Editing SELF File Format

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
SELF stands for Signed Executable and Linkable Format. SPRX stands for Signed Playstation Relocatable eXecutable. They are the format used by the executables on the PS3, PS Vita and PS4. PS4 SELF files have a different structure from the PS3/PS Vita ones but contain mostly the same information. See [https://www.psdevwiki.com/ps3/SELF_-_SPRX PS3/PS Vita SELF/SPRX wiki page] and [https://www.psdevwiki.com/ps3/Certified_File PS3/PS Vita Certified File wiki page].
ORBIS SELFs from PS4 have a somewhat different structure from the ones we see on vita and ps3.
The structure is documented as follows:


= SELF Header Structure =
= SELF Header Structure =
Line 10: Line 11:
| 0x4 || 4 || Unknown || Always 00 01 01 12
| 0x4 || 4 || Unknown || Always 00 01 01 12
|-
|-
| 0x8 || 1 || Category || 1 on SELF, 4 on PUP Entry (probably SPP). See [https://www.psdevwiki.com/ps3/Certified_File#Category PS3/PS Vita Category].
| 0x8 || 1 || Unknown || Always 1
|-
|-
| 0x9 || 1 || [[Program Type]] || First Half denotes version (anything between 0, oldest and F, newest), second Half denotes true type, 4 for Games, 5 for sce_module modules, 6 for Video Apps like Netflix, 8 for System/EX Apps/Executables, 9 for System/EX modules/dlls
| 0x9 || 1 || Key Type || 0xC SK, 0xF SL, 0xE SM, 0x8 EBOOT and ELF and SELF, 0x9 SPRX and SDLL and SEXE 
|-
|-
| 0xA || 2 || Padding ||
| 0xA || 2 || Padding ||
|-
|-
| 0xC || 2 || Header Size ||
| 0xC || 2 || MetaData Offset ||
|-
|-
| 0xE || 2 || Signature Size || ?Metadata Size?
| 0xE || 2 || MetaData Size ||
|-
|-
| 0x10 || 4 || File Size || Size of SELF
| 0x10 || 4 || Size of SELF ||
|-
|-
| 0x14 || 4 || Padding ||
| 0x18 || 2 || Unknown || 1 SK, 2 SL and Modules, 4 SK Elfs, 6 .selfs, 2 .sdll, 6 .sprx, 6 ShellCore, 6 eboot.bin, 2 sexe
|-
| 0x18 || 2 || Number of Segments || 1 Kernel, 2 SL and Secure Modules, 4 Kernel ELFs, 6 .selfs, 2 .sdll, 6 .sprx, 6 ShellCore, 6 eboot.bin, 2 sexe
|-
|-
| 0x1A || 2 || Unknown || Always 0x22
| 0x1A || 2 || Unknown || Always 0x22
|-
|-
| 0x1C || 4 || Padding ||
| 0x20 || 2 || Unknown || Always 0x6, Except in Leaked 6.00b1 kernel (0x040F)
|}
 
== SELF Segment Structure ==
 
Depending on the number of segments, at offset 0x20 the following structure follows and presents a size multiple of 0x20.
 
<pre>
typedef struct {
unsigned long long flags; // 0x130006 / 0x00040F / 0x000006 / 0x110006
unsigned long long offset;
unsigned long long encrypted_compressed_size;
unsigned long long decrypted_decompressed_size;
} SEGMENT_TABLE;
</pre>
 
=== Flags ID ===
 
<pre>
enum SegFlags {
    SF_ORDR = 0x1,    // ordered?
    SF_ENCR = 0x2,    // encrypted
    SF_SIGN = 0x4,    // signed
    SF_DFLG = 0x8,    // deflated
    SF_BFLG = 0x800,  // block segment
};
</pre>
 
=== Flags Maths ===
 
<pre>
uint32_t Id() {
return Flags >> 20; //0 or 1
}
 
bool IsOrdered() {
return (Flags & 1) != 0;//0 or 1
}
 
bool IsEncrypted() {
return (Flags & 2) != 0;//0 or 2
}
 
bool IsSigned() {
return (Flags & 4) != 0;//0 or 4
}
 
bool IsCompressed() {
return (Flags & 8) != 0;//0 or 8
}
 
bool IsBlocked() {
return (Flags & 0x800) != 0;//0 or 0x800
}
</pre>
 
== ELF Segment Structure ==
 
After this, follows the ELF Header:
 
