PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

126w ago - Following up on the PS3 Save Game Tools Pack by Flat_z, today PlayStation 3 developer K.G 971 has released a PS3 Save Resigner and updates below that allow the resigning of game save files for retail OFW or on CFW from any regions and any accounts.

Download: PS3 Save Resigner Homebrew Application / PS3 Save Resigner Homebrew Application (Mirror) / PS3 Save Resigner v1.1 Homebrew Application / PS3 Save Resigner v1.3 Homebrew Application / PS3 Save Resigner v1.4 Homebrew Application / PS3 Save Resigner v1.4 Homebrew Application (Mirror) / .NET Framework 4 (Required) / Red-EyeX32 - The Evil Within Save Editor.rar by Red-EyeX32

To quote: Hi guys this is a PS3 save resigner. Thanks to flat_z for his amazing work. The games.conf is from aldostool. This is just for people who needs an easier way to use flat_z's tool. Credit goes to flat_z for his pfdtool.

You can resign any saves from any regions to any regions. From any accounts to any accounts. You can also remove the copy-protection.

It's easy to use, and very user-friendly. It works for Retail PS3. All you have to do is search for the keys on Internet (watch the video).

Updates: PS3 Save Resigner v1.1 homebrew application is now available (linked above) and includes the following updates:

  • added an option for modders: Decrypt the entire game save folder. It decrypts the game save folder for you, then it waits for you to mod what you want in it, and then it recrypts and resigns it.

How it works:

Follow the video exept that instead of clicking "resign", you will click decrypt. Then , once you are done modding, click "Encrypt & Resign". Done. You can still select the first way if you are not planning to mod the file, just hit "Resign".

PS3 Save Resigner 1.3 Changelog:

  • Added some features
  • Added "Copy params of a specified game" option: To all those who were getting corruption errors (Tekken ect..), this version may fix them.
  • Make sure to select the "Copy params of a specified game" option, and load the PARAM.SFO of your version of the game that you try to resign a save to.
  • Decrypt option updated: When you decrypt a game save folder, it's now in the folder "Decrypted Save Folders".
  • Attempt to fix the XP problem.

PS3 Save Resigner 1.4 Changelog:

  • Fixed Windows XP problems. Now it works for everyone. BIG thanks to RuiGR for his great help.

Note: the games.conf is updated regularly by aldostools, so i will update the new file each times in the "dropbox folder". You will have to replace the old one by the updated one in the tool's folder.






Public Keys:

  • syscon_manager_key=D413B89663E1FE9F75143D3BB4565274
  • keygen_key=6B1ACEA246B745FD8F93763B920594CD53483B82
  • savegame_param_sfo_key=0C08000E090504040D010F000406020209060D03
  • fallback_disc_hash_key=D1C1E10B9C547E689B805DCD9710CE8D






How to Use Someone Else's PS3 Game Save Guide - Liberating Your PS3 Game Save from gingerbread:

Method 1 - Pseudo Save Resigning

Step 1: You have to be on CFW to perform these steps. Open PARAM.SFO in any Hex Editor (i.e HxD, Hex Workshop, Ultra Edit and etc.). It does not matter which hex editor you use because all can represent data in raw and have copy/paste/find options which are sufficient.

Step 2: The "Account ID" which identifies Your user account and PSN. The Account ID always starts at (0x140) and always have 16 bytes and the length is 10.

Step 3: Replace it with your values and you have to do it twice. First at 0x140. The second offset address is somewhere in the file. Use Search and use the original value to perform a search and replace it. The address of 2nd "Account ID" is constant only with the same game save title, it's different for different games.


Step 4: The Second ID is "console id" which identifies Your console (don't mislead it with IDPS). It also have 16 bytes and also is not on constant offset.


Step 5: Third ID is user number account (for example: for "dev_hdd0/home/00000001/" will be 01)). In the example above, it is 48. There are in two position that 48 is.

Step 6: You can't simply copy back your save using XMB. It will most likely give you an error. You have to FTP back to your save folder and overwrite the files.

Note: The method works most of the time but could result in corrupted saves. If the game is design to regenerate a new save, it usually creates a new working save.

Method 2 - Fake Save Data Owner

Info: Only available in Debug FW or Rebug's CFW.


Info: Allows use of save data from other users and displays a warning message at every load/save during the game. Once a save data has been saved with this features activated, that save couldn't be read with this function deactivated.

Off: deactivate the Fake Save Data Owner function.

On: activate the Fake Save Data Owner function.

Note: There is a notification of the "Caution: Fake Save Data Owner On" every-time when any game is saving. It can be very annoying.

Method 3 - Changing Your PS3's Console ID. WARNING: May cause RSOD if done wrongly.

Step 1: Use FTP to transfer a file name xRegistry.sys from your CFW PS3 to your PC (located at /dev_flash2/etc/)
Step 2: Useing Hex Editor application to open a file named PARAM.SFO from any of your save data. Go to offset 140 you'll see your PSN account serial in a 16 digits format, copy that 16 digits and paste it somewhere (notepad or something). Look at Method 1.
Step 3: Open xRegistry.sys with the xRegistry editor (I recommend you to BACKUP the file before you edit it)

Step 4: Now you have to edit the following fields:

[Register or Login to view code]

Step 5: Save the file and FTP it back to your CFW PS3.

Note: Now you suppose to be able to share your save data (that locked to PSN ID) between the 2 PS3s like they're the same machine. You can also hack the game with cheat PKG or other solutions on CFW PS3 and then transfer the save to OFW PS3 and continue collecting trophies with hacked saves.

Method 4 - PS3 Save Resigner by K.G (100% Real Save Resigning)

Download: PS3 Save Resigner Homebrew Application by K.G 971

Method 5 - PS3 Bruteforce Save Data by Aldostools (100% Real Save Resigning)

Download: aldostools.org/temp/BruteforceSaveData.rar

For Resigning PS3 Save Data

Step 1: Edit the global.conf and enter your console_id. (Ctrl+H)
Step 2: Click "Set PARAM.SFO as Template" and Select "Configure Profiles" and Pick a Profile from 1 - 5
Step 3: A Dialog Box will appear, Select "PARAM.SFO" from your save.
Step 4: Give a Name For your Profile.
Step 5: Bulit PARAM.SFO from template (Ctrl+B)

For Decrypting/Encrypting PS3 Save Data

Step 1: Edit the global.conf and enter your console_id. (Ctrl+H)
Step 2: Copy a PARAM.SFO with your account_id as template.sfo in the folder of Bruteforce Save Data (Ctrl+T)
Step 3: Scan the folder with the saves (the Key should be listed).
Step 4: If the key is not available, double click on the save and select the EBOOT.ELF to bruteforce the key (use the scetool commands above to extract the ELF)
Step 5: Once you have the secure_file_id for your game, select the following command in that order:
Step 5a: Update Account ID and Copy Parameters
Step 5b: Patch SFO: Remove Copy Protection
Step 5c: Decrypt PFD
Step 5d: Update PFD
Step 5e: Encrypt PFD
Step 5f: Verify PFD

The buttons are placed in that order... so it is easy to select:

Update Account ID -> Patch SFO -> Decrypt PFD -> Update PFD -> Encrypt PFD -> Verify PFD

Method 6 - Game Genie: Save Editor for PS3 (100% Real Save Resigning)

Commercial method: Game Genie for PS3 (thegamegenie.com/ps3/ -and- forum.thegamegenie.com/viewforum.php?f=8) is a save editor. The main function of this product is to modify your saves. There is also a secondary function to Resign your someone else's save and make it yours. It even works for copy-protected saves (You need CFW).

Method 7 - Xploder PS3 Ultimate Cheats System

Commercial method: xploder.net/playstation-3/products/244/Xploder-PS3-Ultimate-Cheats-System.htm

From JeoWay comes a PS3 Save Resigner by K.G Tutorial, as follows:

Hello! To start off, all tools and programs are linked at the end. REQUIRES .Net Framework 4 and msvr100.dll !!!

