Talk:PARAM.PFD: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (→‎Header: note)
m (request filled)
 
(11 intermediate revisions by 4 users not shown)
Line 1: Line 1:
[https://www.sendspace.com/file/jmo0do pfd_sfo_tools_code by flat_z]
== Sperimental PFD Reader ==
== Sperimental PFD Reader ==
To compile it just place it inside the ps3tools folder and add '''pfd''' into the makefile  in the last '''TOOLS +=''' line [[User:Deroad|Deroad]] 20:09, 15 July 2012 (MSK)


[http://pastie.org/private/hcir9ukjmdqaj3pccs7xw pfd.c]
Link: [http://pastie.org/private/hcir9ukjmdqaj3pccs7xw pfd.c]
 
to compile it just place it inside the ps3tools folder and add '''pfd''' into the makefile  in the last '''TOOLS +=''' line
 
[[User:Deroad|Deroad]] 20:09, 15 July 2012 (MSK)


----
== Other Sources ==
 
*Xploder PS3
The guys at http://us.xploder.net are the first ones that reversed the .PFD structure/encryption/signing
The guys at http://us.xploder.net are the first ones that reversed the .PFD structure/encryption/signing. By reversing what this disc does we can understand the decryption method


His "Xploder PS3 Cheats System" (is a disc intended to be used in PC) is able to decrypt and reencrypt .PFD files in a PC
His "Xploder PS3 Cheats System" (is a disc intended to be used in PC) is able to decrypt and reencrypt .PFD files in a PC
Line 15: Line 14:
In difference with the previous cheat hacks as (Code Freak, PS3UserCheat, E3 GoldenFinger, P3Go Cheat, PS3 Cheat Enabler) this old methods depends of a dongle that patches the firmware to bypass the .PFD checks
In difference with the previous cheat hacks as (Code Freak, PS3UserCheat, E3 GoldenFinger, P3Go Cheat, PS3 Cheat Enabler) this old methods depends of a dongle that patches the firmware to bypass the .PFD checks


 
==Example Files==
By reversing what this disc does we can understand the decryption method
 
----


Just a collection of PARAM (.bin .pfd .sfo .tpf) files: http://www.mirrorcreator.com/files/0OAXGOHN/PARAM.rar_links
Just a collection of PARAM (.bin .pfd .sfo .tpf) files: http://www.mirrorcreator.com/files/0OAXGOHN/PARAM.rar_links
Line 24: Line 20:




==PARAM.PFD Structure generation process==
*This is more than speculation, is a representation of how mirror's edge PARAM.PFD was generated, and how the index numbers are used to "jump" to the next one. I did this table weeks ago, and there was something wrong i realized at the end but thanks to it i understood how the PARAM.PFD is generated using timestamps, probably the table is wrong (because the mirror's edge file im using as example has been updated several times by his owner) but we need to use something like this to order them also it can help others


From files timestamps----->to----->PARAM.PFD


 
Last time modifyed timestamp
==This is a VERY USEFUL game save==
http://db.gamefaqs.com/console/ps3/save/mirror_s_edge.zip
 
The structure of this PARAM.PFD can be considered "rare", and is perfect to be used for explains and to understand how it works, the structure contains all the "problems" not present in "standard" files that can be considered unknown... there are other game saves that can be used (MotoGP10, Heavy rain)... but the list of protected files in heavy rain is HUGE (use this file if you are coding an app as a "stress test", but not for examples)
 
From now on... lest use the PARAM.PFD from "mirror's edge "game save" for the examples in the main page
 
===Header===
 
0000  00 00 00 00 50 46 44 42  00 00 00 00 00 00 00 03 |....PFDB........|
0010  69 15 2C 97 81 2B 25 C5  2A D4 FA 18 E4 B8 16 A8 |i.,..+%.*.......|
0020  7C 1F 5C 28 A7 EE 4D 39  22 AD C8 28 E6 CD 78 88 ||.\(..M9"..(..x.|
0030  98 0F 33 B6 23 94 EE E9  97 06 77 4E 71 91 24 13 |..3.#.....wNq.$.|
0040  A7 CF DB E5 E3 8E 8D 0C  5B CF 88 07 FC B7 B5 9C |........[.......|
0050  4C 5A 3D 98 39 04 B6 CE  ED E2 71 52 AA 9C 2F 85 |LZ=.9.....qR../.|
0060  00 00 00 00 00 00 00 39  00 00 00 00 00 00 00 72 |.......9.......r|
0070  00 00 00 00 00 00 00 21                          |.......!
 
