How to dump PSVita Games

Discussion in 'PS Vita - Tutorials' started by Shrinefox, Feb 4, 2016.

  1. Shrinefox
    OP

    Shrinefox GBAtemp Regular

    Member
    114
    76
    Sep 5, 2013
    United States
    OUTDATED: Old guide for 3.52



    STEP ONE: INSTALL HENKAKU
    https://henkaku.me/



    STEP TWO: EDIT THE APP.DB OVER FTP
    Hint: If you're dumping a cartridge, ALSO add "NPXS10000;1;gro0;" to the tbl_uri.
    Another hint: If you're using a PSTV, which has no Near app, use NPXS10072 (the email app) instead of NPXS10000.

    STEP THREE: WITH THE MANUAL OPEN, MOVE MOLECULARSHELL
    The reason you can't dump from molecularShell's current location is that it doesn't have the proper permissions to access other apps. That's because it's also in the app folder. An easy way to get around this is to find the molecularShell app folder (MLCL00001), then copy it somewhere on your desktop. Once you've done that, open it. We'll be copying the files inside to the ux0:Patch directory.

    This is where game updates are stored and loaded on boot. If your game already has a patch folder, go inside and either backup or delete the contents. Then, move the contents of the copied molecularShell folder inside. You can probably guess what we're going to do now-- that's right, close molecularShell and open your game. It should open up right to the molecularShell we put in the patch folder. If it didn't, go back and make sure you set it up exactly like I did (see video).

    STEP FOUR: DUMP FROM THESE DIRECTORIES
    If you overwrite the current path in FTP with /app0: (or one of the other options)
    you'll be brought to the game data, which you can right click and download. It will download straight to the directory you have set on the left of the FTP window, unencrypted.

    You can also access /savedata0: or /addcont0: where your save data and DLC respectively are for this game. You can dump that the same way. Notice how we have access to all these things because we're basically running molecularShell as though it were the game we're dumping. Of course an app would have access to its own savedata, game data, and DLC.

    Note: /addcont0: seems to still have a layer of encryption on it. If I figure out what to do about that later, I'll make a guide.


    BONUS! STEP FIVE: REPLACING EDITED DATA YOU DUMPED PREVIOUSLY
    Now, if you're like me, you want to modify these and use them in-game. Good news is you can do that!

    With molecularShell still mounted in the patch directory, I simply just replaced the savedata bin with my modified one. To play the game of course, you have to exit this molecularShell, enter the normal one, and delete the contents of the patch directory again. Now, you can place your modified files here. In this case, the CPK I dumped from Golden.

    Also put the sce_sys folder from molecularShell in here, otherwise the game will report that it's been corrupt when you launch it.
     
    Last edited by Shrinefox, Aug 3, 2016
  2. hii915

    hii915 GBAtemp Fan

    Member
    438
    146
    Dec 9, 2015
    United States
    Earth, GBAtemp
    nice
     
    Chelsea_Fantasy likes this.
  3. Duo8

    Duo8 I don't like video games

    Member
    3,444
    1,144
    Jul 16, 2013
    If you're telling people to use SQLiteBrowser you should make the instructions a bit easier

    Open the tbl_uri table. Make a new entry.
    Enter NPXS10000 for the titleId column
    1 for the flag column
    ux0 for scheme column

    Open tbl_appinfo. Use the filter on the titleId column to filter out NPXS10000
    Search the val column for an entry with the eboot path. Replace with vs0:app/NPXS10027/eboot.bin

    It's a bit easier to look in tbl_appinfo_icon


    If you want to dump the app folder, use ../../../app/. (I've heard someone failed with ../../../app , though I've never tried myself)
    This includes all downloaded apps, but only the one you're dumping will be decrypted. As such, it can be huge and will take forever to transfer if you have many games.

    If you just want to dump the decrypted game's folder, input ../../../app/titleIdOfGame/.


    I've dumped 3 games so far. No error but I'm kinda worried it might destroy the memory card with all the writes.
     
