Locoroco isn't a typical elf executable, its AES signed, much like the .psp file in update eboot packages.

As it shares that similarity with the update, it shares another: MD5 checksums, which detect if the eboot has been altered in any way.

I've heard people asking if Locoroco used kernel mode, the answer is no, even though it is Sony's its still run in game mode, and game mode is limited to user space.

__________________