{| class="wikitable"
|-
! Offset !! Size !! Value !! Description
|-
| 0x00 || 0x08 bytes || PFDB || Magic value in ASCII
|-
| 0x08 || 0x08 bytes || 00000000 00000003 || constant
|-
| 0x10 || 0x10 bytes || 69152C97 812B25C5 2AD4FA18 E4B816A8 || key to en/decrypt
|-
| 0x20 || 0x14 bytes || 7C1F5C28 A7EE4D39 22ADC828 E6CD7888 980F33B6 || encrypted, decrypted by vtrm
|-
| 0x34 || 0x14 bytes || 2394EEE9 9706774E 71912413 A7CFDBE5 E38E8D0C || encrypted, decrypted by vtrm
|-
| 0x48 || 0x14 bytes || 5BCF8807 FCB7B59C 4C5A3D98 3904B6CE EDE27152 || encrypted, decrypted by vtrm
|-
| 0x5C || 0x04 bytes || AA9C2F85 || padding, encrypted by vtrm
|-
| 0x60 || 0x08 bytes || 0000000000000039 || Number of reserved entries in the '''X table''' & '''Y table''' (57 in decimal)
|-
| 0x68 || 0x08 bytes || 0000000000000072 || Number of reserved entries in the '''Protected files table''' (114 in decimal)
|-
| 0x70 || 0x08 bytes || 0000000000000021 || Number of used entries in the '''Protected files table''' (33 in decimal)
|-
|}
 
*Note
The last 3 entries in this table probably are not part of the header... probably must be considered as the "header of the next table", but by now is more simple to explain the structure this way, and is not a big problem to fix later
 
===X table===
 
0070                          00 00 00 00 00 00 00 72          .......r|
0080  00 00 00 00 00 00 00 '''01'''  00 00 00 00 00 00 00 72  |...............r|
0090  00 00 00 00 00 00 00 '''0C'''  00 00 00 00 00 00 00 72  |...............r|
00a0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''1F'''  |.......r........|
00b0  00 00 00 00 00 00 00 '''10'''  00 00 00 00 00 00 00 '''1B'''  |................|
00c0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''14'''  |.......r........|
00d0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
00e0  00 00 00 00 00 00 00 '''0B'''  00 00 00 00 00 00 00 '''0D'''  |................|
00f0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
0100  00 00 00 00 00 00 00 '''15'''  00 00 00 00 00 00 00 '''19'''  |................|
0110  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''13'''  |.......r........|
0120  00 00 00 00 00 00 00 '''17'''  00 00 00 00 00 00 00 72  |...............r|
0130  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''0E'''  |.......r........|
0140  00 00 00 00 00 00 00 '''11'''  00 00 00 00 00 00 00 72  |...............r|
0150  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''18'''  |.......r........|
0160  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
0170  00 00 00 00 00 00 00 '''1A'''  00 00 00 00 00 00 00 '''12'''  |................|
0180  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
0190  00 00 00 00 00 00 00 '''04'''  00 00 00 00 00 00 00 72  |...............r|
01a0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''1C'''  |.......r.......r|
01b0  00 00 00 00 00 00 00 '''07'''  00 00 00 00 00 00 00 72  |...............r|
01c0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
01d0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
01e0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''03'''  |.......r........|
01f0  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 72  |.......r.......r|
0200  00 00 00 00 00 00 00 '''1D'''  00 00 00 00 00 00 00 72  |...............r|
0210  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''20'''  |.......r........|
0220  00 00 00 00 00 00 00 '''0F'''  00 00 00 00 00 00 00 72  |...............r|
0230  00 00 00 00 00 00 00 72  00 00 00 00 00 00 00 '''1E'''  |.......r........|
 
