.'pfdtool' & 'sfopatcher' (beta version) by flatz
ATTENTION!!! Be careful with 'pfdtool' because it is working with the directory you specify so it will overwrite files inside it.
Some notes about keys:
1. 'Syscon Manager Key' (syscon_manager_key): a constant key from a Syscon Manager.
2. 'PARAM.SFO Key' (param_sfo_key): a constant key used for PARAM.SFO entry.
3. 'Fallback Disc Hash Key' (fallback_disc_hash_key): a constant key used for discless PSN/SEN games.
4. 'Authentication ID' (authentication_id): an additional constant key.
5. 'Console ID' (console_id): your unique console identifier.
6. 'Secure File ID' (secure_file_id): per a game file, almost the same for all files of the game, specified by a game developer (used to encrypt save game files and to hash their content).
7. 'Disc Hash Key' (disc_hash_key): per a game disc or a constant key for PSN/SEN games (used to hash a file entry). You need to use an original game disc and extract it from the disc. For PSN/SEN games they used a fallback disc hash key. 'Disc Hash Key' hash is not verified by PS3 so you can omit this key.
Attention! Some game developers (for example, creators of Metal Gear Solid 4) uses a custom additional encryption layer for their save files. In these cases you need to reverse-engineer the game itself.
1. Paste your console specific data inside 'global.conf'.
You need to paste your console ID (IDPS) and needed keys.
Open 'Keys' page on the PS3DevWiki and look into the 'Key lists - sc_iso module 1.00-4.00'. There is a 'Syscon Manager Key' at the #2.
Open 'Talk:Keys' page on the PS3DevWiki and search for strings 'Params' and 'Fallback key'. They are 'PARAM.SFO Key' and 'Fallback Disc Hash Key'.
2. Prepare required keys for the game and place them inside 'games.conf'.
You need these keys only to verify your .PFD file (it is an optional feature) or to play with save game data encryption.
So if you want only to resign a foreign save game then you need only your console ID and skip some hash updates by specifying some flags at 'pfdtool'.
For secure file IDs you can specify an exact file name or use wildcards to match a file name (for example, you don't need to specify the same key for all game files if the game uses the same key for all of them).
A disc hash key can be extracted only from an original game disc. For PSN/SEN games a fallback disc hash key is used. This type of hash is not verified by PS3 so you can omit its key but they can add a check in the future firmware versions.
So if you want to use 'Disc Hash Key'=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX and 'Secure File ID'=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY for a save file named 'SAVE.DAT' and your game have a product code='BLZZZZZZZ' place them inside a config file:
[BLZZZZZZZ]
disc_hash_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
secure_file_id:SAVE.DAT=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
3. Make a custom save game to use it as a pattern for 'sfopatcher'.
1) You may also need to patch a copy protection flag inside your PARAM.SFO because some games uses it:
sfopatcher patch <input PARAM.SFO> <output PARAM.SFO> --remove-copy-protection
After copying it to the PS3 you need to update a game cache. You have two solutions:
a) 'Rebuild Database' in the system recovery menu. Be careful with it because it can corrupt your file system in rarely cases.
b) Manually copy your save game to the corresponding folder by using a FTP client (for example, embedded in MultiMAN).
2) You need to patch a foreign PARAM.SFO with data from your PARAM.SFO (the tool uses your account ID, save parameters, optional title and description values):
sfopatcher build <foreign PARAM.SFO> <your PARAM.SFO> <patched PARAM.SFO>
If you also want to patch title and description use a command below:
sfopatcher build <foreign PARAM.SFO> <your PARAM.SFO> <patched PARAM.SFO> --copy-title --copy-detail
4. Import your optionally patched save game folder to 'pfdtool' and use it.
Make sure that you specify a game setting set (from 'games.conf') otherwise you will get some fails.
Attention!
a) You will always get a 'Disc Hash Key FAIL' if you don't use a valid disc hash key. It is not important because it is not checked.
b) If you will get a 'Console ID Hash FAIL' then you use a wrong console ID.
c) If you will get a 'Secure File ID Hash FAIL' then you use a wrong secure file ID for a corresponding file.
