Self file format

From PS3Wiki

Contents 1 Main header 2 App Info header: 3 Encrypted phdr offset entry 4 Meta Checksums

Main header

field	offset	type	notes
Magic	0x0	u32	Must be "SCE\0"
SCE header version	0x4	u32	This must be 2 or the Self loader will abort
flags	0x8	u16	0: retail type 0 1: retail 2: retail type 1 0x8000: devkit 4: unknown, games that require 3.42. 7: unknown, all games that require 3.50 have that flag.
SCE header type	0xA	u16	1 for SELF, 3 for update PKG
meta_offset	0xC	u32	Offset to the checksums. Must be at least 20 bytes before the end of the header.
header size	0x10	u64	This is the length of the header (including the fake elf headers) The total length of the header must be less that 8KB
Encrypted size	0x18	u64	The size of the encrypted part of the self file.
unknown	0x20	u64	Must be 3
App_info_offset	0x28	u64	An offset in the header, usually at 0x70. See App info header.
elf_offset	0x30	u64	offset to the elf header
phdr_offset	0x38	u64	offset to phdr
shdr_offset	0x40	u64	offset to shdr
encrypted phdr sizes/offsets table offset	0x48	u64	Offset to a table which maps phdr entries to the actual offset/size within the encrypted fself. Because fselfs can be compressed, they might not match the values listed within the elf.
sceversion header	0x50	u64	Offset to a header which contains some version information, including an offset to the .sceversion section of the encrypted elf. The playstation 3 doesn't care about this, and doesn't even check the header.
Digest	0x58	u64
Digest Size	0x60	u64

The real ELF data is located after the SCE header (see header size). It is encrypted, unless the flags are 0x8000. unfself works by cutting the SCE header from the (fake) SELF.

App Info header:

Aligned to 0x10 bytes.

field	offset	type	notes
authid	0x00	u64
unknown	0x08	u32
app_type	0x0c	u32	2 -- level 1 3 -- level 2 4 -- application 5 -- isolated SPU module 6 -- secure loader 8 -- NP-DRM application
app_version	0x10	u64

Encrypted phdr offset entry

There is one of these entries for each phdr entry in the elf file so that the ps3 knows where to decrypt the data from. (because it might also be compressed.)

field	offset	type	notes
Encrypted Data Offset	0x00	u64
Encrypted Data Size	0x08	u64
unknown	0x10	u32	This has been 1 in all the examples I have seen.
unknown	0x14	u32	Always 0, as far as I know.
unknown	0x18	u32	Always 0, as far as I know.
unknown	0x1c	u32	This is 2 for loadable segment types, and 0 for other types.

Meta Checksums

There are 3 checksums at the offset specified by meta_offset.

• The first is the sha1 checksum of the entire self file.
• The 2nd checksum is the inverse of the first checksum.
• The 3rd checksum is the first checksum XORed with 0xAAAAAA..AAAAAB

The PSJailbreak payload ignores the actual checksums, but checks that the 3rd checksum is the 2nd checksum XORed with 0xAAAAAA..AAAAAB.