In this table there are 25 entries "indexed"
 
{| class="wikitable"
|-
! Position in table !! Virtual Index ID
|-
| 1 || {{No}}
|-
| 2 || 0x01
|-
| 3 || {{No}}
|-
| 4 || 0x0C
|-
| 5 || {{No}}
|-
| 6 || {{No}}
|-
| 7 || 0x1F
|-
| 8 || 0x10
|-
| 9 || 0x1B
|-
| 10 || {{No}}
|-
| 11 || 0x14
|-
| 12 || {{No}}
|-
| 13 || {{No}}
|-
| 14 || 0x0B
|-
| 15 || 0x0D
|-
| 16 || {{No}}
|-
| 17 || {{No}}
|-
| 18 || 0x15
|-
| 19 || 0x19
|-
| 20 || {{No}}
|-
| 21 || 0x13
|-
| 22 || 0x17
|-
| 23 || {{No}}
|-
| 24 || {{No}}
|-
| 25 || 0x0E
|-
| 26 || 0x11
|-
| 27 || {{No}}
|-
| 28 || {{No}}
|-
| 29 || 0x18
|-
| 30 || {{No}}
|-
| 31 || {{No}}
|-
| 32 || 0x1A
|-
| 33 || 0x12
|-
| 34 || {{No}}
|-
| 35 || {{No}}
|-
| 36 || 0x04
|-
| 37 || {{No}}
|-
| 38 || {{No}}
|-
| 39 || 0x1C
|-
| 40 || 0x07
|-
| 41 || {{No}}
|-
| 42 || {{No}}
|-
| 43 || {{No}}
|-
| 44 || {{No}}
|-
| 45 || {{No}}
|-
| 46 || {{No}}
|-
| 47 || 0x03
|-
| 48 || {{No}}
|-
| 49 || {{No}}
|-
| 50 || 0x1D
|-
| 51 || {{No}}
|-
| 52 || {{No}}
|-
| 53 || 0x20
|-
| 54 || 0x0F
|-
| 55 || {{No}}
|-
| 56 || {{No}}
|-
| 57 || 0x1E
|-
|}
 