1) Open up the Save Resigner.
2) In the tabs, go to "Customized Profile Settings"
3) Go the options to "Enter Public Keys"
4) Enter in the Public Keys into the Correct Lines.

PUBLIC KEYS

[Register or Login to view code]

5) Press "Save Keys" (So you don't have to enter on startup)
6) Copy over *YOUR* save data from the PS3.
7) Locate "Enter Private Keys".
8) Either enter the values in yourself or load YOUR param.sfo from YOUR Save.
9) Now click save Profile (As either 01, 02, or 03)
10) On the tabs, go back to "Save Resigner"
11) Go to File > Open > Locate Modded Save Data
12) After mod save is loaded, you can change region by editing the Game ID.
13) (Don't edit the Console, Account, or User ID's)
14) Now select a profile to resign to.
15) Either decrypt the save and then edit and re-encrypt and resign OR...
16) Simply click "Resign" and use it.
17) Sometimes it still says corrupt after resign so you need to copy params.

FIXING CORRUPT ISSUES

1) Check the box of copy params of a specific game.
2) If you get an error, you need to install msvr100.dll (Link Below)
3. Now select "Resign", and it MAY fix the corrupt issue.

(I have had this problem with Sound Shapes Game Save)

DOWNLOAD LINKS


Flat_z has also Tweeted (twitter.com/flat_z/status/294371165760274432) that he has reversed the whole PS3 emu encryption, stating: ps2_netemu (config, .enc, virtual memory cards cryptography) pwned

Finally, from Red-EyeX32 (via atreyu187) comes a The Evil Within Save File Editor (linked above) with details below, as follows:

So I am running through this game again on the hardest difficulty and seem to run out ammo. So I went looking for a cheat pkg but could only find them for the BLES variants of the game. I think this is due to the fact the "scene" releases are all PAL so nothing for folks like me that bought the NTSC-U variant till now.... Thanks to Red EyeX32 for making this awesome save file editor. It doesn't allow "God Mode" which is a plus in my mind as I sill like a little challenge even cheating.

ALL CREDITS TO Red-EyeX32 - The Evil Within Save Editor

NOTE: YOU NEED A CFW TO REMOVE THE PROTECTION ON THE SAVE

From author's words: Today I'm bringing you guys a save editor for the game 'The Evil Within'. This will allow you to modify your weapons and the ammo, it will also allow you to modify the amount of items you have in your inventory.

All of this wouldn't of been possible without the help of kill_seth. Make sure you make a backup. Please report any problems to me immediately!

Also when saving make sure that two message boxes appear before closing the app because it won't fix the hashes and save the changes!

NOTE: YOU NEED A CFW TO REMOVE THE PROTECTION ON THE SAVE (This is sort of true, you need CFW to backup the save, the app decrypt and recrypt the save file)

Simply open multiMAN/IRISMAN File Manager and get the save file from the following location /dev_hdd0/home/00000001/savedate/NPUB31392-GAMES-SLOT_X (for NTSC-U BLUS variant) I prefer IRISMAN as it shows exactly which game you are looking at by displaying the ICON0.PNG of which file you are dealing with.

Make sure you backup the original save file before modding your save file. Then once edited just simply overwrite the old save file (keeping your backup safe just in case) start your game and enjoy!!!


Video: PS3 Save Resigner Homebrew Application by K.G 971 Out

Video: PS3 Save Resigner Homebrew Application by K.G 971 Out

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew PS4 Downloads.




#55 - BerserkLeon - 127w ago
BerserkLeon's Avatar
Can anyone able to communicate with the devs ask them if they could include multicore support for bruteforcing? I've got a fairly crappy quad core and each core can't do much on its own, but pfdtool seems to be locked to a single core.

Either that, or CUDA/OpenCL. one or both of those options should really speed up the bruteforcing.

Update: From : I suppose I sort of used the wrong term when I said this code could be optimized, to be honest, since it is working with byte arrays, you cannot really get more speed out of it unless you are constantly reading/writing large sections of bytes (which if you are, feel free to hit me up for some optimization tips on your current code). However, like I said previously, the code could be shrunk way down to a few functions and I only wrote it the way I did for people to easily learn from. Here is all the above code complete in a few functions:

VB.NET Code

[Register or Login to view code]

C# Code
[code]Add to a class:

using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;

static class clsGlobal
{
//**************************************************************************************************************************'
//* GLOBAL KEYS *'
//**************************************************************************************************************************'
public static byte[] SYSCON_MANAGER_KEY = new byte[] {
0xd4,
0x13,
0xb8,
0x96,
0x63,
0xe1,
0xfe,
0x9f,
0x75,
0x14,
0x3d,
0x3b,
0xb4,
0x56,
0x52,
0x74
};
//**************************************************************************************************************************'
//* GLOBAL HEADER TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct PFD_HEADER_SECTION
{
public const int MAGIC_OFFSET = 0x0;
public const int VERSION_OFFSET = 0x8;
public const int IV_OFFSET = 0x10;
public const int SIGNATURE_OFFSET = 0x20;
public const int TOP_HASH_OFFSET = 0x0;
public const int BOTTOM_HASH_OFFSET = 0x14;
}
public struct PFD_HEADER_SECTION_SIZE
{
public const int MAGIC_SIZE = 8;
public const int VERSION_SIZE = 8;
public const int IV_SIZE = 16;
public const int SIGNATURE_SIZE = 64;
public const int HASH_SIZE = 20;
}
public struct PFD_HEADER
{
public const int OFFSET = 0x0;
public const int SIZE = 96;
}
//**************************************************************************************************************************'
//* GLOBAL HASH TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct HASH_TABLE
{
public const int OFFSET = 0x60;
public const int SIZE = 456;
public const int MAX_ENTRIES = 57;
public const int HEADER_OFFSET = 0x60;
public const int HEADER_SIZE = 24;
public const int ENTRY_OFFSET = 0x78;
public const int ENTRY_SIZE = 8;
}
//**************************************************************************************************************************'
//* GLOBAL PROTECTED FILES TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct PF_TABLE_SECTION
{
public const int INDEX = 0;
public const int NAME = 8;
public const int GARBAGE = 73;
public const int DATA = 80;
public const int ENTRY_KEY = 80;
public const int HASHES = 144;
public const int HASH1 = 144;
public const int HASH2 = 164;
public const int HASH3 = 184;
public const int HASH4 = 204;
public const int PADDING = 224;
public const int FILE_SIZE = 264;
}
public struct PF_TABLE_SECTION_SIZE
{
public const int INDEX = 8;
public const int NAME = 65;
public const int GARBAGE = 7;
public const int DATA = 192;
public const int ENTRY_KEY = 64;
public const int HASHES = 80;
public const int HASH = 20;
public const int PADDING = 40;
public const int FILE_SIZE = 8;
}
public struct PF_TABLE
{
public const int OFFSET = 0x240;
public const int SIZE = 31008;
public const int MAX_ENTRIES = 113;
public const int ENTRY_SIZE = 272;
}
//**************************************************************************************************************************'
//* GLOBAL Y TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct Y_TABLE
{
public const int MAX_ENTRIES = 56;
public const int OFFSET = 0x7b60;
public const int SIZE = 1140;
public const int ENTRY_SIZE = 20;
}
//**************************************************************************************************************************'
//* GLOBAL PADDING VARIABLES *'
//**************************************************************************************************************************'
public struct BOTTOM_PADDING
{
public const int OFFSET = 0x7fd4;
public const int SIZE = 44;
}
}

Add to a class:

using System;
using System.Windows.Forms;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using System.IO;
using System.Text;
using System.Security.Cryptography;
using glb = clsGlobal;

static class clsClasses
{
//***************************************************************************************************************'
//* OPEN FILE DIALOG BOX : RETURNS A STRING *'
//***************************************************************************************************************'
public static string File_Dialog(string sTitle, string sFilter, string sFileName)
{
OpenFileDialog OFD = new OpenFileDialog();

