velovix
Forum Noob
Recently, I got my hands on some early PS3 .PUP files from back when they were still using dev kits (early-mid 2006) and I decided to pick them apart to see what was inside. I got to some Sony files (.RCO, .GIM, etc), but the ones that weren't even recognized by PKGview were the ones in the File_5 folder. I eventually decided to look deeper into one of the files (CORE_OS_PACKAGE.pkg) with a hex editor and began to look for file headers. Interestingly, there were some .zip headers that looked a little off. Normally, the beginning of .zip headers look like this: 50 4B 03 04. But the ones i got had the 50 4B parts on them, just not the remaining 2 bytes of 03 and 04. Those remaining 2 bytes were gone and replaced with whatever 2 bytes came after leaving behind "PK" in the decoded text. I thought at first that these files were encrypted with some sort of key (NPDRM, AES). I tried to decrypt them using openSSL prompts and the retail and debug .pkg AES key, which at first seemed to work until i looked deeper into the file where i realized it looked entirely scrambled and unreadable. However, there still seemed to be several "PK" headers within the junk.
Here are the first 250 bytes from the unmodified CORE_OS_PACKAGE.
=================================================================================
53 43 45 00 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 00 00 02 80 00 00 00 00 00 70 00 60 DA BD AD C7 E0 28 05 FC 5D E7 78 D2 32 32 43 D7 3B F4 86 FA A6 BB F2 3E E5 F0 FF 07 2A 7F 65 A4 31 06 94 7D 12 FD 85 30 7E C3 A0 AF 6F 50 6A FE 19 F7 95 0E 47 CA BF C2 4F BC 8F BB 0B BA D5 AF A6 21 7A B7 B2 DE DF E8 82 0B 02 4C 74 1A 34 72 E3 15 A8 04 70 A1 F5 CE 5E 2C A0 97 ED 73 A1 50 6C 19 C7 4C 5E 3A 7D 61 5E DB 0A 21 AD 90 5B 90 59 F2 0C 7D F1 B7 51 8D E3 81 D3 6A AD 9F A0 D3 BC A0 8A 3D 3F BE 19 FE 73 64 FC 1F E5 0A 6C A8 D5 F7 FA 9A 17 DB 74 A4 7E CE F9 CE AF 5B D7 02 42 14 22 71 6E D0 5A 9A E0 79 01 19 CA 68 71 BD 91 3A 24 A3 D5 1E 3A 6E 7B 12 EA E0 6F E8 2B 90 30 0B C6 D8 A8 35 C1 9E D2 A7 5C 73 A4 54 43 8B 88 1E E6 79 D5 73 65 1A 7B 86 06 EB 85 7F 9D D7 26 28 00 6B 59 98 AC B8 CB C6 DD EA 79 7A 6B AB 45 24 D2 80 99 73 DA 05 AB 1E B8 85 5B CB C1 7D E2 5A 73 9E 6A 9B 71 3A EA 34 DE 29 F3 1B 84 67 39 1C FF 29 28 65 9F 1E DE 9F DC A2 C5 E5 38 93 A4 CF E1 80 0C 7F B1 23 DA 20 13 31 F9 A9 AF 29 B6 6E 6B 57 D4 03 96 E1 CD CF 46 F9 6C B5 3D B0 6C 05 CD E5 EA D2 65 7A F0 CB 23 52 36 D7 B4 B8 08 01 3C F5 E2 88 BA 68 D2 F3 63 2F 95 66 1B A0 80 6F 27 E4 98 D3 F4 FB A5 BB 17 D4 28 B0 98 8D C6 B8 95 A5 7B 15 13 0C A7 CB E2 07 76 EF 6C CC A0 1A EF 80 75 3D 48 7D E7 E1 BA 26 9C 22 2F 42 62 8B D5 D7 94 97 9C A1 E8 B0 3D D7 5A 56 84 77 D2 2E 4A F5 D4 A6 89 F0 89 9D 82 68 05 C8 DB 3D E1 CC 73 E4 0D AA 64 A6 C9 A9 08 F1 2C 42 9A C5 48 DE BC 7B F0 71 38 5D 3A 6B E8 F3 82 D1 A9 DC 75 A8 40 FD F5 05 63 C0 F0 4C 46 24 25 9F 61 7F F1 DA 84 55 42 6A B8 F9 D4 0D 99 BC 6D 74 33 5A 27 18 A5 21 2F 88 6B 35 75 3B 0A 8C DA 75 74 DD 02 7B 41 75 29 91 E6 21 66 C3 4B 17 2F 8F 74 15 99 3A 5D 84 A8 DC 1D C7 62 11 D4 2E FA 31 CB 00 DF AD 64 9F AC 2F 1A D5 69 8F 20 BD 14 85 44 C7
============================================================================
And here is the first 250 bytes from the "decrypted" CORE_OS_PACKAGE.
