PS3 non NPDRM to NPDRM .sprx resigning

[sandungas]

Yes i tried with %s, it doesn't work, which is weird because I see %s being used elsewhere in the eboot.

I will try without the / at the end

Is because the %s only indicates the data type of what is going to be inserted (an string into another string), but is the function who decides the text of the inserted string

So... for this to work the function needs to insert the TITLE_ID in the %s
Incase the function is inserting other text in the %s (or simply doesnt even understand what is an %s because is not defined as an argument) then is not going to work

 

[raidriar]

Is because the %s only indicates the data type of what is going to be inserted (an string into another string), but is the function who decides the text of the inserted string

So... for this to work the function needs to insert the TITLE_ID in the %s
Incase the function is inserting other text in the %s (or simply doesnt even understand what is an %s because is not defined as an argument) then is not going to work

Unfortunately nothing seems to be working except for replacing the characters within bounds of the existing path. ugh. all these tools and can't do something as basic as changing path on an eboot

%d and %s must be doing something different in this eboot.

 

[sandungas]

Have you tryed this ?

Original:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

008B3FF0                          2F 64 65 76 5F 62 64 76          /dev_bdv
008B4000  64 2F 50 53 33 5F 47 41 4D 45 2F 55 53 52 44 49  d/PS3_GAME/USRDI
008B4010  52 2F 00 00 00 00 00 00                          R/......

Modifyed:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

008B3FF0                          2F 64 65 76 5F 68 64 64          /dev_hdd
008B4000  30 2F 67 61 6D 65 2F 4E 50 55 41 33 30 30 30 39  0/game/NPUA30009
008B4010  2F 55 53 52 44 49 52 00                          /USRDIR.

In the original there are 6 bytes with zeroes... but we need to keep one of them (is usually named the NULL byte, and indicates the end of the string)
So... im increasing the lenght of the path in 5 characters (note im not adding the / you was adding at the ending)

 

[raidriar]

Have you tryed this ?

Original:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

008B3FF0                          2F 64 65 76 5F 62 64 76          /dev_bdv
008B4000  64 2F 50 53 33 5F 47 41 4D 45 2F 55 53 52 44 49  d/PS3_GAME/USRDI
008B4010  52 2F 00 00 00 00 00 00                          R/......

Modifyed:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

008B3FF0                          2F 64 65 76 5F 68 64 64          /dev_hdd
008B4000  30 2F 67 61 6D 65 2F 4E 50 55 41 33 30 30 30 39  0/game/NPUA30009
008B4010  2F 55 53 52 44 49 52 00                          /USRDIR.

In the original there are 6 bytes with zeroes... but we need to keep one of them (is usually named the NULL byte, and indicates the end of the string)
So... im increasing the lenght of the path in 5 characters (note im not adding the / you was adding at the ending)

Doesn't work. eboot fires up but its stuck on accessing disc meaning it cannot find the eboot in the USRDIR I guess.

However an interesting discovery. Upon loading the game from hdd using path dev_hdd0/game/FAB/USRDIR/ (of course after hex edit eboot to point to FAB), it creates a new folder BLUS30009 in dev_hdd0/game/, which means there must be a variable in the eboot somewhere it is storing BLUS30009 to be creating a new folder with that name.


