PS3 Apollo save tool (development thread)

[Kevstah2004]

Indeed, some PS2 game saves have copy protection. Example "Dead or Alive 2: Hardcore".

Convert save to PSU, then edit folder attributes via PS2 Save Converter. After that, convert it back to ugly PSV.

Neither PS2 Save Converter or PS2 Save Builder showed any protection on the original

 

[Berion]

Check all files then. If even one file have CP, then whole folder copy is blocked.

If none of the files have blockade, it means that tool for PSV conversion doing something wrong or XMB during importing. In such case, temporary solution would be preparing VM2 with save and importing it via Apollo.

 

[Kevstah2004]

Check all files then. If even one file have CP, then whole folder copy is blocked.

If none of the files have blockade, it means that tool for PSV conversion doing something wrong or XMB during importing. In such case, temporary solution would be preparing VM2 with save and importing it via Apollo.

Not seeing anything.
I did it as a test to see if I could launch uLE etc ELFs off the memory card with Swap Magic but it crashes to the XMB
even though it can save & read the code database, here's the .PSU I used.

 

[bucanero]

Not seeing anything.
I did it as a test to see if I could launch uLE etc ELFs off the memory card with Swap Magic but it crashes to the XMB
even though it can save & read the code database, here's the .PSU I used.

good , I was about to ask about the original PSU file. Now it's possible to see if the original PSU had any copy-flag or if the converter missed something.

 

[bucanero]

I've uploaded the sources of the new decrypters and checksum fixers I mentioned in my previous update:
https://github.com/bucanero/ps3-save-decrypters

I've created a single repository and merged all the content there. The files should be considered as PoC, of course they work but my focus was on understanding the logic so I could add them to Apollo.

 

[bucanero]

a small side note about custom decrypters: yesterday I spent a day reversing a decrypter for Resident Evil Zero, and when I finally found the key, it was actually the same key they used on Resident Evil HD remaster. (and they even used the same SHA1 hash with the same offsets too)

I should have tried with the RE decrypters I already had available before jumping into reversing, specially since developers might reuse keys and algorithms. (e.g. Naughty dog using the same key for Uncharted games and TLOU)

anyways, I'll add another custom save-game decrypt to the Apollo supported list

edit: credits to Dark_nacho for the original RE Zero save editor.

 

[Berion]

Maybe then they using the same for RE:Revelation 2? ^^

 

[bucanero]

Maybe then they using the same for RE:Revelation 2? ^^

no, actually RE:Revelations 2 uses a different key, but that I already reversed it from a decrypter I found on the web.
I coded a simplified version here: https://github.com/bucanero/ps3-save-decrypters/tree/master/re-revelations2-decrypter

Capcom also changed the hash checksum verification and used 2 hashes: SHA1 and DWADD.

 

[bucanero]

I finally reversed another custom decrypter (after removing a few obfuscation layers!): this time is NFS Undercover.

When I began, I assumed that this game would probably use something similar like NFS Rivals (blowfish), but they went with a fully custom encryption scheme, based on MD5 and XOR.
It's actually neat to see, how they ended up using MD5 (a hash algorithm) to create a cipher block chaining with a regular XOR.

As usual, my open-source version is available on GitHub:
https://github.com/bucanero/ps3-save-decrypters/tree/master/nfs-undercover-decrypter

credits to Red-EyeX32 for the original decrypter tool.

 

[bucanero]

who needs another custom decrypter? (probably nobody... but still)
now it's Silent Hill 3 HD.

Edit: source code is available >> https://github.com/bucanero/ps3-save-decrypters/tree/master/silent-hill3-decrypter

(this decrypter includes the checksum fixer too it seems like a custom DWADD checksum)

credits to chaoszage for the original editor tool

 

[bucanero]

today's custom decrypter: call of duty black ops (triple DES encryption, CBC)

this one was a bit of a struggle and I had to take a break in between to solve it...
when I first decompiled it, I was able to recognize the triple DES encryption, but I totally missed the CBC part and I assumed it was ECB (so it didn't work)
today I retried, spent some time with OllyDbg and I was able to find the missing IV value for CBC... then everything worked as expected.

Source code is here: https://github.com/bucanero/ps3-save-decrypters/tree/master/cod-blackops-decrypter

btw, this tool should work in CoD Black Ops 1 and Black Ops 2. (and perhaps others?)

credits to Red-EyeX32 for the original decrypter tool.

