Welcome to PS3Hax, your official PS3 hacks, PS3 Homebrew, and PS3 Downloads scene. Check back daily to keep up with the latest PS3 Hacks and drop by our forums for more PS3 Hacks discussions.
  • Posted by manster , on 27/04/2013 , @ 03:06am


    K.G has released the second version of his [PS3] Save Resigner app. This tool is to resign/decrypt/encrypt PS3 Game Saves.

    What’s up guys,

    I give a whole new version of my first PS3 Save Resigner.
    PS3 Save Resigner 2.0.
    It’s further more easier to resign/decrypt/encrypt a PS3 save now.

    With the PS3 Save Resigner, you can resign any saves from any regions to any regions. From any accounts to any Accounts.
    You can also remove the copy-protection, decrypt & encrypt.
    It’s easy to use, and VERY user-friendly. It works for Retail PS3.
    You don’t have to search keys anymore.

    ▶ Download link:
    [PS3] Save Resigner 2.0 (Latest Update)
    Note: the games.conf is updated regularly by aldostool, so i will update the new file each times in the “yousendit folder”. You will have to replace the old one by the updated one in the tool’s folder.

    Thanks to @ flat_z for his amazing work. The games.conf is from aldostool.
    This is just for people who needs an easier way to use flat_z’s tool.
    Credit goes to flatz for his pfdtool.

    ▶ Update logs:

    Click to expand post: Click here to see full text SelectShow

    Source: PS3HaX

  • Posted by GregoryRasputin , on 31/12/2012 , @ 09:22am


    2012 has been an awesome year for the PS3 and the PS3 scene, here is a summary of what has went on over the past 12 months, its not complete and i still have a lot to add, but this is the vast amount, enjoy :)


  • Posted by GregoryRasputin , on 30/12/2012 , @ 08:09am


    PS3 Dev KDSBest has ported XB36Harzard’s XBox 360 Dishonored Save Game Editor to the PS3 and personally modified it, here is a quote from the release thread:


    I ported XB36Harzard’s XBox 360 Dishonored Save Game Editor to PS3 and modified it. His was detected as virus and I know why. Mine shouldn’t get detected.


    You have to use pfdtool to decrypt PAYLOAD of your Dishonored Save.

    Enter the Stuff the SaveGame wants to know.

    Play till you got at least 1 rune to be save.

    Backup the savegame it uses a heuristic method since the positions of coins and runes are not fixed. It will warn you if it came to trouble and it backups your old PAYLOAD file.

    If no warning comes (even sometimes if one comes) you should have more coins, runes and 65000 of most of the bullet types.

    At the end you have to encrypt the PAYLOAD file with pfdtool again.

    To the SaveGame it uses some strange modified zip algorithm to zip and unzip the save.

    XB36Harzard uses offzip and packzip to manage the zip algo for him. So do I!
    I just ported his stuff and modified it and wrote it in C#… VB really sucks 

    Have fun,


    PS: Wenn Autosaves Fehlschlagen einfach Kreis für Abbrechen drücken und normal speichern. Das geht bei mir!



  • Posted by GregoryRasputin , on 20/12/2012 , @ 07:16am


    PS3HaX member K.G has released an application to resign game saves, it also lets you remove copy protection from the saves, here is a quote from the release thread:


    Hi guys this is a PS3 save resigner.

    Thanks to @ flaz_z for his amazing work. The games.conf is from aldostool.
    This is just for people who needs an easier way to use flat_z’s tool.
    Credit goes to flat_z for his pfdtool.

    You can resign any saves from any regions to any regions. From any accounts to any Accounts.
    You can also remove the copy-protection.

    It’s easy to use, and very user-friendly. It works for Retail PS3.
    All you have to do is search for the keys on internet (watch the video).

    Download link:

    K.G 971

  • Posted by manster , on 15/12/2012 , @ 01:44pm


    If you want to know how to use the lately released Save Game Tools by flatz, this tutorial by zorrolaro (posted in the PS3HaX Tutorials Section) will help you.

    Required tools:

