Spkg hdr.tar

Signed Package headers TAR file is present since PS3 System Software 3.56. It contains the TAR'ed collection of all SPKG Certified Files headers for installation on 3.56 and later PS3.

History

With the public release of PS3 System Software keys of versions 3.55 and earlier, Sony decided to change the keyset since version 3.56. To have backward compatibility, that is to allow any console on 3.55 and lower to install 3.56+ System Software updates, Sony had to keep compatibility with the old updater program. To do so, Sony kept using the format and algorithms for Certified Files of 3.55 and lower updater. But when installing a 3.56+ PS3 System Software update on a 3.56+ PS3, the 3.56+ updater applies an overlay filesystem to the Certified Files of the PUP, using the "Spkg hdr.tar" file newly added. All .spkg_hdr.1 files contained in this ?encrypted? TAR are read as Certification headers of the same PKG files. This patch Certification header is then decrypted by the newer SPKG keyset to obtain the CF keys needed to decrypt the rest of the PKG. As the PKG body is encrypted with a unique AES key, the CF key retrieved by the 3.56+ updater is the same as the one obtained by the 3.55 and earlier updater.

For example:

• UPL.xml.pkg (4.60) can be decrypted using PKG keyset [0x0000 03.55] for PS3 FW <= 3.55.
• UPL.xml.pkg.spkg_hdr.1 can be decrypted using SPKG keyset for PS3 FW > 3.55.

Between patched and original SPKG, only Metadata Info and Signature change.

 [*] Encryption Root Header:                                     [*] Encryption Root Header:
 Key 87 EE 46 44 60 DA DA EA 49 74 58 F9 02 1D 6D 11             Key E0 12 4D EC 48 3A 52 0E BE 4C C1 4A A6 E3 20 D8 
 IV  F4 9F 43 D8 D0 6A F0 FC 33 AF 5E 6E CF 2F 30 1E             IV  93 92 A9 38 8D B7 2B 8F 43 0E 0B 97 3D 45 9A 74 

Of course, a change in the Certification gives completely different sha1 digests of 0x250 bytes:

.pkg    d2 00 81 31 33 ab dc 4c 76 3a 86 21 bf d0 12 ff 69 b2 a7 2e
.spkg   da 88 a0 cb 89 b0 07 44 62 9c cc 01 d5 eb d9 f6 04 dc 60 74

and changes Signature:

.pkg    008e17ec1f0cdc62515eb7d3c90fdc548a0993062b 0096d693c42a5214a9a3712ea6be9791ebe20f615e 000000000000
.spkg   0063651d703369fea4aac784d81b4f4d623836f4d4 00bcaf0dbbd251b5235fc28d1a4dea390d38f2bbac 000000000000

The very first (early) 4.xx CFW PUPs were only installable on 3.55 and earlier PS3s because they were not having SPKG headers TAR.

The reason why CFW is not installable over any 3.56+ OFW is that we do not have 3.56+ SPKG private keys.

Location

spkg_hdr.tar file is contained in any PS3 3.56+ PUP file.

Structure

spkg_hdr.tar ?once decrypted? is a TAR file containing files with ".pkg.spkg_hdr.1" extension.

These files are patch Certified File headers applied as an overlay on PKG files contained in the PUP.

Example

BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 53 43 45 00 00 00 00 02 00 00 00 03 00 00 00 00 SCE............. 00000010 00 00 00 00 00 00 02 80 00 00 00 00 00 1E 01 10 .......€........

Example

3.56 CEX/Retail spkg_hdr.tar content

 BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
 BDPT_FIRMWARE_PACKAGE_301R.pkg.spkg_hdr.1
 BDPT_FIRMWARE_PACKAGE_302R.pkg.spkg_hdr.1
 BDPT_FIRMWARE_PACKAGE_303R.pkg.spkg_hdr.1
 BDPT_FIRMWARE_PACKAGE_304R.pkg.spkg_hdr.1
 BDPT_FIRMWARE_PACKAGE_306R.pkg.spkg_hdr.1
 BDPT_FIRMWARE_PACKAGE_308R.pkg.spkg_hdr.1
 BLUETOOTH_FIRMWARE.pkg.spkg_hdr.1
 CORE_OS_PACKAGE.pkg.spkg_hdr.1
 dev_flash_000.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_001.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_002.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_003.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_004.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_005.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_006.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_007.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_008.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_009.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_010.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_011.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_012.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_013.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_014.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_015.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_016.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_017.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_018.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_019.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_020.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash_021.tar.aa.2011_01_25_032219.spkg_hdr.1
 dev_flash3_022.tar.aa.2011_01_25_032219.spkg_hdr.1
 MULTI_CARD_FIRMWARE.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01000006.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01010303.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01020302.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01030302.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01040402.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01050002.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_01050101.pkg.spkg_hdr.1
 SYS_CON_FIRMWARE_S1_00010002083E0832.pkg.spkg_hdr.1
 UPL.xml.pkg.spkg_hdr.1

Tools

• [(linux/win)]