Tutorial  Updated

How to dump PSVita Games


Thanks to Mr. Gas for the help getting this set up.

For awhile now, it's been public knowledge that you can dump files from the PS Vita.
However, there's a catch. Every file you dump from a game is (USUALLY) protected by PFS protection.

There's now a clever way to bypass that encryption though-- and I'm gonna show you how.
This means getting ROM dumps of Vita games, actually being able to view and download
the contents for your own use.

NOTE: This does NOT enable piracy or emulation of PSVita games.
The eboot.bin is encrypted with a form OTHER than pfs which can't be bypassed so easily.
For now, this tutorial is good for ripping assets such as models, music, and graphics
FROM PSVITA GAMES.


Before we get started, here's a few requirements.
  • First of all, you need to be on a firmware BELOW 3.55.
    They patched the email trick that makes database editing possible.
  • You'll need some form of PSP homebrew capabilities on your Vita.
  • And probably a memory card larger than 8 GB (otherwise good luck...)
  • Also, the game you need to dump NEEDS to be digital.
    If you only have a physical copy, there's a very convoluted way to install it
    as a digital game. Here's a link:
    http://wololo.net/talk/viewtopic.php?p=402472
    Either way it needs to be fully installed on your memory card.

You might be thinking, if I can't update, how do I get the game digitally?
You really can't get on PSN with your Vita without updating it.

The short answer is, you need a PS3 console.
Borrow one from your friend for awhile if you don't have one.
It needs to be on the same PSN account that you registered your Vita to.

Buy the game on the online store from your computer, and log into PSN
on the PS3. You can download the game from there and then transfer it to your
Vita, where it will be installed without even connecting to the internet.

You might get pesky Update prompts trying to use the content manager, though.
A way to get around that is to first switch your Vita into airplane mode, then reboot.
It's also a good idea to replace the content manager assistant on your computer
with the open source alternative qCMA, which doesn't require an internet connection
or the latest firmware to operate.

--- DUMPING ---

I suggest you make an email account specifically for this process, because it'll
get messy in your inbox real quick. Trust me...

Set up your new email on the Vita.
Then on the computer, send yourself this mail.db file.
The name of the file has to be exactly THIS:
\..\..\..\email\message\mail.db
Since you can't do this from gmail, do it from Mozilla thunderbird.

then on the Vita, open it.
It should say that you can't view the image. Do NOT ever click okay on the errors,
just close the app or you'll have to start over from this step.

This'll wipe the mail database so you have to log in again, but it's
important. Now you can send yourself the app database, which is the key to
this trick.

In your next email, it doesn't matter what the subject line is, but
you NEED to have a link to exactly this address:
email:send?attach=ur0:shell/db/app.db.

On the Vita, when you touch the link, it should open a composition.
Send it to yourself and open it on the PC. This is how you can download
your app database.
The app will then close itself, that means you did it right.

Next, you'll need to install SQLite Browser. It's quick and easy.
Open the database with it and go to tbl_uri. Make a new entry and enter exactly this:
NPXS10000;1;ux0;
Make sure you click write changes before you continue!

Then go to tbl_appinfo look for the one mentioning an eboot path. Replace that with this:
vs0:app/NPXS10027/eboot.bin
Write changes again.

Last step, search for the ID of a PSP game you own. If you don't know the ID, you can find it
by backing up the game or the save to your computer and looking at the folder name.
You can also look up the ID by name in the tbl_appinfo part of the database.

While you're there, also take note of the game you're gonna dump's ID.
This isn't going to be used until later, but it's good to know!

Once you found the PSP game's ID, add a new entry starting with the ID. Then put in this exact sequence of numbers in the next cell:
2454440077
Finally, put exactly this in the third cell:
../../../app
Write changes again.

If you do not have a PSP game, I recommend you get two using the PS3 method.
One for homebrew, and one to execute the dump. You'll see why later.
You can get minis for dirt cheap, as low as $1, and you don't have to keep them or even
play them at all.

Write changes, close the SQL program and rename the file to #0 with no extension.
Send it to yourself and put exactly THIS as the subject:
ur0:shell/db/app.db

You know the drill by now, open it on the Vita, and it should say you can't view
the image. If it says anything else, you did something wrong. Look over your steps
carefully.

