Giter VIP home page Giter VIP logo

pspdecrypt's Introduction

pspdecrypt

A quick and dirty tool to decrypt PSP binaries, and also PSP updaters (PSAR format)

Licensed under GPLv3

Decryption code copied from ppsspp, making use of libkirk by draan

KL3E & KL4E implementation and PSAR extraction by artart78

Usage

pspdecrypt is capable of decrypting PRX and IPL files as well as decrypting and extracting PSAR archives and its contents, including IPL stages where possible.

Release Notes

1.0

  • Merges pspdecrypt and psardecrypt into one binary
  • Top-level utility re-write with additional options by @artart78
  • syscon key ipl xor support by @proximav
  • Disable broken KIRK1 ECDSA signature verification that was slowing down extraction for certain OFW
  • Support for decrypting remaining IPL variants
  • Replace Table decryption with DES implementation

0.8

  • Adds KL3E & KL4E decompression support for PSAR contents
  • Adds PSAR support
  • Extracts most public FW, older JigKick payloads, and most TT FW

Initial release (unversioned)

  • Decrypts PRX files

pspdecrypt's People

Contributors

artart78 avatar balika011 avatar john-k avatar krystalgamer avatar proximav avatar spenon-dev avatar yoti avatar zecoxao avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

pspdecrypt's Issues

Ugly error text while decrypting bogus FW

All the text in one line and also empty string

<...>
'flash0:/kd/loadcore.prx' expanded,decrypted,saved!
'flash0:/kd/loadcorei.prx' expanded,decrypted,saved!
'flash0:/kd/loadexec.prx' expanded,saved,extracting reboot.binCannot find reboot.bin inside loadexec.

'flash0:/kd/me_for_vsh.prx' expanded,decrypted,gzip,expanded,saved!
'flash0:/kd/me_wrapper.prx' expanded,decrypted,saved!
<...>

RCO extraction support?

I'm honestly not sure if this would even be the scope of this, but Resurssiklunssi is problematic on modern firmwares (I think it does work with (L)ME and leda.prx, but not able to verify right now) and there's otherwise no way I know of to extract rco files for later firmware versions, which I've come to realize is a pain recently seeing as I'm trying to modify the XMB waves.

I just want to know if it's something that could be considered for addition. Thanks.

Find out about missing keys for retail firmwares

There are issues with :

  • 5.05, 5.50, 5.51: expanded,error during decryption [tag 4c9420f0]. (10 modules)
  • 5.55: expanded,error during decryption [tag 4c941af0] (87 times), [tag 4c941bf0] (10 times), [tag 4c9421f0] (10 times)
  • 5.70 (fake PSAR): expanded,error during decryption [tag 4c941af0] (81 times), [tag 4c9421f0] (10 times)
  • 6.10go: '00005' Cannot decrypt 5g table FFFFFFFF [tag C0A39A7A]. (everything fails afterwards so there could be other keys missing for the modules themselves)
  • 6.20go: '00005' Cannot decrypt 5g table FFFFFFFF [tag A1C325FA]. (same as above)
  • 6.39 testing tool: expanded,error during decryption [tag 4c9480f0] (93 times)

Error while processing custom 4.21 PSAR

PSAR version 2
Firmware version 4.21.
table_mode = 2
'flash0:/data/cert/CA_LIST.cer' expanded,saved!
'flash0:/dic/atokp.dic' expanded,saved!
<...>
'flash0:/vsh/module/netplay_client_plugin.prx' expanded,decrypted,gzip,expanded,saved!
'flash0:/vsh/module/impose_plugin.prx' expanded,decrypted,gzip,expanded,saved!
'flash0:/vsh/module/content_browser.prx' expanded,decrypted,gzip,expanded,saved!
Decrypt IPL 1 failed 0x00000002, WTF!
'ipl:/nandipl_-2147352261g.ipl' expanded,saved!,descramble using xorkey 1,decrypted IPL,linearized at 040f0000,stage2 unscrambled & decompressed,kernel keys decrypted,stage3 decrypted
Done!
12.11.2021  23:01    <DIR>          .
12.11.2021  23:01    <DIR>          ..
12.11.2021  22:56                32 kkeys_nandipl_-2147352261g.ipl
12.11.2021  22:56           147 456 nandipl_-2147352261g.ipl
12.11.2021  22:56            76 144 reboot_03g.bin
12.11.2021  22:56           132 848 stage1_nandipl_-2147352261g.ipl
12.11.2021  22:56            54 404 stage2_nandipl_-2147352261g.ipl
12.11.2021  22:56            67 144 stage3_nandipl_-2147352261g.ipl