===Protected files table===
 
And the other 8 "indexed" are in this table


{| class="wikitable"
{| class="wikitable"
|-
|-
! Position in table !! Virtual Index ID !! File Name !! Unknown !! Certificate !! File Size
! Timestamp !! File Name (by timestamp) !! Next jump offset from Xtable !! Next jump offset from Filetable !! Generated table
|-
|-
| 1 || {{No}} || PARAM.SFO || 00568CD8 || longer than others || 00000AB0
| rowspan="2" style="background-color:#DDDDDD;" | 2009/06/14 7:20:12 || PARAM.SFO || 0x72 + 0x01 || {{no}} || PARAM.SFO
|-
|-
| 2 || {{No}} || SAVTOC0.BIN || 00568CD8 || || 0000058C
| SAVTOC0.BIN || 0x72 + 0x0C || {{no}} || SAVTOC0.BIN
|-
|-
| 3 || {{No}} || SAV33.BIN || 00568CD8 || || 00000584
| rowspan="12" style="background-color:#DDDDDD;" | 2009/06/14 7:20:14 || SAV0.BIN || ?? || 0x06 || SAV33.BIN
|-
|-
| 4 || {{No}} || SAV14.BIN || 00568CD8 || || 00009543
| SAV3.BIN || 0x72 + 0x72 + 0x1F || {{no}} || SAV14.BIN  
|-
|-
| 5 || {{No}} || SAV3.BIN || 00568CD8 || || 0000848F
| SAV5.BIN || 0x10 || {{no}} || SAV3.BIN  
|-
|-
| 6 || {{No}} || SAV22.BIN || 00568CD8 || || 00008221
| SAV6.BIN || 0x1B || {{no}} || SAV22.BIN  
|-
|-
| 7 || {{No}} || SAV21.BIN || 00568CD8 || || 00009D66
| SAV7.BIN || 0x72 + 0x14 || {{no}} || SAV21.BIN  
|-
|-
| 8 || {{No}} || SAV13.BIN || 00568CD8 || || 00009EF5
| SAV8.BIN || 0x72 + 0x72 + 0x0B || {{no}} || SAV13.BIN  
|-
|-
| 9 || {{No}} || SAV5.BIN || 00568CD8 || || 0000CD1B
| SAV13.BIN || 0x0D || {{no}} || SAV5.BIN  
|-
|-
| 10 || {{No}} || SAV6.BIN || 00568CD8 || || 0000B3AF
| SAV14.BIN || 0x72 + 0x72 + 0x15 || {{no}} || SAV6.BIN  
|-
|-
| 11 || {{No}} || SAV7.BIN || 00568CD8 || || 00008266
| SAV16.BIN || 0x19 || {{no}} || SAV7.BIN  
|-
|-
| 12 || {{No}} || SAV8.BIN || 00568CD8 || || 00007618
| SAV21.BIN || 0x72 + 0x13 || {{no}} || SAV8.BIN  
|-
|-
| 13 || {{No}} || SAV16.BIN || 00568CD8 || || 0000B95A
| SAV22.BIN || 0x17 || {{no}} || SAV16.BIN  
|-
|-
| 14 || 0x06 || SAV0.BIN || 00568CD8 || || 00009F4D
| SAV33.BIN || 0x72 + 0x72 + 0x0E || {{no}} || SAV0.BIN
|-
|-
| 15 || {{No}} || SAV19.BIN || 00568CD8 || || 0000A11B
| rowspan="19" style="background-color:#DDDDDD;" | 2009/06/14 7:20:16  || SAV1.BIN || ??? || 0x05 || SAV19.BIN
|-
|-
| 16 || {{No}} || SAV15.BIN || 00568CD8 || || 0000CC00
| SAV2.BIN || 0x11 || {{no}} || SAV15.BIN  
|-
|-
| 17 || {{No}} || SAV20.BIN || 00568CD8 || || 000109F0
| SAV9.BIN || 0x72 + 0x72 + 0x18 || {{no}} || SAV20.BIN  
|-
|-
| 18 || {{No}} || SAV11.BIN || 00568CD8 || || 00009C0A
| SAV10.BIN || 0x72 + 0x72 + 0x1A || {{no}} || SAV11.BIN  
|-
|-
| 19 || {{No}} || SAV12.BIN || 00568CD8 || || 0000948D
| SAV11.BIN ||0x12  || {{no}} || SAV12.BIN  
|-
|-
| 20 || {{No}} || SAV9.BIN || 00568CD8 || || 0000C712
| SAV12.BIN || 0x72 + 0x72 + 0x04 || {{no}} || SAV9.BIN  
|-
|-
| 21 || {{No}} || SAV17.BIN || 00568CD8 || || 0000E4FD
| SAV15.BIN || 0x72 + 0x72 + 0x1C || {{no}} || SAV17.BIN  
|-
|-
| 22 || 0x02 || SAV18.BIN || 00568CD8 || || 0000AE4D
| SAV17.BIN || 0x07 || {{no}} || SAV18.BIN
|-
|-
| 23 || {{No}} || SAV2.BIN || 00568CD8 || || 0000CD55
| SAV18.BIN || ??? || 0x02 || SAV2.BIN
|-
|-
| 24 || 0x05 || SAV1.BIN || 00568CD8 || || 000098B3
| SAV19.BIN || 0x72 + 0x72 + 0x72 + 0x72 + 0x72 + 0x72 + 0x03 || {{no}} || SAV1.BIN
|-
|-
| 25 || 0x16 || SAV23.BIN || 00568CD8 || || 00004FBE
| SAV20.BIN || 0x72 + 0x72 + 0x1D || {{no}} || SAV23.BIN
|-
|-
| 26 || {{No}} || SAV10.BIN || 00568CD8 || || 0000ADBD
| SAV23.BIN || ??? || 0x16 || SAV10.BIN
|-
|-
| 27 || {{No}} || SAV35.BIN || 00568CD8 || || 00008E2E
| SAV26.BIN || ??? || 0x08 || SAV35.BIN
|-
|-
| 28 || 0x00 || SAVTOC1.BIN || 00568CD8 || || 00000108
| SAV27.BIN || ??? || 0x09 || SAVTOC1.BIN
|-
|-
| 29 || {{No}} || SAV36.BIN || 00568CD8 || || 00009CBE
| SAV28.BIN || ??? || 0x0A || SAV36.BIN
|-
|-
| 30 || 0x08 || SAV26.BIN || 00568CD8 || || 0000B4D7
| SAV35.BIN || 0x72 + 0x72 + 0x20 || {{no}} || SAV26.BIN
|-
|-
| 31 || 0x09 || SAV27.BIN || 00568CD8 || || 00009FD1
| SAV36.BIN || 0x0F || {{no}} || SAV27.BIN
|-
|-
| 32 || 0x0A || SAV28.BIN || 00568CD8 || || 00007D73
| SAV38.BIN || 0x72 + 0x72 + 0x1E || {{no}} || SAV28.BIN
|-
|-
| 33 || {{No}} || SAV38.BIN || 00568CD8 || || 0000D401
| SAVTOC1.BIN || ??? || 0x00 || SAV38.BIN
|-
| Up to 114 || {{No}} || {{No}} || {{No}} || {{No}} || {{No}}
|-
|-
|}
|}