I think it's wise at this point to reboot the Vita.

Here's how this is gonna work. Go to your web browser and enter this and the ID of the
game you'll be dumping:
ux0:app/[GAMEID]
If you edited the database correctly, Near should open and the game's manual will appear.
Keep it open, don't close it. Just minimize it and go to your content manager.

This tricks the system into keeping the game's data open AND unencrypted while the content
manager is open, which is normally impossible. Now, when the memory card is dumped, your unencrypted
game content will be in the "app" folder of the PSP emulator.

Remember how earlier we assigned that path to the PSP game you'll use for the dump?
What that tells the content manager is, "go back to the root-- then into the app folder."
That's where it will be searching for content to copy to the PC when you back up your game in the content manager.

Tricky, huh? Just make sure you're in airplane mode (or at least started the system that way)
and that qCMA is already running on your PC. It tends to close itself when you disconnect, so try opening the backup manager window to keep it running.

Then transfer your PSP game to your PC. You'll notice that it's taking a lot longer than normally
for its size, and that's good! That means it's taking your unencrypted Vita game with it.

Of course, the file on your computer is still encrypted like all PSP backups are.
It can never be that easy, can it? Don't be discouraged though! The PSP game is unencrypted
on the way back to the Vita-- and so will your Vita game contents. So transfer it back now.

You might get an error. The error means one of two things.
this one means you didn't succeed to dump the game at all. Some solutions would be to dump
one folder at a time (earlier I suggested you do only the app folder and not the entire root).
Also, try using PSP homebrew to delete the temp folder. Then try again.

The error, as long as it happens near the end, is harmless. It means some files could not
be transferred, but by that it probably means the actual PSP game. Your Vita dump should
be not only intact, but unencrypted!

Now the problem is getting to it. You need to have at least some form of PSP homebrew installed.
I used TN-V11 custom bubbles. ARK and VHBL work too. Either way you need a way to run PSPFiler or VitaFTP.

I'm not going to get into that, there's plenty of excellent tutorials on wololo.net and YouTube if you
need to know how to do it. It's a lot harder on 3.5x firmwares though, so be warned!

Anyway, now just launch your PSPFiler. Locate the apps folder that was generated and copy the files you want
to a PSP savegame folder.
At last you can transfer your save to the PC as saves aren't encrypted in this process.
And here we have it, for the first time ever, actual dumps of PSVita game data!

Hope this helps you guys out!




STEP ONE: INSTALL HENKAKU
https://henkaku.me/



STEP TWO: EDIT THE APP.DB OVER FTP
Mr. Gas said:
1- add a value in table tbl_uri like the following
NPXS10000;1;ux0;
2- modify NPXS10000 eboot.bin path in tbl_appinfo to vs0:app/NPXS10027/eboot.bin
3- overwrite the modified app.db using email app and reboot
4- now use the browser to call the new uri with your target game . example :
ux0:app/PCSA00017
Hint: If you're dumping a cartridge, ALSO add "NPXS10000;1;gro0;" to the tbl_uri.
Another hint: If you're using a PSTV, which has no Near app, use NPXS10072 (the email app) instead of NPXS10000.

STEP THREE: WITH THE MANUAL OPEN, MOVE MOLECULARSHELL
The reason you can't dump from molecularShell's current location is that it doesn't have the proper permissions to access other apps. That's because it's also in the app folder. An easy way to get around this is to find the molecularShell app folder (MLCL00001), then copy it somewhere on your desktop. Once you've done that, open it. We'll be copying the files inside to the ux0:Patch directory.

This is where game updates are stored and loaded on boot. If your game already has a patch folder, go inside and either backup or delete the contents. Then, move the contents of the copied molecularShell folder inside. You can probably guess what we're going to do now-- that's right, close molecularShell and open your game. It should open up right to the molecularShell we put in the patch folder. If it didn't, go back and make sure you set it up exactly like I did (see video).

STEP FOUR: DUMP FROM THESE DIRECTORIES
Major_Tom said:
- app0: (basically the same as ux0:app/[TITLEID], but with mixed files from ux0:Patch as well)
- addcont0: (DLC Content)
- savedata0: (That's where the fun is, unencrypted savegame, you can edit it directly, it should encrypt it back automatically)
If you overwrite the current path in FTP with /app0: (or one of the other options)
you'll be brought to the game data, which you can right click and download. It will download straight to the directory you have set on the left of the FTP window, unencrypted.

