0x04 bytes | AA9C2F85 | padding, encrypted by vtrm |
0x60 | 0x08 bytes | 0000000000000039 | Number of reserved entries in the X table & Y table (57 in decimal) |
0x68 | 0x08 bytes | 0000000000000072 | Number of reserved entries in the Protected files table (114 in decimal) |
0x70 | 0x08 bytes | 0000000000000021 | Number of used entries in the Protected files table (33 in decimal) |
X table
00000070 00 00 00 00 00 00 00 72 .......r| 00000080 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 72 |...............r| 00000090 00 00 00 00 00 00 00 0C 00 00 00 00 00 00 00 72 |...............r| 000000a0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 1F |.......r........| 000000b0 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 1B |................| 000000c0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 14 |.......r........| 000000d0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000000e0 00 00 00 00 00 00 00 0B 00 00 00 00 00 00 00 0D |................| 000000f0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000100 00 00 00 00 00 00 00 15 00 00 00 00 00 00 00 19 |................| 00000110 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 13 |.......r........| 00000120 00 00 00 00 00 00 00 17 00 00 00 00 00 00 00 72 |...............r| 00000130 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 0E |.......r........| 00000140 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 72 |...............r| 00000150 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 18 |.......r........| 00000160 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000170 00 00 00 00 00 00 00 1A 00 00 00 00 00 00 00 12 |................| 00000180 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000190 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 72 |...............r| 000001a0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 1C |.......r.......r| 000001b0 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 72 |...............r| 000001c0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001d0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001e0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 03 |.......r........| 000001f0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000200 00 00 00 00 00 00 00 1D 00 00 00 00 00 00 00 72 |...............r| 00000210 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 20 |.......r........| 00000220 00 00 00 00 00 00 00 0F 00 00 00 00 00 00 00 72 |...............r| 00000230 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 1E |.......r........|
In this table there are 25 entries "indexed"
Position in table | Virtual Index ID |
---|---|
1 | No |
2 | 0x01 |
3 | No |
4 | 0x0C |
5 | No |
6 | No |
7 | 0x1F |
8 | 0x10 |
9 | 0x1B |
10 | No |
11 | 0x14 |
12 | No |
13 | No |
14 | 0x0B |
15 | 0x0D |
16 | No |
17 | No |
18 | 0x15 |
19 | 0x19 |
20 | No |
21 | 0x13 |
22 | 0x17 |
23 | No |
24 | No |
25 | 0x0E |
26 | 0x11 |
27 | No |
28 | No |
29 | 0x18 |
30 | No |
31 | No |
32 | 0x1A |
33 | 0x12 |
34 | No |
35 | No |
36 | 0x04 |
37 | No |
38 | No |
39 | 0x1C |
40 | 0x07 |
41 | No |
42 | No |
43 | No |
44 | No |
45 | No |
46 | No |
47 | 0x03 |
48 | No |
49 | No |
50 | 0x1D |
51 | No |
52 | No |
53 | 0x20 |
54 | 0x0F |
55 | No |
56 | No |
57 | 0x1E |
Protected files table
And the other 8 "indexed" are in this table
Position in table | Virtual Index ID | File Name | Unknown | Certificate | File Size |
---|---|---|---|---|---|