String retval = string.Empty;

OFD.Filter = sFilter;
OFD.InitialDirectory = Application.ExecutablePath;
OFD.Title = sTitle;
OFD.Filter = sFilter;
OFD.FileName = sFileName;

if (OFD.ShowDialog() == DialogResult.OK)
{
retval = OFD.FileName;
}
if (retval == String.Empty)
{
return string.Empty;
}
else
{
return retval;
}
}
//**************************************************************************************************************************'
//* AES DECRYPTION FUNCTION *'
//**************************************************************************************************************************'
public static byte[] AES_Decrypt(byte[] bytes, int block_size, int key_size, byte[] aes_iv, byte[] aes_key)
{
//--------------------------------------------------------------------------------------------------------------------------'
// AES Crypto Service Provider
//--------------------------------------------------------------------------------------------------------------------------'
AesCryptoServiceProvider AES = new AesCryptoServiceProvider();
//--------------------------------------------------------------------------------------------------------------------------'
// AES Crypto Service Provider parameters
//--------------------------------------------------------------------------------------------------------------------------'
AES.BlockSize = block_size;
AES.KeySize = key_size;
AES.IV = aes_iv;
AES.Key = aes_key;
AES.Mode = CipherMode.CBC;
AES.Padding = PaddingMode.None;
//--------------------------------------------------------------------------------------------------------------------------'
// Decrypt the bytes : AES 128 CBC mode
//--------------------------------------------------------------------------------------------------------------------------'
using (ICryptoTransform AES_Dec = AES.CreateDecryptor()) {
byte[] dec_bytes = AES_Dec.TransformFinalBlock(bytes, 0, bytes.Length);
//--------------------------------------------------------------------------------------------------------------------------'
// Return the byte array of decrypted bytes
//--------------------------------------------------------------------------------------------------------------------------'
return dec_bytes;
}
}
//***************************************************************************************************************'
//* CONVERT A BYTE ARRAY TO A HEXADECIMAL STRING *'
//***************************************************************************************************************'
public static string ByteArray_To_Hex(byte[] bytes, string separator = null)
{
string retval = string.Empty;
StringBuilder strHex = new StringBuilder(bytes.Length * 2);

foreach (byte b in bytes) {
strHex.Append((b.ToString("X2")) + separator);
}

retval = strHex.ToString().ToUpper();

return retval.Trim();
}

//**************************************************************************************************************************'
//* READ DATA FROM HASH TABLE :: OUTPUT = LIST OF BYTE ARRAYS *'
//**************************************************************************************************************************'
public static List Read_Hash_Table(string pfd_file, int start_offset, int section_size)
{
List output_bytes = new List();
long curr_offset = start_offset;

for (int i = 0; i

#54 - PS4 News - 127w ago
PS4 News's Avatar
Following up on his previous update, today PlayStation 3 developer Flat_z has updated the PS3 Save Game Tools Pack to include SFOPatcher v0.2.0 and PFDTool version 0.2.3 alongside an update to the BruteforceSaveData GUI by aldostools below.

Download: PS3 Save Game Tools Pack Update (121412) / PFDTool and SFOPatcher Source Code / BruteforceSaveData GUI

From Flat_z: Some people asked me about the source code of pfd & sfo tools.. here they are (linked above).

Guys, here is an update of my tools. It contains an update to sfopatcher (see the changelog below) and a small update to pfdtool. Previously you should make a save game for your game on your console and then use PARAM.SFO from it as a template to PARAM.SFO from a foreign save game to build a new PARAM.SFO which will contain the data specific to your console. A newer version of sfopatcher will use a foreign save data directory and params only if you specify these options.

From aldostools: A new version of the frontend is available with the updated tools from flatz and new settings to take advantage of these features.

Changes: new "Rebuild" option, new "Restore" option, updated the database with secure_file_id for more than 750 games (over 3140 title ids). Added a new "date" column. Special thanks to flatz, Alex at CMP, acab, skillerCMP, gingerbread and many others

Changelog:

pfdtool 0.2.3

  • Added an option to specify the relative offset to advance each time while bruteforcing a secure file ID.

Below is a guide from zorrolaro on how to use PFDTool without PS3 CFW using Borderlands 2 as an example:

Required Tools:


Guide:

  • Create a folder near your root drive for pfdtool (i.e. c:/pfdtool/), then extract all files into that folder from the linked archive.
  • Download and install wireshark and winPcap (included with the wireshark installer)
  • Download and install the .net runtimes
  • Download and install PS3 ProxyServer
  • Open a command prompt (start menu -> all programs -> accessories -> command prompt) and enter command "ipconfig". Write down the IPv4 address (should look like 192.168.0.10 or something similar)
  • Open PS3 ProxyServer and copy the IPv4 address you wrote down into the IP Address field and check of PS3 mode, leave the other options alone. Hit the big start button. Keep you IPv4 number handy, you'll need it again. Leave this program running.
  • Open Wireshark. On the left side there is an option to start capture. Left click with your mouse to select the appropriate network adapter listed below the start command. If you are not sure about which adapter to use, select them all using ctrl + left mouse click. Hit the start button once you've highlighted the appropriate adapters. Leave this program running.
  • Boot up your PS3 and navigate to Settings -> Network Settings -> Internet Connection Settings. on the first page select Custom, on the second select whether you are connected wirelessly or wired. Skip all other options by hitting right on your controller until you get to the Proxy Server page, then select use for that option. input the IPv4 address you wrote down earlier into the top field.

    Make sure that the port number on this page matches the port number on PS3 ProxyServer (should both say 8080). Skip to the last page on the configuration and hit x. Test connection when prompted by hitting x again. As long as the top 3 fields say succeeded you can carry on to the next step. if not, review your settings in this step and steps 5 and 6 and retry.
  • Sign into the playstation network and login to the psn store.
  • Go back to your pc and check Wireshark. There should be a whole bunch of information displayed on the screen, don't worry you don't need to know what it means. Press [ctrl]+ e to stop capturing, then press [ctrl]+f to bring up your search dialogue. Under "find" check of "string" and under "Search In" check off "Packet bytes". Enter 0000000100 as your search criteria and hit enter. If the necessary packet was found, in the bottom frame it should show the number highlighted on the right side (plaintext view) to ensure you have the right packet, right before the highlighted text it should say "devideID":" and then the numbers you searched for.

    Take all the numbers and letters starting with your highlighted numbers and copy everything down until you find the next quotation mark in the plaintext. You should have a total of 32 digits written down. Should look something like 000000010084 followed by a bunch of letters and numbers. This is your console id.
  • Go to the folder you installed pfdtool in. Open global.conf in notepad. Eidt the line where it says console_id=by adding the console id you just captured after the =. Also change the other fields that are bolded below to match

    [Register or Login to view code]


  • Save file and exit (make sure you save as .conf not .txt)
  • Open the games.conf file in the same folder. Edit it as follows for NA retail disc version only. You'll have a different game id (the BLUS30982) and secure_file_id. You'll need to ask for someone on the forums to get those for you if you are using a different region, version or entirely differnt game. You can add additional games follwing the same layout by adding more lines. The disc_hash_key is commented out, so you will get a notifaction everytime you use pfdtool, but it still works fine.

    [Register or Login to view code]


  • Save and close the file once you are done adding games. Again make sure you save as .conf, not .txt.
  • Make sure you have a copy of your save game on your pc. I like to copy them right into the same folder as pfdtool to make for shorter commands.
  • You are now ready to actually use pfdtool. Navigate your command prompt to the folder you installed it (command to use is simply the path of the folder, ie "c:/pfdtool"). To decrypt we use the following command:

    [Register or Login to view code]


  • Where the part in quotations will be changed to reflect your actual drive location and the name of the file will be changed to your actual file name. The file name and path are case sensitive, make sure you double check you have the right case.
  • You now have a decrypted save file. Use your hex editor of choice or in the case of Borderlands 2 you can use the latest version of Gibbed's Borderlands 2 Save Editor. Once you are done editing, sae your game again and onto the last step.
  • All that's left at this point is to encrypt the file again. See below, same notes as when decrypting about file path and name.

