Hacking Major_Tom Explains Game Dumping/Mods on 3.60

dkabot · Aug 2, 2016

https://twitter.com/MajorTomVita/status/760595053865820166

Pastebin: http://pastebin.com/pz9FbTet

While we can't directly read game assets with the old Manual method, we can with HENKaku~
Apparently the patch directory works similar to PBOOTs in PSP-land in that anything in it is replaced... including the executable.
So we can run Manual to decrypt the game, then run MolecularShell as the game to read its data from app0: to get anything we want (barring patch data itself, apparently).

This also brings up that HENKaku lets us run unsigned EBOOTs, so if we could theoretically decrypt a game EBOOT, we could do... things. Yes, things.

metroid maniac · Aug 2, 2016

dkabot said:
This also brings up that HENKaku lets us run unsigned EBOOTs, so if we could theoretically decrypt a game EBOOT, we could do... things. Yes, things.

Half of the Vita community is very excited right now. The other half is very nervous.

Bubsy Bobcat · Aug 2, 2016

dkabot said:
This also brings up that HENKaku lets us run unsigned EBOOTs, so if we could theoretically decrypt a game EBOOT, we could do... things. Yes, things.

I'm listening....

DinohScene · Aug 2, 2016

Why does all the good stuff happen when I have massive bills to pay ;-;
Somebody be so kind and gift me a Vita pls <З
I'll love you forever~

naughtyotsel · Aug 3, 2016

thats interesting i hope it gets some progress

Transdude1996 · Aug 3, 2016

DinohScene said:
Why does all the good stuff happen when I have massive bills to pay ;-;
Somebody be so kind and gift me a Vita pls <З
I'll love you forever~

You can pick up a used Vita TV for $30 at GameStop.

Tony_93 · Aug 3, 2016

Transdude1996 said:
You can pick up a used Vita TV for $30 at GameStop.

Amazon, newegg and ebay too.

No excuses xD

leerz · Aug 3, 2016

looking at the pastebin..

so

You can now access ux0:app/[TITLEID], your decrypted game files will be present (or gro0:app/[TITLEID] if you want to decrypt a cartridge).

we replaced its main binary with MolecularShell.

makes neebs like me excited.

AIDA · Aug 3, 2016

Can confirm this works, used it to dump two games. I'm working on modifying the text for one and creating an English patch. I just wish there were some way to avoid the WiFi speeds. D:

Shrinefox · Aug 3, 2016

This is great news. I'm having trouble getting a repacked CPK to run as a patch, however. Specifically, the data.cpk from Persona 4 Golden.
I'm using Cri Packed File Maker to create the new CPK from a directory extracted using quickBMS (no other programs will extract the CPK, saying it's invalid).
I just get an error saying the game is corrupted unless I delete it from the patch directory.

Here's a comparison of the original CPK and the repacked CPK. I did replace a few model files but it shouldn't account for such a big difference. The main problem seems to be the selective compression. I haven't tried without compression though, I will test that shortly.

Anyone know of any other CPK tools?

EDIT: With all this trial and error, it'd be nice if you could duplicate the bubble. Like have one be molecularshell and another actually be the game

olembet · Aug 3, 2016

so, u can save edit ur game save now ? max money?

Shrinefox · Aug 3, 2016

olembet said:
so, u can save edit ur game save now ? max money?

Yes, as long as you can find the money value in a hex editor.

VitaType · Aug 3, 2016

olembet said:
so, u can save edit ur game save now ? max money?

Does it mean that I'm a bad human if I have more problems with that than piracy?

zoogie · Aug 3, 2016

metroid maniac said:
~~Half~~ 95% of the Vita community is very excited right now. The other ~~half~~ 5% is very nervous.

A little bit of reality touch-up

bache · Aug 3, 2016

Considering the PSTV doesn't have the "near" app, does that mean those users are out of luck?

metroid maniac · Aug 3, 2016

bache said:
Considering the PSTV doesn't have the "near" app, does that mean those users are out of luck?

I assume there'll be a workaround like there was for Welcome Park and PS3 Remote Play.

bache · Aug 3, 2016

metroid maniac said:
I assume there'll be a workaround like there was for Welcome Park and PS3 Remote Play.

Bummer, guess I'll have to wait a bit longer to make my P4G undub

DarkSynopsis · Aug 3, 2016

Awesome, keep checking back into the VITA Community to see whats going on, more and more reason I might want to pick up the system but leaning towards PSTV.

Right now I mainly want a dump of Taiko no Tatsujin V so I can get a look at the song files/note chart files and maybe port them to 3DS games, Taiko DX from PSP was possible, anyone manages to dump the files drop me a PM

Wuigi · Aug 3, 2016

Actually it is already possible with PS Vita TV, but you have to change a few steps and you lose access to the E-Mail app until you remove the DB entries again and write them back via molecule:
You have to use the ID NPXS10072 instead of NPXS10000 in all steps it is mentioned, when you add the entries to the app.db you previously dumped with molecule.
Also you have to change in the step with the eboot path the ID from NPXS10072 to NPXS10027 which is the manual app.
For now it's best to install the whitelist to launch any game on PS vita TV and then connect it via LAN to the router, I got speeds up to 5.0 MB/s like this.

bache · Aug 3, 2016

Wuigi said:
Actually it is already possible with PS Vita TV, but you have to change a few steps and you lose access to the E-Mail app until you remove the DB entries again and write them back via molecule:
You have to use the ID NPXS10072 instead of NPXS10000 in all steps it is mentioned, when you add the entries to the app.db you previously dumped with molecule.
Also you have to change in the step with the eboot path the ID from NPXS10072 to NPXS10027 which is the manual app.
For now it's best to install the whitelist to launch any game on PS vita TV and then connect it via LAN to the router, I got speeds up to 5.0 MB/s like this.

I've added NPXS10072 to table_uri, and changed the eboot path to NPXS20027.

I input the path into the web browser, but it tells me it could not find the application. I've double checked the path, and it seems to be correct. Any ideas?

My path is gro0:app/PCSA00147, but I have also tried gro0:/app/PCSA00147

Hacking Major_Tom Explains Game Dumping/Mods on 3.60

Better With Others' Systems Than Their Own

An idiot with an opinion

funny rabbit

Gay twink catboy

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Persona Modder

Well-Known Member

Persona Modder

Well-Known Member

playing around in the end of life

Well-Known Member

An idiot with an opinion

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum