Packages: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
 
 
(8 intermediate revisions by 3 users not shown)
Line 1: Line 1:
PKG files for PSVita are essentially the same structure as PS3 and PSP game PKG files with different AES, RSA and ECC keys.
PKG files for PSVita are essentially the same structure as PS3 and PSP game PKG files with different AES, RSA and ECC keys.


== AES Keys ==
== Algorithm ==
There now are 5 AES keys used for the decryption of game PKG files.


*PSP : <code>{ 0x07, 0xf2, 0xc6, 0x82, 0x90, 0xb5, 0x0d, 0x2c, 0x33, 0x81, 0x8d, 0x70, 0x9b, 0x60, 0xe6, 0x2b};</code>
The overall algorithm is the same as PSP with one exception.
*PS3 : <code>{ 0x2e, 0x7b, 0x71, 0xd7, 0xc9, 0xc9, 0xa1, 0x4e, 0xa3, 0x22, 0x1f, 0x18, 0x88, 0x28, 0xb8, 0xf8};</code>
*PSV2: <code>{ TBD };</code>
*PSV3: <code>{ TBD };</code>
*PSV4: <code>{ TBD };</code>


The overall algorithm is the same as PSP with one exception. On the PSP, the file table and the data is AES CTR encrypted using the 0x10 bytes from offset +0x70 in the file as the IV along with the PSP AES Key. On the PSVita for type 2,3 and 4, they first encrypt the 0x10 bytes at +0x70 to create a new AES session key, then do the normal AES_CTR with +0x70 as the IV and the new session key as the AES CTR key.
[https://www.psdevwiki.com/ps3/PKG_files#File_Header Header struct]


=== Keys ===


At offset +0xE7 in the PKG file is a version byte. This is only in the PSP type PKG files inside the .ext section. If its type 1, the use the PSP key as normal, if its type 2, use the PSV2 key with the new session key step, and if its type 3, use the PSV3, etc.
Some keys are common with PSP and PS3 depending on the type of package.
 
=== PS3 / PSP ===
 
On the PS3/PSP, the file table and the data is AES CTR encrypted using the 0x10 bytes from offset 0x70 in the file as the IV along with the PS3/PSP AES Key.
 
=== PSVita / PSM ===
 
On the PSVita for type 2, 3 and 4, they first encrypt the 0x10 bytes at 0x70 to create a new AES session key, then do the normal AES_CTR with 0x70 as the IV and the new session key as the AES CTR key.
 
=== PKG key id ===
 
At offset 0xE7 in the PKG file is a version byte. This is only in the PSP type PKG files inside the .ext section. If it is type 1, then use the PSP key as normal, if it is type 2, use the PSV2 key with the new session key step, and if its type 3, use the PSV3, etc.


== Installing ==
== Installing ==


Package Installer uses SceNpDrm to decrypt/extract the game package into a temporary directory. Then it calls ScePromoterUtil NID 0x86641BC6 on 1.69 and NID 0x716C81F4 on 1.80+ to "promote" (aka install) the files into the right directory in ux0. ScePromoterUtil is just a wrapper for a SceShellSvc call, so SceShell actually moves the files, then adds the LiveArea bubble and updates app.db accordingly. In theory you can use SceNpDrm and ScePromoterUtil separately and package your games in an alternative format.
Package Installer uses [[SceNpDrm]] to decrypt/extract the game package into a temporary directory. Then it calls [[ScePromoterUtil#scePromoterUtilityPromotePkgWithRif]] on FW 1.69 and [[ScePromoterUtil#scePromoterUtilityPromotePkg]] on FWs 1.80+ to "promote" (i.e. install) the files into the right directory in ux0. [[ScePromoterUtil]] is just a wrapper for a [[SceShellSvc]] call, so [[SceShell]] actually moves the files, then adds the LiveArea bubble and updates app.db accordingly. After getting usermode execution, you can use [[SceNpDrm]] and [[ScePromoterUtil]] separately and package your games in an alternative format, for example .vpk.
 


[[Category:Formats]]
[[Category:Formats]]

Latest revision as of 19:43, 16 January 2023

PKG files for PSVita are essentially the same structure as PS3 and PSP game PKG files with different AES, RSA and ECC keys.

Algorithm

The overall algorithm is the same as PSP with one exception.

Header struct

Keys

Some keys are common with PSP and PS3 depending on the type of package.

PS3 / PSP

On the PS3/PSP, the file table and the data is AES CTR encrypted using the 0x10 bytes from offset 0x70 in the file as the IV along with the PS3/PSP AES Key.

PSVita / PSM

On the PSVita for type 2, 3 and 4, they first encrypt the 0x10 bytes at 0x70 to create a new AES session key, then do the normal AES_CTR with 0x70 as the IV and the new session key as the AES CTR key.

PKG key id

At offset 0xE7 in the PKG file is a version byte. This is only in the PSP type PKG files inside the .ext section. If it is type 1, then use the PSP key as normal, if it is type 2, use the PSV2 key with the new session key step, and if its type 3, use the PSV3, etc.

Installing

Package Installer uses SceNpDrm to decrypt/extract the game package into a temporary directory. Then it calls ScePromoterUtil#scePromoterUtilityPromotePkgWithRif on FW 1.69 and ScePromoterUtil#scePromoterUtilityPromotePkg on FWs 1.80+ to "promote" (i.e. install) the files into the right directory in ux0. ScePromoterUtil is just a wrapper for a SceShellSvc call, so SceShell actually moves the files, then adds the LiveArea bubble and updates app.db accordingly. After getting usermode execution, you can use SceNpDrm and ScePromoterUtil separately and package your games in an alternative format, for example .vpk.