pspdecrypt doesn't extract gzip format to plaintext elf on PRXs

0x6 2 Compression Type 0x300-Plain, 0x200-KL4E, 0x100-2RLZ, 0x000-GZIP Little endian u16 & 0xF00
this flag can be found at PRX header, for some reason pspdecrypt handles everything properly except gzip formats, which it doesn't extract to plain elfs

Add support for the devkit kbooti/IPL blocks

The devkit kbooti/bootdispi/formati/dformat...., which contain devkit IPL blocks aren't supported yet,

These are the changes that need to be done:

All files that start with the following 0x10 bytes need to have the initial 0x1000 bytes skipped as the IPL only starts at 0x1000 in the file:

119D57D9E9DBA671F21092278A53E44D // kbooti 0.4.0

38045D6178F2501329690FCDF18F0930 // kbooti 0.6.0

C823470DD088E9126CE1E4F45CC90D0B // kbooti 0.7.0

D1ECAA62F333D3294519D95FF3402F8B // kbooti 0.9.0

027A247EB68166EEAC05EC157A328DFF // kbooti 2.6.0

1E9AD1BA7F28E2FE3DC329BD43B18B79 // kbooti 2.7.1

F3A5DBD7BA2064CD0786CE78B0EB6683 // kbooti 3.5.0

If the IPL blocks are using kbooti 3.5.0 (the file starts with the 0xF3A5DBD7BA2064CD0786CE78B0EB6683 bytes), then an xor step needs to be applied to the kirk1 header of each blocks (0x40 bytes of each blocks)

XOR key:
0E82DE13A84BB23E1FEC71542153C45A
A97D9B6A461B761DD1B921E594E08D4F
96402C0524660D700C8FFEB089D53E0E
6390CE0E5E71CBA581915314993E3474

A specific seed hash key also needs to be used to decrypt later IPL stages:

8E939AF03C553F7775317044853D9323
6C7F856DCF97F759EFC3236762E80AF7
4A9561D58704E6538410D9EEBFED2E97
EE4C8B042BC817DFD3D91EF6714055F7

See here for more info here https://playstationdev.wiki/pspdevwiki/index.php?title=Keys#3.5.0_DTP-T1000_Lib-PSP_iplloader

If kbooti 0.4.0 or 0.6.0 are used, the IPL format only uses a single block (like stage 3 IPLs on retails)

5.02+ Revision 04 PSAR (used in official JIG) does not decrypt

I get the following error even after increasing the buffer size, it appears to be a table decryption issue

root@DARKBASE:/mnt/e/DTP/pspdecrypt# ./psardecrypt vsh_arc_b02786_ww_20081114
PSAR ok version 4
psarVersion = 4
Version 5.02.
table_mode = 3
'00001' Cannot decrypt 1g table.
1g table buffer too small. Recompile with bigger buffer.
Segmentation fault

2.82 and older rev 0x04 PSAR decrypt fine.

Merge pspdecrypt and psardecrypt, with additional arguments

Here's my proposal:

  • pspdecrypt could take PBPs, PSARs and PSPs as an input
  • --outfile/-o specifies the output decrypted PSP
  • --outdir/-O specifies the output dir for PSAR
  • --extract-only will only extract and not decrypt the PSAR's contents
  • --psar-only and --psp-only, if given a PBP, will select what to extract/decrypt

Then, independently (using only --outdir/-O), --ipl-decrypt and a facultative --preipl argument.

Also, possibly, --verbose (at least for enabling the IPL decryption output).

It should cover #5 and #6

Support for decrypting PS1 ELFs

Hello! Requesting to add decryption support for PS1 (loader) ELFs in the EBOOT.PBP of PS1 / PSone titles.

I get the following error when using pspdecrypt 1.0:

Decryption failed for tag DAA06F0

In testing, i used the Tekken 2 and Resident Evil 1: Directors Cut ELF to try to decrypt. I can upload the ELF if need be for testing :P

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.