{| class="wikitable"
|+ ELF header
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! 32-bit !! 64-bit !! 32-bit !! 64-bit
|-
| colspan="2" | 0x00 || colspan="2" | 4 || <tt>e_ident[EI_MAG0]</tt> through <tt>e_ident[EI_MAG3]</tt>
| <code>0x7F</code> followed by <code>ELF</code>({{code|45 4c 46}}) in [[ASCII]]; these four bytes constitute the [[magic number (programming)|magic number]].
|-
| colspan="2" | 0x04 || colspan="2" | 1 || <tt>e_ident[EI_CLASS]</tt>
|This byte is set to either <code>1</code> or <code>2</code> to signify 32- or 64-bit format, respectively.
|-
| colspan="2" | 0x05 || colspan="2" | 1 || <tt>e_ident[EI_DATA]</tt>
|This byte is set to either <code>1</code> or <code>2</code> to signify little or big [[endianness]], respectively. This affects interpretation of multi-byte fields starting with offset <code>0x10</code>.
|-
| colspan="2" | 0x06 || colspan="2" | 1 || <tt>e_ident[EI_VERSION]</tt>
|Set to <code>1</code> for the original version of ELF.
|-
| colspan="2" | 0x07 || colspan="2" | 1 || <tt>e_ident[EI_OSABI]</tt>
|Identifies the target operating system [[application binary interface|ABI]].
{| class="wikitable"
|-
!Value!!ABI
|-
|0x00||[[System V]]
|-
|0x01||[[HP-UX]]
|-
|0x02||[[NetBSD]]
|-
|0x03||[[Linux]]
|-
|0x04||[[GNU Hurd]]
|-
|0x06||[[Solaris (operating system)|Solaris]]
|-
|0x07||[[IBM AIX|AIX]]
|-
|0x08||[[IRIX]]
|-
|0x09||[[FreeBSD]]
|-
|0x0A||[[Tru64]]
|-
|0x0B||Novell Modesto
|-
|0x0C||[[OpenBSD]]
|-
|0x0D||[[OpenVMS]]
|-
|0x0E||[[NonStop (server computers)|NonStop Kernel]]
|-
|0x0F||[[AROS Research Operating System|AROS]]
|-
|0x10||Fenix OS
|-
|0x11||[[CloudABI]]
|}
Notes: It is often set to <code>0</code> regardless of the target platform.
The PS4 uses the same ABI identifier as FreeBSD.
|-
| colspan="2" | 0x08 || colspan="2" | 1 || <tt>e_ident[EI_ABIVERSION]</tt>
|Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it. In that case, offset and size of EI_PAD are <code>8</code>.
|-
| colspan="2" | 0x09 || colspan="2" | 7 || <tt>e_ident[EI_PAD]</tt>
|Padding
|-
| colspan="2" | 0x10 || colspan="2" | 2 || <tt>e_type</tt>
| Identifies object file type.
{| class="wikitable"
|-
!Value!!Type!!Notes
|-
|0x00||ET_NONE||
|-
|0x01||ET_REL||
|-
|0x02||ET_EXEC||
|-
|0x03||ET_DYN||
|-
|0x04||ET_CORE||
|-
|0xfe00||ET_SCE_EXEC||eboot without ASLR
|-
|0xfe01||ET_SCE_REPLAY_EXEC||
|-
|0xfe10||ET_SCE_DYNEXEC||eboot with ASLR
|-
|0xfe18||ET_SCE_DYNAMIC||
|-
|0xfeff||ET_HIOS||
|-
|0xff00||ET_LOPROC||
|-
|0xffff||ET_HIPROC||
|}
|-
| colspan="2" | 0x12 || colspan="2" | 2 || <tt>e_machine</tt>
|Specifies target [[instruction set architecture]]. Some examples are:
{| class="wikitable"
|-
!Value!!ISA
|-
|0x00|| No specific instruction set
|-
|0x02||[[SPARC]]
|-
|0x03||[[x86]]
|-
|0x08||[[MIPS architecture|MIPS]]
|-
|0x14||[[PowerPC]]
|-
|0x16
|[[Z/Architecture|S390]]
|-
|0x28||[[ARM architecture|ARM]]
|-
|0x2A||[[SuperH]]
|-
|0x32||[[IA-64]]
|-
|0x3E||[[x86-64]]
|-
|0xB7||[[AArch64]]
|-
|0xF3||[[RISC-V]]
|}
|-
| colspan="2" | 0x14 || colspan="2" | 4 || <tt>e_version</tt>
|Set to <code>1</code> for the original version of ELF.
|-
| colspan="2" | 0x18 || 4 || 8 || <tt>e_entry</tt>
|This is the memory address of the [[entry point]] from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier.
|-
| 0x1C || 0x20 || 4 || 8 || <tt>e_phoff</tt>
|Points to the start of the program header table. It usually follows the file header immediately, making the offset <code>0x34</code> or <code>0x40</code> for 32- and 64-bit ELF executables, respectively.
|-
| 0x20 || 0x28 || 4 || 8 || <tt>e_shoff</tt>
|Points to the start of the section header table.
|-
| 0x24 || 0x30 || colspan="2" | 4 || <tt>e_flags</tt>
|Interpretation of this field depends on the target architecture.
|-
| 0x28 || 0x34 || colspan="2" | 2 || <tt>e_ehsize</tt>
|Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format.
|-
| 0x2A || 0x36 || colspan="2" | 2 || <tt>e_phentsize</tt>
|Contains the size of a program header table entry. <!-- 0x38/0x20? -->
|-
| 0x2C || 0x38|| colspan="2" | 2 || <tt>e_phnum</tt>
|Contains the number of entries in the program header table.
|-
| 0x2E || 0x3A || colspan="2" | 2 || <tt>e_shentsize</tt>
|Contains the size of a section header table entry.
|-
| 0x30 || 0x3C || colspan="2" | 2 || <tt>e_shnum</tt>
|Contains the number of entries in the section header table.
|-
| 0x32 || 0x3E || colspan="2" | 2 || <tt>e_shstrndx</tt>
|Contains index of the section header table entry that contains the section names.
|}
 