 
*The problem is the timestamps of the "protected files" changed when the owner of this game save updated it (we must suppose he did lot of times). Its needed to understand if this update process rebuilds all the tables reasigning the "index nº's" or if the positions of the "protected files" are moved inside "protected files table". Also is needed to verify how new files are added to the "protected files table" when the game generate new ones. To verify all this is needed to begin with a "fresh created" game save, understand how has been built, and compare how it changes after several updates, this is where i stopped ;)
 
*This means the examples from this mirror's edge game save (downloaded from gamefaq) are not enought to explain how it works, are needed at least 3 different game saves generated by the same user in the same ps3, or in other words... all the examples must be replaced :/
===Y table===
**1.- A copy of the folder the first time the game save is generated (copyed from hdd, NOT exported to usb)
Dont forget this table... uses something similar
**2.- A copy of the folder after a "normal" update (no new files are added to the "protected files table")
 
**2.- A copy of the folder after a "special" update (new files are added to the "protected files table")
Is in direct relationship with the '''X table'''... the positions of the entries used are the same in both tables
**This completes all the behaviours/functions possibles for PARAM.PFD related with his creation/updates
 
When a entry in this table is not used is "marked" with a "standard" value... for mirror's edge game save is: '''5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0'''
 
{| class="wikitable"
|-
! Position in table !! ???
|-
| 1 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 2 || other
|-
| 3 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 4 || other
|-
| 5 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 6 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 7 || other
|-
| 8 || other
|-
| 9 || other
|-
| 10 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 11 || other
|-
| 12 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 13 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 14 || other
|-
| 15 || other
|-
| 16 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 17 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 18 || other
|-
| 19 || other
|-
| 20 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 21 || other
|-
| 22 || other
|-
| 23 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 24 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 25 || other
|-
| 26 || other
|-
| 27 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 28 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 29 || other
|-
| 30 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 31 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 32 || other
|-
| 33 || other
|-
| 34 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 35 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 36 || other
|-
| 37 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 38 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 39 || other
|-
| 40 || other
|-
| 41 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 42 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 43 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 44 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 45 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 46 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 47 || other
|-
| 48 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 49 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 50 || other
|-
| 51 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 52 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 53 || other
|-
| 54 || other
|-
| 55 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 56 || 5A7EAF6D 029992D0 7580EBCA 42698114 9F2C5DF0
|-
| 57 || other
|-
|}
 