    [Register or Login to view code]


  • You can now transfer your save game back to your PS3.

A couple of quick notes: I have tried to make this as noob friendly as possible, but you still need some basic knowledge to follow this guide. Also, atm I really have no interest in modding any other save games so I do not have the info for other games to place in your games.conf file, though if anyone wants to post them I will be happy to add them to the guide. I did not write nor do I support any of the software mentioned in this guide.

Unfortunately we can't extract it from .PFD because IDPS is not stored there. They used it as a HMAC key to hash the content of PARAM.SFO.

I already said many times that some hashes are not checked. That's why Xploder works fine without your console ID. But my goal was the correct generation of the PFD (because S0ny can add new checks in the future) and I had managed to use all keys but you can omit some of them (based on your console id or disc hash key, for example).

From cheetahh: I can confirm that flat_z tool can be used to decrypt TROPTRANS.DAT file and if you know how to modify all the files correctly (there are different checksums and hashes in the files) you can sync those unlocked trophies to PSN as well.

From Sunny992: All information should be free, don't conceal it if it's already leaked, which it was.

[Register or Login to view code]

It was leaked on NGU.

Finally, from comes a VB.NET/C# PARAM.PFD Code Snippet below, as follows:

Figured I would share this as it is a starting point to anyone who wants to work with PARAM.PFD files within VB.NET/C#. Use it, change it, do what you want with it. I used a code converter to avoid rewriting everything between the 2 languages, and then went through and fixed what broke during the conversion.

The code could be optimized... Most of the classes/functions could easily be combined down to just a few classes/functions, and global variables should be avoided when possible other than for this demonstration. The reason it is the way it is now is so that it is easier to see what is going on. If anyone actually uses this, and wants an optimized set of functions or classes just ask.

With that said, all that is needed is a decryption/encryption (AES 128 CTR Mode) function/class for save files and you can be on your way to making your own cheat editor without the need of bundling in flatz pfdtools.

VB.NET Code

[Register or Login to view code]

C# Code
[code]Add to a class:

using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;

public class clsGlobal
{
//**************************************************************************************************************************'
//* GLOBAL KEYS *'
//**************************************************************************************************************************'
public static byte[] SYSCON_MANAGER_KEY = new byte[] {
0xd4,
0x13,
0xb8,
0x96,
0x63,
0xe1,
0xfe,
0x9f,
0x75,
0x14,
0x3d,
0x3b,
0xb4,
0x56,
0x52,
0x74

};
//**************************************************************************************************************************'
//* GLOBAL HEADER TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct PFD_HEADER
{
public const int OFFSET = 0x0;
public const int SIZE = 96;
public const int MAGIC_OFFSET = 0x0;
public const int MAGIC_SIZE = 8;
public const int VERSION_OFFSET = 0x8;
public const int VERSION_SIZE = 8;
public const int IV_OFFSET = 0x10;
public const int IV_SIZE = 16;
public const int SIGNATURE_OFFSET = 0x20;
public const int SIGNATURE_SIZE = 64;
public const int TOP_HASH_OFFSET = 0x0;
public const int TOP_HASH_SIZE = 20;
public const int BOTTOM_HASH_OFFSET = 0x14;
public const int BOTTOM_HASH_SIZE = 20;
}
public static byte[] PFD_HEADER_TABLE = new byte[PFD_HEADER.SIGNATURE_SIZE + 1];
public static byte[] PFD_HEADER_MAGIC = new byte[PFD_HEADER.MAGIC_SIZE + 1];
public static byte[] PFD_HEADER_VERSION = new byte[PFD_HEADER.VERSION_SIZE + 1];
public static byte[] PFD_HEADER_TABLE_IV = new byte[PFD_HEADER.IV_SIZE + 1];
public static byte[] PFD_HEADER_SIGNATURE = new byte[PFD_HEADER.SIGNATURE_SIZE + 1];
public static byte[] PFD_HEADER_DECRYPTED = new byte[PFD_HEADER.SIGNATURE_SIZE + 1];
public static byte[] PFD_HEADER_DECRYPTED_TOP_HASH = new byte[PFD_HEADER.TOP_HASH_SIZE + 1];
public static byte[] PFD_HEADER_DECRYPTED_BOTTOM_HASH = new byte[PFD_HEADER.BOTTOM_HASH_SIZE + 1];
//**************************************************************************************************************************'
//* GLOBAL HASH TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct HASH_TABLE
{
public const int MAX_ENTRIES = 57;
public const int HEADER_OFFSET = 0x60;
public const int HEADER_SIZE = 24;
public const int OFFSET = 0x78;
public const int SIZE = 456;
public const int TABLE_ENTRY_SIZE = 8;
}
public static byte[] PFD_HASH_TABLE_HEADER = new byte[HASH_TABLE.HEADER_SIZE + 1];
public static byte[] PFD_HASH_TABLE = new byte[HASH_TABLE.SIZE + 1];
public static byte[] PFD_HASH_TABLE_ALL_ENTRIES = new byte[HASH_TABLE.SIZE / HASH_TABLE.TABLE_ENTRY_SIZE + 1];
//**************************************************************************************************************************'
//* GLOBAL PROTECTED FILES TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct PF_TABLE
{
public const int OFFSET = 0x240;
public const int SIZE = 31008;
public const int ENTRY_SIZE = 272;
public const int ENTRY_INDEX_SIZE = 8;
public const int ENTRY_NAME_SKIP_BYTES = 8;
public const int ENTRY_NAME_SIZE = 65;
public const int ENTRY_GARBAGE_SKIP_BYTES = 73;
public const int ENTRY_GARBAGE_SIZE = 7;
public const int ENTRY_DATA_SKIP_BYTES = 80;
public const int ENTRY_DATA_SIZE = 192;
public const int ENTRY_KEY_SKIP_BYTES = 80;
public const int ENTRY_KEY_SIZE = 64;
public const int ENTRY_HASHES_SKIP_BYTES = 144;
public const int ENTRY_HASHES_SIZE = 80;
public const int ENTRY_HASH1_SKIP_BYTES = 144;
public const int ENTRY_HASH_SIZE = 20;
public const int ENTRY_HASH2_SKIP_BYTES = 164;
public const int ENTRY_HASH3_SKIP_BYTES = 184;
public const int ENTRY_HASH4_SKIP_BYTES = 204;
public const int ENTRY_PADDING_SKIP_BYTES = 224;
public const int ENTRY_PADDING_SIZE = 40;
public const int ENTRY_FILESIZE_SKIP_BYTES = 264;
public const int ENTRY_FILESIZE_SIZE = 8;
}
public static byte[] PFD_PROTECTED_FILES_TABLE = new byte[PF_TABLE.SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY = new byte[PF_TABLE.ENTRY_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ALL_ENTRIES = new byte[PF_TABLE.SIZE / PF_TABLE.ENTRY_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_INDEX = new byte[PF_TABLE.ENTRY_INDEX_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_NAME = new byte[PF_TABLE.ENTRY_NAME_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_GARBAGE = new byte[PF_TABLE.ENTRY_GARBAGE_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_DATA = new byte[PF_TABLE.ENTRY_DATA_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_KEY = new byte[PF_TABLE.ENTRY_KEY_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_HASHES = new byte[PF_TABLE.ENTRY_HASHES_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_HASH1 = new byte[PF_TABLE.ENTRY_HASH_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_HASH2 = new byte[PF_TABLE.ENTRY_HASH_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_HASH3 = new byte[PF_TABLE.ENTRY_HASH_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_HASH4 = new byte[PF_TABLE.ENTRY_HASH_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_PADDING = new byte[PF_TABLE.ENTRY_PADDING_SIZE + 1];
public static byte[] PFD_PROTECTED_FILES_TABLE_ENTRY_FILESIZE = new byte[PF_TABLE.ENTRY_FILESIZE_SIZE + 1];
//**************************************************************************************************************************'
//* GLOBAL Y TABLE VARIABLES *'
//**************************************************************************************************************************'
public struct Y_TABLE
{
public const int MAX_ENTRIES = 57;
public const int OFFSET = 0x7b60;
public const int SIZE = 1140;
public const int TABLE_ENTRY_SIZE = 20;
}
public static byte[] PFD_Y_TABLE = new byte[Y_TABLE.SIZE + 1];
public static byte[] PFD_Y_ALL_ENTRIES = new byte[Y_TABLE.SIZE / Y_TABLE.TABLE_ENTRY_SIZE + 1];
//**************************************************************************************************************************'
//* GLOBAL PADDING VARIABLES *'
//**************************************************************************************************************************'
public struct BOTTOM_PADDING
{
public const int OFFSET = 0x7fd4;
public const int SIZE = 44;
}
public static byte[] PFD_BOTTOM_PADDING = new byte[BOTTOM_PADDING.SIZE + 1];
}