You can also access /savedata0: or /addcont0: where your save data and DLC respectively are for this game. You can dump that the same way. Notice how we have access to all these things because we're basically running molecularShell as though it were the game we're dumping. Of course an app would have access to its own savedata, game data, and DLC.

Note: /addcont0: seems to still have a layer of encryption on it. If I figure out what to do about that later, I'll make a guide.


BONUS! STEP FIVE: REPLACING EDITED DATA YOU DUMPED PREVIOUSLY
Now, if you're like me, you want to modify these and use them in-game. Good news is you can do that!

With molecularShell still mounted in the patch directory, I simply just replaced the savedata bin with my modified one. To play the game of course, you have to exit this molecularShell, enter the normal one, and delete the contents of the patch directory again. Now, you can place your modified files here. In this case, the CPK I dumped from Golden.

Also put the sce_sys folder from molecularShell in here, otherwise the game will report that it's been corrupt when you launch it.
 
Last edited by Shrinefox,

Duo8

Well-Known Member
Member
Joined
Jul 16, 2013
Messages
3,613
Trophies
2
XP
3,008
Country
Vietnam
There's no need to get salty... It's bound to be achieved one day... :rolleyes:

Also, I don't see the "obvious" part of it.
Replacing a few files on a nearly unmodified system won't be accepted. I thought that was obvious.
Anw point is people tried and it didn't work, for the usual reasons.
 
D

Deleted User

Guest
It's on wololo iirc
Didn't you just tried it yourself?
No. Because I told you, the files aren't currently encrypted yet. I'm still looking for a method to try and re-encrypt them through the Vita (if there even is a method using all the tricks we currently have...)

Also, link to the wololo page? (Or what subforum is it in?)
 

Duo8

Well-Known Member
Member
Joined
Jul 16, 2013
Messages
3,613
Trophies
2
XP
3,008
Country
Vietnam
No. Because I told you, the files aren't currently encrypted yet. I'm still looking for a method to try and re-encrypt them through the Vita (if there even is a method using all the tricks we currently have...)

Also, link to the wololo page? (Or what subforum is it in?)
Think it was tutorials, the dumping guide thread is there.
There's no way to encrypt it right now, and you'd still have to fix the hash, and then the signature.
The vfs that is mounted is also read only.
 
D

Deleted User

Guest
you'd still have to fix the hash, and then the signature.
The vfs that is mounted is also read only.
How do you know all of this? If it's just a theory, it doesn't necessarily have to mean it's true.

Plus, I didn't think it had anything to do with 'read-only' material.

Basically, Here are the brief steps I was planning to take:
1) Dump a (decrypted) game.
2) Edit files.
3) Re-encrypt through the system (and yes, I did acknowledge that at the moment, there's no way to encrypt the files yet).
4) dump the new encrypted files.
5) Make a custom >3.20 install package from the new encrypted files.
6) Install them through the >3.20 install method and hope for the best.
 

xy2_

Well-Known Member
Member
Joined
Feb 4, 2016
Messages
256
Trophies
0
XP
452
Country
France
Can this allow for dumping games that require an higher firmware than the vita currently has?
 

dfsa3fdvc1

Well-Known Member
Member
Joined
Jan 3, 2015
Messages
226
Trophies
0
XP
214
Country
Albania
Can this allow for dumping games that require an higher firmware than the vita currently has?

That's a good question. I would see if it's possible to open the digital game manual of the high FW game. If that's possible, I think it would work.
 

Shrinefox

Persona Modder
OP
Member
Joined
Sep 5, 2013
Messages
124
Trophies
1
Website
shrinefox.com
XP
511
Country
United States
It is possible, I've done it with Digimon Cyber Sleuth even though that game requires an update higher than 3.52 to actually play. You can still look at the manual and that's all you need.
 
D

Deleted User

Guest
It's a damn shame I can't fully dump Minecraft off of my cartridge because of most files being 7+ directories into the filesystem. :wink:
I hope there will be some way to dump those files one day...
 

