# Yifan Lu releases psvimgtools, a Vita Backup Decrypter



## Molina (Feb 20, 2017)

You're on fire @WiiUBricker with those news.
Maybe it's time to endorse a reporter title.

PsVita's scene is doing great, maybe I should get one or a PsTv.


----------



## DarthDub (Feb 20, 2017)

Molina said:


> You're on fire @WiiUBricker with those news.
> Maybe it's time to endorse a reporter title.
> 
> PsVita's scene is doing great, maybe I should get one or a PsTv.


Just recently purchased a PSTV. $45 for me. Dunno about UK though.


----------



## Molina (Feb 20, 2017)

DarthDub said:


> Dunno about UK though.


Do you see me with a UK flag? I had it changed, maybe a bug cause you to see me with a UK one.

I'm in a special place in France where I get taxed even more than other french department. So for me it will be a little more.
I hesitate on game on the go with a PsVita or couchgaming with a PsTv.


----------



## WiiUBricker (Feb 20, 2017)

This is how you brute-force your key:


```
D:\psvimgtools-0.1-win64>psvimg-keyfind 3 partials.bin
Found 0/8 words, current knowledge:
  ****************************************************************
dispatching 3 jobs with 0x55555555 tries per job.

 69% [==================================                ] (left: 0x4dc445d3)
Found 1/8 words, current knowledge:
  2BBA8792********************************************************
dispatching 3 jobs with 0x55555555 tries per job.

 23% [===========                                       ] (left: 0xc3438a8d)
Found 2/8 words, current knowledge:
  2BBA879271758459************************************************
dispatching 3 jobs with 0x55555555 tries per job.

 18% [=========                                         ] (left: 0xcf75b947)
Found 3/8 words, current knowledge:
  2BBA879271758459B7467D64****************************************
dispatching 3 jobs with 0x55555555 tries per job.
```

It takes a while, but it will get the job done. I will see how decrypted save files look like and if they are easy to edit.

Edit: Alright. Here is the content of my extracted save file. Some .bin, .db and .icv files. Still giberish to me. Maybe someone else can figure it out or better yet, create a save file editing tool for popular games.


----------



## Deleted User (Feb 20, 2017)

Sweet new tool; massive props to Yifan lu for finally cracking the Vita's CMA backup crypto!

Shame about the backed-up files still having PFS encryption, though I'm almost positive that will be cracked pretty soon as well. Nothing can really be done with PFS-encrypted files, apart from install them using the really old method introduced by Mr.Gas, so it makes sense that cracking PFS next will make this an even bigger deal!


----------



## WiiUBricker (Feb 20, 2017)

Voxel said:


> Sweet new tool; massive props to Yifan lu for finally cracking the Vita's CMA backup crypto!
> 
> Shame about the backed-up files still having PFS encryption, though I'm almost positive that will be cracked pretty soon as well. Nothing can really be done with PFS-encrypted files, apart from install them using the really old method introduced by Mr.Gas, so it makes sense that cracking PFS next will make this an even bigger deal!


Interesting. That's the first time I hear about PFS encryption. Do all Vita games use it?


----------



## Deleted User (Feb 20, 2017)

WiiUBricker said:


> Interesting. That's the first time I hear about PFS encryption. Do all Vita games use it?


Pretty much, yes. When you launch a legit purchased/downloaded game (or installed via PKG Installer), any files listed in /sce_pfs/files.db (which are pretty much almost all of the files in the game's filesystem) are decrypted by the system and mounted as the app0: partition. After that, the game will begin to run.

It's one of the main reasons you have to run the party app (as the manual app) before dumping a game in Vitamin/MaiDump, as the manual app also has the ability to decrypt the PFS in every file of the game's filesystem.

The PFS EncKey and Secret Key have been out in the wild for a while now, so I'm not really sure if the decryption method is just waiting to be developed now, or whether there are other things needed to decrypt them properly still...


----------



## Jhyrachy (Feb 20, 2017)

I don't get it, how could this works on 3.63 vita?
Is the key the same for all the ps vita?


----------



## WiiUBricker (Feb 20, 2017)

Jhyrachy said:


> I don't get it, how could this works on 3.63 vita?
> Is the key the same for all the ps vita?


You can give me your CMA backup and your AID and I will brute-force your key, decrypt your backup, make changes you want, re-encrypt it and send it back to you. Then you just need to import it via CMA. That's the general idea of how this works if you don't have a 3.60 Vita.

