1. Shrinefox

    OP Shrinefox Persona Modder
    Member

    Joined:
    Sep 5, 2013
    Messages:
    119
    Country:
    United States

    Thanks to Mr. Gas for the help getting this set up.

    For awhile now, it's been public knowledge that you can dump files from the PS Vita.
    However, there's a catch. Every file you dump from a game is (USUALLY) protected by PFS protection.

    There's now a clever way to bypass that encryption though-- and I'm gonna show you how.
    This means getting ROM dumps of Vita games, actually being able to view and download
    the contents for your own use.

    NOTE: This does NOT enable piracy or emulation of PSVita games.
    The eboot.bin is encrypted with a form OTHER than pfs which can't be bypassed so easily.
    For now, this tutorial is good for ripping assets such as models, music, and graphics
    FROM PSVITA GAMES.


    Before we get started, here's a few requirements.
    • First of all, you need to be on a firmware BELOW 3.55.
      They patched the email trick that makes database editing possible.
    • You'll need some form of PSP homebrew capabilities on your Vita.
    • And probably a memory card larger than 8 GB (otherwise good luck...)
    • Also, the game you need to dump NEEDS to be digital.
      If you only have a physical copy, there's a very convoluted way to install it
      as a digital game. Here's a link:
      http://wololo.net/talk/viewtopic.php?p=402472
      Either way it needs to be fully installed on your memory card.

    You might be thinking, if I can't update, how do I get the game digitally?
    You really can't get on PSN with your Vita without updating it.

    The short answer is, you need a PS3 console.
    Borrow one from your friend for awhile if you don't have one.
    It needs to be on the same PSN account that you registered your Vita to.

    Buy the game on the online store from your computer, and log into PSN
    on the PS3. You can download the game from there and then transfer it to your
    Vita, where it will be installed without even connecting to the internet.

    You might get pesky Update prompts trying to use the content manager, though.
    A way to get around that is to first switch your Vita into airplane mode, then reboot.
    It's also a good idea to replace the content manager assistant on your computer
    with the open source alternative qCMA, which doesn't require an internet connection
    or the latest firmware to operate.

    --- DUMPING ---

    I suggest you make an email account specifically for this process, because it'll
    get messy in your inbox real quick. Trust me...

    Set up your new email on the Vita.
    Then on the computer, send yourself this mail.db file.
    The name of the file has to be exactly THIS:
    \..\..\..\email\message\mail.db
    Since you can't do this from gmail, do it from Mozilla thunderbird.

    then on the Vita, open it.
    It should say that you can't view the image. Do NOT ever click okay on the errors,
    just close the app or you'll have to start over from this step.

    This'll wipe the mail database so you have to log in again, but it's
    important. Now you can send yourself the app database, which is the key to
    this trick.

    In your next email, it doesn't matter what the subject line is, but
    you NEED to have a link to exactly this address:
    email:send?attach=ur0:shell/db/app.db.

    On the Vita, when you touch the link, it should open a composition.
    Send it to yourself and open it on the PC. This is how you can download
    your app database.
    The app will then close itself, that means you did it right.

    Next, you'll need to install SQLite Browser. It's quick and easy.
    Open the database with it and go to tbl_uri. Make a new entry and enter exactly this:
    NPXS10000;1;ux0;
    Make sure you click write changes before you continue!

    Then go to tbl_appinfo look for the one mentioning an eboot path. Replace that with this:
    vs0:app/NPXS10027/eboot.bin
    Write changes again.

    Last step, search for the ID of a PSP game you own. If you don't know the ID, you can find it
    by backing up the game or the save to your computer and looking at the folder name.
    You can also look up the ID by name in the tbl_appinfo part of the database.

    While you're there, also take note of the game you're gonna dump's ID.
    This isn't going to be used until later, but it's good to know!

    Once you found the PSP game's ID, add a new entry starting with the ID. Then put in this exact sequence of numbers in the next cell:
    2454440077
    Finally, put exactly this in the third cell:
    ../../../app
    Write changes again.

    If you do not have a PSP game, I recommend you get two using the PS3 method.
    One for homebrew, and one to execute the dump. You'll see why later.
    You can get minis for dirt cheap, as low as $1, and you don't have to keep them or even
    play them at all.

    Write changes, close the SQL program and rename the file to #0 with no extension.
    Send it to yourself and put exactly THIS as the subject:
    ur0:shell/db/app.db

    You know the drill by now, open it on the Vita, and it should say you can't view
    the image. If it says anything else, you did something wrong. Look over your steps
    carefully.

    I think it's wise at this point to reboot the Vita.

    Here's how this is gonna work. Go to your web browser and enter this and the ID of the
    game you'll be dumping:
    ux0:app/[GAMEID]
    If you edited the database correctly, Near should open and the game's manual will appear.
    Keep it open, don't close it. Just minimize it and go to your content manager.

