PRX File Format: Difference between revisions
Jump to navigation
Jump to search
m (Add missing tags, and note about PRX type 9/10 ECDSA) |
|||
| (8 intermediate revisions by 5 users not shown) | |||
| Line 9: | Line 9: | ||
| 0x0 || 4 || Magic || ~PSP | | 0x0 || 4 || Magic || ~PSP | ||
|- | |- | ||
| 0x6 || 2 || Compression Type || 0x300-Plain, 0x200-KL4E, 0x100-2RLZ, 0x000-GZIP Little endian u16 & | | 0x6 || 2 || Compression Type || 0x300-Plain, 0x200-KL4E, 0x100-2RLZ, 0x000-GZIP Little endian u16 & 0xF00 | ||
|- | |||
| 0x28 || 4 || Plaintext Size (ELF) || Little endian u32 | |||
|- | |- | ||
| 0x2C || 4 || Total Size || Little endian u32 | | 0x2C || 4 || Total Size || Little endian u32 | ||
|- | |||
| 0x34 || 4 || Filetype || if ((s32)(header+0x34) >=0) (Determines if user (positive) or kernel (negative) ) | |||
|- | |- | ||
| 0xD0 || 4 || Key Tag Type || Little endian u32 | | 0xD0 || 4 || Key Tag Type || Little endian u32 | ||
|- | |||
| 0x7C || 1 || Encryption Type || 0 - internal / 1 - ??? / 2 - supported by multiloader / 3 - Used by vshmain (???) | |||
|- | |- | ||
|} | |} | ||
= PRX Types & Tags = | |||
Reversed by Linblow | |||
Extracted from the mesg_led_02g kernel module (firmware<code>6.61</code>model <code>02g</code>). | |||
=== PSP header v1 (0/1/8) === | |||
Use PSP header structure v1. | |||
Primary key size: <code>144</code> bytes. | |||
No secondary key, and no secure ID. | |||
Type 0: 03000000 (mode: 4 USER_MODULE) | |||
Type 0: 04000000 (mode: 5) | |||
Type 0: 05000000 (mode: 6) | |||
Type 0: 06000000 (mode: 7 PSAR_DEVTOOL) | |||
Type 0: 08000000 (mode: 9 UMD_GAME_EXEC) | |||
Type 0: 09000000 (mode: 10 GAMESHARING_EXEC) | |||
Type 0: 0A000000 (mode: 11 GAMESHARING_EXEC_DEVTOOL) | |||
Type 0: 0C000000 (mode: 13 DEMO_EXEC) | |||
Type 0: 0D000000 (mode: 14 APP_MODULE) | |||
Type 0: 0E000000 (mode: 15 PSAR_RETAIL) | |||
Type 0: 0F000000 (mode: 16 ME_IMAGE) | |||
Type 1: 3ACE4DCE (mode: 4 USER_MODULE) | |||
Type 1: C0CB167C (mode: 9 UMD_GAME_EXEC) | |||
Type 1: BB67C59F (mode: 10 GAMESHARING_EXEC) | |||
Type 1: 7F24BDCD (mode: 13 DEMO_EXEC) | |||
Type 1: 1BC8D12B (mode: 14 APP_MODULE) | |||
Type 1: 862648D1 (mode: 16 ME_IMAGE) | |||
Type 8: 02000000 (mode: 3 VSH_MODULE) | |||
Type 8: 0B000000 (mode: 12 MS_UPDATER) | |||
=== PSP header v2 === | |||
Use PSP header structure v2. | |||
Primary key size: <code>16</code> bytes. | |||
Secondary key size: <code>16</code> bytes. | |||
Secure ID: type-dependent, <code>16</code> bytes. | |||
==== Type 2/4/6/9 (no secure ID) ==== | |||
Type 2: 457B05F0 (mode: 4 USER_MODULE) | |||
Type 2: 457B06F0 (mode: 4 USER_MODULE) | |||
Type 2: 457B08F0 (mode: 4 USER_MODULE) | |||
Type 2: 457B0AF0 (mode: 4 USER_MODULE) | |||