A screencapture of this table with the width fixed (each entry is one row)... there is a total of 57 entries, 25 of them used
 
http://img6.imagebanana.com/img/q82sh1dj/Ytablemirrorsedge.jpg
 
==The "virtual index"==
The addition of the "indexed" entries in this tables makes the total of '''33 protected files'''... are "indexed" by spreading his ID numbers between "X table" and "protected files table"
 
Ok... more tables... this is the "virtual index" that we have if we place all the entries from the 2 tables together, and ordered by his ID number. This makes a total of 33 "indexed files":
 
{| class="wikitable"
|-
! Virtual Index ID !! Placement/position !! File Name
|-
| 0x00 || protected files table / position 28 || SAVTOC1.BIN
|-
| 0x01 || X table / position 2 || {{No}}
|-
| 0x02 || protected files table / position 22 || SAV18.BIN
|-
| 0x03 ||  X table / position 47 || {{No}}
|-
| 0x04 ||  X table / position 36 || {{No}}
|-
| 0x05 || protected files table / position 24 || SAV1.BIN
|-
| 0x06 || protected files table / position 14 || SAV0.BIN
|-
| 0x07 || X table / position 40 ||  {{No}}
|-
| 0x08 || protected files table / position 30 || SAV26.BIN
|-
| 0x09 || protected files table / position 31 || SAV27.BIN
|-
| 0x0A || protected files table / position 32 || SAV28.BIN
|-
| 0x0B || X table / position 14 || {{No}}
|-
| 0x0C ||  X table / position 4 || {{No}}
|-
| 0x0D ||  X table / position 15 || {{No}}
|-
| 0x0E ||  X table / position 25 || {{No}}
|-
| 0x0F ||  X table / position 54 || {{No}}
|-
| 0x10 ||  X table / position 8 || {{No}}
|-
| 0x11 ||  X table / position 26 || {{No}}
|-
| 0x12 ||  X table / position 33 || {{No}}
|-
| 0x13 ||  X table / position 21 || {{No}}
|-
| 0x14 ||  X table / position 11 || {{No}}
|-
| 0x15 ||  X table / position 18 || {{No}}
|-
| 0x16 || protected files table / position 25 || SAV23.BIN
|-
| 0x17 ||  X table / position 22 || {{No}}
|-
| 0x18 ||  X table / position 29 || {{No}}
|-
| 0x19 ||  X table / position 19 || {{No}}
|-
| 0x1A ||  X table / position 32 || {{No}}
|-
| 0x1B ||  X table / position 9 || {{No}}
|-
| 0x1C ||  X table / position 39 || {{No}}
|-
| 0x1D ||  X table / position 50 || {{No}}
|-
| 0x1E ||  X table / position 57 || {{No}}
|-
| 0x1F ||  X table / position 7 || {{No}}
|-
| 0x20 ||  X table / position 53 || {{No}}
|-
|}

Latest revision as of 19:12, 5 November 2015

pfd_sfo_tools_code by flat_z

Sperimental PFD Reader[edit source]

To compile it just place it inside the ps3tools folder and add pfd into the makefile in the last TOOLS += line Deroad 20:09, 15 July 2012 (MSK)

Link: pfd.c

Other Sources[edit source]

  • Xploder PS3

The guys at http://us.xploder.net are the first ones that reversed the .PFD structure/encryption/signing. By reversing what this disc does we can understand the decryption method

His "Xploder PS3 Cheats System" (is a disc intended to be used in PC) is able to decrypt and reencrypt .PFD files in a PC

In difference with the previous cheat hacks as (Code Freak, PS3UserCheat, E3 GoldenFinger, P3Go Cheat, PS3 Cheat Enabler) this old methods depends of a dongle that patches the firmware to bypass the .PFD checks

Example Files[edit source]

Just a collection of PARAM (.bin .pfd .sfo .tpf) files: http://www.mirrorcreator.com/files/0OAXGOHN/PARAM.rar_links


PARAM.PFD Structure generation process[edit source]