Add to a class:

using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using glb = clsGlobal;

public class clsPFDTables
{
//**************************************************************************************************************************'
//* READ THE TOP HASH FROM DECRYPTED HEADER IN AN ARRAY *'
//**************************************************************************************************************************'
public static byte[] Read_Decrypted_Header_Top_Hash(byte[] decrypted_header_array, int offset)
{

byte[] output_array = new byte[glb.PFD_HEADER.TOP_HASH_SIZE];

Buffer.BlockCopy(decrypted_header_array, offset, output_array, 0, glb.PFD_HEADER.TOP_HASH_SIZE);

return output_array;
}
//**************************************************************************************************************************'
//* READ THE BOTTOM HASH FROM DECRYPTED HEADER IN AN ARRAY *'
//**************************************************************************************************************************'
public static byte[] Read_Decrypted_Header_Bottom_Hash(byte[] decrypted_header_array, int offset)
{
byte[] output_array = new byte[glb.PFD_HEADER.BOTTOM_HASH_SIZE];

Buffer.BlockCopy(decrypted_header_array, offset, output_array, 0, glb.PFD_HEADER.BOTTOM_HASH_SIZE);

return output_array;
}
//**************************************************************************************************************************'
//* READ ALL ENTRIES FROM HASH TABLE TO A LIST OF ARRAYS *'
//**************************************************************************************************************************'
public static List Build_Hash_Table_Entries_Array(byte[] hash_table_array)
{
List output_bytes = new List();

for (int i = 0; i

#53 - GMOTE - 128w ago
GMOTE's Avatar
Nice news.

#52 - eric994 - 128w ago
eric994's Avatar
this is a favour i want to ask for anyone who understands this stuff.

Could it be possible to fix the "corrupt save data" dilemma in the call of duty: black ops II(BLES01717) with will highly appreciated by me and many others with the same copies of this amazing game.

#51 - PS4 News - 128w ago
PS4 News's Avatar
Following up on his initial release, this weekend PlayStation 3 developer Flat_z has updated his PS3 Save Game Tools hacking pack alongside a fix for PFDTool v0.2.0 followed by v0.2.1 and v0.2.2 with details below.

Download: PS3 Save Game Tools Pack v0.2.0 / PFDTool v0.2.0 Fix / PFDTool v0.2.2 (Removed) / PFDTool v0.2.2 Fix / PFDTool v0.2.2 (Final) / MSVCR100.dll (Required)

From the included ReadMe file: Guys, here is an updated version of pfdtool.

Please test it carefully because I have no time at the moment to test it by myself.

Changelog:

  • Support of PARAM.PFD for trophies (without keys, of course)
  • Support of PARAM.PFD v4 which used in a newer SDK
  • Fixed a bug with verify operation on signature hashes
  • Now you can use a list of product codes delimeted by '/' (slash), for example: [BLUS31142/BLES01403], they should use the same disc hash key and secure file IDs
  • Show an information about .PFD type and version

The format for 'global.conf' is different. Please add these changes to your files:

1. Add a new parameter called 'user_id' which set the user identifier (the same number as used in your home folder: /dev_hdd0/home/[user_id]/)
2. Add a new parameter called 'keygen_key'. Open 'Talk:Keys' page on the PS3DevWiki and search for string 'KeygenV4'
3. Rename the parameter 'param_sfo_key' to 'savegame_param_sfo_key' (see below)
4. There a bunch of new keys for trophies: 'trophy_param_sfo_key', 'tropsys_dat_key', 'tropusr_dat_key', 'troptrns_dat_key', 'tropconf_sfm_key' and they are not public so left them as XX.

[Register or Login to view code]

Also I noticed that some of you use a kernel swapping feature in the REX firmware. Don't forget to use your current (!) console ID. For example, if you made a save game on a DEX then you need to specify a DEX console ID.

Disc hash keys are sent to the PS3 by the Blu Ray Drive itself (well, not the actual disc hash key but some data from the disc which will be encrypted after that and used as a disc hash key).

PFDTool 0.2.1 Changelog:

  • Fixed issues with the file size.

PFDTool 0.2.2 Changelog:

  • Now encrypt and decrypt operations update hashes automatically (be sure to use all keys!).
  • Fixed another issue with the file size of modified files.
  • Removed a verbose flag because it is not used at the moment.

More PlayStation 3 News...

#50 - BerserkLeon - 129w ago
BerserkLeon's Avatar
Wow, something I'd love to use. can't wait until it's ported to 4.21... hope some sort of code hacking plugin can be released soon too.

Also, Demario, no, can't be used on a non-modded ps3, I'm pretty sure. As the instructions say to replace files in dev_flash... on the console.

Anyway, If I were you, dev, I wouldn't worry about people hacking their trophies. Because anyone on 4.21REX can do that and sync with servers as normal. since there are already tools out that can allow you to do it, I wouldn't worry about releasing a more complex process that'd allow one to do the same thing. That's just me though.

#49 - Demario - 129w ago
Demario's Avatar
i got a question; does it work with normal ps3 ? (not modded)

#48 - lokesea - 129w ago
lokesea's Avatar
a new way to enter ps3 as wii??

Welcome to legend of zelda savegame PS3 LOL

#47 - PS4 News - 129w ago
PS4 News's Avatar
Following up on the previous release, this weekend PlayStation 3 hacker Flat_z has released PS3 Save Game Tools including a Data Dumper, Disc Hash Key Dumper, PFD SFO Tools, Secure File ID Dumper, and a PFD Tool update with details below.

Download: PS3 Save Game Tools / PS3 Save Game Tools (Mirror) / PFD Tool Update / BruteforceSaveData v1.2.0 by aldostools

From Twitter: A save game tool in a testing phase before tomorrow's release save game tools. hehe, dunno yet maybe I will make a managed dll for pfd stuff. An another link if you experience a troubles with downloading. Little update of pfdtool (I fixed an issue with 4 version for some games. They should be fine now.)

Trophies will work in the next release but I'm afraid to add support for them because you can easily hack your trophies with it and synchronize them with the server. I'll release a port of my dumpers to 4.21 soon. I'm working on a new payload which I think allow me to not to replace sprx. And newer version will write keys directly to the file.

You don't need to replace modules and launch a dumper if you only want to resign files. A dumper required only for extracting a save game key directly from the memory of the game. And trophy keys are the same for every console because they are constant. In addition, you don't need to extract/read/write keys every time.

A .PFD file for save games is a bit complex than trophy's .PFD. And games uses different keys for their save files. Trophy keys are constants as I mentioned above. I don't like a name PSID because there are two different PSIDs on the PS3: PSID and OpenPSID. So I call the first one as Console ID (it should contains the Target ID of your console). The second one seems to be random bytes (or encrypted bytes) which widely used on PSN stuff.

