SELF

SELF files are a wrapper around encrypted ELF files. The encrypted header contains keys to decrypt each encrypted ELF program, which are decrypted and loaded individually. Because of this, a copy of the ELF headers and ELF program headers are stored in plain text next to the SCE header.

Authentication ID

Offset 0x80 in the SELF header. SceWebCore has 0x8000 set; the only system app with that flag set.

sceAppMgrConvertVs0UserDrivePath checks the authentication id to limit mount points.

0x2800000000008003 seen used by SceWebCore can only access vs0:data/external/cert/ and vs0:data/external/webcore/

0x2800000000008004 seen used by games and 0x210000101CD20007 seen used by PSM can only access vs0:data/external and vs0:sys/external

Relocations

Offset	Size	Description
0x0	0x4	Relocation Type
0x4	0x4	Long entry: Addend
0x4	0x4	Short entry: 0-19 = Bits 10-29 of offset, 20-31 = addend
0x8	0x4	Long entry: Offset

Relocations can be of two types: 8 byte "short" entries or 12 byte "long" entries. The relocation code is the same as ARM ELF format.

Segment start = Buffer address of segment indexed at "Patch segment"

Symbol start = Buffer address of segment indexed at "Symbol segment"

Address to patch = segment start + offset

P = address to patch

S = "Symbol segment" == 15 ? 0 : symbol start

A = addend

Relocation Type

Start	End	Description
0	3	Short entry if set
4	7	Symbol segment
8	15	Relocation code
16	19	Patch segment
20	27	Long entry: Optional relocation code 2
28	31	Long entry: Optional distance 2
20	31	Short entry: Lower 12 bits of offset

Supported Relocation Codes (1.69)

Code	Description
0	R_ARM_NONE
2	R_ARM_ABS32
3	R_ARM_REL32
10	R_ARM_THM_CALL
28	R_ARM_CALL
29	R_ARM_JUMP24
38	R_ARM_TARGET1 (same as R_ARM_ABS32)
40	R_ARM_V4BX (same as R_ARM_NONE)
41	R_ARM_TARGET2 (same as R_ARM_REL32)
42	R_ARM_PREL31
43	R_ARM_MOVW_ABS_NC
44	R_ARM_MOVT_ABS
47	R_ARM_THM_MOVW_ABS_NC
48	R_ARM_THM_MOVT_ABS