  • This is more than speculation, is a representation of how mirror's edge PARAM.PFD was generated, and how the index numbers are used to "jump" to the next one. I did this table weeks ago, and there was something wrong i realized at the end but thanks to it i understood how the PARAM.PFD is generated using timestamps, probably the table is wrong (because the mirror's edge file im using as example has been updated several times by his owner) but we need to use something like this to order them also it can help others

From files timestamps----->to----->PARAM.PFD

Last time modifyed timestamp

Timestamp File Name (by timestamp) Next jump offset from Xtable Next jump offset from Filetable Generated table
2009/06/14 7:20:12 PARAM.SFO 0x72 + 0x01 No PARAM.SFO
SAVTOC0.BIN 0x72 + 0x0C No SAVTOC0.BIN
2009/06/14 7:20:14 SAV0.BIN ?? 0x06 SAV33.BIN
SAV3.BIN 0x72 + 0x72 + 0x1F No SAV14.BIN
SAV5.BIN 0x10 No SAV3.BIN
SAV6.BIN 0x1B No SAV22.BIN
SAV7.BIN 0x72 + 0x14 No SAV21.BIN
SAV8.BIN 0x72 + 0x72 + 0x0B No SAV13.BIN
SAV13.BIN 0x0D No SAV5.BIN
SAV14.BIN 0x72 + 0x72 + 0x15 No SAV6.BIN
SAV16.BIN 0x19 No SAV7.BIN
SAV21.BIN 0x72 + 0x13 No SAV8.BIN
SAV22.BIN 0x17 No SAV16.BIN
SAV33.BIN 0x72 + 0x72 + 0x0E No SAV0.BIN
2009/06/14 7:20:16 SAV1.BIN ??? 0x05 SAV19.BIN
SAV2.BIN 0x11 No SAV15.BIN
SAV9.BIN 0x72 + 0x72 + 0x18 No SAV20.BIN
SAV10.BIN 0x72 + 0x72 + 0x1A No SAV11.BIN
SAV11.BIN 0x12 No SAV12.BIN
SAV12.BIN 0x72 + 0x72 + 0x04 No SAV9.BIN
SAV15.BIN 0x72 + 0x72 + 0x1C No SAV17.BIN
SAV17.BIN 0x07 No SAV18.BIN
SAV18.BIN ??? 0x02 SAV2.BIN
SAV19.BIN 0x72 + 0x72 + 0x72 + 0x72 + 0x72 + 0x72 + 0x03 No SAV1.BIN
SAV20.BIN 0x72 + 0x72 + 0x1D No SAV23.BIN
SAV23.BIN ??? 0x16 SAV10.BIN
SAV26.BIN ??? 0x08 SAV35.BIN
SAV27.BIN ??? 0x09 SAVTOC1.BIN
SAV28.BIN ??? 0x0A SAV36.BIN
SAV35.BIN 0x72 + 0x72 + 0x20 No SAV26.BIN
SAV36.BIN 0x0F No SAV27.BIN
SAV38.BIN 0x72 + 0x72 + 0x1E No SAV28.BIN
SAVTOC1.BIN ??? 0x00 SAV38.BIN
  • The problem is the timestamps of the "protected files" changed when the owner of this game save updated it (we must suppose he did lot of times). Its needed to understand if this update process rebuilds all the tables reasigning the "index nº's" or if the positions of the "protected files" are moved inside "protected files table". Also is needed to verify how new files are added to the "protected files table" when the game generate new ones. To verify all this is needed to begin with a "fresh created" game save, understand how has been built, and compare how it changes after several updates, this is where i stopped ;)
  • This means the examples from this mirror's edge game save (downloaded from gamefaq) are not enought to explain how it works, are needed at least 3 different game saves generated by the same user in the same ps3, or in other words... all the examples must be replaced :/
    • 1.- A copy of the folder the first time the game save is generated (copyed from hdd, NOT exported to usb)
    • 2.- A copy of the folder after a "normal" update (no new files are added to the "protected files table")
    • 2.- A copy of the folder after a "special" update (new files are added to the "protected files table")
    • This completes all the behaviours/functions possibles for PARAM.PFD related with his creation/updates
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:PARAM.PFD&oldid=39586"