    This tricks the system into keeping the game's data open AND unencrypted while the content
    manager is open, which is normally impossible. Now, when the memory card is dumped, your unencrypted
    game content will be in the "app" folder of the PSP emulator.

    Remember how earlier we assigned that path to the PSP game you'll use for the dump?
    What that tells the content manager is, "go back to the root-- then into the app folder."
    That's where it will be searching for content to copy to the PC when you back up your game in the content manager.

    Tricky, huh? Just make sure you're in airplane mode (or at least started the system that way)
    and that qCMA is already running on your PC. It tends to close itself when you disconnect, so try opening the backup manager window to keep it running.

    Then transfer your PSP game to your PC. You'll notice that it's taking a lot longer than normally
    for its size, and that's good! That means it's taking your unencrypted Vita game with it.

    Of course, the file on your computer is still encrypted like all PSP backups are.
    It can never be that easy, can it? Don't be discouraged though! The PSP game is unencrypted
    on the way back to the Vita-- and so will your Vita game contents. So transfer it back now.

    You might get an error. The error means one of two things.
    this one means you didn't succeed to dump the game at all. Some solutions would be to dump
    one folder at a time (earlier I suggested you do only the app folder and not the entire root).
    Also, try using PSP homebrew to delete the temp folder. Then try again.

    The error, as long as it happens near the end, is harmless. It means some files could not
    be transferred, but by that it probably means the actual PSP game. Your Vita dump should
    be not only intact, but unencrypted!

    Now the problem is getting to it. You need to have at least some form of PSP homebrew installed.
    I used TN-V11 custom bubbles. ARK and VHBL work too. Either way you need a way to run PSPFiler or VitaFTP.

    I'm not going to get into that, there's plenty of excellent tutorials on wololo.net and YouTube if you
    need to know how to do it. It's a lot harder on 3.5x firmwares though, so be warned!

    Anyway, now just launch your PSPFiler. Locate the apps folder that was generated and copy the files you want
    to a PSP savegame folder.
    At last you can transfer your save to the PC as saves aren't encrypted in this process.
    And here we have it, for the first time ever, actual dumps of PSVita game data!

    Hope this helps you guys out!



    STEP ONE: INSTALL HENKAKU
    https://henkaku.me/



    STEP TWO: EDIT THE APP.DB OVER FTP
    Hint: If you're dumping a cartridge, ALSO add "NPXS10000;1;gro0;" to the tbl_uri.
    Another hint: If you're using a PSTV, which has no Near app, use NPXS10072 (the email app) instead of NPXS10000.

    STEP THREE: WITH THE MANUAL OPEN, MOVE MOLECULARSHELL
    The reason you can't dump from molecularShell's current location is that it doesn't have the proper permissions to access other apps. That's because it's also in the app folder. An easy way to get around this is to find the molecularShell app folder (MLCL00001), then copy it somewhere on your desktop. Once you've done that, open it. We'll be copying the files inside to the ux0:Patch directory.

    This is where game updates are stored and loaded on boot. If your game already has a patch folder, go inside and either backup or delete the contents. Then, move the contents of the copied molecularShell folder inside. You can probably guess what we're going to do now-- that's right, close molecularShell and open your game. It should open up right to the molecularShell we put in the patch folder. If it didn't, go back and make sure you set it up exactly like I did (see video).

    STEP FOUR: DUMP FROM THESE DIRECTORIES
    If you overwrite the current path in FTP with /app0: (or one of the other options)
    you'll be brought to the game data, which you can right click and download. It will download straight to the directory you have set on the left of the FTP window, unencrypted.

    You can also access /savedata0: or /addcont0: where your save data and DLC respectively are for this game. You can dump that the same way. Notice how we have access to all these things because we're basically running molecularShell as though it were the game we're dumping. Of course an app would have access to its own savedata, game data, and DLC.

    Note: /addcont0: seems to still have a layer of encryption on it. If I figure out what to do about that later, I'll make a guide.


    BONUS! STEP FIVE: REPLACING EDITED DATA YOU DUMPED PREVIOUSLY
    Now, if you're like me, you want to modify these and use them in-game. Good news is you can do that!

    With molecularShell still mounted in the patch directory, I simply just replaced the savedata bin with my modified one. To play the game of course, you have to exit this molecularShell, enter the normal one, and delete the contents of the patch directory again. Now, you can place your modified files here. In this case, the CPK I dumped from Golden.

    Also put the sce_sys folder from molecularShell in here, otherwise the game will report that it's been corrupt when you launch it.
     