Followed by the program header
 
{| class="wikitable"
|+ Program header
|-
! colspan="2" | Offset!! colspan="2" | Size (bytes) !! rowspan="2" | Field !! rowspan="2" | Purpose
|-
! 32-bit !! 64-bit !! 32-bit !! 64-bit
|-
| colspan="2" | 0x00 || colspan="2" | 4 ||<tt>p_type</tt>||Identifies the type of the segment.
{| class="wikitable"
|-
!Value!!Name!!Meaning
|-
|0x00000000||<tt>PT_NULL</tt>
| Program header table entry unused
|-
|0x00000001||<tt>PT_LOAD</tt>
| Loadable segment
|-
|0x00000002||<tt>PT_DYNAMIC</tt>
| Dynamic linking information
|-
|0x00000003||<tt>PT_INTERP</tt>
| Interpreter information
|-
|0x00000004||<tt>PT_NOTE</tt>
| Auxiliary information
|-
|0x00000005||<tt>PT_SHLIB</tt>
| reserved
|-
|0x00000006||<tt>PT_PHDR</tt>
| segment containing program header table itself
|-
|0x60000000||<tt>PT_LOOS</tt>
| rowspan="4" | see below
|-
|0x6FFFFFFF||<tt>PT_HIOS</tt>
|-
|-
|0x70000000||<tt>PT_LOPROC</tt>
| 0x22 || 2 || Unknown || Always 0x13, Except in Secure Modules (0x00)
|-
|-
|0x7FFFFFFF||<tt>PT_HIPROC</tt>
|}
|}
<tt>PT_LOOS</tt> to <tt>PT_HIOS</tt> (<tt>PT_LOPROC</tt> to <tt>PT_HIPROC</tt>) is an inclusive reserved ranges for operating system (processor) specific semantics.
|-
|  || 0x04 ||  || 4 ||<tt>p_flags</tt>||Segment-dependent flags (position for 64-bit structure).
|-
| 0x04 || 0x08 || 4 || 8||<tt>p_offset</tt>||Offset of the segment in the file image.
|-
| 0x08 || 0x10 || 4 || 8 ||<tt>p_vaddr</tt>||Virtual address of the segment in memory.
|-
| 0x0C || 0x18 || 4 || 8 ||<tt>p_paddr</tt>||On systems where physical address is relevant, reserved for segment's physical address.
|-
| 0x10 || 0x20 || 4 || 8 ||<tt>p_filesz</tt>||Size in bytes of the segment in the file image. May be 0.
|-
| 0x14 || 0x28 || 4 || 8 ||<tt>p_memsz</tt>||Size in bytes of the segment in memory. May be 0.
|-
| 0x18 ||  || 4 ||  ||<tt>p_flags</tt>||Segment-dependent flags (position for 32-bit structure).
|-
| 0x1C || 0x30 || 4 || 8 ||<tt>p_align</tt>||<code>0</code> and <code>1</code> specify no alignment. Otherwise should be a positive, integral power of 2, with <tt>p_vaddr</tt> equating <tt>p_offset</tt> modulus <tt>p_align</tt>.
|-
|0x20
|0x38
| colspan="3" |
|End of Program Header (size)
|}
= Program Identification Header =
Program Identification Header is located just before the SELF segments certifications.
{| class="wikitable"
! Offset !! Size !! Description !! Notes
|-
| 0 || 0x8 || [[Program Authority ID]] ||
|-
| 0x8 || 0x8 || [[Program Type]] ||
|-
| 0x10 || 0x8 || Program Version ||
|-
| 0x18 || 0x8 || System Software Version || Requested minimum version.