    • pfdtool by flatz http://rghost.ru/42242210
    • wireshark http://www.wireshark.org/download.html
    • PS3 ProxyServer by CF3B5 http://www.ps3hax.net/downloads.php?do=file&id=92
    • .net 1.1 runtimes (for PS3 PoxyServer) http://www.microsoft.com/en-us/downl…ils.aspx?id=26
    1. Create a folder near your root drive for pfdtool (i.e. c:/pfdtool/), then extract all files into that folder from the linked archive.
    2. Download and install wireshark and winPcap (included with the wireshark installer)
    3. Download and install the .net runtimes
    4. Download and install PS3 ProxyServer
    5. Open a command prompt (start menu -> all programs -> accessories -> command prompt) and enter command “ipconfig”. Write down the IPv4 address (should look like or something similar)
    6. Open PS3 ProxyServer and copy the IPv4 address you wrote down into the IP Address field and check of PS3 mode, leave the other options alone. Hit the big start button. Keep you IPv4 number handy, you’ll need it again. Leave this program running.
    7. Open Wireshark. On the left side there is an option to start capture. Left click with your mouse to select the appropriate network adapter listed below the start command. If you are not sure about which adapter to use, select them all using ctrl + left mouse click. Hit the start button once you’ve highlighted the appropriate adapters. Leave this program running.
    8. Boot up your PS3 and navigate to Settings -> Network Settings -> Internet Connection Settings. on the first page select Custom, on the second select whether you are connected wirelessly or wired. Skip all other options by hitting right on your controller until you get to the Proxy Server page, then select use for that option. input the IPv4 address you wrote down earlier into the top field. Make sure that the port number on this page matches the port number on PS3 ProxyServer (should both say 8080). Skip to the last page on the configuration and hit x. Test connection when prompted by hitting x again. As long as the top 3 fields say succeeded you can carry on to the next step. if not, review your settings in this step and steps 5 and 6 and retry.
    9. Sign into the playstation network and login to the psn store.
    10. Go back to your pc and check Wireshark. There should be a whole bunch of information displayed on the screen, don’t worry you don’t need to know what it means. Press [ctrl]+ e to stop capturing, then press [ctrl]+f to bring up your search dialogue. Under “find” check of “string” and under “Search In” check off “Packet bytes”. Enter 0000000100 as your search criteria and hit enter. If the necessary packet was found, in the bottom frame it should show the number highlighted on the right side (plaintext view) to ensure you have the right packet, right before the highlighted text it should say “devideID”:” and then the numbers you searched for. Take all the numbers and letters starting with your highlighted numbers and copy everything down until you find the next quotation mark in the plaintext. You should have a total of 32 digits written down. Should look something like 000000010084 followed by a bunch of letters and numbers. This is your console id.
    11. Go to the folder you installed pfdtool in. Open global.conf in notepad. Eidt the line where it says console_id=by adding the console id you just captured after the =. Also change the other fields that are bolded below to match

      ; Global settings



      Save file and exit (make sure you save as .conf not .txt)

    12. Open the games.conf file in the same folder. Edit it as follows for NA retail disc version only. You’ll have a different game id (the BLUS30982) and secure_file_id. You’ll need to ask for someone on the forums to get those for you if you are using a different region, version or entirely differnt game. You can add additional games follwing the same layout by adding more lines. The disc_hash_key is commented out, so you will get a notifaction everytime you use pfdtool, but it still works fine.

      ; “Borderlands 2″

      Save and close the file once you are done adding games. Again make sure you save as .conf, not .txt.

    13. Make sure you have a copy of your save game on your pc. I like to copy them right into the same folder as pfdtool to make for shorter commands.
    14. You are now ready to actually use pfdtool. Navigate your command prompt to the folder you installed it (command to use is simply the path of the folder, ie “c:/pfdtool”). To decrypt we use the following command:

      pfdtool -g BLUS30982 -d “C:/pfdtool/BLUS30982-SAVE-SAVE0001″ SAVE0001.SAV

      where the part in quotations will be changed to reflect your actual drive location and the name of the file will be changed to your actual file name. The file name and path are case sensitive, make sure you double check you have the right case.

    15. You now have a decrypted save file. Use your hex editor of choice or in the case of Borderlands 2 you can use the latest version of Gibbed’s Borderlands 2 Save Editor. Once you are done editing, sae your game again and onto the last step.
    16. All that’s left at this point is to encrypt the file again. See below, same notes as when decrypting about file path and name.

      pfdtool -g BLUS30982 -e “C:/pfdtool/BLUS30982-SAVE-SAVE0001″ SAVE0001.SAV

      you can now transfer your save game back to your ps3.

    A couple of quick notes: I have tried to make this as noob friendly as possible, but you still need some basic knowledge to follow this guide. Also, atm I really have no interest in modding any other save games so I do not have the info for other games to place in your games.conf file, though if anyone wants to post them I will be happy to add them to the guide. I did not write nor do I support any of the software mentioned in this guide.

    If you have any suggestions for additions to this guide, post in comments below ^^, happy modding.

    Source: PS3HaX

  • Posted by GregoryRasputin , on 01/12/2012 , @ 03:42am


    Well known PS3 Dev flatz has released some quite cool Game Save Tools, his tools are used for save game decryption/encryption, resigning and patching SFO, here is a quote from the read me:

    ‘pfdtool’ & ‘sfopatcher’ (beta version) by flatz

    ATTENTION!!! Be careful with ‘pfdtool’ because it is working with the directory you specify so it will overwrite files inside it.