1 | No | PARAM.SFO | 00568CD8 | longer than others | 00000AB0 |
2 | No | SAVTOC0.BIN | 00568CD8 | 0000058C | |
3 | No | SAV33.BIN | 00568CD8 | 00000584 | |
4 | No | SAV14.BIN | 00568CD8 | 00009543 | |
5 | No | SAV3.BIN | 00568CD8 | 0000848F | |
6 | No | SAV22.BIN | 00568CD8 | 00008221 | |
7 | No | SAV21.BIN | 00568CD8 | 00009D66 | |
8 | No | SAV13.BIN | 00568CD8 | 00009EF5 | |
9 | No | SAV5.BIN | 00568CD8 | 0000CD1B | |
10 | No | SAV6.BIN | 00568CD8 | 0000B3AF | |
11 | No | SAV7.BIN | 00568CD8 | 00008266 | |
12 | No | SAV8.BIN | 00568CD8 | 00007618 | |
13 | No | SAV16.BIN | 00568CD8 | 0000B95A | |
14 | 0x06 | SAV0.BIN | 00568CD8 | 00009F4D | |
15 | No | SAV19.BIN | 00568CD8 | 0000A11B | |
16 | No | SAV15.BIN | 00568CD8 | 0000CC00 | |
17 | No | SAV20.BIN | 00568CD8 | 000109F0 | |
18 | No | SAV11.BIN | 00568CD8 | 00009C0A | |
19 | No | SAV12.BIN | 00568CD8 | 0000948D | |
20 | No | SAV9.BIN | 00568CD8 | 0000C712 | |
21 | No | SAV17.BIN | 00568CD8 | 0000E4FD | |
22 | 0x02 | SAV18.BIN | 00568CD8 | 0000AE4D | |
23 | No | SAV2.BIN | 00568CD8 | 0000CD55 | |
24 | 0x05 | SAV1.BIN | 00568CD8 | 000098B3 | |
25 | 0x16 | SAV23.BIN | 00568CD8 | 00004FBE | |
26 | No | SAV10.BIN | 00568CD8 | 0000ADBD | |
27 | No | SAV35.BIN | 00568CD8 | 00008E2E | |
28 | 0x00 | SAVTOC1.BIN | 00568CD8 | 00000108 | |
29 | No | SAV36.BIN | 00568CD8 | 00009CBE | |
30 | 0x08 | SAV26.BIN | 00568CD8 | 0000B4D7 | |
31 | 0x09 | SAV27.BIN | 00568CD8 | 00009FD1 | |
32 | 0x0A | SAV28.BIN | 00568CD8 | 00007D73 | |
33 | No | SAV38.BIN | 00568CD8 | 0000D401 | |
Up to 114 | No | No | No | No | No |
- Note about the "virtual index"
The addition of the "indexed" entries in this 2 tables makes the total of 33 protected files... are "indexed" by spreading his ID numbers between "X table" and "protected files table"
Ok... more tables... this is the "virtual index" that we have if we place all the entries from the 2 tables together, and ordered by his ID number. This makes a total of 33 "indexed files":
Virtual Index ID | Placement/position | File Name |
---|---|---|
0x00 | protected files table / position 28 | SAVTOC1.BIN |
0x01 | X table / position 2 | No |
0x02 | protected files table / position 22 | SAV18.BIN |
0x03 | X table / position 47 | No |
0x04 | X table / position 36 | No |
0x05 | protected files table / position 24 | SAV1.BIN |
0x06 | protected files table / position 14 | SAV0.BIN |
0x07 | X table / position 40 | No |
0x08 | protected files table / position 30 | SAV26.BIN |
0x09 | protected files table / position 31 | SAV27.BIN |
0x0A | protected files table / position 32 | SAV28.BIN |
0x0B | X table / position 14 | No |
0x0C | X table / position 4 | No |
0x0D | X table / position 15 | No |
0x0E | X table / position 25 | No |
0x0F | X table / position 54 | No |
0x10 | X table / position 8 | No |
0x11 | X table / position 26 | No |
0x12 | X table / position 33 | No |
0x13 | X table / position 21 | No |
0x14 | X table / position 11 | No |
0x15 | X table / position 18 | No |
0x16 | protected files table / position 25 | SAV23.BIN |
0x17 | X table / position 22 | No |
0x18 | X table / position 29 | No |
0x19 | X table / position 19 | No |
0x1A | X table / position 32 | No |
0x1B | X table / position 9 | No |
0x1C | X table / position 39 | No |
0x1D | X table / position 50 | No |
0x1E | X table / position 57 | No |
0x1F | X table / position 7 | No |
0x20 | X table / position 53 | No |
Y table
Dont forget this table... uses something similar