Author Topic: Extracting PS Vita's boot logo  (Read 4152 times)

teakhanirons

  • Guest
Extracting PS Vita's boot logo
« on: May 16, 2020, 07:59:14 AM »
PS Vita boot logo is located in display.skprx which is located in os0:kd.
Prototype firmwares that are lower than 1.00 have a different boot logo, different than that of retail firmware.
To extract the boot logo, you have to get a decrypted copy of it by either using VitaShell or pup_fiction.py.
On firmwares higher than 1.00, the boot logo is gzip'd. Anything lower, it's zlib'd.

FOR GZIP (FIRMWARE HIGHER THAN 1.00):
gzip format has a header starting with the magic number of 1F 8B in hex. After those two bytes comes the byte that represents the compression method, in our case 08 which represents "deflate".
You can locate size indicator and manually find the end offset of the gzip file or you can just look for bytes 00 E0 1F 00.
Copy that stream including the header to another file (I prefer HxD for this job) so that our new file starts with the header and save it with .gz extension. Not tarball'd like usual so no .tar.gz.
When you extract the gzip, resulting file will be the raw framebuffer with the size of 960x544 in RGB32 format.

FOR ZLIB (FOR FIRMWARE LOWER THAN 1.00):
zlib format has a bunch of different headers:
  • 78 01
  • 78 5E
  • 78 9C
  • 78 DA
The one we're looking for is 78 9C (which indicates that it's compressed with the default compression level of 6).
Copy the rest of the file including the header to another file (I prefer HxD for this job) so that our new file starts with the header and save it.
After that, you can just use offzip on the new file and the resulting file will be the raw framebuffer with the size of 960x544 in RGB32 format.

After extracting the raw framebuffer, you can load it in your viewer of choice (with the size set to 960x544 and the format set to RGB32), mine is rawpixels.net.

Thanks to Princess of Sleeping and SKGleba.
« Last Edit: May 16, 2020, 02:39:15 PM by teakhanirons »

teakhanirons

  • Guest
Re: Extracting PS Vita's boot logo
« Reply #1 on: May 16, 2020, 01:33:16 PM »
UPDATE: I'm an idiot. zlib and gzip both use deflate and offzip has an "extract all deflate" option.

Here's a simpler method, for all firmwares:
Use offzip on your decrypted display.skprx with this command:
Code: [Select]
offzip -z -15 -a PATH_TO_DISPLAY_SKPRX
There should be several outputs. Find the one that is about 2MB or so and ditch the other ones. That should be your raw framebuffer file.

After extracting the raw framebuffer, you can load it in your viewer of choice (with the size set to 960x544 and the format set to RGB32), mine is rawpixels.net.

On another note, Princess says the raw framebuffer has to be 2088960 bytes when extracted.

I'm leaving the original methods intact for documentation purposes.
« Last Edit: May 16, 2020, 02:09:04 PM by teakhanirons »