    Voxel and Shrinefox like this.
  4. Voxel

    Voxel Fable Junkie

    Member
    GBAtemp Patron
    Voxel is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,209
    5,958
    Jun 27, 2015
    United Kingdom
    England, UK
    You're a lifesaver, OP! I really wanted a vid tutorial instead of just text. :P Awesome work put into it!!

    Ya, I think that might have actually happened to my Memcard already... :(
    A reboot does the trick tho for some reason.
     
    Shrinefox likes this.
  5. Shrinefox
    OP

    Shrinefox GBAtemp Regular

    Member
    114
    76
    Sep 5, 2013
    United States
    Thanks for clearing that up, I just did what works for me but there's a few things that could be done differently.
    "app" has never failed for me unless I didn't have enough room on my memory card, but ../../../. definitely fails. I've never
    been able to successfully dump the entire memory card at once.

    Same here... it's crazy how much is involved in this trick, but it's the best thing we've got for now
     
  6. flame1234

    flame1234 GBAtemp Advanced Fan

    Member
    727
    409
    May 17, 2009
    United States
    Was trying to follow the guide and got stuck on step 1: send yourself the mail.db

    I looked here: Fix questionmark bug for mail hack. http://hackinformer.com/PlayStationGuide/PSV/tutorials/how_to_fix_questionmark_bug_for_mailhax.html
    There is a "writer.eml" linked there and if I send it to myself I see the picture icon. And in that mail is a mail.db with the weird name.
    And then if I extract the mail.db from that email and make a new mail message using it, I see the question mark icon when I open that mail.
    What could I be doing wrong? Everything looks like in the video, except for the icon type.

    I'm using yahoo mail. You can't use gmail anymore with PS Vita, at least not on 3.52.

    If it's not too much trouble, could you compose & post a thunderbird .eml with mail.db that worked for you?

    Another weird thing: If I open the writer.eml and click forward, it shows the picture icon in Thunderbird, which I thought was weird. It doesn't show the picture icon in Thunderbird for the mail.db's I'm attaching: even the same one that's extracted from the same mail.
    MailFwd.png
     
  7. Voxel

    Voxel Fable Junkie

    Member
    GBAtemp Patron
    Voxel is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,209
    5,958
    Jun 27, 2015
    United Kingdom
    England, UK
    I could use gmail on my old 3.52 Vita. o.O
     
  8. flame1234

    flame1234 GBAtemp Advanced Fan

    Member
    727
    409
    May 17, 2009
    United States
    gmail changed.
    Obviously not the firmware.

    Did you forget the part in the guide where you have to use MailWriter program? Just generating a mail normally will not work. At least it didn't work for me.
     
    Last edited by flame1234, Feb 15, 2016
  9. Shrinefox
    OP

    Shrinefox GBAtemp Regular

    Member
    114
    76
    Sep 5, 2013
    United States
    If you give me the email address you're using I can forward you the one that worked for me. I sent it to two other people having this problem and it worked.
    I feel bad but I literally don't remember what I did different the first time that made it work.

    Also, Gmail does in fact still work on 3.52. I used it today to dump 4 more games, so...
     
  10. flame1234

    flame1234 GBAtemp Advanced Fan

    Member
    727
    409
    May 17, 2009
    United States
    I got this to work. For step 1: send yourself mail.db, you need MailWriter application. That worked for me.
     
  11. Duo8

    Duo8 I don't like video games

    Member
    3,444
    1,144
    Jul 16, 2013
    About that, this is a part of how the "trick" works. Specifying the file as an image will have the vita caches it and try to open the image. This is how the file is written to the filesystem.
     
  12. InquisitionImplied

    InquisitionImplied Two-cent DF

    Member
    175
    106
    Sep 25, 2015
    United States
    Arizona
    This looks like it could be used for fan translations! Nice! I'll have to try this as soon as I can!
     
  13. Duo8

    Duo8 I don't like video games

    Member
    3,444
    1,144
    Jul 16, 2013
    You can get the data but you can't modify them. The program binary is also encrypted.
     