There are different ways to get your console ID. If you have a flasher then you can make a dump of your flash, then locate your EID0 there and the first 16 bytes will be your Console ID. The second way is using a proxy server as you mentioned. A PS3 will send your console ID in different queries (for example, when you try to login to PSN, when it fetches your act.dat, etc).

It used as a HMAC key to hash a file content along with another keys. I suppose that current firmwares don't check these hashes. That's why Xploder don't need your Console ID. You can check it by yourself making a different console ID and resign your save game and then try to load it. But I want to generate all hashes correctly. That's why I used all real parameters. But you can omit some of them.

You don't need to specify a full file path, only a file name inside a folder (actually it is an entry name inside .PFD). By the way, specifying a zero offset causes a very slow processing. Because .ELF files have a 70-80% of code and not data. And I recommend to use a dumper instead of bruteforcing.

It is better than Xploder because it is not server based, so you can do what you want with your save game and I think Xploder doesn't allow you to decrypt/encrypt data (I can be wrong because I don't use the Xploder's software). Trophies are also supported but not in current version because I didn't include keys for them in the release.

From the included ReadMe Files: Data Dumper (data_dumper.pkg)

Requirements:

  • 3.55 CFW (e.g. Kmeaw)
  • MultiMAN or original dev_blind application and FTP client

1. Install Data Dumper (data_dumper.pkg) if you didn't installed it before. It is a homebrew application to dump a data from some LV2 memory to a file: /dev_hdd0/tmp/dumps.bin

2. Every time you're want to dump a data from my applications (e.g. Klicensee Dumper) you're need to reboot a console to clear a data storage in LV2 memory.

3. Run a dumper loader, then start your game.

4. After exiting from the game you need to run Data Dumper, you will hear some beeps.

5. Then run any FTP client (e.g. builtin in MultiMAN) and download a dumped data from /dev_hdd0/tmp/dumps.bin.

Disc Hash Key Dumper (disc_hash_key_dumper_loader.pkg)

Requirements:

  • 3.55 CFW (e.g. Kmeaw)
  • MultiMAN or another FTP client

1. Install Data Dumper (data_dumper.pkg) if you didn't installed it before. It is a homebrew application to dump a data from some LV2 memory to a file: /dev_hdd0/tmp/dumps.bin A data which stored there is written by dumper loaders, e.g. by Disc Hash Key Dumper.

2. Install Disc Hash Key Dumper Loader (disc_hash_key_dumper_loader.pkg). It stores a disc hash key if your game is not a PSN/SEN game.

3. Reboot a console to clear a data storage in LV2 memory.

4. Now you need to start Disc Hash Key Dumper Loader, then start your game.

5. After exiting from the game you need to run Data Dumper, you will hear some beeps.

6. Then run any FTP client (e.g. builtin in MultiMAN) and download a dumped disc hash key from /dev_hdd0/tmp/dumps.bin.

PFDTool & SFOPatcher Beta version (pfd_sfo_tools: pfdtool.exe and sfopatcher.exe)

ATTENTION!!! Be careful with 'pfdtool' because it is working with the directory you specify so it will overwrite files inside it.

Some notes about keys:

1. 'Syscon Manager Key' (syscon_manager_key): a constant key from a Syscon Manager.
2. 'PARAM.SFO Key' (param_sfo_key): a constant key used for PARAM.SFO entry.
3. 'Fallback Disc Hash Key' (fallback_disc_hash_key): a constant key used for discless PSN/SEN games.
4. 'Authentication ID' (authentication_id): an additional constant key.
5. 'Console ID' (console_id): your unique console identifier.
6. 'Secure File ID' (secure_file_id): per a game file, almost the same for all files of the game, specified by a game developer (used to encrypt save game files and to hash their content).
7. 'Disc Hash Key' (disc_hash_key): per a game disc or a constant key for PSN/SEN games (used to hash a file entry). You need to use an original game disc and extract it from the disc. For PSN/SEN games they used a fallback disc hash key. 'Disc Hash Key' hash is not verified by PS3 so you can omit this key.

Attention! Some game developers (for example, creators of Metal Gear Solid 4) uses a custom additional encryption layer for their save files. In these cases you need to reverse-engineer the game itself.

1. Paste your console specific data inside 'global.conf'. You need to paste your console ID (IDPS) and needed keys. Open 'Keys' page on the PS3 Dev Wiki and look into the 'Key lists - sc_iso module 1.00-4.00'. There is a 'Syscon Manager Key' at the #2.

Open 'Talk:Keys' page on the PS3 Dev Wiki and search for strings 'Params' and 'Fallback key'. They are 'PARAM.SFO Key' and 'Fallback Disc Hash Key'.

2. Prepare required keys for the game and place them inside 'games.conf'. You need these keys only to verify your .PFD file (it is an optional feature) or to play with save game data encryption. So if you want only to resign a foreign save game then you need only your console ID and skip some hash updates by specifying some flags at 'pfdtool'.

For secure file IDs you can specify an exact file name or use wildcards to match a file name (for example, you don't need to specify the same key for all game files if the game uses the same key for all of them). A disc hash key can be extracted only from an original game disc. For PSN/SEN games a fallback disc hash key is used. This type of hash is not verified by PS3 so you can omit its key but they can add a check in the future firmware versions.

So if you want to use 'Disc Hash Key'=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX and 'Secure File ID'=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY for a save file named 'SAVE.DAT' and your game have a product code='BLZZZZZZZ' place them inside a config file:

[Register or Login to view code]

3. Make a custom save game to use it as a pattern for 'sfopatcher'.

1) You may also need to patch a copy protection flag inside your PARAM.SFO because some games uses it:

[Register or Login to view code]

After copying it to the PS3 you need to update a game cache. You have two solutions:

a) 'Rebuild Database' in the system recovery menu. Be careful with it because it can corrupt your file system in rarely cases.
b) Manually copy your save game to the corresponding folder by using a FTP client (for example, embedded in MultiMAN).

2) You need to patch a foreign PARAM.SFO with data from your PARAM.SFO (the tool uses your account ID, save parameters, optional title and description values):

[Register or Login to view code]

If you also want to patch title and description use a command below:

[Register or Login to view code]

4. Import your optionally patched save game folder to 'pfdtool' and use it.

Make sure that you specify a game setting set (from 'games.conf') otherwise you will get some fails.

Attention!

a) You will always get a 'Disc Hash Key FAIL' if you don't use a valid disc hash key. It is not important because it is not checked.
b) If you will get a 'Console ID Hash FAIL' then you use a wrong console ID.
c) If you will get a 'Secure File ID Hash FAIL' then you use a wrong secure file ID for a corresponding file.

You don't need to get a valid console ID for foreign save, just use your console ID and update a save game.

1) To list all entries from PARAM.PFD use a 'list' command:

[Register or Login to view code]

2) To check the validity of PARAM.PFD use a 'check' command.

[Register or Login to view code]

3) If you don't plan to modify save game files and you want only to resign a save game for your console then just use an 'update' command with a 'partial' update option:

[Register or Login to view code]

4) If you plan to modify save game files then use an 'update' command without the option above:

[Register or Login to view code]

5) To encrypt or decrypt specified save game files use 'encrypt' or 'decrypt' command:

[Register or Login to view code]

6) To bruteforce a secure file ID use a 'brute' command along with the .ELF file from the game and specified decimal offset (I recommend to specify an offset of data segment which is usually started at 70-80% of the entire file):

[Register or Login to view code]

Bruteforcing a secure file ID takes a lot of time because it is based on hashing of the game file. The larger the file size, the longer the wait. And bruteforcing don't guarantee that you will get a secure file ID because it can not be specified in the plaintext inside an ELF file.

Once again, if you want to easily resign a save game (as publicly known commercial tools does) you just need to place your console ID and use the command:

[Register or Login to view code]

I also recommend to use my 'Disc Key Dumper' (incorrectly named because it is a disc hash key really) and 'Secure File ID Dumper' to dump keys directly from the memory of a game. But they are written for 3.55 CFW. I will port them to the 4.21 soon.