(decrypters... I should let them go and get back to Apollo and trophies)

 

[bucanero]

I added a quick checksum fixer for Final fantasy X & X-2 HD; this one was straight-forward because there are many open source fixers available. I just "translated" the C# source code.

My version is here: https://github.com/bucanero/ps3-save-decrypters/tree/master/ffxhd-checksum-fixer

of course, all these custom fixers/decrypters will be added to Apollo... just keep an eye for the next release.

 

[sandungas]

Are like pokemons

 

[Berion]

My first connotation too.

 

[bucanero]

as a final step in the "pokemon decrypt" road, I reversed the Final Fantasy XIII (1, XIII-2, XIII-3) save-game decryption

this one is based on the Final fantasy XIII Encryptor tool by Jappi88 (credits to him, Unknown v2, & Echelo for the original tool)

I still need to clean up the source code because it's quite dirty, as I was doing a rough port from the C# decompilation to C, trying to avoid any mistakes along the way. (right now over 700 lines of code)
Honestly, the encryption scheme looks quite complex, and I really wonder if it's custom made by Square Enix devs or perhaps it's a standard algorithm that I couldn't recognize. I actually googled for a certain constant "0xA1652347" and the only 1 match I've got, was actually another ps2 save decoder for Final Fantasy VII.
Maybe a developer with a better crypto background can answer that question when reviewing the source.

I'll post the source link as soon as I upload it to Github.

Anyways, time to get out of the rabbit hole... and bring all these new features into Apollo.

 

[bucanero]

I'll post the source link as soon as I upload it to Github.

Here's the source, I tested it with save-games from FF XIII, XIII-2 and XIII Lightning Returns and everything worked as expected:
https://github.com/bucanero/ps3-save-decrypters/tree/master/ff13-decrypter

Still, the code is not as clean as I'd like to, but I was able to reduce a good amount of junk. Decompilers are extremely useful, but of course they can't give meaning to variables so many parts are still using "long_0, long_1, int_0" kind of names.

(note: with some adjustments the tool could also support Xbox save-games, but I skipped it altogether.)

 

[aldostools]

@bucanero I'm very impressed with Apollo Save Tool 1.5. You did an outstanding job!

If you have some free time, here are my suggested features:
1. Allow to delete a trophy folder.
2. Show ICON0.PNG of the selected item in a corner of the screen (I suggest the bottom-right corner).
3. Show the trophy icon of the selected trophy in a corner of the screen.
4. Show ICON0.PNG of the current item when you enter to the Detail screen.
5. When you enter to Setting, the screen is named Options
6. In Options screen, allow to select the default user (All or 0001, 0002, 0003, etc).
7. Filter saves/trophy listings by the selected user. Use SELECT to toggle the user (All or 0001, 0002, 0003, etc)
(You could show the selected user/name where it says "Save Game List").
9. PS2 Classic options have long titles that are truncated when you enter to the option.
10. In Export Licenses the scroll with L1/L2 is not working. The option View Code does nothing.
11. It helps to identify the game of a RAP if you show the ICON from a database or download it online. Or you can use titleid.txt database to show the name of the game.

 

[Berion]

Trophies can be safely deleting in debug vsh. I'm not sure if deleting dir is enough, as trophy set still exist in global index.

 

[bucanero]

@bucanero I'm very impressed with Apollo Save Tool 1.5. You did an outstanding job!

If you have some free time, here are my suggested features:
1. Allow to delete a trophy folder.
2. Show ICON0.PNG of the selected item in a corner of the screen (I suggest the bottom-right corner).
3. Show the trophy icon of the selected trophy in a corner of the screen.
4. Show ICON0.PNG of the current item when you enter to the Detail screen.
5. When you enter to Setting, the screen is named Options
6. In Options screen, allow to select the default user (All or 0001, 0002, 0003, etc).
7. Filter saves/trophy listings by the selected user. Use SELECT to toggle the user (All or 0001, 0002, 0003, etc)
(You could show the selected user/name where it says "Save Game List").
9. PS2 Classic options have long titles that are truncated when you enter to the option.
10. In Export Licenses the scroll with L1/L2 is not working. The option View Code does nothing.
11. It helps to identify the game of a RAP if you show the ICON from a database or download it online. Or you can use titleid.txt database to show the name of the game.

thanks for the comments @aldostools !