    Some notes about keys:
    1. ‘Syscon Manager Key’ (syscon_manager_key): a constant key from a Syscon Manager.
    2. ‘PARAM.SFO Key’ (param_sfo_key): a constant key used for PARAM.SFO entry.
    3. ‘Fallback Disc Hash Key’ (fallback_disc_hash_key): a constant key used for discless PSN/SEN games.
    4. ‘Authentication ID’ (authentication_id): an additional constant key.
    5. ‘Console ID’ (console_id): your unique console identifier.
    6. ‘Secure File ID’ (secure_file_id): per a game file, almost the same for all files of the game, specified by a game developer (used to encrypt save game files and to hash their content).
    7. ‘Disc Hash Key’ (disc_hash_key): per a game disc or a constant key for PSN/SEN games (used to hash a file entry). You need to use an original game disc and extract it from the disc. For PSN/SEN games they used a fallback disc hash key. ‘Disc Hash Key’ hash is not verified by PS3 so you can omit this key.

    Attention! Some game developers (for example, creators of Metal Gear Solid 4) uses a custom additional encryption layer for their save files. In these cases you need to reverse-engineer the game itself.

    1. Paste your console specific data inside ‘global.conf’.
    You need to paste your console ID (IDPS) and needed keys.
    Open ‘Keys’ page on the PS3DevWiki and look into the ‘Key lists - sc_iso module 1.00-4.00′. There is a ‘Syscon Manager Key’ at the #2.
    Open ‘Talk:Keys’ page on the PS3DevWiki and search for strings ‘Params’ and ‘Fallback key’. They are ‘PARAM.SFO Key’ and ‘Fallback Disc Hash Key’.

    2. Prepare required keys for the game and place them inside ‘games.conf’.
    You need these keys only to verify your .PFD file (it is an optional feature) or to play with save game data encryption.
    So if you want only to resign a foreign save game then you need only your console ID and skip some hash updates by specifying some flags at ‘pfdtool’.
    For secure file IDs you can specify an exact file name or use wildcards to match a file name (for example, you don’t need to specify the same key for all game files if the game uses the same key for all of them).
    A disc hash key can be extracted only from an original game disc. For PSN/SEN games a fallback disc hash key is used. This type of hash is not verified by PS3 so you can omit its key but they can add a check in the future firmware versions.
    So if you want to use ‘Disc Hash Key’=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX and ‘Secure File ID’=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY for a save file named ‘SAVE.DAT’ and your game have a product code=’BLZZZZZZZ’ place them inside a config file:

    3. Make a custom save game to use it as a pattern for ‘sfopatcher’.
    1) You may also need to patch a copy protection flag inside your PARAM.SFO because some games uses it:
    sfopatcher patch <input PARAM.SFO> <output PARAM.SFO> -remove-copy-protection
    After copying it to the PS3 you need to update a game cache. You have two solutions:
    a) ‘Rebuild Database’ in the system recovery menu. Be careful with it because it can corrupt your file system in rarely cases.
    b) Manually copy your save game to the corresponding folder by using a FTP client (for example, embedded in MultiMAN).
    2) You need to patch a foreign PARAM.SFO with data from your PARAM.SFO (the tool uses your account ID, save parameters, optional title and description values):
    sfopatcher build <foreign PARAM.SFO> <your PARAM.SFO> <patched PARAM.SFO>
    If you also want to patch title and description use a command below:
    sfopatcher build <foreign PARAM.SFO> <your PARAM.SFO> <patched PARAM.SFO> -copy-title -copy-detail

    4. Import your optionally patched save game folder to ‘pfdtool’ and use it.
    Make sure that you specify a game setting set (from ‘games.conf’) otherwise you will get some fails.
    a) You will always get a ‘Disc Hash Key FAIL’ if you don’t use a valid disc hash key. It is not important because it is not checked.
    b) If you will get a ‘Console ID Hash FAIL’ then you use a wrong console ID.
    c) If you will get a ‘Secure File ID Hash FAIL’ then you use a wrong secure file ID for a corresponding file.
    You don’t need to get a valid console ID for foreign save, just use your console ID and update a save game.
    1) To list all entries from PARAM.PFD use a ‘list’ command:
    pfdtool -l <save game folder>
    2) To check the validity of PARAM.PFD use a ‘check’ command.
    pfdtool -g <game setting set> -c <save game folder>
    3) If you don’t plan to modify save game files and you want only to resign a save game for your console then just use an ‘update’ command with a ‘partial’ update option:
    pfdtool -g <game setting set> -p -u <save game folder>
    4) If you plan to modify save game files then use an ‘update’ command without the option above:
    pfdtool -g <game setting set> -u <save game folder>
    5) To encrypt or decrypt specified save game files use ‘encrypt’ or ‘decrypt’ command:
    pfdtool -g <game setting set> -e <save game folder> <file1 file2…>
    pfdtool -g <game setting set> -d <save game folder> <file1 file2…>
    6) To bruteforce a secure file ID use a ‘brute’ command along with the .ELF file from the game and specified decimal offset (I recommend to specify an offset of data segment which is usually started at 70-80% of the entire file):
    pfdtool -b <save game folder> <elf file> <starting offset in decimal> <file1 file2…>
    Bruteforcing a secure file ID takes a lot of time because it is based on hashing of the game file. The larger the file size, the longer the wait. And bruteforcing don’t guarantee that you will get a secure file ID because it can not be specified in the plaintext inside an ELF file.

