PS3 developer flat_z has released a new set of tools for save game manipulation. These tools can decrypt/encrypt save games as well as reisgn and patch SFO files. There is also a Secure File ID dumpr included as well. Let’s take a look:
pfdtool & sfopatcher Instructions
ATTENTION!!! Be careful with ‘pfdtool’ because it is working with the directory you specify so it will overwrite files inside it.
Some notes about keys:
- ‘Syscon Manager Key’ (syscon_manager_key): a constant key from a Syscon Manager.
- ‘PARAM.SFO Key’ (param_sfo_key): a constant key used for PARAM.SFO entry.
- ‘Fallback Disc Hash Key’ (fallback_disc_hash_key): a constant key used for discless PSN/SEN games.
- ‘Authentication ID’ (authentication_id): an additional constant key.
- ‘Console ID’ (console_id): your unique console identifier.
- ‘Secure File ID’ (secure_file_id): per a game file, almost the same for all files of the game, specified by a game developer (used to encrypt save game files and to hash their content).
- ‘Disc Hash Key’ (disc_hash_key): per a game disc or a constant key for PSN/SEN games (used to hash a file entry). You need to use an original game disc and extract it from the disc. For PSN/SEN games they used a fallback disc hash key. ‘Disc Hash Key’ hash is not verified by PS3 so you can omit this key.
Attention! Some game developers (for example, creators of Metal Gear Solid 4) uses a custom additional encryption layer for their save files. In these cases you need to reverse-engineer the game itself.
- Paste your console specific data inside ‘global.conf’. You need to paste your console ID (IDPS) and needed keys. Open ‘Keys’ page on the PS3DevWiki and look into the ‘Key lists – sc_iso module 1.00-4.00′. There is a ‘Syscon Manager Key’ at the #2. Open ‘Talk:Keys’ page on the PS3DevWiki and search for strings ‘Params’ and ‘Fallback key’. They are ‘PARAM.SFO Key’ and ‘Fallback Disc Hash Key’.
- Prepare required keys for the game and place them inside ‘games.conf’. You need these keys only to verify your .PFD file (it is an optional feature) or to play with save game data encryption. So if you want only to resign a foreign save game then you need only your console ID and skip some hash updates by specifying some flags at ‘pfdtool’. For secure file IDs you can specify an exact file name or use wildcards to match a file name (for example, you don’t need to specify the same key for all game files if the game uses the same key for all of them). A disc hash key can be extracted only from an original game disc. For PSN/SEN games a fallback disc hash key is used. This type of hash is not verified by PS3 so you can omit its key but they can add a check in the future firmware versions.
So if you want to use ‘Disc Hash Key’=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX and ‘Secure File ID’=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY for a save file named ‘SAVE.DAT’ and your game have a product code=’BLZZZZZZZ’ place them inside a config file:
3. Make a custom save game to use it as a pattern for ‘sfopatcher’.
- You may also need to patch a copy protection flag inside your PARAM.SFO because some games uses it:
4. Import your optionally patched save game folder to ‘pfdtool’ and use it. Make sure that you specify a game setting set (from ‘games.conf’) otherwise you will get some fails.
Once again, if you want to easily resign a save game (as publicly known commercial tools does) you just need to place your console ID and use the command:
pfdtool -p -u
I also recommend to use my ‘Disc Key Dumper’ (incorrectly named because it is a disc hash key really) and ‘Secure File ID Dumper’ to dump keys directly from the memory of a game. But they are written for 3.55 CFW. I will port them to the 4.21 soon. I will be glad to see if someone will write a batch script for automate the process or a GUI application because I have no time to do it personally. Also will be nice if someone will create a centralized storage of game setting’ sets to find keys there. In the future the tool needs to be improved for error handling because it is poor at the moment. I will plan to improve it in further versions.
Secure File ID Dumper
A secure file ID is specified by developer of the game. There are can be more than one secure file IDs, one ID per file. There are cases when these bytes stored at EBOOT.ELF as is, so you can use my PFD tool to bruteforce them by specifying a PARAM.PFD and file name. In other cases you need skills of reverse-engineering and a disassembler to find a secure file ID. That’s why I had created this dumper. It dumps a secure file ID from memory itself.
- 3.55 CFW (e.g. Kmeaw)
- MultiMAN or original dev_blind application and FTP client
- Install `Data Dumper` (data_dumper.pkg) if you didn’t installed it before. It is a homebrew application to dump a data from some LV2 memory to a file: /dev_hdd0/tmp/dumps.bin. A data which stored there is written by dumper loaders, e.g. by Klicensee Dumper.
- Install `Secure File ID Dumper Loader` (secure_file_id_dumper_loader.pkg). It stores a file path to the file which used in your save data and a secure file ID of this file.
- Now you need to replace original libraries located at `dev_flash/vsh/module` by modified versions. There are `ps3_savedata_plugin.sprx`, `ps3_savedata_plugin_game.sprx`, `ps3_savedata_plugin_game_mini.sprx`. I use a dev_blind feature from MultiMAN, you can use any other way. Don’t forget to backup original files.
- Reboot a console to clear a data storage in LV2 memory.
- Now you need to start `Secure File ID Dumper`, then start your game.
- Then you need to make a game save.
- After exiting from the game you need to run `Data Dumper`, you will hear some beeps.
- Then run any FTP client (e.g. builtin in MultiMAN) and download dumped secure file IDs from /dev_hdd0/tmp/dumps.bin.
- Restore original libraries `ps3_savedata_plugin.sprx`, `ps3_savedata_plugin_game.sprx`, `ps3_savedata_plugin_game_mini.sprx` using the same method as at step 3.
Notes: Not all of these libraries used with all games, there is one library per game type.
You can download the Save Game Tools below.
Download: Save Game Tools by flatz
Source: PS3HaxTweet this!