PS3 [Question] SPRX signed as 'Certified file'

[jordywastaken]

Hi psx-place!
I stumbled upon an interesting sprx, so I decided to yeet it into ida but the output seemed incorrect, so I decided to take a peek at the decrypted prx in HxD and that's when I realized it was no ordinary sprx.

I took a look around on psdevwiki and noticed that the start of the prx matched with the 'cf_header' structure, I then looked at the rest of the header and noticed this:

Pretty funny isn't it?
After that I loaded the prx in ida as a binary file to get access to the elf header and segment headers to map them out, I managed to label most of it and noticed that the 3 main segment of the sprx are zlib compressed

I then extracted each segment into different .bin files and extracted their content with an open source zlib tool, checked with HxD and they seemed correct, first segment contains code, second segment contains a mix of code and data and the third segment contains only data.

My question is: Is there any tool to decompress automatically 'Certified file' signed prx and elf files? On the wiki it is specified that system software packages (e.g. .pkg, .spkg_hdr.X) and others are also signed with this format.


Sources:
- https://www.psdevwiki.com/ps3/Certified_File
- https://www.psdevwiki.com/ps3/SELF_-_SPRX

 

[TheRouLetteBoi]

Ah Yes Mr. Hacker Enstone

Don't let him get in your KEYZ

You have 3 options
1. either make your own unfself to convert sprx to prx (but hard code the keys or use different file name for keys)
2. use Break 'n' Make tool
3. decrypted file can be found here. https://github.com/TheRouletteBoi/ps3RE/tree/9aa613e23a0148a12b98c0ecd7025d298a2be0c8/484/VSH

btw he will most likely change obfuscation methods after he sees this post. So be ready for more research


UPDATE: does anyone have Break 'n' Make source code?

 

[Joonie]

UPDATE: does anyone have Break 'n' Make source code?

CC @mathieulh @zecoxao

 

[jordywastaken]

2. use Break 'n' Make tool
3. decrypted file can be found here. https://github.com/TheRouletteBoi/ps3RE/tree/9aa613e23a0148a12b98c0ecd7025d298a2be0c8/484/VSH

I loaded the prx from your repo into ida, segments are not being created so I had to do it myself. The opd section isn't loaded into ida either which makes the module info not so useful