I will be glad to see if someone will write a batch script for automate the process or a GUI application because I have no time to do it personally. Also will be nice if someone will create a centralized storage of game setting' sets to find keys there. In the future the tool needs to be improved for error handling because it is poor at the moment. I will plan to improve it in further versions.

Secure File ID Dumper (secure_file_id_dumper: ps3_savedata_plugin.sprx, ps3_savedata_plugin_game.sprx, ps3_savedata_plugin_game_mini.sprx and secure_file_id_dumper_loader.pkg)

A secure file ID is specified by developer of the game. There are can be more than one secure file IDs, one ID per file. There are cases when these bytes stored at EBOOT.ELF as is, so you can use my PFD tool to bruteforce them by specifying a PARAM.PFD and file name.

In other cases you need skills of reverse-engineering and a disassembler to find a secure file ID. That's why I had created this dumper. It dumps a secure file ID from memory itself.

Requirements:

  • 3.55 CFW (e.g. Kmeaw)
  • MultiMAN or original dev_blind application and FTP client

1. Install Data Dumper (data_dumper.pkg) if you didn't installed it before. It is a homebrew application to dump a data from some LV2 memory to a file: /dev_hdd0/tmp/dumps.bin. A data which stored there is written by dumper loaders, e.g. by Klicensee Dumper.

2. Install Secure File ID Dumper Loader (secure_file_id_dumper_loader.pkg). It stores a file path to the file which used in your save data and a secure file ID of this file.

3. Now you need to replace original libraries located at dev_flash/vsh/module by modified versions. There are ps3_savedata_plugin.sprx, ps3_savedata_plugin_game.sprx, ps3_savedata_plugin_game_mini.sprx. I use a dev_blind feature from MultiMAN, you can use any other way. Don't forget to backup original files.

4. Reboot a console to clear a data storage in LV2 memory.

5. Now you need to start Secure File ID Dumper, then start your game.

6. Then you need to make a game save.

7. After exiting from the game you need to run Data Dumper, you will hear some beeps.

8. Then run any FTP client (e.g. builtin in MultiMAN) and download dumped secure file IDs from /dev_hdd0/tmp/dumps.bin.

9. Restore original libraries ps3_savedata_plugin.sprx, ps3_savedata_plugin_game.sprx, ps3_savedata_plugin_game_mini.sprx using the same method as at step 3.

Notes: Not all of these libraries used with all games, there is one library per game type.

From gingerbread: Save Data Information

[Register or Login to view code]

Let me say a few words about the process of signing. There are two types of files - system file object (PARAM.SFO) and game files (which are encrypted by the secure file ID). The first one contains 3 or 4 hashes (depending on whether it is a trophy file database or not).

So for game saves they are a static key embedded in the prx module, your unique console ID, disc hash key and authentication ID (it is static too). So if you take a foreign save game you probably don't have its console ID and the disc hash key (you can only take a disc hash key if you have an original game disc for it).

Also if you don't have a secure file ID and you are lazy to get it (by bruteforcing it/reversing the game executable/dumping from the memory) then you can't calculate hashes for game files too. That's why I created two different modes of signing/checking - one for these people who want only to resign a foreign save game and nothing more and the second one is for people who have all data to update all hashes for their save game.

The first mode called partial update/check (see the corresponding option at pfdtool), and for full update you don't need to specify this option. The partial update only updates hashes which are easy to calculate (based on static data such as authentication ID and console ID).

So if you have a filled global.conf (all keys and your console ID) and run a partial update on the foreign save game to resign it for your console then you got a fully working resigned save game.

But if you want to modify save game files which are encrypted then you need to get all data and specify them in configuration files and then use a full update to resign it. By the way the PS3 itself doesn't check some hashes such as a hash which was calculated using a disc hash key.

So you can omit some of them (I only omitted the hash which I said and it works fine). But I don't know what situation will be in the future, maybe S0ny will add a check for them.

Finally, from aldostools: I have updated the BruteforceSaveData tool with the suggested changes. Also if you press the buttons holding Ctrl it will allow to edit the command line

TIP: Hold Ctrl key and press Enter or double-click on a game to skip the bruteforce using the keys in the database. This feature can be use useful for savegames with large data (eg. >4MB and that you already know that the key is unknown)

More PlayStation 3 News...

#46 - PS4 News - 144w ago
PS4 News's Avatar
This weekend Oct0xor (aka Mr. DongleBreaker) has followed up his previous release with PS3UserCheat PS3 Cheat Dongle v2.3 update which features Cheatlist.dat v6.1 as outlined below.

Download: PS3UserCheat PS3 Cheat Dongle v2.3 Update / PS3UserCheat PS3 Cheat Dongle v2.3 Update (Mirror) / PS3UserCheat PS3 Cheat Dongle v2.3 Update (Mirror #2) / PS3 Cheats Editor Installer (by aldostools) / PS3 DEX 3.55 Cheat Pack by technodon

From his Tweet: Release: Custom ps3usercheat v2.3 + cheatlist.dat v6.1

Finally releasing what I have many times asked for

Now everyone can make their own AR cheats for PS3.

I hope that in one day PS3 will have so much cheats like Nintendo DS

Thanks to HeroQ8 for support.

!!! Never use this for cheating in online games !!!

This would help you making your own cheats: pastebin.com/tsD7wKv7

In related news Tetzrep has made available (via psx-scene.com/forums/content/even-2606/) a PSUserCheatfile MK9 Multiplayer NPC (Password: tetzrep)

This time allowing for mulitplayer and tag team use of the NPC's that were unlocked last month. A few other nice touches in this update include:

  • The ability to morph Shang Tsung into other characters, as he does in the arcade ladder. This is nice considering all you can do with the move is take a bit of their life bar away. Now with certain button combos, you can pretty much morph into any character on the roster, and the NPC's to boot. All of this selectable through ps3usercheat, and the same directions from last months post applies also.
  • The ability in the challenge tower on challenge 227 (Cyborg-Absorb) to not just play as Cyber-Reptile in this challenge, but to give the cyborg character in that challenge the fighting styles and any character, including the bosses.
  • Other cheats added allow you to speed up and slow down gameplay.

There is a very nice jpg packaged in with the .dat file which gives specific instructions on how to get this to work, and the button combos needed.

Also from Hero Q8 (aka ueess via codemasters-project.net/vb/showthread.php?13123-Cheat&p=132900#post132900) comes some PS3 CFW 4.21+ Only Cheat Packages below, as follows:

Installation Instructions

1. Unrar The Rar File
2. Copy the pkg file to your USB
3. Install Package from "Install Package Files".
4. Choose The Game from Multiman or any other Manager (Must Have Any Disc In The Drive)
5. Boot the game from installed pkg not the disc icon it will start the game with the codes
NOTE 1: Some Games Needs Files from USRDIR to be moved to PKG dir (Minus Eboot) after install i will add Note 1 for these Games
NOTE 2: Some PKG are Just Update Install It and Boot The Game Normal i will add Note 2 for these Games

All Cheats For 4.21+ Only - For People who are on 3.55 CFW use PS3UserCheats (free) Which Has all codes converted to be used on that divice (Same ones you find in All Old and Current Eboot PKGs)

2nd Super Robot Taisen OG BLJS10133

1. Infinite Money
2. Infinite PP
3. Infinite SP

BLJS10133
http://www.putlocker.com/file/31B61E77E1AD8976

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Borderlands 2 BLUS30982

1. Max Money on Buy
2. Max Badass Token & Skills
3. Max Level [NO EXP REQUIRED]
4. Infinite Ammo

BLUS30982
http://www.putlocker.com/file/EB1CB757807F469B

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Darksiders 2 BLUS30829 and BLES01597

1. Infinite Skill Points Have at least 1
2. Infinite Wrath
3. Infinite Reaper Gauge
4. Max Yellow Coins after Save
5. Max Blue Coins after Save

