Capability Flags

From PS3 Developer wiki
Jump to: navigation, search

This is a 32-byte buffer that specifies if a SELF has more or less capabilities.

Capability is stored either as plaintext in SELF Supplemental Header (SELF and PS3 only) or encrypted in the Certified File Optional Header.

PS3[edit]

Plaintext Capability[edit]

Temp name was Control Flags. Official name is plaintext_capability.

It is widely used by PS3 lv2.

Examples[edit]

Long Value Short Notation Type Whitelisting
0000000000000000000000000000000000000000000000000000000000000000 00 00 00 00 00 00 00 00 00 00 00 00 lv1::PLAINTEXT_CAPABILITY_DEFAULT Yes
0000000000000000000000000000000000000000000000000000000000000000 00 00 00 00 00 00 00 00 00 00 00 00 lv2::PLAINTEXT_CAPABILITY_DEFAULT Yes
0000000000000000000000000000000000000000000000000000000000000003 00 00 00 00 00 00 00 00 00 00 00 03 ? Yes
4000000000000000000000000000000000000000000000000000000000000000 40 00 00 00 00 00 00 00 00 00 00 00 Root Flags Yes
4000000000000000000000000000000000000000000000000000000000000002 40 00 00 00 00 00 00 00 00 00 00 02 Root Flags + debug_mode_capability flags (vsh) Yes
4000000000000000000000000000000000000000000000000000000000000004 40 00 00 00 00 00 00 00 00 00 00 04 Root flags + product_mode_capability flags Yes

Structure[edit]

struct { // Size is 0x20 bytes
  uint32_t ctrl_flag1; // 0x80000000(all?), 0x40000000(root), 0x20000000(dbg), 0x00000000(normal?)
  uint32_t unknown2;
  uint32_t unknown3;
  uint32_t unknown4;
  uint32_t unknown5;
  uint32_t unknown6;
  uint32_t unknown7; // ex: 0, 8, 9, 0xC
  uint32_t unknown8; // ex: 0(normal_mode), 1, 2(debug_mode), 4(product_mode)
} plaintext_capability;

Encrypted Capability[edit]

Examples[edit]

Long Value Short Notation Type Whitelisting
00000000000000000000000000000000000000000000001B0000000100000000 00 00 00 00 00 00 00 1B 00 00 00 01 00 00 00 00 ? No
00000000000000000000000000000000000000000000001B0000000100100000 00 00 00 00 00 00 00 1B 00 00 00 01 00 10 00 00 ? Yes
0000000000000000000000000000000000000000000000380000000100002000 00 00 00 00 00 00 00 38 00 00 00 01 00 00 20 00 ? Yes
00000000000000000000000000000000000000000000003B0000000000002000 00 00 00 00 00 00 00 3B 00 00 00 00 00 00 20 00 ? Yes
00000000000000000000000000000000000000000000003B0000000000020000 00 00 00 00 00 00 00 3B 00 00 00 00 00 02 00 00 BluRay Unknown
00000000000000000000000000000000000000000000003B0000000100000000 00 00 00 00 00 00 00 3B 00 00 00 01 00 00 00 00 ? Yes
00000000000000000000000000000000000000000000003B0000000100002000 00 00 00 00 00 00 00 3B 00 00 00 01 00 00 20 00 ? Yes
00000000000000000000000000000000000000000000003B0000000100040000 00 00 00 00 00 00 00 3B 00 00 00 01 00 04 00 00 ? Yes
00000000000000000000000000000000000000000000007B0000000100000000 00 00 00 00 00 00 00 7B 00 00 00 01 00 00 00 00 lv1 Yes
00000000000000000000000000000000000000000000007B0000000100000000 00 00 00 00 00 00 00 7B 00 00 00 01 00 00 00 00 lv2_kernel Yes
00000000000000000000000000000000000000000000007B0000000100116000 00 00 00 00 00 00 00 7B 00 00 00 01 00 11 60 00 ? Yes

Structure[edit]

appldr

0x17 = 0x78

xsetting

0x17 = 0x3B
0x1B = 0x01
0x1D = 0x02

ps3swu

0x17 = 0x7B
0x1B = 0x01
0x1D = 0x11
0x1E = 0x60

lv2

0x17 = 0x7B
0x1B = 0x01

lv1

0x17 = 0x7B
0x1B = 0x01

libfs

0x17 = 0x7B
0x1B = 0x01

icolaunch

0x17 = 0x3B
0x1B = 0x01
0x1D = 0x04

hddcopy

0x17 = 0x7B
0x1B = 0x01
0x1D = 0x08

flowers

0x17 = 0x3B
0x1B = 0x01
0x1E = 0x20

fdm_spu

0x17 = 0x38

emu_drm

0x17 = 0x3B
0x1D = 0x02

bdj

0x0F = 0x01 //qa-bdp type1
0x17 = 0x27
0x1D = 0x02

swagner

0x0F = 0x02 //qa-bdp type2
0x17 = 0x3F
0x1D = 0x02

0x0C = 0x00000001 / 0x00000002 // qa_bdp_type_flags
0x14 = 0x00000038 / 0x0000003B / 0x00000078 / 0x0000007B / 0x00000027
0x18 = 0x00000001
0x1C = 0x00002000 / 0x00020000 / 0x00040000 / 0x00080000 / 0x00116000

0x14:

#define CAP_FLAG_REFTOOL 0x08 // DEH
#define CAP_FLAG_DEBUG   0x10 // DEX
#define CAP_FLAG_RETAIL  0x20 // CEX
#define CAP_FLAG_SYSDBG  0x40 // ARCADE

Some more cap flags from appldr 3.56 whitelist:

https://web.archive.org/web/20161126102609/http://pastie.org/3090973

https://web.archive.org/web/20161126102716/http://pastie.org/3090976

PSVita[edit]

Plaintext Capability[edit]

PSVita does not use plaintext capability.

Encrypted Capability[edit]

See [1].