Compression/Encryption in LocationFree LFR files?

Discuss the development of new homebrew software, tools and libraries.

Moderators: cheriff, TyRaNiD

Post Reply
ixalon
Posts: 6
Joined: Mon Jul 17, 2006 11:39 pm

Compression/Encryption in LocationFree LFR files?

Post by ixalon »

Hi guys,

I'm getting annoyed with the lack of updates to the LocationFree remote data for the PSP compared to that of the client for the PC - so I'm taking a stab at working out the file format of the LFR files you put on your memorystick to update the remote control code data. Hopefully this will allow a tool where you convert the plain-text RC data files sony has available for download for the PC LocationFree client to the binary LFR format for use on the PSP.

So far I've got:

Code: Select all

struct lfrm_header {
        char magic[4]; // LFRM
        short version; // 0x00 0x01
        short unknown1; // 0x00 0x00
};
struct lfrm_block {
        unsigned int offset;
        unsigned int length;
};

// pseudo code:
// read lfrm_header
// read lfrm_block until offset==0x0
// block 0 looks like it's IR data
// block 1 looks like manufacturer -> model structure (uint32 followed by null terminated string * n1)
// block 2 looks like a stringtable (null terminated string * n2)
// block 3 is zero-length
// block 4 is zero-length
// block 5 looks compressed and/or encrypted
I'm stuck on block 5, the files for each region have the same 48 byte header, then the rest of the block looks like compressed/encrypted data. Does anyone know which encryption/compression algorithms the PSP tends to use which would use a 48 byte header?

This 48 byte header doesn't contain any obvious structures and doesn't change even when the rest of the data in the file changes. Either the compression/encryption algorithm writes 48 byte chunks and the first n-bytes of plaintext data is the same for each file or it's the key used to decrypt the remaning data.

The 48 bytes:

Code: Select all

B7 E5 3B 7C 18 9C 09 44   6C 46 CD 9B 15 C9 FA 39
E3 54 4B 08 06 26 FA 2B   F1 ED 66 99 8D 2F D8 63
43 E8 FB 97 06 1E 18 55   2C D8 CA F8 95 9F C5 FA
Cheers,
ix
[FireFly]
Posts: 2
Joined: Sun Aug 06, 2006 7:01 am

Post by [FireFly] »

The remote control codes in the plain-text RC data files are actually encrypted. Fortunately I was able to debug the player software on PC and figure everything out. The reason why I did this was so that I could generate LocationFree remote control codes for controlling Windows Media Center through a Pinnacle TV card. If anyone wants to use a LF-B1 base station for controlling an unsupported infared device, PM me.
Post Reply