PRX File Format
Jump to navigation
Jump to search
Structure of the PRX Goes as follows
PRX File Format Structure
| Offset | Size | Description | Notes |
|---|---|---|---|
| 0x0 | 4 | Magic | ~PSP |
| 0x6 | 2 | Compression Type | 0x300-Plain, 0x200-KL4E, 0x100-2RLZ, 0x000-GZIP Little endian u16 & 0xF00 |
| 0x28 | 4 | Plaintext Size (ELF) | Little endian u32 |
| 0x2C | 4 | Total Size | Little endian u32 |
| 0x34 | 4 | Filetype | if ((s32)(header+0x34) >=0) (Determines if user (positive) or kernel (negative) ) |
| 0xD0 | 4 | Key Tag Type | Little endian u32 |
| 0x7C | 1 | Encryption Type | 0 - internal / 1 - ??? / 2 - supported by multiloader / 3 - Used by vshmain (???) |
PRX Types & Tags
Reversed by Linblow
Extracted from the mesg_led_02g kernel module (firmware6.61model 02g).
PSP header v1 (0/1/8)
Use PSP header structure v1.
Primary key size: 144 bytes.
No secondary key, and no secure ID.
Type 0: 03000000 (mode: 4 USER_MODULE) Type 0: 04000000 (mode: 5) Type 0: 05000000 (mode: 6) Type 0: 06000000 (mode: 7 PSAR_DEVTOOL) Type 0: 08000000 (mode: 9 UMD_GAME_EXEC) Type 0: 09000000 (mode: 10 GAMESHARING_EXEC) Type 0: 0A000000 (mode: 11 GAMESHARING_EXEC_DEVTOOL) Type 0: 0C000000 (mode: 13 DEMO_EXEC) Type 0: 0D000000 (mode: 14 APP_MODULE) Type 0: 0E000000 (mode: 15 PSAR_RETAIL) Type 0: 0F000000 (mode: 16 ME_IMAGE) Type 1: 3ACE4DCE (mode: 4 USER_MODULE) Type 1: C0CB167C (mode: 9 UMD_GAME_EXEC) Type 1: BB67C59F (mode: 10 GAMESHARING_EXEC) Type 1: 7F24BDCD (mode: 13 DEMO_EXEC) Type 1: 1BC8D12B (mode: 14 APP_MODULE) Type 1: 862648D1 (mode: 16 ME_IMAGE) Type 8: 02000000 (mode: 3 VSH_MODULE) Type 8: 0B000000 (mode: 12 MS_UPDATER)
PSP header v2
Use PSP header structure v2.
Primary key size: 16 bytes.
Secondary key size: 16 bytes.
Secure ID: type-dependent, 16 bytes.
Type 2/4/6/9 (no secure ID)
Type 2: 457B05F0 (mode: 4 USER_MODULE) Type 2: 457B06F0 (mode: 4 USER_MODULE) Type 2: 457B08F0 (mode: 4 USER_MODULE) Type 2: 457B0AF0 (mode: 4 USER_MODULE) Type 2: 457B0BF0 (mode: 4 USER_MODULE) Type 2: 457B0CF0 (mode: 4 USER_MODULE) Type 2: 457B10F0 (mode: 4 USER_MODULE) Type 2: 76202403 (mode: 4 USER_MODULE) Type 2: 628910F0 (mode: 5) Type 2: 8B9B10F0 (mode: 6) Type 2: 5A5C10F0 (mode: 7 PSAR_DEVTOOL) Type 2: E42C2303 (mode: 7 PSAR_DEVTOOL) Type 2: 8004FD03 (mode: 9 UMD_GAME_EXEC) Type 2: D91605F0 (mode: 9 UMD_GAME_EXEC) Type 2: D91606F0 (mode: 9 UMD_GAME_EXEC) Type 2: D9160AF0 (mode: 9 UMD_GAME_EXEC) Type 2: D9160BF0 (mode: 9 