Secure Profile Loader: Difference between revisions

Revision as of 05:32, 13 November 2012

Default.spp file is stored on /dev/rflash1

Packet ID	Description
0x15001	Get LPAR Parameter Size/Get LPAR Parameter
0x15003	Get Contents Size/Get Contents
0x15009	Get Component

The file is encrypted but can be read by using 0x15003 service of SPL
SPL reads SPP file, parses SPP header and checks some fields
SPP file is verified and decrypted by SPU module spp_verifier.self that cab be executed with HV SPE calls
Even old default.spp from PS3 Firmware 1.10 can be decrypted with spp_verifier.self from PS3 Firmware 3.41
Header format version should be 5 or else the header check fails
If (SPP header size % 256 != 0) then header check fails
Finally i was able to decrypt profile file from 3.41 but by using SPE HV calls only !!! And Linux Manager is still there !!!
The decrypted file is a binary file

Here are the contents of Default.spp#3.56_RETAIL.2FCEX from 3.55.
Here are the contents of Default.spp#3.55_RETAIL.2FCEX from 3.55.
Here are the contents of Default.spp#3.41_RETAIL.2FCEX from 3.41.
Here are the contents of Default.spp#3.15_RETAIL.2FCEX from 3.15.
Here are the contents of Default.spp#1.00_DEBUG.2FDEX from 1.00 Debug Firmware.

offset 0x2 - header format version (2 bytes)

offset 0x4 - header size (4 bytes)

offset 0x18 - number of segments (4 bytes)

Here is the list of profile segments from 3.41:

Revision as of 22:25, 25 September 2012 (edit) Mysis (talk \| contribs) (kudos to graf/glevand for this reverse engineering)		Revision as of 05:32, 13 November 2012 (edit) (undo) Euss (talk \| contribs) mNo edit summary Newer edit →
Line 1:		Line 1:
			[[Category:Software]]
	[[Default.spp]] file is stored on '''/dev/rflash1'''		[[Default.spp]] file is stored on '''/dev/rflash1'''