You don't need to get a valid console ID for foreign save, just use your console ID and update a save game.
1) To list all entries from PARAM.PFD use a 'list' command:
pfdtool -l <save game folder>
2) To check the validity of PARAM.PFD use a 'check' command.
pfdtool -g <game setting set> -c <save game folder>
3) If you don't plan to modify save game files and you want only to resign a save game for your console then just use an 'update' command with a 'partial' update option:
pfdtool -g <game setting set> -p -u <save game folder>
4) If you plan to modify save game files then use an 'update' command without the option above:
pfdtool -g <game setting set> -u <save game folder>
5) To encrypt or decrypt specified save game files use 'encrypt' or 'decrypt' command:
pfdtool -g <game setting set> -e <save game folder> <file1 file2...>
pfdtool -g <game setting set> -d <save game folder> <file1 file2...>
6) To bruteforce a secure file ID use a 'brute' command along with the .ELF file from the game and specified decimal offset (I recommend to specify an offset of data segment which is usually started at 70-80% of the entire file):
pfdtool -b <save game folder> <elf file> <starting offset in decimal> <file1 file2...>
Bruteforcing a secure file ID takes a lot of time because it is based on hashing of the game file. The larger the file size, the longer the wait. And bruteforcing don't guarantee that you will get a secure file ID because it can not be specified in the plaintext inside an ELF file.
Once again, if you want to easily resign a save game (as publicly known commercial tools does) you just need to place your console ID and use the command:
pfdtool -p -u <save game folder>
I also recommend to use my 'Disc Key Dumper' (incorrectly named because it is a disc hash key really) and 'Secure File ID Dumper' to dump keys directly from the memory of a game. But they are written for 3.55 CFW. I will port them to the 4.21 soon.
I will be glad to see if someone will write a batch script for automate the process or a GUI application because I have no time to do it personally.
Also will be nice if someone will create a centralized storage of game setting' sets to find keys there.
In the future the tool needs to be improved for error handling because it is poor at the moment. I will plan to improve it in further versions.
; Global settings
[global]
console_id=00000001008400XX14XX2XXX6BXX5X7X (Este es un idps de ejem, 16 bytes como veis)
syscon_manager_key=D413B89663E1FE9F75143D3BB4565274
param_sfo_key=0C08000E090504040D010F000406020209060D03
fallback_disc_hash_key=D1C1E10B9C547E689B805DCD9710CE8D
authentication_id=1010000001000003; Game settings
; "Mirror's Edge"
[BLES00322]
disc_hash_key=
secure_file_id:NOMBRE_DEL_ARCHIVO=
[BLZZZZZZZ]
disc_hash_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
secure_file_id:SAVE.DAT=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
flatz escribió:Guys, here is an updated version of pfdtool.
http://rghost.ru/42090630
Please test it carefully because I have no time at the moment to test it by myself.
Changelog:
- Support of PARAM.PFD for trophies (without keys, of course)
- Support of PARAM.PFD v4 which used in a newer SDK
- Fixed a bug with verify operation on signature hashes
- Now you can use a list of product codes delimeted by '/' (slash), for example: [BLUS31142/BLES01403], they should use the same disc hash key and secure file IDs
- Show an information about .PFD type and version
The format for 'global.conf' is different. Please add these changes to your files:
1. Add a new parameter called 'user_id' which set the user identifier (the same number as used in your home folder: /dev_hdd0/home/[user_id]/)
2. Add a new parameter called 'keygen_key'. Open 'Talk:Keys' page on the PS3DevWiki and search for string 'KeygenV4'
3. Rename the parameter 'param_sfo_key' to 'savegame_param_sfo_key' (see below)
4. There a bunch of new keys for trophies: 'trophy_param_sfo_key', 'tropsys_dat_key', 'tropusr_dat_key', 'troptrns_dat_key', 'tropconf_sfm_key' and they are not public so left them as XX.