see below

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

008D6EA0  57 41 52 4E 49 4E 47 3A 20 54 68 69 73 20 67 61  WARNING: This ga
008D6EB0  6D 65 20 73 61 76 65 73 20 64 61 74 61 20 61 75  me saves data au
008D6EC0  74 6F 6D 61 74 69 63 61 6C 6C 79 20 61 74 20 63  tomatically at c
008D6ED0  65 72 74 61 69 6E 20 70 6F 69 6E 74 73 2E 20 57  ertain points. W
008D6EE0  68 69 6C 65 20 74 68 65 20 48 44 44 20 61 63 63  hile the HDD acc
008D6EF0  65 73 73 20 69 6E 64 69 63 61 74 6F 72 20 69 73  ess indicator is
008D6F00  20 66 6C 61 73 68 69 6E 67 20 64 61 74 61 20 69  flashing data i
008D6F10  73 20 62 65 69 6E 67 20 73 61 76 65 64 2E 20 44  s being saved. D
008D6F20  6F 20 6E 6F 74 20 73 77 69 74 63 68 20 6F 66 66  o not switch off
008D6F30  20 74 68 65 20 70 6F 77 65 72 20 64 75 72 69 6E  the power durin
008D6F40  67 20 74 68 69 73 20 74 69 6D 65 2E 00 00 00 00  g this time.....
008D6F50  4E 6F 74 20 65 6E 6F 75 67 68 20 48 44 44 20 73  Not enough HDD s
008D6F60  70 61 63 65 00 00 00 00 4E 65 77 20 47 61 6D 65  pace....New Game
008D6F70  64 61 74 61 20 64 69 72 65 63 74 6F 72 79 20 3A  data directory :
008D6F80  20 25 73 00 00 00 00 00 67 61 6D 65 64 61 74 61  %s.....gamedata
008D6F90  3A 20 4E 6F 74 20 65 6E 6F 75 67 68 20 48 44 44  : Not enough HDD
008D6FA0  20 73 70 61 63 65 00 00 47 61 6D 65 64 61 74 61  space..Gamedata
008D6FB0  20 64 69 72 65 63 74 6F 72 79 20 61 6C 72 65 61  directory alrea
008D6FC0  64 79 20 65 78 69 73 74 73 20 3A 20 25 73 20 28  dy exists : %s (
008D6FD0  25 64 20 4B 42 29 00 00 46 75 6C 6C 20 41 75 74  %d KB)..Full Aut
008D6FE0  6F 20 32 20 42 61 74 74 6C 65 6C 69 6E 65 73 00  o 2 Battlelines.
008D6FF0  42 4C 55 53 33 30 30 30 39 00 00 00 00 00 00 00  BLUS30009.......
008D7000  30 30 30 30 30 00 00 00 63 6F 75 6C 64 20 6E 6F  00000...could no
008D7010  74 20 61 6C 6C 6F 63 61 74 65 20 73 79 73 74 65  t allocate syste
008D7020  6D 20 6D 65 6D 6F 72 79 20 63 6F 6E 74 61 69 6E  m memory contain
008D7030  65 72 20 66 6F 72 20 47 61 6D 65 44 61 74 61 20  er for GameData 
008D7040  75 74 69 6C 69 74 79 00 63 65 6C 6C 47 61 6D 65  utility.cellGame
008D7050  44 61 74 61 43 68 65 63 6B 43 72 65 61 74 65 20  DataCheckCreate 
008D7060  66 61 69 6C 65 64 20 25 78 0A 0A 00 00 00 00 00  failed %x.......
008D7070  50 6C 65 61 73 65 20 77 61 69 74 20 63 61 63 68  Please wait cach
008D7080  65 20 69 6E 20 70 72 6F 67 72 65 73 2E 2E 2E 00  e in progres....
008D7090  21 21 43 61 63 68 65 20 64 69 64 20 6E 6F 74 20  !!Cache did not 
008D70A0  73 68 75 74 20 64 6F 77 6E 00 00 00 00 00 00 00  shut down.......
008D70B0  78 32 73 74 75 62 31 00 67 61 6D 65 64 61 74 61  x2stub1.gamedata
008D70C0  20 45 72 72 6F 72 3A 20 25 64 2C 20 69 64 20 25  Error: %d, id %
008D70D0  64 20 73 7A 20 25 64 00 67 61 6D 65 64 61 74 61  d sz %d.gamedata
008D70E0  3A 20 43 6F 70 79 20 53 74 61 72 74 3A 20 25 73  : Copy Start: %s
008D70F0  00 00 00 00 00 00 00 00 70 73 33 43 6F 70 79 3A  ........ps3Copy:
008D7100  20 6F 70 65 6E 20 66 61 69 6C 65 64 20 25 73 00  open failed %s.

