Editing SELF File Format

SELF stands for Signed Executable and Linkable Format. SPRX stands for Signed Playstation Relocatable eXecutable. They are the format used by the executables on the PS3, PS Vita and PS4. PS4 SELF files have a different structure from the PS3/PS Vita ones but contain mostly the same information. See [https://www.psdevwiki.com/ps3/SELF_-_SPRX PS3/PS Vita SELF/SPRX wiki page] and [https://www.psdevwiki.com/ps3/Certified_File PS3/PS Vita Certified File wiki page].

= SELF Header Structure =

{| class="wikitable"
! Offset !! Size !! Description !! Notes
|-
| 0 || 4 || Magic || 4F 15 3D 1D
|-
| 0x4 || 4 || Unknown || Always 00 01 01 12
|-
| 0x8 || 1 || Category || 1 on SELF, 4 on PUP Entry (probably SPP). See [https://www.psdevwiki.com/ps3/Certified_File#Category PS3/PS Vita Category].
|-
| 0x9 || 1 || [[Program Type]] || First Half denotes version, second Half denotes true type, 4 for Games, 6 for Video Apps like Netflix, 8 for System/EX Apps/Executables, 9 for System/EX modules/dlls
|-
| 0xA || 2 || Padding ||
|-
| 0xC || 2 || Header Size ||
|-
| 0xE || 2 || Signature Size || ?Metadata Size?
|-
| 0x10 || 4 || File Size || Size of SELF
|-
| 0x14 || 4 || Padding ||
|-
| 0x18 || 2 || Number of Segments || 1 Kernel, 2 SL and Secure Modules, 4 Kernel ELFs, 6 .selfs, 2 .sdll, 6 .sprx, 6 ShellCore, 6 eboot.bin, 2 sexe
|-
| 0x1A || 2 || Unknown || Always 0x22
|-
| 0x1C || 4 || Padding || 
|}

== SELF Segment Structure ==

Depending on the number of segments, at offset 0x20 the following structure follows and presents a size multiple of 0x20.

<pre>
typedef struct {
 unsigned long long flags; // 0x130006 / 0x00040F / 0x000006 / 0x110006
 unsigned long long offset;
 unsigned long long encrypted_compressed_size;
 unsigned long long decrypted_decompressed_size;
} SEGMENT_TABLE;
</pre>

=== Flags ID ===

<pre>
enum SegFlags {
    SF_ORDR = 0x1,    // ordered?
    SF_ENCR = 0x2,    // encrypted
    SF_SIGN = 0x4,    // signed
    SF_DFLG = 0x8,    // deflated
    SF_BFLG = 0x800,  // block segment
};
</pre>

=== Flags Maths ===

<pre>
uint32_t Id() {
	return Flags >> 20; //0 or 1
}

bool IsOrdered() {
	return (Flags & 1) != 0;//0 or 1
}

bool IsEncrypted() {
	return (Flags & 2) != 0;//0 or 2
}

bool IsSigned() {
	return (Flags & 4) != 0;//0 or 4
}

bool IsCompressed() {
	return (Flags & 8) != 0;//0 or 8
}

bool IsBlocked() {
	return (Flags & 0x800) != 0;//0 or 0x800
}
</pre>

== ELF Segment Structure ==

After this, follows the ELF Header:

{| class="wikitable"
|+ ELF header
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! 32-bit !! 64-bit !! 32-bit !! 64-bit
|-
| colspan="2" | 0x00 || colspan="2" | 4 || <tt>e_ident[EI_MAG0]</tt> through <tt>e_ident[EI_MAG3]</tt>
| <code>0x7F</code> followed by <code>ELF</code>({{code|45 4c 46}}) in [[ASCII]]; these four bytes constitute the [[magic number (programming)|magic number]].
|-
| colspan="2" | 0x04 || colspan="2" | 1 || <tt>e_ident[EI_CLASS]</tt>
|This byte is set to either <code>1</code> or <code>2</code> to signify 32- or 64-bit format, respectively.
|-
| colspan="2" | 0x05 || colspan="2" | 1 || <tt>e_ident[EI_DATA]</tt>
|This byte is set to either <code>1</code> or <code>2</code> to signify little or big [[endianness]], respectively. This affects interpretation of multi-byte fields starting with offset <code>0x10</code>.
|-
| colspan="2" | 0x06 || colspan="2" | 1 || <tt>e_ident[EI_VERSION]</tt>
|Set to <code>1</code> for the original version of ELF.
|-
| colspan="2" | 0x07 || colspan="2" | 1 || <tt>e_ident[EI_OSABI]</tt>
|Identifies the target operating system [[application binary interface|ABI]].
{| class="wikitable"
|-
!Value!!ABI
|-
|0x00||[[System V]]
|-
|0x01||[[HP-UX]]
|-
|0x02||[[NetBSD]]
|-
|0x03||[[Linux]]
|-
|0x04||[[GNU Hurd]]
|-
|0x06||[[Solaris (operating system)|Solaris]]
|-
|0x07||[[IBM AIX|AIX]]
|-
|0x08||[[IRIX]]
|-
|0x09||[[FreeBSD]]
|-
|0x0A||[[Tru64]]
|-
|0x0B||Novell Modesto
|-
|0x0C||[[OpenBSD]]
|-
|0x0D||[[OpenVMS]]
|-
|0x0E||[[NonStop (server computers)|NonStop Kernel]]
|-
|0x0F||[[AROS Research Operating System|AROS]]
|-
|0x10||Fenix OS
|-
|0x11||[[CloudABI]]
|}
It is often set to <code>0</code> regardless of the target platform.
|-
| colspan="2" | 0x08 || colspan="2" | 1 || <tt>e_ident[EI_ABIVERSION]</tt>
|Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it. In that case, offset and size of EI_PAD are <code>8</code>.
|-
| colspan="2" | 0x09 || colspan="2" | 7 || <tt>e_ident[EI_PAD]</tt>
|currently unused
|-
| colspan="2" | 0x10 || colspan="2" | 2 || <tt>e_type</tt>
| Identifies object file type.
{| class="wikitable"
|-
!Value!!Type
|-
|0x00||ET_NONE
|-
|0x01||ET_REL
|-
|0x02||ET_EXEC
|-
|0x03||ET_DYN
|-
|0x04||ET_CORE
|-
|0xfe00||ET_SCE_EXEC
|-
|0xfe01||ET_SCE_REPLAY_EXEC
|-
|0xfe10||ET_SCE_DYNEXEC
|-
|0xfe18||ET_SCE_DYNAMIC
|-
|0xfeff||ET_HIOS
|-
|0xff00||ET_LOPROC
|-
|0xffff||ET_HIPROC
|} 
|-
| colspan="2" | 0x12 || colspan="2" | 2 || <tt>e_machine</tt>
|Specifies target [[instruction set architecture]]. Some examples are:
{| class="wikitable"
|-
!Value!!ISA
|-
|0x00|| No specific instruction set
|-
|0x02||[[SPARC]]
|-
|0x03||[[x86]]
|-
|0x08||[[MIPS architecture|MIPS]]
|-
|0x14||[[PowerPC]]
|-
|0x16
|[[Z/Architecture|S390]]
|-
|0x28||[[ARM architecture|ARM]]
|-
|0x2A||[[SuperH]]
|-
|0x32||[[IA-64]]
|-
|0x3E||[[x86-64]]
|-
|0xB7||[[AArch64]]
|-
|0xF3||[[RISC-V]]
|}
|-
| colspan="2" | 0x14 || colspan="2" | 4 || <tt>e_version</tt>
|Set to <code>1</code> for the original version of ELF.
|-
| colspan="2" | 0x18 || 4 || 8 || <tt>e_entry</tt>
|This is the memory address of the [[entry point]] from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier.
|-
| 0x1C || 0x20 || 4 || 8 || <tt>e_phoff</tt>
|Points to the start of the program header table. It usually follows the file header immediately, making the offset <code>0x34</code> or <code>0x40</code> for 32- and 64-bit ELF executables, respectively.
|-
| 0x20 || 0x28 || 4 || 8 || <tt>e_shoff</tt>
|Points to the start of the section header table.
|-
| 0x24 || 0x30 || colspan="2" | 4 || <tt>e_flags</tt>
|Interpretation of this field depends on the target architecture.
|-
| 0x28 || 0x34 || colspan="2" | 2 || <tt>e_ehsize</tt>
|Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
|-
| 0x2A || 0x36 || colspan="2" | 2 || <tt>e_phentsize</tt>
|Contains the size of a program header table entry. <!-- 0x38/0x20? -->
|-
| 0x2C || 0x38|| colspan="2" | 2 || <tt>e_phnum</tt>
|Contains the number of entries in the program header table.
|-
| 0x2E || 0x3A || colspan="2" | 2 || <tt>e_shentsize</tt>
|Contains the size of a section header table entry.
|-
| 0x30 || 0x3C || colspan="2" | 2 || <tt>e_shnum</tt>
|Contains the number of entries in the section header table.
|-
| 0x32 || 0x3E || colspan="2" | 2 || <tt>e_shstrndx</tt>
|Contains index of the section header table entry that contains the section names.
|}

