Reading PS3 PRFLDB

[bzier]

Hi @sandiz,

I am attempting to use this project with a profile database which I backed up from my PS3. Currently this project is fairly tightly coupled to Steam & the PC version of Rocksmith. I'm not too worried about working through those aspects yet.

For now, I'm simply trying to call the readProfile function, passing the path to my PRFLDB file. I uncommented the line to dump the profile data to a JSON file, just to see if I could read the file. However, I'm currently failing earlier in the process. Either there is a problem decrypting the DB, or the file may be in a different format, which is unreadable by Zlib.

Main question:

I am wondering what you can tell me about some magic values...
The decryption key here:

const keya = [
  114, 139, 54, 158, 36, 237, 1, 52,
  118, 133, 17, 2, 24, 18, 175,
  192, 163, 194, 93, 2, 6, 95,
  22, 107, 75, 204, 88, 205, 38, 68, 242, 158,
]

And skipping 20 bytes here:

  const decrypted = aesEcb.decrypt(data.slice(20, data.length))

The details:

Initially, calling the readProfile method as-is, I hit this exception:

Uncaught (in promise) Error: invalid ciphertext size (must be multiple of 16 bytes)
    at ModeOfOperationECB.push../node_modules/aes-js/index.js.ModeOfOperationECB.decrypt (index.js:408)
    at readProfile$ (steamprofileService.js:41)
    at tryCatch (runtime.js:45)
    at Generator.invoke [as _invoke] (runtime.js:271)
    at Generator.prototype.<computed> [as next] (runtime.js:97)
    at tryCatch (runtime.js:45)
    at invoke (runtime.js:135)
    at runtime.js:145

Digging into that a bit, I found that I may need to pad the data (according to this SO answer). I did that with another example I found, like this:

const decrypted = aesEcb.decrypt(aesjs.padding.pkcs7.pad(data.slice(20, data.length)))

While that allowed it to decrypt 'successfully', it then fails on unzipping with the following:

Error: incorrect header check
    at Zlib._handle.onerror (index.js:352)
    at Zlib.push../node_modules/browserify-zlib/lib/binding.js.Zlib._error (binding.js:283)
    at Zlib.push../node_modules/browserify-zlib/lib/binding.js.Zlib._checkError (binding.js:254)
    at Zlib.push../node_modules/browserify-zlib/lib/binding.js.Zlib._after (binding.js:262)
    at binding.js:126
    at Item.push../node_modules/process/browser.js.Item.run (browser.js:153)
    at drainQueue (browser.js:123)

Dumping the data to a file and examining it, it truly does not appear to be any kind of zip file (zip, tar, 7z, etc). I also tried not slicing off the first 20 bytes, which did allow it to decrypt without the need for padding. However, it fails in the same way when trying to unzip.

I looked back at the history of the steamprofileService.js file to see if I could glean anything from the history, but the key & decryption code was there from the beginning. Any tips/advice you can provide would be helpful, either to understand how/where you got the decryption method, or how I should move forward.

Thanks, and sorry for the looong post.
-Brian

[sandiz]

hi @bzier, nice work on getting to the bottom of this! 😇

the key is the decimal representation of the PCSaveKey. Since you are using PS3, it is likely the SaveKey is different (psarc's are also encrypted with a different key on PS3).

wrt the profile structure, i think it looks like

0: 4 -> MAGIC (EVAS) 
4: 16 -> IV for aes (i am not 100% about this) 
16:20 -> data size in bytes
20: end -> data

definitely take a look at rscustom project, they did the initial research on PS3 Rocksmith PSARC files (not sure about PRFLDB), but the code should still be useful.

since you are experimenting with PRFLDB, i would also suggest rsrtools python library. The library allows you to load and save prfldb with ease and is really well documented. This project is using the PCSaveKey as well, so you will have to find the PS3SaveKey from somewhere.

Good luck and let me know how your search goes!

[BuongiornoTexas]

Hi @bzier, rsrtools is also pretty heavily linked to a steam file layout. If you have python installed, I can put together a snippet that can be run on a prfldb file in any location. You may also have luck with the tools I drew on heavily while assembling rsrtools: rs-utils and rocksmith.

As an aside, I can't remember seeing any by platform keys for the prfldb files (they do vary by platform for the PSARC files).

[bzier]

Thank you both so much for your responses. All of those links/resources are extremely helpful.

I have been spending quite a bit of time the last two days digging into tools for dealing with PS3 game saves (mostly "Bruteforce Save Data", but just found a couple others as well that I'm exploring). I found a tool intended for "Demon's Souls" saves here, which also has some great documentation about the PS3 file protection mechanisms here. I think I may have been able to decrypt the file using the tool (after changing the secure_file_id to the Rocksmith value: 4F45445F574A445F444A445F434A445F), but the result still doesn't appear to be a zip file, or raw json.