about the trophy delete, as @Berion said, if the folder is not deleted by the VSH, the info remains on the db and it will show as a "broken" icon in the XMB. (fixed by a db rebuild, but not as clean as expected)

about the ICON0, I agree and it's a thing I though many times, but kept delaying it because "I want to add some-other-stuff first"

for the trophies, I'm now using the imagefont.bin parser code and I can use them just like another libfont character:



"settings" vs "options" screen: hahaha probably I never changed it from the original Artemis source

L1/L2 not working on some screens: I know and I need to fix it, its also annoying if you have a game with tons of cheats (like some Final Fantasy or Nier) because you need to scroll 1 by 1.
For the licenses, I was thinking that "view code" could actually show the `rap` hex dump (or the rif hex dump) but I never coded it... but still, a basic hex dump would be nice, even for save-game files... I just need to use a fixed width font or it would look like a mess.

icons for rap/rifs: I already made the code in PKGi to download the icon0.png from the TMBD based on the content ID, so it should be straight-forward, once I get the code to display the ICON0 on the screens.

about the multi-user thing: that's one of the things I might avoid messing around for now... Apollo on boot gets the idps/psid/account_id from the user-specific "Apollo settings" save-game, and from there it works with that "constant" assumption. Switching users on runtime requires some logic changes that won't have a high priority on my list. (e.g. I prefer to add "upload a save-game to the online database" before that)
For now, if you launch Apollo, it will work on the logged-in account. But you can switch accounts and re-launch Apollo, and it will work with the new logged user just fine.

btw, I have integrated all the customs decrypters, checksum fixers and related stuff I was doing recently to Apollo, so hopefully I'll release a new version soon. I just need to clean-up the ps3savepatch files

 

[aldostools]

thanks for the comments @aldostools !

about the trophy delete, as @Berion said, if the folder is not deleted by the VSH, the info remains on the db and it will show as a "broken" icon in the XMB. (fixed by a db rebuild, but not as clean as expected)

about the ICON0, I agree and it's a thing I though many times, but kept delaying it because "I want to add some-other-stuff first"

for the trophies, I'm now using the imagefont.bin parser code and I can use them just like another libfont character:

View attachment 32114

"settings" vs "options" screen: hahaha probably I never changed it from the original Artemis source

L1/L2 not working on some screens: I know and I need to fix it, its also annoying if you have a game with tons of cheats (like some Final Fantasy or Nier) because you need to scroll 1 by 1.
For the licenses, I was thinking that "view code" could actually show the `rap` hex dump (or the rif hex dump) but I never coded it... but still, a basic hex dump would be nice, even for save-game files... I just need to use a fixed width font or it would look like a mess.

icons for rap/rifs: I already made the code in PKGi to download the icon0.png from the TMBD based on the content ID, so it should be straight-forward, once I get the code to display the ICON0 on the screens.

about the multi-user thing: that's one of the things I might avoid messing around for now... Apollo on boot gets the idps/psid/account_id from the user-specific "Apollo settings" save-game, and from there it works with that "constant" assumption. Switching users on runtime requires some logic changes that won't have a high priority on my list. (e.g. I prefer to add "upload a save-game to the online database" before that)
For now, if you launch Apollo, it will work on the logged-in account. But you can switch accounts and re-launch Apollo, and it will work with the new logged user just fine.

btw, I have integrated all the customs decrypters, checksum fixers and related stuff I was doing recently to Apollo, so hopefully I'll release a new version soon. I just need to clean-up the ps3savepatch files

For the ICON0 I mean use the local save/trophy icon... there is not need to go online to get the icon.
All saves and trophies include an ICON0.PNG in the directory.

For the trophies I mean to show the icon TROP***.PNG, not a generic image of a trophy.

For the name you could show the game description from PSN store if you want... However not all games are in the PSN store, specially many of the retail ones. That's why I suggested to use my titleid.txt

For the multi users you could leave the current logic, but add an option in Settings/Options to only scan one specific user. Something like if "my_user_id" == 0 show all users; if "my_user_id" != 0, scan only /dev_hdd0/home/000000xx (where xx == my_user_id). You get the same result that I mean, because you're ignoring the content for the rest of the users.

About the trophy deletion, you could prompt to reboot & rebuild the database after delete the trophies.
It is not a good as it should be, but it does the work. For me (and probably many other users) it's very annoying to have trophies of games that you only tested but never played.