============================================================================
55 F3 2D 1B A8 5D 3E 97 98 61 D0 7A 91 83 85 48 C5 45 05 A0 18 18 0C 46 C1 BC 89 15 1D 13 92 B1 AE C5 D2 55 BB 23 7D 6A 55 DA E0 3A AC D4 3E 32 23 C6 8F 72 49 C0 9B AB 6E 3C 62 13 50 C5 CB 4C 5E D9 FF 81 D2 FA CE F8 7D 55 11 E8 CF 52 FC E3 BA 81 22 64 D4 EA C4 8E F9 E5 45 F6 66 09 3A 5F 73 41 22 04 B3 88 B6 62 45 AE 5B 93 54 C4 EB 1D 32 2C 72 B3 43 EB 6A BC A8 9C 71 B5 95 50 AA 44 04 75 70 32 AE F8 99 91 AC A9 E6 40 63 85 EC 22 2A A6 B1 B3 26 A6 E5 95 07 E2 B3 A0 22 69 43 2E B8 1B 9D 35 25 F6 5E 7C F9 11 EB 31 99 FD 00 F6 60 DC F1 5B 54 20 DB 49 D4 8C C7 20 63 4C 7C 4C EC D1 0E 48 84 0D C8 46 F3 E3 BB 48 5C EC F4 28 1E 5C ED 6F 7F 93 C8 EF 3C 7B 72 6C 71 64 0A 4D A7 C6 B9 C3 CE 81 D9 16 E0 32 14 3B 28 04 F1 9C A0 2E B7 B4 B9 71 06 6D C3 0E AF DD 74 63 F6 91 22 72 21 31 26 04 A4 54 40 95 EC 52 F4 7C 7B 41 D4 54 D8 0D 9F 6D 82 7E 34 AB 11 19 2E 03 C1 B7 5D F4 8D 9C D3 55 B1 51 62 A1 7D DC B4 E6 DF 0A C3 D1 86 7B FB 09 0B 44 09 A5 EB 1E 15 11 67 EA 2C 26 16 49 D1 A4 86 14 DD DA F9 E3 62 D9 ED CF 4F DB D0 CA 73 FD A5 E7 40 80 79 88 2F DA 75 3E 1C 51 C9 FE 1E C6 D5 D4 DC DA C0 3B 2A 1A 31 79 4A E8 67 3E 52 1B 87 9C 7E 5E F7 37 2B E4 27 67 10 11 7E CA ED C6 8A 59 5D 25 B9 9E 3E 85 AC 02 32 87 2B DA 67 6D 1F 6C 7B 23 95 00 01 E4 43 75 1C 4B E6 EA BC 95 4C ED 55 62 76 2A 1E DA E2 60 88 19 D0 A7 DB 71 55 22 05 17 A8 30 84 AC 7A 77 FE 11 9E 3C 60 F5 AC 95 A1 3B 7E F2 0E 78 57 50 AE BD 1F 7F E3 49 CF 55 C3 20 3D CB DC D2 07 41 91 7E D0 0B BD 47 15 23 45 49 F6 60 B3 A4 17 D3 6D 96 DD BA 3D 6E BC AE 86 7A EA C8 8B B5 F1 A7 66 9D D4 3B F7 24 49 97 40 F0 30 72 97 A1 F6 8B 8F 7F 40 6C 56 E4 29 04 81 34 C8 A0 2B 05 23 C5 CA 6C B7 97 7C 4E 77 BD 4D 80 31 9E 44 01 8A F3 2B 9E 1D 36 C8 12 59 B9 8F BA 82 D5 D2 04 14 83 1D 08 37 E7 FA 58 26 B3 49 09 D2 97 9E 06 E3 59
=================================================================================
PKGview even opened a copy of a WebMAN .pkg with no issues. I cannot figure out why the CORE_OS_PACKAGE file does not open. Maybe they used a different mechanism and/or key for making these types of files. Maybe there is a tool out there that can just, open these non-standard .pkg files. Any clue on what i should try next? Thanks.
