Hey there.

So... you use an ad blocker. That's cool. Sometimes we do too.

But without ad revenue, we wouldn't even be here. And we might not be here much longer.

Please disable your ad blocker and click to continue.

  1. #1
    Join Date
    Apr 2005

    Guide: How to Reconstruct PS3 SELF Files After Decrypting

    Today netkas (linked above) has shared a brief guide on how to reconstruct PS3 SELF files after decrypting them for PlayStation 3 developers.

    To quote: Here is a little, noob-unfriendly howto about recreating ps3 apps after you have decrypted it

    as example, I will talk about vsh.self, which everyone on jb ps3 can find in /dev_flash/

    1) decrypt it with graf_chokolo's payload, you will get two files after all, lets call them vsh.0 and vsh.1

    2) compress these files with zlib, I use zpipe for it (http://rghost.ru/3486322)

    cat vsh.0 | ./zpipe > vsh.0z
    cat vsh.1 | ./zpipe > vsh.1z

    size of files:

    6951464 2010-12-05 02:06 vsh.0
    2930941 2010-12-05 04:04 vsh.0z
    338832 2010-12-05 02:06 vsh.1
    133356 2010-12-05 04:04 vsh.1z

    3) going into vsh.self
    look at 64-bit big endian value at 0x290 - 0x0000000000000900 (2304 decimal), its start of first segment (vsh0) in vsh.self, next 64bit BE value at 0x298 is size of this section - 0x00000000002cb8fd (2930941 decimal) , perfectly matched to size of out vsh.0z ;)
    same for vsh1, start at 0x2b0 - 0x00000000002dafe0 (2994144 decimal), size at 0x2b8 - 0x00000000000208ec == 133356 (size of vsh.1z)

    4) now we need to copy decrypted and inflated sections to the vsh.self

    dd if=./vsh.0z of=./vsh.self bs=1 seek=2304 conv=notrunc

    dd if=./vsh.1z of=./vsh.self bs=1 seek=2994144 conv=notrunc

    5) need to edit some headers -

    0x08 big endian 0004 to 8000

    0x2af, 0x2cf, 0x2ef, 0x30f, 0x32f - change 0x01 to 0x02.

    6) now u have this pseudo-debug self, and can use usual three steps to make it run on jb ps3, where EBOOT.BIN is our final self after 5th step

    Selftool.exe -o EBOOT2.BIN -c0 EBOOT.BIN
    unfself.exe EBOOT2.BIN EBOOT3.BIN
    make_fself.exe EBOOT3.BIN EBOOT4.BIN

    EBOOT3.BIN is a nice to analyze elf, EBOOT4.BIN is a ready to run SELF.

    More PlayStation 3 News...

  2. #2
    Fr33m4n Guest
    Hmm, what I'm wondering is, since we now can decrypt eboots from games, would it be possible to decrypt an eboot from a black screen game (say MW2) and then reconstruct it to make it work?

  3. #3
    tonyqc Guest
    Quote Originally Posted by Fr33m4n View Post
    Hmm, what I'm wondering is, since we now can decrypt eboots from games, would it be possible to decrypt an eboot from a black screen game (say MW2) and then reconstruct it to make it work?
    mw2 already work

    What you need is the demo


    And a copy of the retail game i am using BLES00686

    1. Install the demo to your hard drive.
    2. Delete sfo from your BLES00686 directory
    3. Delete EBOOT.bin, default.self and default_mp.self from BLES00686/PS3_GAME/USRDIR
    4. Re-name the "PS3_GAME" folder of your BLES00686 directory to NPEB90263
    5. copy to dev_hdd/game over-writing the demo
    6. delete sellScreen.bik from NPEB90263/USRDIR
    7. Boot Directly from the XMB.

    game will boot and you can play the only problem is you cannot save, probably because the EBOOT.BIN doesn't have the instruction to save as it is from the demo.

    recommended file deletes (optional):

    anything starting with mp_ (multiplayer data- multiplayer does not work so therefore unneeded)

  4. #4
    netkas Guest
    if you load it up (decrypted, runable self) in ida, find what causes BS and patch it - should work.

  5. #5
    tiefputin1 Guest
    not quite sure, but do you (ab)use compression for realignment of sections or are the sections really compressed?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Log in