Type 2: 457B0BF0 (mode: 4 USER_MODULE) | |||
Type 2: 457B0CF0 (mode: 4 USER_MODULE) | |||
Type 2: 457B10F0 (mode: 4 USER_MODULE) | |||
Type 2: 76202403 (mode: 4 USER_MODULE) | |||
Type 2: 628910F0 (mode: 5) | |||
Type 2: 8B9B10F0 (mode: 6) | |||
Type 2: 5A5C10F0 (mode: 7 PSAR_DEVTOOL) | |||
Type 2: E42C2303 (mode: 7 PSAR_DEVTOOL) | |||
Type 2: 8004FD03 (mode: 9 UMD_GAME_EXEC) | |||
Type 2: D91605F0 (mode: 9 UMD_GAME_EXEC) | |||
Type 2: D91606F0 (mode: 9 UMD_GAME_EXEC) | |||
Type 2: D9160AF0 (mode: 9 UMD_GAME_EXEC) | |||
Type 2: D9160BF0 (mode: 9 UMD_GAME_EXEC) | |||
Type 2: D91610F0 (mode: 9 UMD_GAME_EXEC) | |||
Type 2: D91611F0 (mode: 9 UMD_GAME_EXEC) <ref name="resmgr">Resmgr tag '''and''' key ''can'' be overwritten via the game's <code>OPNSSMP.BIN</code> program</ref> | |||
Type 2: 0A35EA03 (mode: 10 GAMESHARING_EXEC) | |||
Type 2: 7B0505F0 (mode: 10 GAMESHARING_EXEC) | |||
Type 2: 7B0506F0 (mode: 10 GAMESHARING_EXEC) | |||
Type 2: 7B0508F0 (mode: 10 GAMESHARING_EXEC) | |||
Type 2: 7B0510F0 (mode: 10 GAMESHARING_EXEC) | |||
Type 2: EFD210F0 (mode: 11 GAMESHARING_EXEC_DEVTOOL) | |||
Type 2: D67B3303 (mode: 13 DEMO_EXEC) | |||
Type 2: D66DF703 (mode: 14 APP_MODULE) | |||
Type 2: 63BAB403 (mode: 15 PSAR_RETAIL) | |||
Type 2: D82310F0 (mode: 15 PSAR_RETAIL) | |||
Type 2: 1B11FD03 (mode: 16 ME_IMAGE) | |||
Type 2: D13B05F0 (mode: 16 ME_IMAGE) | |||
Type 2: D13B06F0 (mode: 16 ME_IMAGE) | |||
Type 2: D13B08F0 (mode: 16 ME_IMAGE) | |||
Type 2: D13B10F0 (mode: 16 ME_IMAGE) | |||
Type 2: 3C2A08F0 (mode: 22) | |||
Type 2: 3C2A10F0 (mode: 22) | |||
Type 4: ADF310F0 (mode: 13 DEMO_EXEC) | |||
Type 4: ADF305F0 (mode: 13 DEMO_EXEC) | |||
Type 4: ADF306F0 (mode: 13 DEMO_EXEC) | |||
Type 4: ADF308F0 (mode: 13 DEMO_EXEC) | |||
Type 4: 279D05F0 (mode: 14 APP_MODULE) | |||
Type 4: 279D06F0 (mode: 14 APP_MODULE) | |||
Type 4: 279D08F0 (mode: 14 APP_MODULE) | |||
Type 4: 279D10F0 (mode: 14 APP_MODULE) | |||
Type 6: 457B80F0 (mode: 4 USER_MODULE) | |||
Type 6: 457B8AF0 (mode: 4 USER_MODULE) | |||
Type 6: D91680F0 (mode: 9 UMD_GAME_EXEC) <ref name="resmgr" /> | |||
Type 9: 380290F0 (mode: 3 VSH_MODULE) | |||
Type 9: 380291F0 (mode: 3 VSH_MODULE) | |||
Type 9: 457B90F0 (mode: 4 USER_MODULE) | |||
Type 9: 457B91F0 (mode: 4 USER_MODULE) | |||
Type 9: 0B2B91F0 (mode: 8 VSH_INDEX_DAT) | |||
Type 9: D91690F0 (mode: 9 UMD_GAME_EXEC) <ref name="resmgr" /> | |||
==== Type 3/5/7/10 (optional secure ID) ==== | |||
Type 3: 89742B04 (mode: 18 MS_DNAS_DRMBB) | |||
Type 3: E92408F0 (mode: 18 MS_DNAS_DRMBB) | |||
Type 3: E92410F0 (mode: 18 MS_DNAS_DRMBB) | |||
Type 3: 692808F0 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) | |||
Type 3: 692810F0 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) | |||