Followed by the program header

{| class="wikitable"
|+ Program header
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! 32-bit !! 64-bit !! 32-bit !! 64-bit
|-
| colspan="2" | 0x00 || colspan="2" | 4 ||<tt>p_type</tt>||Identifies the type of the segment.
{| class="wikitable"
|-
!Value!!Name!!Meaning
|-
|0x00000000||<tt>PT_NULL</tt>
| Program header table entry unused
|-
|0x00000001||<tt>PT_LOAD</tt>
| Loadable segment
|-
|0x00000002||<tt>PT_DYNAMIC</tt>
| Dynamic linking information
|-
|0x00000003||<tt>PT_INTERP</tt>
| Interpreter information
|-
|0x00000004||<tt>PT_NOTE</tt>
| Auxiliary information 
|-
|0x00000005||<tt>PT_SHLIB</tt>
| reserved
|-
|0x00000006||<tt>PT_PHDR</tt>
| segment containing program header table itself
|-
|0x60000000||<tt>PT_LOOS</tt>
| rowspan="4" | see below
|-
|0x6FFFFFFF||<tt>PT_HIOS</tt>
|-
|0x70000000||<tt>PT_LOPROC</tt>
|-
|0x7FFFFFFF||<tt>PT_HIPROC</tt>
|}
<tt>PT_LOOS</tt> to <tt>PT_HIOS</tt> (<tt>PT_LOPROC</tt> to <tt>PT_HIPROC</tt>) is an inclusive reserved ranges for operating system (processor) specific semantics.
|-
|  || 0x04 ||  || 4 ||<tt>p_flags</tt>||Segment-dependent flags (position for 64-bit structure).
|-
| 0x04 || 0x08 || 4 || 8||<tt>p_offset</tt>||Offset of the segment in the file image.
|-
| 0x08 || 0x10 || 4 || 8 ||<tt>p_vaddr</tt>||Virtual address of the segment in memory.
|-
| 0x0C || 0x18 || 4 || 8 ||<tt>p_paddr</tt>||On systems where physical address is relevant, reserved for segment's physical address.
|-
| 0x10 || 0x20 || 4 || 8 ||<tt>p_filesz</tt>||Size in bytes of the segment in the file image. May be 0.
|-
| 0x14 || 0x28 || 4 || 8 ||<tt>p_memsz</tt>||Size in bytes of the segment in memory. May be 0.
|-
| 0x18 ||  || 4 ||  ||<tt>p_flags</tt>||Segment-dependent flags (position for 32-bit structure).
|-
| 0x1C || 0x30 || 4 || 8 ||<tt>p_align</tt>||<code>0</code> and <code>1</code> specify no alignment. Otherwise should be a positive, integral power of 2, with <tt>p_vaddr</tt> equating <tt>p_offset</tt> modulus <tt>p_align</tt>.
|-
|0x20
|0x38
| colspan="3" |
|End of Program Header (size)
|}

= Program Identification Header =

Program Identification Header is located just before the SELF segments certifications.

{| class="wikitable"
! Offset !! Size !! Description !! Notes
|-
| 0 || 0x8 || [[Program Authority ID]] ||
|-
| 0x8 || 0x8 || [[Program Type]] ||
|-
| 0x10 || 0x8 || Program Version ||
|-
| 0x18 || 0x8 || System Software Version || Requested minimum version.
|-
| N.A/0x20 || 0x20 || Content ID || Only exists if the SELF is protected by NPDRM.
|-
| 0x20/0x40 || 0x20 || Digest || SHA-256 of the decrypted elf (for example, on 7.55 retail decrypted/mmapped elf libc.sprx hash is 67c19a2b053ee386819dcd316d21c4381b35bd3de283ce7ca2e143c86b34f79a)
|}

= Segment Certification =

From leaked decrypted PS4 6.00b1 Kernel (containing only one segment) the following information can be deduced:

{| class="wikitable"
! Offset !! Size !! Description !! Notes
|-
| 0 || 0x10 || AES Key || AES128CBC Key for Segment 1
|-
| 0x10 || 0x10 || AES IV || AES128CBC IV for Segment 1
|-
| 0x20 || 0x20 || HMAC Hash || SHA256HMAC Hash for Segment 1 (decrypted but compressed in this case) (without extra at footer)
|-
| 0x40 || 0x10 || HMAC Key || SHA256HMAC Key for Segment 1
|-
| 0x50 || 0x40 || License + BMP Header || ???
|-
| 0x90 || 0x20 || BMP Entries || 2 (0x10) Entries (first entry is NULL)
|-
| 0xB0 || 0x100 || RSA Signature || RSA Signature of the Segment Certification
|}

= Footer Signature =

Additionally, at the bottom of a SELF, there is likely a footer RSA signature as well as some extra data (relative size).

= Tools =

== Official tools ==

To document.

== Unofficial tools ==

=== SELF Decrypter on PS4 ===

[https://github.com/AlexAltea/orbital/blob/master/tools/dumper/source/self_decrypter.c PS4 SELF Decrypter on PS4 by AlexAltea]

As PS4 SELF decryption keys are not publicly known, to decrypt SELFs, one can use his PS4 as a blackbox. There are some conditions: the SELF must have valid signatures, it must have a required FW version lower than the FW version of the PS4 being used, and for System SELFs the SELF key_revision must be according to the PS4 FW version. There are exceptions like in first PS4 firmwares where some SELF checks were missing and allowed to decrypt SELFs that did not meet such requirements.

=== make_fself by flatz ===

To document.

=== SELF backport tools ===

To document.


{{File Formats}}
<noinclude>[[Category:Main]]</noinclude>