Edit: Actually you just need to give me your AID. I can then send you your partials.bin file that you can use yourself to brute-force your key and do the changes you need yourself.


----------



## Jhyrachy (Feb 20, 2017)

WiiUBricker said:


> You can give me your CMA backup and your AID and I will brute-force your key, decrypt your backup, make changes you want, re-encrypt it and send it back to you. Then you just need to import it via CMA. That's the general idea of how this works if you don't have a 3.60 Vita.


oh, i tought the crack happened on the ps vita side!

So what's the 'dump_partials.vpk' for?


----------



## WiiUBricker (Feb 20, 2017)

Jhyrachy said:


> oh, i tought the crack happened on the ps vita side!
> 
> So what's the 'dump_partials.vpk' for?


It's described in the linked blog post.



> I wrote a tool to do this brute force for you. It is not hyper-optimized but is portable and can find any key on a modern computer in about ten minutes. I have provided a Vita homebrew that generates the chosen ciphertexts on any HENkaku enabled Vita. These “partials”, as I call it, can be passed to psvimg-keyfind to retrieve a backup key for any PSN AID. The AID is not console unique but is tied to your PSN account. This is the hex sequence you see in your CMA backup path. The idea is that if you have a non-hackable Vita, you can easily send your AID to a friend (or stranger) who can generate the partials for you. You can then use psvimg-keyfind to find your backup key and use it to modify settings on your non-hackable Vita. Huge thanks to Proxima for the reference implementation that this is based off of.


----------



## Jhyrachy (Feb 20, 2017)

thanks a lot!

So it's: generate partial.bin on the ps vita using the AID, copy them to the pc (using ftp?) and then crack them using psvimg-keyfind.exe right?


----------



## Deleted User (Feb 20, 2017)

Woah WiiUBricker. Your more active then some of the reporters here lmao. You should probably be one

And this is nice. Don't own a ps anything but this is neat


----------



## Silverthorn (Feb 20, 2017)

WiiUBricker said:


> It's described in the linked blog post.



So basically if you're on a non-hackable Vita, the only outside help you actually need is to generate those partials files, the rest can be done on your PC.


----------



## WiiUBricker (Feb 20, 2017)

Jhyrachy said:


> thanks a lot!
> 
> So it's: generate partial.bin on the ps vita using the AID, copy them to the pc (using ftp?) and then crack them using psvimg-keyfind.exe right?


I have edited my post above. You actually just need to provide me or a person with a hacked 3.60 Vita your AID. Then I can use your AID with the homebrew app to generate a partials.bin that you can use to brute-force your own key and decrypt and re-encrypt your backup yourself.



Silverthorn said:


> So basically if you're on a non-hackable Vita, the only outside help you actually need is to generate those partials files, the rest can be done on your PC.


Yes.


----------



## Deleted User (Feb 20, 2017)

Did anybody get the psvimg creation tool working yet? I'm not really having much luck with this myself for some strange reason...

C:\Users\Owner\Downloads\PSVita_2\psvimgtools-0.1-win64>psvimg-create -n app -K _*insert key*_ ux0_temp_game_PCSI00009_app_PCSI00009 .
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/bridge_prx.suprx because it is not a directory!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/eboot.bin because it is not a directory!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/managed because VITA_PATH.TXT is not found!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/module because VITA_PATH.TXT is not found!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/mono_prx.suprx because it is not a directory!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/resource because VITA_PATH.TXT is not found!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/sce_module because VITA_PATH.TXT is not found!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/sce_pfs because VITA_PATH.TXT is not found!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/sce_sys because VITA_PATH.TXT is not found!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/UnityDevelopmentPlayer.self because it is not a directory!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/UnityReleasePlayer.self because it is not a directory!
WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/VITA_PATH.TXT because it is not a directory!
created ./app.psvimg (size: 20, content size: 0)
created ./app.psvmd
The "ux0_temp_game_PCSI00009_app_PCSI00009" contains all my extracted files.
But I can't understand for the life of me why VITA_PATH.TXT isn't being found, and when it does end up being found (see bottom of the log), it says it's "not a directory"... 

I was looking at the readme, however nothing was really making a lick of sense to me:
_The pack input directory should follow the same format as the output of psvimg-extract. This means a separate directory for each backup set (there may only be one set, in which your input directory will contain one subdirectory) each with a VITA_PATH.TXT file specifying the Vita path and optionally a VITA_DATA.BIN file if the set is a file._

I have tried many different input folders, such as "ux0/temp/game/PCSI00009/app/PCSI00009", removing the 'ux0' part from the path, and even just "PCSI0009", but I just get the same old output...