Nirmonculus

Well-Known Member
Member
Joined
Nov 4, 2014
Messages
735
Trophies
0
XP
560
Country
I tried dumping files from a Persona4g cart and I noticed that my png files can't be opened? the ones I dumped that is. I dumped all the license already but is it normal that the png files seem corrupted but are not 0kb? they actually have their own kb sizes but they won't open. I want to know if I'm doing the right thing, I might be wasting my time doing it wrong..
 

Shrinefox

Persona Modder
OP
Member
Joined
Sep 5, 2013
Messages
124
Trophies
1
Website
shrinefox.com
XP
511
Country
United States
It sounds like it's still PFS encrypted. Did you forget to open the manual in Near from the browser first, and keep that open while you transfer the game? If you need the files, I already uploaded them here
 
  • Like
Reactions: Nirmonculus

Nirmonculus

Well-Known Member
Member
Joined
Nov 4, 2014
Messages
735
Trophies
0
XP
560
Country
It sounds like it's still PFS encrypted. Did you forget to open the manual in Near from the browser first, and keep that open while you transfer the game? If you need the files, I already uploaded them here
Well, what I just wanted to do was dump a game and see if I can do it. It just happen that Persona is all I have. But thanks for the files. Yes, it seems that it is still pfs encrypted, I don't know how to get around that yet.
 

Shrinefox

Persona Modder
OP
Member
Joined
Sep 5, 2013
Messages
124
Trophies
1
Website
shrinefox.com
XP
511
Country
United States
Technically, no. While you can install a copy of the game on another Vita if you dump some extra stuff, you still need the cartridge to start the game each time, so that's worthless unless you just leave your Vita on all the time.

I forget, but I believe if you exit and start playing another game, you need to insert the cartridge again before you can continue playing. With the time that method consumes, you might as well buy a Blackfin.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • K3Nv2 @ K3Nv2:
    We just question @AncientBoi
  • ZeroT21 @ ZeroT21:
    it wasn't a question, it was fact
  • BigOnYa @ BigOnYa:
    He said he had 3 different doctors apt this week, so he prob there. Something about gerbal extraction, I don't know.
    +1
  • ZeroT21 @ ZeroT21:
    bored, guess i'll spread more democracy
  • LeoTCK @ LeoTCK:
    @K3Nv2 one more time you say such bs to @BakerMan and I'll smack you across the whole planet
  • K3Nv2 @ K3Nv2:
    Make sure you smack my booty daddy
    +1
  • LeoTCK @ LeoTCK:
    telling him that my partner is luke...does he look like someone with such big ne
    eds?
  • LeoTCK @ LeoTCK:
    do you really think I could stand living with someone like luke?
  • LeoTCK @ LeoTCK:
    I suppose luke has "special needs" but he's not my partner, did you just say that to piss me off again?
  • LeoTCK @ LeoTCK:
    besides I had bigger worries today
  • LeoTCK @ LeoTCK:
    but what do you know about that, you won't believe me anyways
  • K3Nv2 @ K3Nv2:
    @BigOnYa can answer that
  • BigOnYa @ BigOnYa:
    BigOnYa already left the chat
  • K3Nv2 @ K3Nv2:
    Biginya
  • BigOnYa @ BigOnYa:
    Auto correct got me, I'm on my tablet, i need to turn that shit off
  • K3Nv2 @ K3Nv2:
    With other tabs open you perv
  • BigOnYa @ BigOnYa:
    I'm actually in my shed, bout to cut 2-3 acres of grass, my back yard.
  • K3Nv2 @ K3Nv2:
    I use to have a guy for that thanks richard
  • BigOnYa @ BigOnYa:
    I use my tablet to stream to a bluetooth speaker when in shed. iHeartRadio, FlyNation
  • K3Nv2 @ K3Nv2:
    While the victims are being buried
  • K3Nv2 @ K3Nv2:
    Grave shovel
  • BigOnYa @ BigOnYa:
    Nuh those goto the edge of the property (maybe just on the other side of)
  • K3Nv2 @ K3Nv2:
    On the neighbors side
    +1
  • BigOnYa @ BigOnYa:
    Yup, by the weird smelly green bushy looking plants.
    BigOnYa @ BigOnYa: Yup, by the weird smelly green bushy looking plants.