|-
| N.A/0x20 || 0x20 || Content ID || Only exists if the SELF is protected by NPDRM.
|-
| 0x20/0x40 || 0x20 || Digest || SHA-256 of the decrypted elf (for example, on 7.55 retail decrypted/mmapped elf libc.sprx hash is 67c19a2b053ee386819dcd316d21c4381b35bd3de283ce7ca2e143c86b34f79a)
|}
= Segment Certification =
From leaked decrypted PS4 6.00b1 Kernel (containing only one segment) the following information can be deduced:
{| class="wikitable"
! Offset !! Size !! Description !! Notes
|-
| 0 || 0x10 || AES Key || AES128CBC Key for Segment 1
|-
| 0x10 || 0x10 || AES IV || AES128CBC IV for Segment 1
|-
| 0x20 || 0x20 || HMAC Hash || SHA256HMAC Hash for Segment 1 (decrypted but compressed in this case) (without extra at footer)
|-
| 0x40 || 0x10 || HMAC Key || SHA256HMAC Key for Segment 1
|-
| 0x50 || 0x40 || License + BMP Header || ???
|-
| 0x90 || 0x20 || BMP Entries || 2 (0x10) Entries (first entry is NULL)
|-
| 0xB0 || 0x100 || RSA Signature || RSA Signature of the Segment Certification
|}
= Footer Signature =
Additionally, at the bottom of a SELF, there is likely a footer RSA signature as well as some extra data (relative size).
= Tools =
== Official tools ==
To document.
== Unofficial tools ==
=== SELF Decrypter on PS4 ===
[https://github.com/AlexAltea/orbital/blob/master/tools/dumper/source/self_decrypter.c PS4 SELF Decrypter on PS4 by AlexAltea]
As PS4 SELF decryption keys are not publicly known, to decrypt SELFs, one can use his PS4 as a blackbox. There are some conditions: the SELF must have valid signatures, it must have a required FW version lower than the FW version of the PS4 being used, and for System SELFs the SELF key_revision must be according to the PS4 FW version. There are exceptions like in first PS4 firmwares where some SELF checks were missing and allowed to decrypt SELFs that did not meet such requirements.
=== make_fself by flatz (2018) ===
* https://wololo.net/ps4-fpkg-writeup-by-flatz
=== make_fself.py (2018-2020) ===
* https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/master/scripts/make_fself.py
* https://github.com/nikolaevich23/PKGi-PS4/blob/master/make_fself.py
=== make_fself_gui by cfwprpht (2018) ===
* https://github.com/cfwprpht/make_fself_gui
=== free-ps2-pub-gen by cfwprpht (2018) ===
* https://github.com/cfwprpht/free-ps2-pub-gen
=== ps4_unfself by SocraticBliss (2020-2024) ===
* https://github.com/SocraticBliss/ps4_unfself
=== SELF backport tools ===
To be documented.
{{File Formats}}
<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/SELF_File_Format"