Resource Container CXML (RCO, QRC, Theme Files, RAF, CXML)

RCO

• In PSvita the RCO's uses a cxml structure, with a header size of 0x50 and the magic identifyer RCOF
  • RCOF header is 0x10 bytes bigger than any cxml header in PS3 (this means there are 2 new tables added for the new cxml variant used in vita rco's). And endianess changed
  • Some of the extracted files (after cropped and zlib decompressed) are another variant of a cxml structure with identifyer RCSF. After a second extraction (with a cxml decompiler tool) the resulting file is a .xml containing only text strings (this double cxml method is used for .xml files that stores language translations)

Simply Vita RCO Extractor

Some RCO as Reference

notification_settings_plugin.rco (PSvita)

Offset	Size	Example	Name	Notes
CXML Header
0x00	0x04	RCOF	Magic
0x04	0x04	10 01 00 00	Version
0x08	0x04	50 00 00 00	Tree absolute start offset, also header size	in PS3 = Tree absolute start offset
0x0C	0x04	2C 15 00 00	Tree size	in PS3 = Tree size
0x10	0x04	80 15 00 00	ID table absolute start offset	in PS3 = ID table absolute start offset
0x14	0x04	B0 00 00 00	ID table size	in PS3 = ID table size
0x18	0x04	30 16 00 00	---------- unknown table 1 ----------	in PS3 = Strings table absolute start offset
0x1C	0x04	98 00 00 00	---------- unknown table 1 size ----------	in PS3 = Strings table size
0x20	0x04	D0 16 00 00	Strings table absolute start offset	in PS3 = Integer array absolute start offset
0x24	0x04	F1 01 00 00	Strings table size	in PS3 = Integer array size
0x28	0x04	D0 18 00 00	overlapped (not used, but present in the header to keep the structure standards)	in PS3 = Float array absolute start offset
0x2C	0x04	00 00 00 00	empty	in PS3 = Float array size
0x30	0x04	D0 18 00 00	---------- unknown table 2 ----------	in PS3 = File table absolute start offset
0x34	0x04	34 00 00 00	---------- unknown table 2 size ----------	in PS3 = File table size
0x38	0x04	10 19 00 00	Integer array absolute start offset	in PS3 = Unknown area absolute start offset
0x3C	0x04	2C 00 00 00	Integer array size	in PS3 = Unknown area size
0x40	0x04	40 19 00 00	Float array absolute start offset	in PS3 = Not present
0x44	0x04	8C 00 00 00	Float array size	in PS3 = Not present
0x48	0x04	D0 19 00 00	File table absolute start offset	in PS3 = Not present
0x4C	0x04	60 89 00 00	File table size	in PS3 = Not present
Tables
0x50	Tree starts here

Attribute

Attribute types structure

Offset	Length	Name	Attribute type
			Integer	Float	String	Integer Array	Float Array	analysing...	ID with ref	File
0x0	0x4	Attribute name offset	________________________________________________ xml tag string from the "strings table" ____________________________________________
0x4	0x4	Attribute type	1	2	3	4	5	6	7	8
0x8	0x4	variable 1	Integer value	Float value	String Offset	Integer Array Offset	Float Array Offset	analysing...	Filename offset	File offset
0xC	0x4	variable 2	unknown (usually 0)	unknown (usually 0)	String Length	Integer count	Float count	analysing...	unknown (usually 0)	File size

Container Common Structure

RCO

ZLIB Compressed level 9 (only container)

RCOF

RCOF (Resources Container Flat?)

• Example from FW?? notification_settings_plugin.rco:

Offset(h) 00 01 02 03 04 05 06 07
00000000  52 43 4F 46 10 01 00 00         RCOF....

Name	Offset	Size	Example	Remark
Magic	0x00	0x04	52 43 4F 46	'RCOF'
?	0x04	0x01	10
Version	0x05	0x01	01	RCO version '0.1'

Zlib Header (source)

byte index	bit 7	bit 6	bit 5	bit 4	bit 3	bit 2	bit 1	bit 0
[0] CMF	Compression info 7 = indicates a 32K window size				Compression method 8 = denotes the "deflate" compression
[1] FLG	FLEVEL 0 - compressor used fastest algorithm 1 - compressor used fast algorithm 2 - compressor used default algorithm 3 - compressor used maximum compression, slowest algorithm		FDICT (Preset dictionary) If set, a DICT dictionary identifier is present immediately after the FLG byte. The dictionary is a sequence of bytes which are initially fed to the compressor without producing any compressed output. DICT is the Adler-32 checksum of this sequence of bytes (see the definition of ADLER32 below). The decompressor can use this identifier to determine which dictionary has been used by the compressor.	FCHECK value must be such that CMF and FLG, when viewed as a 16-bit unsigned integer stored in MSB order (CMF *256 + FLG), is a multiple of 31.

About Data Compression:

• mattmahoney.net/dc/dce.html

Main Header

The header contains an identifier of the container (magic), his version, and allows to store the "absolute start offset" and "size" of 9 tables (or areas)

When a "not used table" is placed before a "used table"... the start offset of the "not used table" and his size (as zero) are stored in the main header to preserve his position in the structure. The "used table" that comes later starts in the same offset than the previously "not used table" (an intuitive way to think in this is imagining are overlapped because starts in the same position but only the one at the top is used)

• The container format is generic (used also by .RAF and .P3T with some variations) so the usage of this tables can vary, in this example there are 3 "not used tables":
  • two of the "not used tables" (both at offset 0x460 with a size of 0) are placed before an used table (also at offset 0x460 but with a size of 0x23A0)
  • the other "not used table" is placed at the end, so there is no need to store his offset