Here are the first 250 bytes from the unmodified CORE_OS_PACKAGE.
=================================================================================
53 43 45 00 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 00 00 02 80 00 00 00 00 00 70 00 60 DA BD AD C7 E0 28 05 FC 5D E7 78 D2 32 32 43 D7 3B F4 86 FA A6 BB F2 3E E5 F0 FF 07 2A 7F 65 A4 31 06 94 7D 12 FD 85 30 7E C3 A0 AF 6F 50 6A FE 19 F7 95 0E 47 CA BF C2 4F BC 8F BB 0B BA D5 AF A6 21 7A B7 B2 DE DF E8 82 0B 02 4C 74 1A 34 72 E3 15 A8 04 70 A1 F5 CE 5E 2C A0 97 ED 73 A1 50 6C 19 C7 4C 5E 3A 7D 61 5E DB 0A 21 AD 90 5B 90 59 F2 0C 7D F1 B7 51 8D E3 81 D3 6A AD 9F A0 D3 BC A0 8A 3D 3F BE 19 FE 73 64 FC 1F E5 0A 6C A8 D5 F7 FA 9A 17 DB 74 A4 7E CE F9 CE AF 5B D7 02 42 14 22 71 6E D0 5A 9A E0 79 01 19 CA 68 71 BD 91 3A 24 A3 D5 1E 3A 6E 7B 12 EA E0 6F E8 2B 90 30 0B C6 D8 A8 35 C1 9E D2 A7 5C 73 A4 54 43 8B 88 1E E6 79 D5 73 65 1A 7B 86 06 EB 85 7F 9D D7 26 28 00 6B 59 98 AC B8 CB C6 DD EA 79 7A 6B AB 45 24 D2 80 99 73 DA 05 AB 1E B8 85 5B CB C1 7D E2 5A 73 9E 6A 9B 71 3A EA 34 DE 29 F3 1B 84 67 39 1C FF 29 28 65 9F 1E DE 9F DC A2 C5 E5 38 93 A4 CF E1 80 0C 7F B1 23 DA 20 13 31 F9 A9 AF 29 B6 6E 6B 57 D4 03 96 E1 CD CF 46 F9 6C B5 3D B0 6C 05 CD E5 EA D2 65 7A F0 CB 23 52 36 D7 B4 B8 08 01 3C F5 E2 88 BA 68 D2 F3 63 2F 95 66 1B A0 80 6F 27 E4 98 D3 F4 FB A5 BB 17 D4 28 B0 98 8D C6 B8 95 A5 7B 15 13 0C A7 CB E2 07 76 EF 6C CC A0 1A EF 80 75 3D 48 7D E7 E1 BA 26 9C 22 2F 42 62 8B D5 D7 94 97 9C A1 E8 B0 3D D7 5A 56 84 77 D2 2E 4A F5 D4 A6 89 F0 89 9D 82 68 05 C8 DB 3D E1 CC 73 E4 0D AA 64 A6 C9 A9 08 F1 2C 42 9A C5 48 DE BC 7B F0 71 38 5D 3A 6B E8 F3 82 D1 A9 DC 75 A8 40 FD F5 05 63 C0 F0 4C 46 24 25 9F 61 7F F1 DA 84 55 42 6A B8 F9 D4 0D 99 BC 6D 74 33 5A 27 18 A5 21 2F 88 6B 35 75 3B 0A 8C DA 75 74 DD 02 7B 41 75 29 91 E6 21 66 C3 4B 17 2F 8F 74 15 99 3A 5D 84 A8 DC 1D C7 62 11 D4 2E FA 31 CB 00 DF AD 64 9F AC 2F 1A D5 69 8F 20 BD 14 85 44 C7
============================================================================
And here is the first 250 bytes from the "decrypted" CORE_OS_PACKAGE.