    Once again, if you want to easily resign a save game (as publicly known commercial tools does) you just need to place your console ID and use the command:
    pfdtool -p -u <save game folder>

    I also recommend to use my ‘Disc Key Dumper’ (incorrectly named because it is a disc hash key really) and ‘Secure File ID Dumper’ to dump keys directly from the memory of a game. But they are written for 3.55 CFW. I will port them to the 4.21 soon.

    I will be glad to see if someone will write a batch script for automate the process or a GUI application because I have no time to do it personally.
    Also will be nice if someone will create a centralized storage of game setting’ sets to find keys there.
    In the future the tool needs to be improved for error handling because it is poor at the moment. I will plan to improve it in further versions.


    flatz has also added Secure File ID dumper to the bundle of tools, here is a readme for that file:

    Secure File ID Dumper

    A secure file ID is specified by developer of the game. There are can be more than one secure file IDs, one ID per file.
    There are cases when these bytes stored at EBOOT.ELF as is, so you can use my PFD tool to bruteforce them by specifying a PARAM.PFD and file name.
    In other cases you need skills of reverse-engineering and a disassembler to find a secure file ID.
    That’s why I had created this dumper. It dumps a secure file ID from memory itself.

    - 3.55 CFW (e.g. Kmeaw)
    - MultiMAN or original dev_blind application and FTP client

    1. Install `Data Dumper` (data_dumper.pkg) if you didn’t installed it before.
    It is a homebrew application to dump a data from some LV2 memory to a file: /dev_hdd0/tmp/dumps.bin
    A data which stored there is written by dumper loaders, e.g. by Klicensee Dumper.

    2. Install `Secure File ID Dumper Loader` (secure_file_id_dumper_loader.pkg).
    It stores a file path to the file which used in your save data and a secure file ID of this file.

    3. Now you need to replace original libraries located at `dev_flash/vsh/module` by modified versions. There are `ps3_savedata_plugin.sprx`, `ps3_savedata_plugin_game.sprx`, `ps3_savedata_plugin_game_mini.sprx`. I use a dev_blind feature from MultiMAN, you can use any other way. Don’t forget to backup original files.

    4. Reboot a console to clear a data storage in LV2 memory.

    5. Now you need to start `Secure File ID Dumper`, then start your game.

    6. Then you need to make a game save.

    7. After exiting from the game you need to run `Data Dumper`, you will hear some beeps.

    8. Then run any FTP client (e.g. builtin in MultiMAN) and download dumped secure file IDs from /dev_hdd0/tmp/dumps.bin.

    9. Restore original libraries `ps3_savedata_plugin.sprx`, `ps3_savedata_plugin_game.sprx`, `ps3_savedata_plugin_game_mini.sprx` using the same method as at step 3.

    Not all of these libraries used with all games, there is one library per game type.

    Download Save Game Tools


    pfdtool 0.2.3
    - Added an option to specify the relative offset to advance each time while bruteforcing a secure file ID.

    sfopatcher 0.2.0
    - Now the tool doesn’t copy PARAMS and SAVEDATA_DIRECTORY parameters. Use new options if you want them.

    pfdtool 0.2.2
    - Now encrypt and decrypt operations update hashes automatically (be sure to use all keys!).
    - Fixed another issue with the file size of modified files.
    - Removed a verbose flag because it is not used at the moment.

    pfdtool 0.2.1
    - Fixed issues with the file size.

    pfdtool 0.2.0
    - Support of PARAM.PFD for trophies (without keys, of course).
    - Support of PARAM.PFD v4 which used in a newer SDK.
    - Fixed a bug with verify operation on signature hashes.
    - Now you can use a list of product codes delimeted by ‘/’ (slash), for example: [BLUS31142/BLES01403], they should use the same disc hash key and secure file IDs.
    - Show an information about .PFD type and version.

    sfopatcher 0.1.0
    - Initial release.

    pfdtool 0.1.0
    - Initial release.

    Download pfdtool 0.2.3 and sfopatcher 0.2.0

    Follow flatz on Twitter.