UMD_GAME_EXEC) Type 2: D91610F0 (mode: 9 UMD_GAME_EXEC) Type 2: D91611F0 (mode: 9 UMD_GAME_EXEC) [1] Type 2: 0A35EA03 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0505F0 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0506F0 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0508F0 (mode: 10 GAMESHARING_EXEC) Type 2: 7B0510F0 (mode: 10 GAMESHARING_EXEC) Type 2: EFD210F0 (mode: 11 GAMESHARING_EXEC_DEVTOOL) Type 2: D67B3303 (mode: 13 DEMO_EXEC) Type 2: D66DF703 (mode: 14 APP_MODULE) Type 2: 63BAB403 (mode: 15 PSAR_RETAIL) Type 2: D82310F0 (mode: 15 PSAR_RETAIL) Type 2: 1B11FD03 (mode: 16 ME_IMAGE) Type 2: D13B05F0 (mode: 16 ME_IMAGE) Type 2: D13B06F0 (mode: 16 ME_IMAGE) Type 2: D13B08F0 (mode: 16 ME_IMAGE) Type 2: D13B10F0 (mode: 16 ME_IMAGE) Type 2: 3C2A08F0 (mode: 22) Type 2: 3C2A10F0 (mode: 22) Type 4: ADF310F0 (mode: 13 DEMO_EXEC) Type 4: ADF305F0 (mode: 13 DEMO_EXEC) Type 4: ADF306F0 (mode: 13 DEMO_EXEC) Type 4: ADF308F0 (mode: 13 DEMO_EXEC) Type 4: 279D05F0 (mode: 14 APP_MODULE) Type 4: 279D06F0 (mode: 14 APP_MODULE) Type 4: 279D08F0 (mode: 14 APP_MODULE) Type 4: 279D10F0 (mode: 14 APP_MODULE) Type 6: 457B80F0 (mode: 4 USER_MODULE) Type 6: 457B8AF0 (mode: 4 USER_MODULE) Type 6: D91680F0 (mode: 9 UMD_GAME_EXEC) [1] Type 9: 380290F0 (mode: 3 VSH_MODULE) Type 9: 380291F0 (mode: 3 VSH_MODULE) Type 9: 457B90F0 (mode: 4 USER_MODULE) Type 9: 457B91F0 (mode: 4 USER_MODULE) Type 9: 0B2B91F0 (mode: 8 VSH_INDEX_DAT) Type 9: D91690F0 (mode: 9 UMD_GAME_EXEC) [1]
Type 3/5/7/10 (optional secure ID)
Type 3: 89742B04 (mode: 18 MS_DNAS_DRMBB) Type 3: E92408F0 (mode: 18 MS_DNAS_DRMBB) Type 3: E92410F0 (mode: 18 MS_DNAS_DRMBB) Type 3: 692808F0 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) Type 3: 692810F0 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) Type 3: F5F12304 (mode: 19 MS_DNAS_DRMBB_DEVTOOL) Type 5: 0DAA06F0 (mode: 20 POPS_EXEC) Type 5: 0DAA10F0 (mode: 20 POPS_EXEC) Type 5: E1ED06F0 (mode: 21) Type 5: E1ED10F0 (mode: 21) Type 5: 407810F0 (mode: 23) Type 5: 2E5E10F0 (mode: 25 MS_BOOT_PATCH) Type 5: 2E5E11F0 (mode: 25 MS_BOOT_PATCH) [1] Type 7: 2E5E80F0 (mode: 25 MS_BOOT_PATCH) [1] Type 10: 2E5E90F0(mode: 25 MS_BOOT_PATCH) [1]
Notes
PRX type 9 and 10 also have an early ECDSA signature check in the decryption routine (mesg_led).
The public key used for the signature check depends on the PRX tag.
Since the corresponding ECDSA private keys are unknown, we cannot create legit type 9/10 PRX.