Type 3: F5F12304 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) | |||
Type 5: 0DAA06F0 (mode: 20 POPS_EXEC) | |||
Type 5: 0DAA10F0 (mode: 20 POPS_EXEC) | |||
Type 5: E1ED06F0 (mode: 21) | |||
Type 5: E1ED10F0 (mode: 21) | |||
Type 5: 407810F0 (mode: 23) | |||
Type 5: 2E5E10F0 (mode: 25 MS_BOOT_PATCH) | |||
Type 5: 2E5E11F0 (mode: 25 MS_BOOT_PATCH) <ref name="resmgr" /> | |||
Type 7: 2E5E80F0 (mode: 25 MS_BOOT_PATCH) <ref name="resmgr" /> | |||
Type 10: 2E5E90F0(mode: 25 MS_BOOT_PATCH) <ref name="resmgr" /> | |||
==== Notes ==== | |||
PRX type 9 and 10 also have an early ECDSA signature check in the decryption routine (mesg_led). | |||
The [[Keys#PRX_type_9_and_10_Keys|public key used for the signature check]] depends on the PRX tag. | |||
Since the corresponding ECDSA private keys are unknown, we cannot create legit type 9/10 PRX. | |||
Latest revision as of 11:48, 29 January 2024
Structure of the PRX Goes as follows
PRX File Format Structure[edit | edit source]
| Offset | Size | Description | Notes |
|---|---|---|---|
| 0x0 | 4 | Magic | ~PSP |
| 0x6 | 2 | Compression Type | 0x300-Plain, 0x200-KL4E, 0x100-2RLZ, 0x000-GZIP Little endian u16 & 0xF00 |
| 0x28 | 4 | Plaintext Size (ELF) | Little endian u32 |
| 0x2C | 4 | Total Size | Little endian u32 |
| 0x34 | 4 | Filetype | if ((s32)(header+0x34) >=0) (Determines if user (positive) or kernel (negative) ) |
| 0xD0 | 4 | Key Tag Type | Little endian u32 |
| 0x7C | 1 | Encryption Type | 0 - internal / 1 - ??? / 2 - supported by multiloader / 3 - Used by vshmain (???) |
PRX Types & Tags[edit | edit source]
Reversed by Linblow
Extracted from the mesg_led_02g kernel module (firmware6.61model 02g).
PSP header v1 (0/1/8)[edit | edit source]
Use PSP header structure v1.
Primary key size: 144 bytes.
No secondary key, and no secure ID.
Type 0: 03000000 (mode: 4 USER_MODULE) Type 0: 04000000 (mode: 5) Type 0: 05000000 (mode: 6) Type 0: 06000000 (mode: 7 PSAR_DEVTOOL) Type 0: 08000000 (mode: 9 UMD_GAME_EXEC) Type 0: 09000000 (mode: 10 GAMESHARING_EXEC) Type 0: 0A000000 (mode: 11 GAMESHARING_EXEC_DEVTOOL) Type 0: 0C000000 (mode: 13 DEMO_EXEC) Type 0: 0D000000 (mode: 14 APP_MODULE) Type 0: 0E000000 (mode: 15 PSAR_RETAIL) Type 0: 0F000000 (mode: 16 ME_IMAGE) Type 1: 3ACE4DCE (mode: 4 USER_MODULE) Type 1: C0CB167C (mode: 9 UMD_GAME_EXEC) Type 1: BB67C59F (mode: 10 GAMESHARING_EXEC) Type 1: 7F24BDCD (mode: 13 DEMO_EXEC) Type 1: 1BC8D12B (mode: 14 APP_MODULE) Type 1: 862648D1 (mode: 16 ME_IMAGE) Type 8: 02000000 (mode: 3 VSH_MODULE) Type 8: 0B000000 (mode: 12 MS_UPDATER)
PSP header v2[edit | edit source]
Use PSP header structure v2.
Primary key size: 16 bytes.
Secondary key size: 16 bytes.
Secure ID: type-dependent, 16 bytes.