    Last edited by Shrinefox, Aug 3, 2016
  2. hii915

    hii915 GBAtemp Fan
    Member

    Joined:
    Dec 9, 2015
    Messages:
    447
    Country:
    United States
    nice
     
    Chelsea_Fantasy likes this.
  3. Duo8

    Duo8 GBAtemp Psycho!
    Member

    Joined:
    Jul 16, 2013
    Messages:
    3,579
    Country:
    Vietnam
    If you're telling people to use SQLiteBrowser you should make the instructions a bit easier

    Open the tbl_uri table. Make a new entry.
    Enter NPXS10000 for the titleId column
    1 for the flag column
    ux0 for scheme column

    Open tbl_appinfo. Use the filter on the titleId column to filter out NPXS10000
    Search the val column for an entry with the eboot path. Replace with vs0:app/NPXS10027/eboot.bin

    It's a bit easier to look in tbl_appinfo_icon


    If you want to dump the app folder, use ../../../app/. (I've heard someone failed with ../../../app , though I've never tried myself)
    This includes all downloaded apps, but only the one you're dumping will be decrypted. As such, it can be huge and will take forever to transfer if you have many games.

    If you just want to dump the decrypted game's folder, input ../../../app/titleIdOfGame/.


    I've dumped 3 games so far. No error but I'm kinda worried it might destroy the memory card with all the writes.
     
    Voxel and Shrinefox like this.
  4. Voxel

    Voxel GBAtemp Guru
    Member

    Joined:
    Jun 27, 2015
    Messages:
    5,361
    Country:
    United Kingdom
    You're a lifesaver, OP! I really wanted a vid tutorial instead of just text. :P Awesome work put into it!!

    Ya, I think that might have actually happened to my Memcard already... :(
    A reboot does the trick tho for some reason.
     
    Shrinefox likes this.
  5. Shrinefox

    OP Shrinefox Persona Modder
    Member

    Joined:
    Sep 5, 2013
    Messages:
    119
    Country:
    United States
    Thanks for clearing that up, I just did what works for me but there's a few things that could be done differently.
    "app" has never failed for me unless I didn't have enough room on my memory card, but ../../../. definitely fails. I've never
    been able to successfully dump the entire memory card at once.

    Same here... it's crazy how much is involved in this trick, but it's the best thing we've got for now
     
  6. flame1234

    flame1234 GBAtemp Advanced Fan
    Member

    Joined:
    May 17, 2009
    Messages:
    734
    Country:
    United States
    Was trying to follow the guide and got stuck on step 1: send yourself the mail.db

    I looked here: Fix questionmark bug for mail hack. http://hackinformer.com/PlayStationGuide/PSV/tutorials/how_to_fix_questionmark_bug_for_mailhax.html
    There is a "writer.eml" linked there and if I send it to myself I see the picture icon. And in that mail is a mail.db with the weird name.
    And then if I extract the mail.db from that email and make a new mail message using it, I see the question mark icon when I open that mail.
    What could I be doing wrong? Everything looks like in the video, except for the icon type.

    I'm using yahoo mail. You can't use gmail anymore with PS Vita, at least not on 3.52.

    If it's not too much trouble, could you compose & post a thunderbird .eml with mail.db that worked for you?

    Another weird thing: If I open the writer.eml and click forward, it shows the picture icon in Thunderbird, which I thought was weird. It doesn't show the picture icon in Thunderbird for the mail.db's I'm attaching: even the same one that's extracted from the same mail.
    MailFwd.png
     
  7. Voxel

    Voxel GBAtemp Guru
    Member

    Joined:
    Jun 27, 2015
    Messages:
    5,361
    Country:
    United Kingdom
    I could use gmail on my old 3.52 Vita. o.O
     
  8. flame1234

    flame1234 GBAtemp Advanced Fan
    Member

    Joined:
    May 17, 2009
    Messages:
    734
    Country:
    United States
    gmail changed.
    Obviously not the firmware.

    Did you forget the part in the guide where you have to use MailWriter program? Just generating a mail normally will not work. At least it didn't work for me.
     
    Last edited by flame1234, Feb 15, 2016
  9. Shrinefox

    OP Shrinefox Persona Modder
    Member

    Joined:
    Sep 5, 2013
    Messages:
    119
    Country:
    United States
    If you give me the email address you're using I can forward you the one that worked for me. I sent it to two other people having this problem and it worked.
    I feel bad but I literally don't remember what I did different the first time that made it work.

    Also, Gmail does in fact still work on 3.52. I used it today to dump 4 more games, so...
     
  10. flame1234

    flame1234 GBAtemp Advanced Fan
    Member

    Joined:
    May 17, 2009
    Messages:
    734
    Country:
    United States
    I got this to work. For step 1: send yourself mail.db, you need MailWriter application. That worked for me.
     
  11. Duo8

    Duo8 GBAtemp Psycho!
    Member

    Joined:
    Jul 16, 2013
    Messages:
    3,579
    Country:
    Vietnam
    About that, this is a part of how the "trick" works. Specifying the file as an image will have the vita caches it and try to open the image. This is how the file is written to the filesystem.
     