  14. Voxel

    Voxel Fable Junkie

    Member
    GBAtemp Patron
    Voxel is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,209
    5,958
    Jun 27, 2015
    United Kingdom
    England, UK
    It'd be nice if we could have something similar to HANS for the 3DS, but for the Vita instead! That being said, does Rejuvenate even have priveliges to open apps while running? I'll check.
     
  15. bajul

    bajul Member

    Newcomer
    35
    4
    Aug 26, 2015
    Indonesia
    please give tutor for cartridges

    i am stuck in



    (gro0:app/PCSXXXXX/sce_pfs/files.db)
    (gro0:app/PCSXXXXX/sce_pfs/unicv.db)
    (gro0:app/PCSXXXXX/sce_sys/package/body.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/head.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/stat.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/tail.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/work.bin)



    how do I get ?
     
  16. Shrinefox
    OP

    Shrinefox GBAtemp Regular

    Member
    114
    76
    Sep 5, 2013
    United States
    Try following this tutorial: http://wololo.net/talk/viewtopic.php?f=65&t=45013
    Download this: https://mega.nz/#!i4131LJK!KuINZIJvuk-E9eNJ8aR6sdqZczjoevp5RSqsyOsuyD8

    After you do the mail.db trick, send yourself an email with the subject: \..\..\..\mms\music\AVContent.db
    and attach the AVContent.db that's in the download above.
    Then you have to send yourself an email with the subject line gro0:app/YOUR_GAME_ID/sce_pfs/files.db
    and attach the #1 file.

    On the Vita, open the email and forward it to yourself. The screen might be white for awhile, that's normal.
    Then you can open the .db file in sqlite browser and look for the files.db (or whatever file you're trying to dump)
    in the DT_MESSAGE_PART section. It'll tell you which db file it would be when you dump your music directory.

    Then send that from the music on your vita to the pc using the content manager, and it should really actually be your files.db file.
    You can rename it and use it, then restart this whole process for each file.

    Sounds tedious, right? Even after you have all those files, you still have to install it and dump it...
    Which is why I suggested you just get a digital version instead.
     
  17. bajul

    bajul Member

    Newcomer
    35
    4
    Aug 26, 2015
    Indonesia

    I 've followed the steps in there and I stopped when the results of any similar-sized dump

    i dump
    (gro0:app/PCSXXXXX/sce_pfs/files.db)
    (gro0:app/PCSXXXXX/sce_pfs/unicv.db)
    (gro0:app/PCSXXXXX/sce_sys/package/body.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/head.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/stat.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/tail.bin)
    (gro0:app/PCSXXXXX/sce_sys/package/work.bin)
     
  18. dfsa3fdvc1

    dfsa3fdvc1 GBAtemp Regular

    Member
    215
    94
    Jan 3, 2015
    Albania
    Excellent video tutorial.
    And wow, that physical cart to digital install process is intense.Hope the process for retail becomes easier soon.
     
    Last edited by dfsa3fdvc1, Feb 24, 2016
  19. dfsa3fdvc1

    dfsa3fdvc1 GBAtemp Regular

    Member
    215
    94
    Jan 3, 2015
    Albania
    So really dumb question. In that mega link I only see 4 files
    #1
    MAIL DATABASE.png
    MUSIC DATABASE.png
    SENDING MUSIC AND MAIL DB.txt

    When you say attach the AVContent.db... Are you saying attach the "MUSIC DATABASE.png" or are you saying rename that file to AVContent.db and send the renamed file.

    And earlier when you said

    You're saying to basically perform this tutorial using the "MAIL DATABASE.png", right?
    http://hackinformer.com/PlayStationGuide/PSV/tutorials/how_to_fix_questionmark_bug_for_mailhax.html
     
  20. Voxel

    Voxel Fable Junkie

    Member
    GBAtemp Patron
    Voxel is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,209
    5,958
    Jun 27, 2015
    United Kingdom
    England, UK
    Attach MUSIC DATABASE.png, and then rename it to "\..\..\..\mms\music\AVContent.db" (without quotes) within thunderbird or whatever you're using.
     
    Shrinefox likes this.