BLUS30829
http://www.putlocker.com/file/16A1AAF26AC0AB47

BLES01597
http://www.putlocker.com/file/7BCE345B19B1F135

NOTE: For Yellow and Blue Coins Load Game with code save game, quit game & reload
NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Devil May Cry 4 BLUS300920

1. Infinite Health
2. Infinite Devil Trigger
3. Infinite Exceed
4. Always SSS Style

BLUS300920
http://www.putlocker.com/file/B28AB14D1635C8CB

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Far Cry 3 BLUS30687

1. Max Money on Buy/Sell
2. Max Skill Points on Use
3. Max Exp on Gain
4. Infinite Ammo

BLUS30687
http://www.putlocker.com/file/2E1D1E00B3E0465C

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Medal of Honor Warfighter BLUS30990

1. Infinite Ammo

BLUS30990
http://www.putlocker.com/file/FE8FCF2C2CA5499F

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Need for Speed Most Wanted BLUS31010

1. Infinite Nitros
2. Infinite SP

BLUS31010
http://www.putlocker.com/file/F2D114D7ABA60F82

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Never Dead BLES01303

1. Infinite Ammo

BLES01303
http://www.putlocker.com/file/4E52BC166CC88799

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Ni no Kuni Wrath of the White Witch BLES01555

1. Max Money On Gain

BLES01555
http://www.putlocker.com/file/F359211A87282361

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Sleeping Dogs BLES01661

1. Infinite Money

BLES01661
http://www.putlocker.com/file/E186D51F97DDAC28

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Soul Calibur V BLUS30736

1. Infinite Health
2. 1 Hit Ko

BLUS30736
http://www.putlocker.com/file/822992CFA5A437BB

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Spec Ops The Line BLUS30531

1. Infinite Ammo

BLUS30531
http://www.putlocker.com/file/C3322E0AF43DCA0D

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Tekken Tag Tournament 2 BLES01702

1. Max Money on Buy

BLES01702
http://www.putlocker.com/file/E71CC5B09949270F

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

The Darkness II BLUS30743

1. Max Essences on Gain

BLUS30743
http://www.putlocker.com/file/9E0BCFF14D17E781

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Twisted Metal BCUS98106

1. Infinite Health
2. Infinite Ammo

BCUS98106
http://www.putlocker.com/file/76E57141489BBBAA

NOTE 2: This Is Update PKG Just Boot The Game Normal After Install

Below is a Tool To Apply PS3UserCheat Hacks on Eboots from KDSBest (via twitlonger.com/show/kigtsr):

Download: Patch-ELF-PS3UserCheat.rar

[Register or Login to view code]

Also (via twitlonger.com/show/kjc7cn) We all love assembler or? And working with magic numbers. Try to hook GamePad System Wide. I do, but it is harder than thought. It's not working pretty well. We will see. Code is for REX (4.21) as CEX. If you change something in the setup it won't work LV2 Addresses are different. And my payloads like to jump around in LV2 in the right addresses.

To make things clear again. This is not fully working. Read below. Looking forward to deliver the community a project CWcheat for PSP. I am up 20 hrs now. Go to bed. Getting where I am now with a ps3 dev wiki which is not reachable and totally poor documentation of the ps3 scene was a lot screams and red bull.

Stay tuned, KDSBest

[Register or Login to view code]

My last code is a PoC for hooking a button combo while a game is running in any Game/Homebrew or XMB

[Register or Login to view code]

POC - Hooking A Button Combo During A Game / App Or On The XMB (via twitlonger.com/show/kjuoro):

[Register or Login to view code]

Ni No Kuni Max EXP Cheat by KDSBest

Ni No Kuni Max EXP ps3usercheat hack (You can use my Tool to apply it!): 00002000 006F96BC 38007FFE

Shortly following, AnoRelease (aka KDSBest and CFWProphet) made available a Ni No Kuni EXP Hack.pdf stating:

Hi, it’s me AnoRelease, look what I got hear for ya.

Greetings

AnoRelease

Below is a FAQ Interview from him as well:

Q.1) So it appears you are known by another name, what is it, who are you ?
A) I’m a Chinese hacker and yeah I’m known as different persons. I guess you have to read between the line. I get hacks from a Team and I release them for them. They want to stay underground. This is how this works after all. Who am I? A leaker with the permission to leak the stuff. I’m the Chinese hacker that never existed after all.

Q.2) Rumour has it that you also released the Cex > Dex method, is that true ?
A) Yeah I wasn’t able to register on PS3HaX back then, now I could and so it was released on PS3News. A site which I don’t visit on my own, but I thought interesting news will spread anyway. I just tested the algorithm and got permission to release it. Basically the happy (fairy tail) guy was the brain behind it. Most people in the scene should know who he is. Even if he is mostly underrated.

Q.3) Why did you release it ?
A.) Why not make it public? I asked if I can release it and was told that the owner doesn’t care if it is out there, as long as his name isn’t exposed.

Q.4) Will you be releasing anything else ?
A.) This depends on the brilliant hackers behind all this. I just say AC1D .

Q.5) What do you think of the lv0 keys release ?
A.) Oh I think I know who is behind it, but of course I have no proof. They somehow claim they were forced to release it, but how are they forced to? So they gave it to someone else in the first hand. In my opinion it is their problem after all and I don’t believe that they didn’t want to release it. They checked cex > dex and nothing special happened because of the Anon release maybe and saw how a release is done.

Q.6) What do you think of the PS3 scene ?
A.)I like it. A good amount of drama and epic stories. It is/was a quite impressive time so far. I can’t wait for the next gen consoles. Sometimes it is sad how no brainers talk about the devs and it’s sad how others put them on a throne.

Q.7) What do you think about graf_chokolo ?
A.) His story is sad at the end. He is very inspiring for many hackers in the scene I guess. No one reached his knowledge about the PS3 so far and he will always be the number one hacker in our hearts. Many kudos for him.

Q.8) I hear you are a big fan of GeoHot, what is it you like about him ?
A.) I like it when people act dumb and go to TV. It’s like a robber ringing the bell afterwards and tell the house owner I just stole your stuff. Like my hacker friend (happy [fairy tail] guy) always says “Hacking is an underground job after all”. I don’t know if he ever said that on a forum, but he told me often enough. I like his humour I guess, the rap video was funny as hell. I wish he did more of them, but going on TV is not a well idea. I heard rumours he lost his job at Facebook too. He is just too ego I guess and no team player after all.

Q.9) Will you be working on any Next Gen consoles ?
A.)If I get the chance I will of course. The PS4 Press release was awesome in my opinion. I’m a bit happy about the X86 architecture and a bit sad. X86 is full of garbage because it grew with the time and still is backward compatible. AMD and Intel both worked that whore and that is how she looks like in my opinion.

Q.10) Is there anything you would like to add ?
A.) I would like to thank some people: KDSBest, cfwprophet, Team AC1D, GregoryRasputin, Pockets69, graf, durandal, eussNL, naehrwert and everything else I forgot of course.

Finally, HotNsexy has shared a Dead Space 3 PS3 Cheat PKG for 1.0 stating the following:

Ok. I'm on rebug 4.21.2 and I succeed to make a pkg cheat for Dead Space 3 BLUS31053 Its full heath and stasis and infinite ammo, for version 1.0 if you have 1.01 installed delete it and then install this pkg:

If you get a black screen, just take out your BD from drive, restart console go to MM and start the game (no BD mirror or what so ever), just start the game and then start it from APP/HOME when prompt to update to 1.01 just skip it and enjoy... All greats to "medo" that released the codes.

He also made available an Infinite Ammo & Bottomless Clip stating: Again its for version 1.00 if you update 1.01 installed delete it and then install this pkg. Try it as I didnt try but I think it will work, cause Im currently playing with the other one hehe... Tried with patch update but always give me a black screen.

More PlayStation 3 News...