============================================================================
55 F3 2D 1B A8 5D 3E 97 98 61 D0 7A 91 83 85 48 C5 45 05 A0 18 18 0C 46 C1 BC 89 15 1D 13 92 B1 AE C5 D2 55 BB 23 7D 6A 55 DA E0 3A AC D4 3E 32 23 C6 8F 72 49 C0 9B AB 6E 3C 62 13 50 C5 CB 4C 5E D9 FF 81 D2 FA CE F8 7D 55 11 E8 CF 52 FC E3 BA 81 22 64 D4 EA C4 8E F9 E5 45 F6 66 09 3A 5F 73 41 22 04 B3 88 B6 62 45 AE 5B 93 54 C4 EB 1D 32 2C 72 B3 43 EB 6A BC A8 9C 71 B5 95 50 AA 44 04 75 70 32 AE F8 99 91 AC A9 E6 40 63 85 EC 22 2A A6 B1 B3 26 A6 E5 95 07 E2 B3 A0 22 69 43 2E B8 1B 9D 35 25 F6 5E 7C F9 11 EB 31 99 FD 00 F6 60 DC F1 5B 54 20 DB 49 D4 8C C7 20 63 4C 7C 4C EC D1 0E 48 84 0D C8 46 F3 E3 BB 48 5C EC F4 28 1E 5C ED 6F 7F 93 C8 EF 3C 7B 72 6C 71 64 0A 4D A7 C6 B9 C3 CE 81 D9 16 E0 32 14 3B 28 04 F1 9C A0 2E B7 B4 B9 71 06 6D C3 0E AF DD 74 63 F6 91 22 72 21 31 26 04 A4 54 40 95 EC 52 F4 7C 7B 41 D4 54 D8 0D 9F 6D 82 7E 34 AB 11 19 2E 03 C1 B7 5D F4 8D 9C D3 55 B1 51 62 A1 7D DC B4 E6 DF 0A C3 D1 86 7B FB 09 0B 44 09 A5 EB 1E 15 11 67 EA 2C 26 16 49 D1 A4 86 14 DD DA F9 E3 62 D9 ED CF 4F DB D0 CA 73 FD A5 E7 40 80 79 88 2F DA 75 3E 1C 51 C9 FE 1E C6 D5 D4 DC DA C0 3B 2A 1A 31 79 4A E8 67 3E 52 1B 87 9C 7E 5E F7 37 2B E4 27 67 10 11 7E CA ED C6 8A 59 5D 25 B9 9E 3E 85 AC 02 32 87 2B DA 67 6D 1F 6C 7B 23 95 00 01 E4 43 75 1C 4B E6 EA BC 95 4C ED 55 62 76 2A 1E DA E2 60 88 19 D0 A7 DB 71 55 22 05 17 A8 30 84 AC 7A 77 FE 11 9E 3C 60 F5 AC 95 A1 3B 7E F2 0E 78 57 50 AE BD 1F 7F E3 49 CF 55 C3 20 3D CB DC D2 07 41 91 7E D0 0B BD 47 15 23 45 49 F6 60 B3 A4 17 D3 6D 96 DD BA 3D 6E BC AE 86 7A EA C8 8B B5 F1 A7 66 9D D4 3B F7 24 49 97 40 F0 30 72 97 A1 F6 8B 8F 7F 40 6C 56 E4 29 04 81 34 C8 A0 2B 05 23 C5 CA 6C B7 97 7C 4E 77 BD 4D 80 31 9E 44 01 8A F3 2B 9E 1D 36 C8 12 59 B9 8F BA 82 D5 D2 04 14 83 1D 08 37 E7 FA 58 26 B3 49 09 D2 97 9E 06 E3 59
=================================================================================
PKGview even opened a copy of a WebMAN .pkg with no issues. I cannot figure out why the CORE_OS_PACKAGE file does not open. Maybe they used a different mechanism and/or key for making these types of files. Maybe there is a tool out there that can just, open these non-standard .pkg files. Any clue on what i should try next? Thanks.