 

[sandungas]

Incase it doesn works try this (option 2, but is the same concept)

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

008B3FF0                          64 65 76 5F 68 64 64 30          dev_hdd0
008B4000  2F 67 61 6D 65 2F 4E 50 55 41 33 30 30 30 39 2F  /game/NPUA30009/
008B4010  55 53 52 44 49 52 2F 00                          USRDIR/.

Here im keeping the NULL byte at the end because is mandatory, if we replace that zero we are breaking the structure
But im deleting the / at the most begining of the path

My hope is this string is going to be passed in between many functions.. and eventually some of that functions is going to add the missing / i deleted
Not sure if is going to work though

 

[raidriar]

Incase it doesn works try this (option 2, but is the same concept)

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000                          64 65 76 5F 68 64 64 30          dev_hdd0
00000010  2F 67 61 6D 65 2F 4E 50 55 41 33 30 30 30 39 2F  /game/NPUA30009/
00000020  55 53 52 44 49 52 2F 00                          USRDIR/.

Here im keeping the NULL byte at the end because is mandatory, if we replace that zero we are breaking the structure
But im deleting the / at the most begining of the path

My hope is this string is going to be passed in between many functions.. and eventually some of that functions is going to add the missing / i deleted
Not sure if is going to work though

I have already tried this variation, no success

 

[sandungas]

Ok, then im out of ideas, the only thing left is to "remap" the internal structure to force the function to load the string from a different offset
Lets say... it seems the strings are aligned to 8 (or 16), the string we are modifying uses 2*16... and there is other string somewhere that is not critical and is using 3*16 like that debug message from your paste located a bit before the string we are modifying, something like that can be shorted because is just an info output text

In resume, the idea would be to replace the values that indicates the offsets of the 2 strings
But this is not so easy, is needed to analize the structure to see where are that pointers

 

[haxxxen]

from my memory, you had to change every dev_bdvd, but also app_home string with dev_hdd0.
and why not making a custom folder? for example:
/dev_hdd0/z/B30009/USRDIR/

sth like this I have done with gta4 game, which works fine

 

[raidriar]

from my memory, you had to change every dev_bdvd, but also app_home string with dev_hdd0.
and why not making a custom folder? for example:
/dev_hdd0/z/B30009/USRDIR/

sth like this I have done with gta4 game, which works fine

Trying to copy typical NPDRM structure for cosmetics sake. For this game, app_home can be left alone. Only needed to change dev_bdvd to dev_hdd0 and map to location on hdd, but in this case, the path must be exact.

 

[aldostools]

I think if the folder where the game is stored is mapped to /app_home the game could work without any modification to the sprx. But this require a backup manager or a custom EBOOT that do this prior execute the game from the /app_home icon.

BTW webMAN MOD does it checking the option /dev_hdd0/game in /setup.ps3

 

[MerluzaCuca]

Hi, I'm trying to convert Budokai HD Collection to PKG with these methods but without success, can someone help me?

 

[habib]

On HEN any re-signing of EBOOT's or SPRX's must be with keys from firmware version 3.55 and below. Any higher Keys used in re-signing will result in a black screen on launch with HEN.

who said that? you can resign with any key revision

 

[Cypher_CG89]

who said that? you can resign with any key revision

Already been corrected on this at some point, but thanks for the reminder anyways.

 

[MerluzaCuca]

who said that? you can resign with any key revision

What he said at least applies on me.

 

[pinky]

What he said at least applies on me.

the most versatile way to resign that I know of is probably with scetool.

 

[PattrickH]

Hi, I'm trying to convert Budokai HD Collection to PKG with these methods but without success, can someone help me?

It does work, keep in mind there is a LAUNCH Folder, which has .SELF files renamed as .BIN

 

[SteweEliteModder]

who said that? you can resign with any key revision

After many tests i can say that's true, i've due resign the eboot with 3.XX STD output because other methods aren't working, and... not just black screen but freezing ps3 too, and by the way... for iso conversion is nodrm resign and for pkg conversion npdrm instead.