Revision as of 20:05, 4 October 2015

File Format

/*Needs Documentation*/ Files here

Similar to PUP file.

Structure (highly speculative) is as follows (most parts are byteswapped):

The file starts with a global header :

Offset	Length	Type	Information	Example
0x0	0x8	unsigned long	Magic	("SCECAF")
0x8	0x8	unsigned long	Package Version	(0x02)
0x10	0x8	unsigned long	Image Version	(0x01)
0x18	0x8	unsigned long	Files Count	(0x01)
0x20	0x8	unsigned long	Header Length	(0xC0)
0x28	0x8	unsigned long	Package Length	(0x40)

Entries are then described as follows (There are as many entries as there are files) :

Offset	Length	Type	Information	Example
0x0	0x8	unsigned long	Entry ID	(0x0)
0x8	0x8	unsigned long	Data offset	(0xC0)
0x10	0x8	unsigned long	Data length	(0x40)
0x18	0x8	unsigned long	Unknown	(0x01)
0x20	0x8	unsigned long	Unknown	(0x02)
0x28	0x10	u8[16]	IV	Random IV
0x30	0x8	unsigned long	Padding	(0x0)

Then follows SHA-256 hashes. They probably are salted hashes of the entry headers.

Offset	Length	Type	Information	Example
0x0	0x8	unsigned long	Entry ID	(0x0)
0x8	0x20	u8[32]	SHA-256 Sum	sha256sum
0x28	0x8	unsigned long	Padding	(0x0)

Files data follows. The data is encrypted (using AES-128-CBC ?). Entries are as follows :

Offset	Length	Type	Information	Example
0x0	0x20	u8[32]	SHA-256 Sum	sha256sum
0x20	Variable		Encrypted file data

SCECAF files are used for coredump files. They can be found in ux0:data.

Example :

ux0:data/crash_report.caf

ux0:data/psp2core-SceVideoPlayer.spsp2dmp

@@ Line 63: / Line 63: @@
 | 0x8 || 0x20 || u8[32] || SHA-256 Sum || sha256sum
 |-
-| 0x8 || 0x8 || unsigned long || Padding || (0x0)
+| 0x28 || 0x8 || unsigned long || Padding || (0x0)
 |-
 |}