Editing SCECAF File Format

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
[[Category:Software]]<noinclude>[[Category:Main]]</noinclude>
[[Category:Software]]<noinclude>[[Category:Main]]</noinclude>
Files from coredumps or crash reports are in SCECAF format when encrypted. The file names will be either crash_report.caf or a coredump with a filetype of .spsp2dmp. All data is in little endian format.


== SCECAF Container File Structure ==
= File Format  =
/*Needs Documentation*/
Files [http://f.lui.li/get_3366_2bba.html here]


Similar to PUP file.


=== Header ===
Structure (highly speculative) is as follows (most parts are byteswapped):
 
== Structure ==
 
The file starts with a global header :


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! Offset !! Length !! Type !! Information !! Example
|-
|-
| 0x0 || 0x8 || <code>0x5343454341460000</code> Magic "SCECAF\0\0"
| 0x0 || 0x8 || unsigned long || Magic || ("SCECAF")
|-
|-
| 0x8 || 0x8 || Type (?1: PS4?, 2: PSVita)
| 0x8 || 0x8 || unsigned long || Package Version || (0x02)
|-
|-
| 0x10 || 0x8 || HMAC Key ID (always 1)
| 0x10 || 0x8 || unsigned long || Image Version || (0x01)
|-
|-
| 0x18 || 0x8 || Number of sections
| 0x18 || 0x8 || unsigned long || Files Count || (0x01)
|-
|-
| 0x20 || 0x8 || Size of Header
| 0x20 || 0x8 || unsigned long || Header Length || (0xC0)
|-
|-
| 0x28 || 0x8 || Total Sections Size
| 0x28 || 0x8 || unsigned long || Package Length || (0x40)
 
|-
|-
|}
|}


=== Section Meta Block ===
Entries are then described as follows (There are as many entries as there are files) :


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! Offset !! Length !! Type !! Information !! Example
|-
|-
| 0x0 || 0x8 || Section ID (starts with 0)
| 0x0 || 0x8 || unsigned long || Entry ID || (0x0)
|-
|-
| 0x8 || 0x8 || Section Start Offset
| 0x8 || 0x8 || unsigned long || Data offset || (0xC0)
|-
|-
| 0x10 || 0x8 || Section Length
| 0x10 || 0x8 || unsigned long || Data length || (0x40)
|-
|-
| 0x18 || 0x8 || HMAC Key ID (Always 1)
| 0x18 || 0x8 || unsigned long || Unknown || (0x01)
|-
|-
| 0x20 || 0x8 || Encryption Key ID (Always 2)
| 0x20 || 0x8 || unsigned long || Unknown|| (0x02)
|-
|-
| 0x28 || 0x10 || Encryption IV
| 0x28 || 0x10 || u8[16] || IV || Random IV
|-
|-
| 0x38 || 0x8 || Filler
| 0x30 || 0x8 || unsigned long || Padding|| (0x0)
 
|-
|-
|}
|}


=== Section Hash Block ===
Then follows SHA-256 hashes. They probably are salted hashes of the entry headers.


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! Offset !! Length !! Type !! Information !! Example
|-
|-
| 0x0 || 0x8 || Section ID (starts with 0)
| 0x0 || 0x8 || unsigned long || Entry ID || (0x0)
|-
|-
| 0x8 || 0x20 || HMAC Hash
| 0x8 || 0x20 || u8[32] || SHA-256 Sum || sha256sum
|-
|-
| 0x28 || 0x8 || Filler
| 0x8 || 0x8 || unsigned long || Padding || (0x0)
|-
|-
|}
|}


=== Header Hash Block ===
Files data follows. The data is encrypted (using AES-128-CBC ?). Entries are as follows :


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Description
! Offset !! Length !! Type !! Information !! Example
|-
| 0x0 || 0x20 || u8[32] || SHA-256 Sum || sha256sum
|-
|-
| 0x0 || 0x20 || HMAC Hash
| 0x20 || Variable || || Encrypted file data ||  
|-
|-
|}
|}


=== Sections ===


Sections are data (normally Gzipped ELF core or CPAD padding) that are encrypted. The encryption is AES 128 in CBC. The IV comes from the Section Meta Header and the key is one of the 4 keys listed in the [[Keys#Coredump_Keys]] page for Coredumps. The HMAC is the SCE-Modified HMAC SHA256. The HMAC Key is one of the 3 listed on the [[Keys#Coredump_Keys]] page as well. The current theory is which key is specified in the section meta header, though since there are no sample that vary, it is just a guess.
= Location =
 
SCECAF files are used for coredump files. They can be found in ux0:data.


== Kernel Coredump Encrypted ELF ==
Example :


On firmwares 2.12 and greater, a SceKernelProcess coredump can be created when a critical error (such as a DABT or PABT) occurs in a syscall or kernel thread. The data is encrypted and compressed prior to being wrapped in the SCECAF container.  
ux0:data/crash_report.caf


=== Process ===
ux0:data/psp2core-SceVideoPlayer.spsp2dmp


# The exception handler in the kernel calls SMC 0x122 with the arguments (Error type, TTBR0, VBAR, SysRoot VA)
# TrustZone Configures Pervasive Device and SceGrab device - need why still
# Reset SceDmac5Reg Device
# Create a SceCrashDumpHeader at PA 0x58000000 on retail and 0x60000000 on devkit
# Map SceCrashDumpZero to start of DRAM at PA 0x40000000
# Configure SceDmac5Reg and loop through all of VRAM at PA 0x20000000 in 0x1000 byte chunks
# Configure SceDmac5Reg and loop through all of DRAM at PA 0x40200000 in 0x10000 byte chunks
# Call SMC 0x11A to initial a reboot in requested coredump mode
# Upon reboot, coredump handler will create a SCECAF container of the data in 0x58000000 or 0x60000000


= Location =
== crash_report.caf ==


SCECAF files are used for coredump files. They can be found in ux0:data.


Example :
== psp2core-*.spsp2dmp ==
<source>
ux0:data/crash_report.caf
ux0:data/psp2core-SceVideoPlayer.spsp2dmp
</source>
Please note that all contributions to Vita Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see Vita Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/vita/SCECAF_File_Format"