Any ideas as to how I can get this actually working? I sure hope this isn't a bug, and it's just my stupidity...


----------



## linuxares (Feb 20, 2017)

Bruteforcing my key now. But probably won't use it until any better tools are made


----------



## WiiUBricker (Feb 20, 2017)

Voxel said:


> Did anybody get the psvimg creation tool working yet? I'm not really having much luck with this myself for some strange reason...
> 
> C:\Users\Owner\Downloads\PSVita_2\psvimgtools-0.1-win64>psvimg-create -n app -K _*insert key*_ ux0_temp_game_PCSI00009_app_PCSI00009 .
> WARNING: skipping ux0_temp_game_PCSI00009_app_PCSI00009/bridge_prx.suprx because it is not a directory!
> ...


Just letting you know I have the the exact same problem. Maybe @yifan_lu can help?


----------



## linuxares (Feb 20, 2017)

Jesus it wen't fast fast on 8 cores compare to 4.


----------



## Deleted User (Feb 20, 2017)

WiiUBricker said:


> Just letting you know I have the the exact same problem. Maybe @yifan_lu can help?


Aha, I've got it working! It seems you have to set the input dir as the previous directory to the one with the extracted contents.
I guess the readme was just a tad confusing lol...


----------



## WiiUBricker (Feb 20, 2017)

Voxel said:


> Aha, I've got it working! It seems you have to set the input dir as the previous directory to the one with the extracted contents.
> I guess the readme was just a tad confusing lol...


Thanks. It works here as well. Perhaps someone can code up a noob-friendly gui version, though.


----------



## yifan_lu (Feb 20, 2017)

WiiUBricker said:


> Just letting you know I have the the exact same problem. Maybe @yifan_lu can help?


Read the readme.

https://github.com/yifanlu/psvimgtools/blob/master/README.md

"The pack input directory should follow the same format as the output of psvimg-extract. The means a separate directory for each backup set (there may only be one set, in which your input directory will contain one subdirectory) each with a VITA_PATH.TXT file specifying the Vita path and optionally a VITA_DATA.BIN file if the set is a file."


----------



## Omegadrien (Feb 20, 2017)

https://twitter.com/DaveeFTW/status/833760978869374976

"You no longer need a vita to derive your AID for CMA backup decryption. Use this:"
http://cma.henkaku.xyz/

Great! XD


----------



## Jhyrachy (Feb 20, 2017)

I feel like an idiot, but where is saved the partials.bin?


----------



## Xenon Hacks (Feb 20, 2017)

welp time to buy a Vita


----------



## Omegadrien (Feb 20, 2017)

Jhyrachy said:


> I feel like an idiot, but where is saved the partials.bin?


ux0/data/YourPartials.bin


----------



## WiiUBricker (Feb 20, 2017)

yifan_lu said:


> Read the readme.
> 
> https://github.com/yifanlu/psvimgtools/blob/master/README.md
> 
> "The pack input directory should follow the same format as the output of psvimg-extract. The means a separate directory for each backup set (there may only be one set, in which your input directory will contain one subdirectory) each with a VITA_PATH.TXT file specifying the Vita path and optionally a VITA_DATA.BIN file if the set is a file."


Thanks. Maybe you can include the readme in the download archives as well.



Omegadrien said:


> https://twitter.com/DaveeFTW/status/833760978869374976
> 
> "You no longer need a vita to derive your AID for CMA backup decryption. Use this:"
> http://cma.henkaku.xyz/
> ...


Thanks. I have updated the OP to reflect this change.


----------



## Chary (Feb 20, 2017)

Wow, man, you and Prans are scooping up all the hot news this past week! I'll have to pick up my game and get back into things.

This is awesome to hear, I can't wait to see how the Vita hacking scene progresses onward.


----------



## Westwoodo (Feb 20, 2017)

Hmmm I'm tempted to get a second vita now.


----------



## Sonic Angel Knight (Feb 20, 2017)

I have to agree with @Chary as much as i like these new tools, is just a shame that the people didn't just make stuff like backups easier from day one. 

Now to prepare my body for USB HDD loading on psvita tv. Someone who been buying all his games on sale during playstation store discounts needs this badly. How am i suppose to play chary's beloved persona 4 golden?


