Evilnat
Developer
After some time of research and making some patches, it seems that PS2CLASSICs games are now functional on DEX, with or without DEX kernel
I will try to explain in a simple and quick way what I have done
PSCLASSICs games use the ps2_netemu.self emulator, I researched the emulator with IDA and made several patches but nothing seemed to work, but @Joonie (gracias amigo
) gave me the clue
With the information from Joonie, flatz and juannadie (thank you about all the research you have done) about the PS2CLASSIC algorithm I have been able to find out where I have to look to patch
It's all about the CoreOS file sb_iso_spu_module.self, which is responsible for managing the meta, data and VMC keys for both CEX and DEX (they are different). For DEX, the keys are final keys, it means that they are used directly, but for CEX the keys are used to create the final keys except for VMC
meta and data keys are used to create the final key with cellCryptoSpuAesCbcCfb128Encrypt, in IDA looks like this:
These functions are used when the console is CEX, but when it is DEX things change. Instead of encrypting it directly uses the final DEX key, in IDA it looks like this
Usually PS2CLASSICs are created with CEX keys, and when using the final DEX keys while on DEX the PS3 cannot decrypt the game and gives a black screen
What we need to do is force the PS3 to use the keys for CEX, and this requires some patches
The first patch is to force the use of ps2_key_cex_meta and ps2_key_cex_data, to do this we will need to patch the following in sb_iso_spu_module.self from 4.91
This is how it looks patched in IDA, the ps2_key_dex_meta and ps2_key_dex_data keys are still loaded but with the patches we overwrite them with the final CEX keys later on:
With these patches the game now loads in DEX, but it gives an error when decrypting the VMC (0x80028F24). This happens because it is using the ps2_key_dex_vmc, and since our VMCs are encrypted with ps2_key_cex_vmc we must force it to use this key. The original function looks like this:
ila r71, ps2_key_dex_vmc
The patch is the following:
Now it will look like this:
ila r71, ps2_key_cex_vmc
Now if we load the game again the PS3 can decrypt the VMC, avoiding the error and being able to play the game, everything is complete 
. The only important data is the following, for all this to work in DEX, the PS2CLASSIC game must be encrypted with the CEX keys for meta, data and vmc, if the DEX keys are used it will give a black screen
Again, many thanks to @Joonie, flatz, juannadie and everyone who was involved in the PS2CLASSICs algorithm, without your help this would have been much more difficult to do
Here I leave the PUP with the patches in case anyone wants to test the PS2CLASSICs games in DEX, I did the tests in PEX, so the PS3 must be in CEX to be able to install it
If anyone tries it and reports if it worked for them I would be very grateful, I have tested it myself and everything works perfectly.
I will try to explain in a simple and quick way what I have done
PSCLASSICs games use the ps2_netemu.self emulator, I researched the emulator with IDA and made several patches but nothing seemed to work, but @Joonie (gracias amigo
) gave me the clueWith the information from Joonie, flatz and juannadie (thank you about all the research you have done) about the PS2CLASSIC algorithm I have been able to find out where I have to look to patch
It's all about the CoreOS file sb_iso_spu_module.self, which is responsible for managing the meta, data and VMC keys for both CEX and DEX (they are different). For DEX, the keys are final keys, it means that they are used directly, but for CEX the keys are used to create the final keys except for VMC
meta and data keys are used to create the final key with cellCryptoSpuAesCbcCfb128Encrypt, in IDA looks like this:
These functions are used when the console is CEX, but when it is DEX things change. Instead of encrypting it directly uses the final DEX key, in IDA it looks like this
Usually PS2CLASSICs are created with CEX keys, and when using the final DEX keys while on DEX the PS3 cannot decrypt the game and gives a black screen
What we need to do is force the PS3 to use the keys for CEX, and this requires some patches
The first patch is to force the use of ps2_key_cex_meta and ps2_key_cex_data, to do this we will need to patch the following in sb_iso_spu_module.self from 4.91
Code:
Patch to force the use of ps2_key_cex_meta
- Offset: 0x3B8
- Original value: 0x32000F00
- Patched value: 0x32000380
Patch to force the use of ps2_key_cex_data
- Offset: 0x3C8
- Original value: 0x32001A80
- Patched value: 0x32000F00This is how it looks patched in IDA, the ps2_key_dex_meta and ps2_key_dex_data keys are still loaded but with the patches we overwrite them with the final CEX keys later on:
With these patches the game now loads in DEX, but it gives an error when decrypting the VMC (0x80028F24). This happens because it is using the ps2_key_dex_vmc, and since our VMCs are encrypted with ps2_key_cex_vmc we must force it to use this key. The original function looks like this:
ila r71, ps2_key_dex_vmc
The patch is the following:
Code:
Patch to force the use of ps2_key_cex_vmc
- Offset: 0x4F4
- Original value: 0x422D6047
- Patched value: 0x422D6847Now it will look like this:
ila r71, ps2_key_cex_vmc
. The only important data is the following, for all this to work in DEX, the PS2CLASSIC game must be encrypted with the CEX keys for meta, data and vmc, if the DEX keys are used it will give a black screenAgain, many thanks to @Joonie, flatz, juannadie and everyone who was involved in the PS2CLASSICs algorithm, without your help this would have been much more difficult to do
Here I leave the PUP with the patches in case anyone wants to test the PS2CLASSICs games in DEX, I did the tests in PEX, so the PS3 must be in CEX to be able to install it
If anyone tries it and reports if it worked for them I would be very grateful, I have tested it myself and everything works perfectly.