Code:
; Global settings
[global]
authentication_id=1010000001000003
console_id=
user_id=00000001
syscon_manager_key=
keygen_key=
savegame_param_sfo_key=
trophy_param_sfo_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
tropsys_dat_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
tropusr_dat_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
troptrns_dat_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
tropconf_sfm_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
fallback_disc_hash_key=
Also I noticed that some of you use a kernel swapping feature in the REX firmware. Don't forget to use your current (!) console ID. For example, if you made a save game on a DEX then you need to specify a DEX console ID.
![[sonrisa]](/images/smilies/nuevos/risa_ani1.gif "sonrisa")
![[plas]](/images/smilies/aplauso.gif "Aplausos")
) elhopillo escribió:llevaba mucho tiempo esperando algo similar... no le quitaré el ojo de encima
si no es mucha molestia para el creador del hilo, ¿te importaria actualizarlo cuando avance mas la cosa? seguro que muchos te lo agradecerian (yo incluido
Dorigon escribió:Esta es la herramienta que habia estado yo comentando en otro hilo y que me preguntaban de quien era. Esta herramienta se puede utilizar para descifrar los trofeos, modificarlos y refirmarlos... con previa modificacion de la herramienta en si.
Lo que tengo duda es si el autor liberara esa funcion o no, miedo me da que la gente empiece a truchear trofeos.
Dorigon escribió:elhopillo escribió:¡alguien lo ha probado ya? yo es que no sé por donde cogerlo... ¿alguien sabe como se usa?
En el texto de arriba en ingles lo explican bastante bien, yo ya lo he estado probando y funcionar funciona.
![[oki]](/images/smilies/net_thumbsup.gif "Ok!")
lokesea escribió:Y ahora una pregunta,....no se podra usar para enviar codigo sin firmar a la ps3 como se hizo en su momento con el bug del leyend of zelda de wii en su momento¿??????
Ahi queda eso
![[qmparto]](/images/smilies/net_quemeparto.gif "Que me parto!")
. A diferencia de la WII, la ps3 cuenta con un Hypervisor (lv1) que nos impediría acceder al las zonas de la memoria interesantes y al propio Hypervisor, para poder habilitar la carga de softawer casero y decualquierotracosamasqueseteocurra! Brais escribió:esto es un xploder gratis??? http://www.xploder.net estaba pensando en comprarlo y sale esto
![[360º]](/images/smilies/nuevos/vueltas.gif "como la niña del exorcista")
Dorigon escribió:elhopillo escribió:alguien se anima a hacer un mini-tuto?
Yo lo haria encantado, pero francamente me explico como un autentico culo...
![[+risas]](/images/smilies/nuevos/risa_ani3.gif "más risas")
, además, cualquier cosa es mejor que nada. Vita-user escribió:Dorigon pero ahora mismo no se checkea aun en ofw ni en nuestros cfw el disc hash key asi que puedes desistir de el bastaria con el secure file id.
. 
snakexn escribió:Vita-user escribió:Bien señores aqui dejo una GUI muy amigable hecha por un tio en ps3hax y la tool se llama ps3 save resigner.
http://www.mediafire.com/?z27wq5f12acccwgHi guys this is a PS3 save resigner.
You can resign any saves from any regions to any regions. From any accounts to any Accounts.
You can also remove the copy-protection.
It's easy to use, and very user-friendly. It works for Retail PS3.
All you have to do is search for the keys on internet.
Thanks to @ flaz_z for his amazing work. The games.conf is from aldostool.
This is just for people who needs an easier way to use flat_z's tool.
Recordad los saves que firmen con esto rulan hasta en OFW pero necesitan su console id ya existen tutoriales para ello incluso en este foro de scene ademas la clave de cada juego por defecto ya viene un games.conf con muchas claves pero los que estan en ofw pueden buscarlas en la red los que estamos en cfw siempre podemos buscarlas nosotros mismos en la misma ps3 con las tools de flatz.
Ademas recordad que solo es una forma de simplificar el proceso de refirmar saves a x consola pero para cosas directamente como descifrar y hackear el save etc es mejor usar la tool por consola o la de aldostools.
donde esta ese supuesto tutorial de consola id? no lo veo
.