Developer Architecture & Internal API

PKGi PS3 is written in C and C++, compiled against the PSL1GHT open-source SDK. This section outlines the architectural decisions and internal modules that power the application.

1. Application Loop & State Management (pkgi.c)

The application relies on a strictly controlled state machine running inside a continuous while-loop (pkgi_update()).

States include:

  • StateRefreshing: Updating the database via HTTP.
  • StateUpdateDone: Post-download parsing.
  • StateMain: The primary UI rendering and input capture loop.
  • StateError: Fatal error halting.

The UI loop runs asynchronously to background threads. Threading is managed via PSL1GHT's sysThreadCreate. For example, pkgi_download_thread and pkgi_refresh_thread execute concurrently with the ya2d rendering pipeline, utilizing sysMutexLock to safely manipulate shared state (like UI progress dialogs).

2. Networking Engine (pkgi_download.c)

All HTTP/HTTPS/FTP requests are routed through a statically linked libcurl instance.

Key Implementation Details:

  • TLS 1.2: Enforced via CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2. The app deliberately disables host/peer verification (CURLOPT_SSL_VERIFYHOST = 0L) to prevent connection failures due to the PS3's notoriously outdated root certificate trust store.
  • Range Requests: Direct downloads support resuming. If a .resume file exists, pkgi_get_size calculates the byte offset, and curl_easy_setopt(..., CURLOPT_RESUME_FROM_LARGE, offset) is invoked.
  • Background Downloading: To implement "Background DL" mode, the app interfaces with the PS3's internal sys_net task format (PDB_HDR_...). PKGi creates d0.pdb (containing URLs, IDs, and metadata) inside /dev_hdd0/vsh/task/{TASK_ID}/. It truncates a dummy .pkg file to the target total_size. Upon the next system boot, the PS3 OS reads the d0.pdb file and natively assumes control of the download.

3. Database & Memory Management (pkgi_db.c)

The PS3 has a strict 256MB memory footprint, heavily segmented. PKGi dynamically allocates a single massive 32MB buffer (db_data = malloc(MAX_DB_SIZE)) to hold the entire textual database in memory.

Custom Heap Sort

Standard C qsort generates too much overhead for 30,000+ string pointers. pkgi_db.c implements a custom, in-place binary Heap Sort (heapify()). When the user changes the filter/sort criteria via the UI, the engine creates a localized array of matched pointers and reorganizes them in $O(n \log n)$ time based on the active Config->sort criteria, allowing near-instantaneous UI refreshes.

4. Cryptography & RIF Generation (rifrap.c, ecdsa.c)

The generation of PlayStation license files (.rif) from .rap files is entirely localized, using algorithms adapted from flatz and the PS3Xploit team.

The Cryptographic Flow:

  1. RAP Decryption: The 16-byte RAP string is decrypted using AES-ECB-128 against the rap_initial_key and scrambled through a permutation box (pbox), generating the klicensee.
  2. IDPS Extraction: ss_aim_get_device_id executes a lv2syscall2 (syscall 867) to extract the hardware's unique IDPS.
  3. act.dat Bind: The IDPS is encrypted against idps_key_const. This key decrypts the user's act.dat key table to retrieve the active account key.
  4. ECDSA Signature: The final .rif buffer is hashed via SHA-1. The hash is fed into ecdsa_sign_rif() along with the static elliptic curve parameters (ec_k_nm, ec_Q_nm), producing the cryptographic R and S signatures required for the PS3 to acknowledge the license as valid.

5. UI Rendering & Graphics (ttf_render.c)

Graphical output is handled by Tiny3D (a lightweight 3D API wrapper for the RSX) and YA2D.

Because rendering thousands of UTF-8 strings frame-by-frame is computationally expensive on the Cell Broadband Engine, ttf_render.c implements a Dynamic Glyph Cache.

  • It hooks into FreeType to load official system fonts from /dev_flash/data/font/.
  • As new characters are requested (display_ttf_string), the glyph is rasterized into a 32x32 texture block.
  • Subsequent requests for the same character reference the cached texture (tiny3d_VertexTexture), drastically reducing CPU overhead and keeping the framerate locked.