self_rebuilder builds selfs from template?

[Rip Cord]

self_rebuilder.exe INPUT.ELF OUPUT.BIN TEMPLATE.BIN

found this in the output self:

Spoiler

003BDD50 3D3D 3D3D 3D3D 3D3D 204C 6F61 6457 6164 ======== LoadWad
003BDD60 2028 2725 7327 2920 3D3D 3D3D 3D3D 3D3D ('%s') ========
003BDD70 0000 0000 0000 0000 2575 3A25 3032 753A ........%u:%02u:
003BDD80 2530 3275 0000 0000 4D53 4700 0000 0000 %02u....MSG.....
003BDD90 4742 4C00 0000 0000 4C56 4C00 0000 0000 GBL.....LVL.....
003BDDA0 706C 6179 6572 4865 616C 7468 0000 0000 playerHealth....
003BDDB0 706C 6179 6572 4D61 7848 6561 6C74 6800 playerMaxHealth.
003BDDC0 6865 616C 7468 4D65 7465 724C 6576 656C healthMeterLevel
003BDDD0 0000 0000 0000 0000 706C 6179 6572 4D61 ........playerMa
003BDDE0 6769 6300 0000 0000 706C 6179 6572 4D61 gic.....playerMa
003BDDF0 784D 6167 6963 0000 6D61 6769 634D 6574 xMagic..magicMet
003BDE00 6572 4C65 7665 6C00 706C 6179 6572 4974 erLevel.playerIt
003BDE10 656D 506F 696E 7473 0000 0000 0000 0000 emPoints........
003BDE20 706C 6179 6572 4D61 7849 7465 6D50 6F69 playerMaxItemPoi
003BDE30 6E74 7300 0000 0000 6974 656D 4D65 7465 nts.....itemMete
003BDE40 724C 6576 656C 0000 676F 6450 6F69 6E74 rLevel..godPoint
003BDE50 7300 0000 0000 0000 6F72 6250 6F69 6E74 s.......orbPoint
003BDE60 7300 0000 0000 0000 6865 616C 7468 5368 s.......healthSh
003BDE70 6172 6473 0000 0000 6D61 6769 6353 6861 ards....magicSha
003BDE80 7264 7300 0000 0000 6974 656D 5368 6172 rds.....itemShar
003BDE90 6473 0000 0000 0000 696E 7649 6365 0000 ds......invIce..
003BDEA0 6669 7265 4C65 7665 6C00 0000 0000 0000 fireLevel.......

just like in the elf:

Spoiler

003BD3D0 3D3D 3D3D 3D3D 3D3D 204C 6F61 6457 6164 ======== LoadWad
003BD3E0 2028 2725 7327 2920 3D3D 3D3D 3D3D 3D3D  ('%s') ========
003BD3F0 0000 0000 0000 0000 2575 3A25 3032 753A ........%u:%02u:
003BD400 2530 3275 0000 0000 4D53 4700 0000 0000 %02u....MSG.....
003BD410 4742 4C00 0000 0000 4C56 4C00 0000 0000 GBL.....LVL.....
003BD420 706C 6179 6572 4865 616C 7468 0000 0000 playerHealth....
003BD430 706C 6179 6572 4D61 7848 6561 6C74 6800 playerMaxHealth.
003BD440 6865 616C 7468 4D65 7465 724C 6576 656C healthMeterLevel
003BD450 0000 0000 0000 0000 706C 6179 6572 4D61 ........playerMa
003BD460 6769 6300 0000 0000 706C 6179 6572 4D61 gic.....playerMa
003BD470 784D 6167 6963 0000 6D61 6769 634D 6574 xMagic..magicMet
003BD480 6572 4C65 7665 6C00 706C 6179 6572 4974 erLevel.playerIt
003BD490 656D 506F 696E 7473 0000 0000 0000 0000 emPoints........
003BD4A0 706C 6179 6572 4D61 7849 7465 6D50 6F69 playerMaxItemPoi
003BD4B0 6E74 7300 0000 0000 6974 656D 4D65 7465 nts.....itemMete
003BD4C0 724C 6576 656C 0000 676F 6450 6F69 6E74 rLevel..godPoint
003BD4D0 7300 0000 0000 0000 6F72 6250 6F69 6E74 s.......orbPoint
003BD4E0 7300 0000 0000 0000 6865 616C 7468 5368 s.......healthSh
003BD4F0 6172 6473 0000 0000 6D61 6769 6353 6861 ards....magicSha
003BD500 7264 7300 0000 0000 6974 656D 5368 6172 rds.....itemShar
003BD510 6473 0000 0000 0000 696E 7649 6365 0000 ds......invIce..
003BD520 6669 7265 4C65 7665 6C00 0000 0000 0000 fireLevel.......

Of course it's not in the original self.

 

[Rip Cord]

I added option to self_rebuilder to input auth id, vendor id, self type, firmware version (field in control info), and sdk type/key revision. When testing with elf/self, I checked the headers and they looked okay. Then checking the body of the self noticed this problem. Thought I messed up the code, so tried encrypting with regular self_rebuilder.exe that had been released with various tools like PS3MFW builder and others, but they produce the same type "self".

Anyone know about this self_rebuilder?

 

[Rip Cord]

forgot to mention that field in self in the control info is ususally labeled as padding, but it's the firmware version.

00000000 5343 4500 0000 0002 0001 0001 0000 0410 SCE.............
00000010 0000 0000 0000 0980 0000 0000 0053 5B08 .............S[.
00000020 0000 0000 0000 0003 0000 0000 0000 0070 ...............p
00000030 0000 0000 0000 0090 0000 0000 0000 00D0 ................
00000040 0000 0000 0053 5CC8 0000 0000 0000 0290 .....S\.........
00000050 0000 0000 0000 0390 0000 0000 0000 03C0 ................
00000060 0000 0000 0000 0070 0000 0000 0000 0000 .......p........
3C0 is the offset of the control info
70 is the length of the control info

here in the last 2 bytes:
000003C0 0000 0001 0000 0030 0000 0000 0000 0001 .......0........
000003D0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000003E0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000003F0 0000 0002 0000 0040 0000 0000 0000 0000 .......@........
00000400 627C B180 8AB9 38E3 2C8C 0917 0872 6A57 b|....8.,....rjW
00000410 9E25 86E4 5EDB 3632 3D99 4681 24B0 EA7B .%..^.62=.F.$..{
00000420 EA53 8B71 7D78 CF2C 0000 0000 0000 7B0C .S.q}x.,......{.

7B0C is the firmware version
6BD0 = 27600 = 2.76
7B0C = 31500 = 3.15
8534 = 34100 = 3.41
88B8 = 35000 = 3.50
8AAC = 35500 = 3.55
....
B1BC = 45500 = 4.55

 

[Rip Cord]

here's a few different versions that had been released over the last few years. place in the your ps3tools folder with cygwin dll's. noticed it can't find the key files if the exe folder is nested more than 1 folder deep from root of drive.
like this is ok:
g:\ps3tools
g:\home\Rip\.ps3

the source above can be compiled on linux or mingw under windows. run autogen.sh and then make selfbuilder. requires autoconf.

 

[Storm Shadow]

If you set your variable environment

PS3KEYS
 
PATH/TO/KEYS

should work

 

[Rip Cord]

tested self_rebuilder on more selfs and they were encrypted ok. it didn't like the 2 eboots I was using as reference for the header work, was skipping encryption of the elf sections. that's a strange coincidence.