Type 2/4/6/9 (no secure ID)[edit | edit source]
Type 2: 457B05F0 (mode: 4 USER_MODULE) Type 2: 457B06F0 (mode: 4 USER_MODULE) Type 2: 457B08F0 (mode: 4 USER_MODULE) Type 2: 457B0AF0 (mode: 4 USER_MODULE) Type 2: 457B0BF0 (mode: 4 USER_MODULE) Type 2: 457B0CF0 (mode: 4 USER_MODULE) Type 2: 457B10F0 (mode: 4 USER_MODULE) Type 2: 76202403 (mode: 4 USER_MODULE) Type 2: 628910F0 (mode: 5) Type 2: 8B9B10F0 (mode: 6) Type 2: 5A5C10F0 (mode: 7 PSAR_DEVTOOL) Type 2: E42C2303 (mode: 7 PSAR_DEVTOOL) Type 2: 8004FD03 (mode: 9 UMD_GAME_EXEC) Type 2: D91605F0 (mode: 9 UMD_GAME_EXEC) Type 2: D91606F0 (mode: 9 UMD_GAME_EXEC) Type 2: D9160AF0 (mode: 9 UMD_GAME_EXEC) Type 2: D9160BF0 (mode: 9 UMD_GAME_EXEC) Type 2: D91610F0 (mode: 9 UMD_GAME_EXEC) Type 2: D91611F0 (mode: 9 UMD_GAME_EXEC) [1] Type 2: 0A35EA03 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0505F0 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0506F0 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0508F0 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0510F0 (mode: 10 GAMESHARING_EXEC) Type 2: EFD210F0 (mode: 11 GAMESHARING_EXEC_DEVTOOL) Type 2: D67B3303 (mode: 13 DEMO_EXEC) Type 2: D66DF703 (mode: 14 APP_MODULE) Type 2: 63BAB403 (mode: 15 PSAR_RETAIL) Type 2: D82310F0 (mode: 15 PSAR_RETAIL) Type 2: 1B11FD03 (mode: 16 ME_IMAGE) Type 2: D13B05F0 (mode: 16 ME_IMAGE) Type 2: D13B06F0 (mode: 16 ME_IMAGE) Type 2: D13B08F0 (mode: 16 ME_IMAGE) Type 2: D13B10F0 (mode: 16 ME_IMAGE) Type 2: 3C2A08F0 (mode: 22) Type 2: 3C2A10F0 (mode: 22) Type 4: ADF310F0 (mode: 13 DEMO_EXEC) Type 4: ADF305F0 (mode: 13 DEMO_EXEC) Type 4: ADF306F0 (mode: 13 DEMO_EXEC) Type 4: ADF308F0 (mode: 13 DEMO_EXEC) Type 4: 279D05F0 (mode: 14 APP_MODULE) Type 4: 279D06F0 (mode: 14 APP_MODULE) Type 4: 279D08F0 (mode: 14 APP_MODULE) Type 4: 279D10F0 (mode: 14 APP_MODULE) Type 6: 457B80F0 (mode: 4 USER_MODULE) Type 6: 457B8AF0 (mode: 4 USER_MODULE) Type 6: D91680F0 (mode: 9 UMD_GAME_EXEC) [1] Type 9: 380290F0 (mode: 3 VSH_MODULE) Type 9: 380291F0 (mode: 3 VSH_MODULE) Type 9: 457B90F0 (mode: 4 USER_MODULE) Type 9: 457B91F0 (mode: 4 USER_MODULE) Type 9: 0B2B91F0 (mode: 8 VSH_INDEX_DAT) Type 9: D91690F0 (mode: 9 UMD_GAME_EXEC) [1]
Type 3/5/7/10 (optional secure ID)[edit | edit source]
Type 3: 89742B04 (mode: 18 MS_DNAS_DRMBB) Type 3: E92408F0 (mode: 18 MS_DNAS_DRMBB) Type 3: E92410F0 (mode: 18 MS_DNAS_DRMBB) Type 3: 692808F0 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) Type 3: 692810F0 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) Type 3: F5F12304 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) Type 5: 0DAA06F0 (mode: 20 POPS_EXEC) Type 5: 0DAA10F0 (mode: 20 POPS_EXEC) Type 5: E1ED06F0 (mode: 21) Type 5: E1ED10F0 (mode: 21) Type 5: 407810F0 (mode: 23) Type 5: 2E5E10F0 (mode: 25 MS_BOOT_PATCH) Type 5: 2E5E11F0 (mode: 25 MS_BOOT_PATCH) [1] Type 7: 2E5E80F0 (mode: 25 MS_BOOT_PATCH) [1] Type 10: 2E5E90F0(mode: 25 MS_BOOT_PATCH) [1]
Notes[edit | edit source]
PRX type 9 and 10 also have an early ECDSA signature check in the decryption routine (mesg_led).
The public key used for the signature check depends on the PRX tag.
Since the corresponding ECDSA private keys are unknown, we cannot create legit type 9/10 PRX.