Editing SCECAF File Format

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[[Category:Software]]<noinclude>[[Category:Main]]</noinclude>
[[Category:Software]]<noinclude>[[Category:Main]]</noinclude>
Files from coredumps or crash reports are in SCECAF format when encrypted. The file names will be either crash_report.caf or a coredump with a filetype of .spsp2dmp. All data is in little endian format.
= File Format  =
/*Needs Documentation*/
Files [http://f.lui.li/get_3366_2bba.html here]


== SCECAF Container File Structure ==
Similar to PUP file.


Structure (highly speculative) is as follows (most parts are byteswapped):


=== Header ===
== For caf ==


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! Offset !! Length !! Type !! Information
|-
|-
| 0x0 || 0x8 || <code>0x5343454341460000</code> Magic "SCECAF\0\0"
| 0x0 || 0x8 || unsigned long || Magic "SCECAF")
|-
|-
| 0x8 || 0x8 || Type (?1: PS4?, 2: PSVita)
| 0x8 || 0x8 || unsigned long || Package Version (0x02)
|-
|-
| 0x10 || 0x8 || HMAC Key ID (always 1)
| 0x10 || 0x8 || unsigned long || Image Version (0x01)
|-
|-
| 0x18 || 0x8 || Number of sections
| 0x18 || 0x8 || unsigned long || File Count (0x01)
|-
|-
| 0x20 || 0x8 || Size of Header
| 0x20 || 0x8 || unsigned long || Header Length (0xC0)
|-
|-
| 0x28 || 0x8 || Total Sections Size
| 0x28 || 0x8 || unsigned long || Package Length (0x40)
 
|-
| 0x30 || 0x8 || unsigned long || Unk (0x01)
|-
| 0x38 || 0x8 || unsigned long || Unk (0x02)
|-
|-
|}
|}


=== Section Meta Block ===
== For spsp2dmp ==


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! Offset !! Length !! Type !! Information
|-
| 0x0 || 0x8 || Section ID (starts with 0)
|-
| 0x8 || 0x8 || Section Start Offset
|-
| 0x10 || 0x8 || Section Length
|-
| 0x18 || 0x8 || HMAC Key ID (Always 1)
|-
| 0x20 || 0x8 || Encryption Key ID (Always 2)
|-
| 0x28 || 0x10 || Encryption IV
|-
| 0x38 || 0x8 || Filler
 
|-
|-
|}
| 0x0 || 0x8 || unsigned long || Magic "SCECAF")
 
=== Section Hash Block ===
 
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
| 0x8 || 0x8 || unsigned long || Package Version (0x02)
|-
|-
| 0x0 || 0x8 || Section ID (starts with 0)
| 0x10 || 0x8 || unsigned long || Image Version (0x01)
|-
|-
| 0x8 || 0x20 || HMAC Hash
| 0x18 || 0x8 || unsigned long || File Count (0x02)
|-
|-
| 0x28 || 0x8 || Filler
| 0x20 || 0x8 || unsigned long || Header Length (0x130)
|-
|-
|}
| 0x28 || 0x8 || unsigned long || Package Length (0x70CC0)
 
=== Header Hash Block ===
 
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
| 0x30 || 0x8 || unsigned long || Unk (0x01)
|-
|-
| 0x0 || 0x20 || HMAC Hash
| 0x38 || 0x8 || unsigned long || Unk (0x02)
|-
|-
|}
|}
=== Sections ===
Sections are data (normally Gzipped ELF core or CPAD padding) that are encrypted. The encryption is AES 128 in CBC. The IV comes from the Section Meta Header and the key is one of the 4 keys listed in the [[Keys#Coredump_Keys]] page for Coredumps. The HMAC is the SCE-Modified HMAC SHA256. The HMAC Key is one of the 3 listed on the [[Keys#Coredump_Keys]] page as well. The current theory is which key is specified in the section meta header, though since there are no sample that vary, it is just a guess.
== Kernel Coredump Encrypted ELF ==
On firmwares 2.12 and greater, a SceKernelProcess coredump can be created when a critical error (such as a DABT or PABT) occurs in a syscall or kernel thread. The data is encrypted and compressed prior to being wrapped in the SCECAF container.
=== Process ===
# The exception handler in the kernel calls SMC 0x122 with the arguments (Error type, TTBR0, VBAR, SysRoot VA)
# TrustZone Configures Pervasive Device and SceGrab device - need why still
# Reset SceDmac5Reg Device
# Create a SceCrashDumpHeader at PA 0x58000000 on retail and 0x60000000 on devkit
# Map SceCrashDumpZero to start of DRAM at PA 0x40000000
# Configure SceDmac5Reg and loop through all of VRAM at PA 0x20000000 in 0x1000 byte chunks
# Configure SceDmac5Reg and loop through all of DRAM at PA 0x40200000 in 0x10000 byte chunks
# Call SMC 0x11A to initial a reboot in requested coredump mode
# Upon reboot, coredump handler will create a SCECAF container of the data in 0x58000000 or 0x60000000
= Location =
SCECAF files are used for coredump files. They can be found in ux0:data.
Example :
<source>
ux0:data/crash_report.caf
ux0:data/psp2core-SceVideoPlayer.spsp2dmp
</source>
Please note that all contributions to Vita Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see Vita Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/vita/SCECAF_File_Format"