----------



## Nirmonculus (Feb 21, 2017)

This is one good news. Really happy about this. Been playing a lot on Vita lately :B so those backups can be edited on the pc side and imported back in?


----------



## wookiee (Feb 21, 2017)

Sorry noob here and just got a vita yesterday. What's a vita backup decrypted? I've got my vita on 3.6 and added henkaku.


----------



## aljpn91 (Feb 21, 2017)

wookiee said:


> Sorry noob here and just got a vita yesterday. What's a vita backup decrypted? I've got my vita on 3.6 and added henkaku.



it's an encrypted backup of a psvita game/save/app made with CMA (content manager assistant) stored in your computer


----------



## elBenyo (Feb 21, 2017)

Now the question is can we trade legit backups between systems or inject the contents of one game over another? If PSP homebrew works on 3.63 do PSP backups load this way, or PS1 games in PSP mode?


----------



## DavidKang (Feb 21, 2017)

3.61+ games on 3.60 vita? By transporting over the games via CMA backup? Not yet right? Still waiting for 3.61+ games support for henkaku...


----------



## signz (Feb 21, 2017)

What I wonder is, by using psvimage-extract, are the extracted files also decrypted or still encrypted? Tried editing my FFXHD (digital, on 3.63) save but FFXED couldn't open the created .psu file (followed this tutorial to create one out of my data0000.bin). Well, it could open it but the data was really scrambled. :/


----------



## PagaN (Feb 21, 2017)

another unneeded for end user tool/hack


----------



## WiiUBricker (Feb 21, 2017)

SignZ said:


> What I wonder is, by using psvimage-extract, are the extracted files also decrypted or still encrypted? Tried editing my FFXHD (digital, on 3.63) save but FFXED couldn't open the created .psu file (followed this tutorial to create one out of my data0000.bin). Well, it could open it but the data was really scrambled. :/


This has been discussed a few posts back in this very thread.


----------



## signz (Feb 21, 2017)

WiiUBricker said:


> This has been discussed a few posts back in this very thread.


Oh, haha. Must have overlooked that post. That explains it, tho. Thanks!


----------



## Hibanahaikara (Feb 21, 2017)

I'm sorry guys. what i need to built an environment for this program. i think i've already installed everything in readme(do i need to instal linux first?). but i still have no idea how to use it. it won't run. when i run the exe files it's just flashing cmd and close by itself. well i never use any linux before so i don't have any idea on how i need to do.


----------



## Haider Raza (Feb 22, 2017)

Correct me if i'm wrong. With this tool we can make a copy of the installed game & we can simply cut paste the game into the vita mem-card without installing the game again right?


----------



## Hibanahaikara (Feb 22, 2017)

Haider Raza said:


> Correct me if i'm wrong. With this tool we can make a copy of the installed game & we can simply cut paste the game into the vita mem-card without installing the game again right?


Hmmm i think we can do that. considering that backup games are already decrypted. 
Btw finally i can do it darn it was so simple.


----------



## stark89 (Feb 22, 2017)

hi, I tried to unpack the burning blood and save file to pack them again with the aid of a second account, unfortunately, in this way the data are not read is no way to transfer saved games from one account to another?

EDIT: I SOLVED, JUST COPY SAVEDATA DECRYPTED TO USER/00/SAVEDATA/GAMEFOLDER


----------



## Ehm (Feb 22, 2017)

So if I'm understanding right, PSVIMG files can be unpacked/decrypted but the output files still require additional PFS decryption?


----------



## Soraiko (Feb 27, 2017)

it is possible to add a vita game to the extracted backup and install it on the vita?


----------



## Soraiko (Feb 27, 2017)

i extracted a whole psvita backup edited it but cant repack it


----------



## Soraiko (Mar 4, 2017)

my vita dont reconize modded backup with customthemes and modded app.db


----------



## Stewie1.0 (Mar 5, 2017)

It works for me, but the only problem is that I can't modify the files. Even if I switched files, they don't work in game. Even the music. It doesn't play. I tried it with Project Diva F, F 2nd's DLC (I don't have F 2nd digital), and Diva X


----------



## Skelletonike (Mar 5, 2017)

The only thing I want to know is, would it be possible to convert a save file of a game from an account from one region to another?
Kinda sucks that there is no way to separate the save file from the game itself... Content manager just bundles the whole thing together. :S


----------



## Soraiko (Mar 5, 2017)

and it is possible to install games in the backup?

--------------------- MERGED ---------------------------

and my vita dont reconize my modded backups (Custom themes)


----------

