PARAM.PFD
Description
This files are responsible to prevent tampering of other files of the same folder, the only purpose is the security of the folder contents. Contains the cryptographic signatures of other files of the same folder (not all, but the ones that developers decided to be important enought to be secured).
Its used in several paths of the PS3, usually to secure data related with the user profile e.g:
/dev_hdd0/home/0000000*/savedata/SAVEDATA_DIRECTORY/PARAM.PFD <---- in all save game folders /dev_hdd0/home/0000000*/trophy/NPCOMMID/PARAM.PFD <--- in all trohpy folders /dev_hdd0/home/0000000*/trophy/_TROPSYS_/PARAM.PFD <---- in the "user trophy index" folder
Usually PARAM.SFO is one of the files listed (and supervised) by PARAM.PFD but this can vary.
Every time one of the files listed in the Protected files table inside the PARAM.PFD is updated... the PARAM.PFD itself needs to be updated to store the new signature of the updated file. e.g:
- When you save a game there is some text that changes inside PARAM.SFO with your current "gameplay time", "character level", etc...
- When you unlock a new trophy the file TROPUSR.DAT is updated with this new data
- When you install new trophies (with a "trophy installer" in .TRP format) from a new game the TROPSYS.DAT is updated to index the new trophy installation
... In all this cases, there is a PARAM.PFD in the same folder that has been updated to store the new "signatures" of the other updated files
More info on other related file formats: PARAM.SFO Game Saves Trophy files.
Structure
Header (120 bytes) X table (456 bytes) Protected files table(31008 bytes) Y table (1140 bytes) Padding (44 bytes) Total file size = 120+456+31008+1140+44 = 32768 bytes (0x8000)
The size is fixed because the number of entries in both X table & Y table is 57 (when the entry is not used his position is reserved and marked as "not-used"). In the same way... the Protected files table has the space reserved for a maximun of 114 entries (usually most of them are not used and are filled with zeroes). As result the file contains the maximun number of possible entries
- Note
Entries in the Protected files table (114) is exactly the double than the entries in X table (57) & Y table (57)
Header
From 0x0 to 0x78 Size = 120 bytes
The end of the header is not clear at first sight, but it can be deduced by counting the number of entries in X table & Y table and comparing the positions used in both
e.g. look for one used entry in the "Y table" and count his position in this table... then look for other used entry in the "X" (both tables matches in the used entries). Then count towards behind to find the first entry (the start of the first entry is the start of the X table)
So the start of the X table is the end offset of the header
| Offset | Size | Value | Description |
|---|---|---|---|
| 0x00 | 0x08 bytes | PFDB | Magic value in ASCII |
| 0x08 | 0x08 bytes | 0000000000000003 | constant |
| 0x10 | 0x10 bytes | random bytes | key to en/decrypt |
| 0x20 | 0x14 bytes | hmac sha1 | encrypted, decrypted by vtrm |
| 0x34 | 0x14 bytes | hmac sha1 | encrypted, decrypted by vtrm |
| 0x48 | 0x14 bytes | hmac sha1 | encrypted, decrypted by vtrm |
| 0x5C | 0x04 bytes | padding, encrypted by vtrm |
| Offset | Size | Value | Description |
|---|---|---|---|
| 0x60 | 0x08 bytes | 0000000000000039 | Max Number of reserved entries in the X table & Hash table (57 in decimal) |
| 0x68 | 0x08 bytes | 0000000000000072 | Max Number of reserved entries in the Protected files table (114 in decimal) |
| 0x70 | 0x08 bytes | value | Number of files listed (114 in decimal) |
X table
- Example of a standard X table
00000070 00 00 00 00 00 00 00 72 |...............r| 00000080 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000090 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000000a0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000000b0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 00 |.......r........| 000000c0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000000d0 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 72 |...............r| 000000e0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000000f0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000100 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000110 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000120 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000130 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000140 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000150 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000160 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000170 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000180 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000190 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001a0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001b0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001c0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001d0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001e0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 000001f0 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000200 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000210 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000220 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r| 00000230 00 00 00 00 00 00 00 72 00 00 00 00 00 00 00 72 |.......r.......r|
Protected files table
Each entry can store the signature of one of the files in the folder, there is always an entry used to store the signature of PARAM.SFO, this gives a maximun number of protected files generated by the game of 113
Used entries fills the table from top to bottom, not-used entries are placed at the end of the table filled with zeroes
The first 8 bytes of each entry (file index) works in the same way than the entries in the X table, usually not used (72) and when used are randmonly placed asigning an "file index" to the entry
This "file index" does not matches with the position of the entry in the Protected files table itself... so seems that this "indexes files" are ???virtually reordered???
In fact, for a theoricall file with all entries used, half of the "file index" numbers will be spreaded between the X table (can only contain 57) ant the first 8 bytes of some entries in the Protected files table
| Size | Value | Description |
|---|---|---|
| 0x8 | 00000000000000** | File index |
| 0x16 | EXAMPLE.WTF | Name of the file included the point and the extension in ASCII (Null-terminated) |
| 0xBC | ????????... | Certificate for the file. When the file is PARAM.SFO then the certificate is bigger in size and uses imput data from the attribute "PARAMS" and/or "ACCOUNT_ID" inside PARAM.SFO. Method unknown (Null-terminated) |
| 0x4 | 1A2B3C4D | Size of the file in bytes |
Hash table
They are Hashes. They are sorted by the X table
Padding
Size = 44 bytes
Cryptography
Unknown by now, but some questions rises...
Why the files are listed in this order and not in other in the "files table" ?
Because are not listed alphabetically, neither by size
Indexes files (in the X table) seems to have different number for every one, never repeats, but there is not direct relationship between the number of entries in X table & Y table (both are fixed to 57) and the numer of files listed in the Protected files table (114)... the most logicall explain if that this 114 files can be linked to both tables (57 each)... but in fact the only table that stores crypto is the Y table (limited to 57)... so what trick they used ? hmmmm
What are this index in the X table and in the Protected files table itself?, his positions seems to be random, seems like an old school "lucas arts games" anticheat card where you pick 2 values and by mixing them you get the unlock code :D
But here what is random is the positions, and index numbers of the entries in the X table, and the indexed files in the Protected files table ??? 2 index ???