  12. InquisitionImplied

    InquisitionImplied Two-cent DF
    Member

    Joined:
    Sep 25, 2015
    Messages:
    205
    Country:
    United States
    This looks like it could be used for fan translations! Nice! I'll have to try this as soon as I can!
     
  13. Duo8

    Duo8 GBAtemp Psycho!
    Member

    Joined:
    Jul 16, 2013
    Messages:
    3,579
    Country:
    Vietnam
    You can get the data but you can't modify them. The program binary is also encrypted.
     
  14. Voxel

    Voxel GBAtemp Guru
    Member

    Joined:
    Jun 27, 2015
    Messages:
    5,361
    Country:
    United Kingdom
    It'd be nice if we could have something similar to HANS for the 3DS, but for the Vita instead! That being said, does Rejuvenate even have priveliges to open apps while running? I'll check.
     
  15. bajul

    bajul Advanced Member
    Newcomer

    Joined:
    Aug 26, 2015
    Messages:
    76
    Country:
    Indonesia
    please give tutor for cartridges

    i am stuck in



    (gro0:app/PCSXXXXX/sce_pfs/files.db)
    (gro0:app/PCSXXXXX/sce_pfs/unicv.db)
    (gro0:app/PCSXXXXX/sce_sys/package/body.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/head.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/stat.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/tail.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/work.bin)



    how do I get ?
     
  16. Shrinefox

    OP Shrinefox Persona Modder
    Member

    Joined:
    Sep 5, 2013
    Messages:
    119
    Country:
    United States
    Try following this tutorial: http://wololo.net/talk/viewtopic.php?f=65&t=45013
    Download this: https://mega.nz/#!i4131LJK!KuINZIJvuk-E9eNJ8aR6sdqZczjoevp5RSqsyOsuyD8

    After you do the mail.db trick, send yourself an email with the subject: \..\..\..\mms\music\AVContent.db
    and attach the AVContent.db that's in the download above.
    Then you have to send yourself an email with the subject line gro0:app/YOUR_GAME_ID/sce_pfs/files.db
    and attach the #1 file.

    On the Vita, open the email and forward it to yourself. The screen might be white for awhile, that's normal.
    Then you can open the .db file in sqlite browser and look for the files.db (or whatever file you're trying to dump)
    in the DT_MESSAGE_PART section. It'll tell you which db file it would be when you dump your music directory.

    Then send that from the music on your vita to the pc using the content manager, and it should really actually be your files.db file.
    You can rename it and use it, then restart this whole process for each file.

    Sounds tedious, right? Even after you have all those files, you still have to install it and dump it...
    Which is why I suggested you just get a digital version instead.
     
  17. bajul

    bajul Advanced Member
    Newcomer

    Joined:
    Aug 26, 2015
    Messages:
    76
    Country:
    Indonesia

    I 've followed the steps in there and I stopped when the results of any similar-sized dump

    i dump
    (gro0:app/PCSXXXXX/sce_pfs/files.db)
    (gro0:app/PCSXXXXX/sce_pfs/unicv.db)
    (gro0:app/PCSXXXXX/sce_sys/package/body.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/head.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/stat.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/tail.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/work.bin)
     
  18. dfsa3fdvc1

    dfsa3fdvc1 GBAtemp Regular
    Member

    Joined:
    Jan 3, 2015
    Messages:
    226
    Country:
    Albania
    Excellent video tutorial.
    And wow, that physical cart to digital install process is intense.Hope the process for retail becomes easier soon.
     
    Last edited by dfsa3fdvc1, Feb 24, 2016
  19. dfsa3fdvc1

    dfsa3fdvc1 GBAtemp Regular
    Member

    Joined:
    Jan 3, 2015
    Messages:
    226
    Country:
    Albania
    So really dumb question. In that mega link I only see 4 files
    #1
    MAIL DATABASE.png
    MUSIC DATABASE.png
    SENDING MUSIC AND MAIL DB.txt

    When you say attach the AVContent.db... Are you saying attach the "MUSIC DATABASE.png" or are you saying rename that file to AVContent.db and send the renamed file.

    And earlier when you said

    You're saying to basically perform this tutorial using the "MAIL DATABASE.png", right?
    http://hackinformer.com/PlayStationGuide/PSV/tutorials/how_to_fix_questionmark_bug_for_mailhax.html
     
  20. Voxel

    Voxel GBAtemp Guru
    Member

    Joined:
    Jun 27, 2015
    Messages:
    5,361
    Country:
    United Kingdom
    Attach MUSIC DATABASE.png, and then rename it to "\..\..\..\mms\music\AVContent.db" (without quotes) within thunderbird or whatever you're using.
     
    Shrinefox likes this.
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - PSVita, Games,