Join Us and become a Member for a Verified Badge to access private areas with the latest PS4 PKGs.
PS4 CFW and Hacks       Thread starter PSXHAX       Start date Jun 29, 2017 at 1:14 AM       17      
Status
Not open for further replies.
With the recent Take-Two notices some were curious about OrbisModding.com, but today @SpecterDev confirmed on Twitter that the PlayStation 4 Package Finder is back up and updated for those wondering. (y)

He also added some PlayStation 4 development research on PS4 PKGs to the PSDevWiki (a lot more HERE and HERE) with details below, to quote:

Package Structure

File Header


While most of the PS4 is little endian, the package file header still uses big endianness as the headers are based on their PS3 predecessors.
Code:
typedef struct {
   uint32_t pkg_magic;          // 0x000
   uint16_t pkg_revision;       // 0x004
   uint16_t pkg_type;           // 0x006
   uint32_t pkg_unk;            // 0x008 - unknown field
   uint32_t pkg_file_count;     // 0x00C
   uint32_t pkg_table_ents;     // 0x010
   uint16_t pkg_sys_ents;       // 0x014
   uint16_t pkg_unk;            // 0x016 - unknown field
   uint32_t pkg_table_offset;   // 0x018 - file table offset
   uint32_t pkg_ent_data_size;  // 0x01C
   uint32_t pkg_unk;            // 0x020 - unknown field
   uint32_t pkg_body_offset;    // 0x024 - seems to always be 0x200
   uint32_t pkg_body_unk;       // 0x028 - unknown field
   uint32_t pkg_body_size;      // 0x02C

   unsigned char pkg_padding[0x10];         // 0x030 - 16 bytes padding
   unsigned char pkg_content_id[0x24];      // 0x040 - packages' content ID as a 36-byte string
   unsigned char pkg_padding[0x10];         // 0x064 - 16 bytes padding
   unsigned char pkg_unknown[0x8C];         // 0x074 - unknown data

   /* Digest table */
   unsigned char digest_entries1[0x20];     // 0x100 - sha256 digest for main entry 1
   unsigned char digest_entries2[0x20];     // 0x120 - sha256 digest for main entry 2
   unsigned char digest_table_digest[0x20]; // 0x140 - sha256 digest for digest table
   unsigned char digest_body_digest[0x20];  // 0x160 - sha256 digest for main table
}
Files

The file table contains a pointer to a list of files in a package file when the package is of "CNT" magic, this pointer can be found as a 32-bit unsigned integer at 0x2B30. File names are separated by null bytes, and packages typically contain the following files:
  • param.sfo - contains information critical to the app / game
  • playgo-chunk.dat - contains data regarding playgo (see Playgo)
  • playgo-chunk.sha - contains hash of playgo (see Playgo)
  • playgo-manifest.xml - contains manifest for playgo (see Playgo)
  • pronunciation.xml - contains word definitions for PS4's voice recognition software
  • pronunciation.sig - signature of definition file
  • pic0.png - small game preview icon
  • pic1.png - large game preview icon
  • icon0.png - small icon
  • icon1.png - large icon
Delivery

Title XML


The PS4 fetches information about pkg files (including where to download them) from an XML file. This XML file contains information such as if the latest patch is mandatory, the latest package version, the manifest, as well as param.sfo information. Below is an example of a typical title XML file:
Code:
<titlepatch titleid="CUSAXXXXX">
<tag name="37" mandatory="true">

  <package version="01.xx" size="" digest="" manifest_url="" content_id="" system_ver="" type="cumulative" remaster="false" patchgo="true">
   <delta_info_set url="" />

   <paramsfo>
    <title></title>
    ...
   </paramsfo>
  </package>

  <latest_playgo_manifest url="" />
</tag>
</titlepatch>
Notes:
  • The 'size' attribute of the 'package' node is in bytes
  • The 'system_ver' attribute of the 'package' node should be converted to hexadecimal for system firmware version
  • The 'delta_info_set' node may or may not be present depending on the package
Manifest

It should be noted that PS4 package files have a maximum size of 4GB (or 4096MB), therefore large (most) games are split into chunks or pieces.

This is kept track of in the manifest file, which contains json fields which document things such as the size of the final package after the chunks are spliced together, the digest of the final package, the number of chunks, as well as information for each chunk such as the pkg url, offset for splicing, size of the file, and the sha1 hash value of the individual chunk.
Code:
originalFileSize: [size]
packageDigest: "[sha256 digest]"
numberOfSplitFiles: [num]

pieces:
[n]:
  url: "[url of pkg chunk]"
  fileOffset: [offset]
  fileSize: [size, often 4294967296 until last chunk]
  hashValue: "[sha1 hash of chunk]"
Sample Packages

Apps/Games

Themes
Finally, here are some related articles on PS4 PKG Tools, Decrypting and Dumping PS4 Games, Decrypted PS4 Package (PKG) Files, Call of Duty 4: Modern Warfare Remastered CUSA03522 1.07 Decrypted and a PS4 Retail / Debug Game Transfusion Guide for those interested with a few more linked HERE!
Another play-go fix - just delete \misc\ChunkMap.dat :p
PS4 PKG Files (Packages) Development Research by SpecterDev.jpg
 

Comments

X86 eh? first time I've ever seen LE with BE headers. or maybe cause people are too stupid to know the difference and go on what they have bin bottle fed.

Instead of just acting tough pretending like you know everything, why don't you actually take a look at PS4 pkg headers before criticizing. Take a look at the pkg_ent_data_size member. In the YouTube package, this field is as follows in a hex dump: 00 00 0F 80

Now if that were little endian, that would mean that the entry data size is 0x800F0000, which is over 2GB. That doesn't make much sense now does it considering the pkg is only ~72mb. You can also see this in flatz' unpkg tool on the wiki at the Discussions page. There are functions for reading big endian and little endian denoted by the suffix of "le" or "be". The "le" (little endian functions) are never called, and the "be" functions are called when parsing the package.

It is odd, usually most things in the PS4 are LE, but pkg files are not. Next time actually do some research before posting such an uninformed comment :)
 
Instead of just acting tough pretending like you know everything, why don't you actually take a look at PS4 pkg headers before criticizing. Take a look at the pkg_ent_data_size member. In the YouTube package, this field is as follows in a hex dump: 00 00 0F 80

Now if that were little endian, that would mean that the entry data size is 0x800F0000, which is over 2GB. That doesn't make much sense now does it considering the pkg is only ~72mb. You can also see this in flatz' unpkg tool on the wiki at the Discussions page. There are functions for reading big endian and little endian denoted by the suffix of "le" or "be". The "le" (little endian functions) are never called, and the "be" functions are called when parsing the package.

It is odd, usually most things in the PS4 are LE, but pkg files are not. Next time actually do some research before posting such an uninformed comment :)
Try looking in the direction of 6422 big/little all in one. the rumors speak for themselves. little in most cases is a x86/amd64 until you look at Intel. and yes I have done my own homework people take things the way they want over messages are hard to see what a single person is saying and most times mixed.

https://eltechs.com/product/exagear-desktop/
 
How to calculate Package Digest? Orbis-pub-gen and orbis-pub-check show not all of that
 
Status
Not open for further replies.
Back
Top