I'm wondering if either/both of you could share an example PRFLDB file from the PC (I don't have the PC version), just so I can see an example of what I'm looking for. It is a bit hard to tell if there are multiple layers of encryption, or if the file layout / headers may just be different, etc. I'm happy to share mine as well if anyone wants to take a look at it.

Thanks again for the help & info provided already. I appreciate it.

[sandiz]

here you go, two different profiles: prfldb.zip

but the result still doesn't appear to be a zip file, or raw json.
multiple layers of encryption

i have the same hunch, it's likely encrypted one more time PS3Decrypt -> RSDecrypt -> Unzip -> JSON

[BuongiornoTexas]

@bzier I'm happy to take a look at one of your PS3 prfldb files to see if I can spot anything obvious. Right at the moment, I have more time than usual on my hands ... (and I'm plain curious).

[bzier]

Awesome, got it 👍
After decrypting with the PS3 method, I have a file with a 4 byte 'header', followed by the zlib-compressed JSON file. I was able to slice the first 4 bytes and 'unzip' the rest into raw JSON.

The first 4 bytes appear to be some data length, but not sure exactly of what. In my case, the first 4 bytes are 00 1F B9 39, which is 2,079,033 in decimal. My file is 2,097,152 bytes long. So, it is pretty close, but not exact (off by 18,119). Interestingly, the uncompressed JSON is quite a bit smaller, at only 1,157,838 bytes.

Regardless, the next 4 bytes were: 78 DA EC BD, which matched the first 4 bytes of your PRFLDB files (after decryption). The 78 DA represents the 'best compression' option of zlib, according to wikipedia here (find in page: 'zlib').

As I have time over the next few days, I'll try to clean up everything I've been hacking with over the last couple days, and make it available. Still want to actually wire this into the rs-manager to take a look at my stats, now that I've got them ;)

Thanks again to both of you for the help.

[bzier]

Just to document my steps here, for myself as much as for anyone else:

• On PS3, use the "Saved Data Utility (PS3)" to backup the Rocksmith game data to USB & transfer the files to PC. The directory hierarchy and included files should be something like this:

  PS3/
  └── SAVEDATA/
      └── BLUS31182-SAVE0/
          ├── ICON0.PNG
          ├── PARAM.PFD
          ├── PARAM.SFO
          └── PRFLDB
  

• Decrypt the files using the PARAM.PFD tool here.
  • This tool was built for "Demon's Souls", so first need to swap the secure_fileID with the correct value for "Rocksmith". Update line 20 in PARAM_PFD.py here with the following:

    secure_fileID = "4F45445F574A445F444A445F434A445F"

    (this magic value comes from the games.conf file of the "Bruteforce Save Data" tool - loading the game save in that tool will also show this value in the 'Key' column)
  • Then, following the usage guide, in a python interpreter run this code:

    from PARAM_PFD import PARAM_PFD
    param_pfd = PARAM_PFD("sourceDir")
    param_pfd.decryptAllDatFiles("sourceDir", "targetDir")

    This should result in the decrypted PRFLDB file being placed in the specified targetDir.
• Then, adapting a couple things in steamprofileService.js in this repo, execute the following method:

  export async function readProfilePs3(prfldb) {
    const data = await readFile(prfldb);
  
    try {
      const rawjson = await unzip(data.slice(4, data.length)); // ignore first 4 bytes and decompress
      const jsonobj = JSON.parse(new TextDecoder("utf-8").decode(rawjson.slice(0, rawjson.length - 1)))
      await writeFile("/tmp/player_data.json", JSON.stringify(jsonobj))
      return jsonobj;
    }
    catch (e) {
      console.log(e);
    }
    return null;
  }

  This should result in the JSON profile data being written to the /tmp directory.

---

Note that, as none of the songs are on my computer, I'm bypassing importing the psarcs, so I'm still having issues fully utilizing rs-manager. However, I was at least able to get it to read/populate the "General" stats & one of the "Songs" stats (playthroughs).

Files:

• The original export from the PS3: PS3.zip
• The resulting (and formatted) JSON file: player_data.json.zip

[BuongiornoTexas]

@bzier Nice work! I think @JustinAiken may have put together a list correlating song ids and song data for ODLC, and there may well be something similar on customsforge. This may be helpful for populating your song data?

[bzier]

Perhaps. I honestly haven't gotten that far yet in looking into what may be next for the song data. Since I skipped all the steam stuff, the DLC directory was undefined, and I bumped into failures when it attempted to scan for the psarcs. So I simply bypassed that chunk of code for the import.

Was able to get it to load the main screen, but only with the data populated in the screenshot I shared. That was enough to call it a night :)

Depending on how busy I am this week, I may start looking at the next steps as well, so any additional info is certainly welcome.