PS Vita Remote Patching

[turecross321]

Patching the EBOOT

A PS Vita EBOOT can be found in two places. It can both be found in ux0:app/<title-id>/, but it can also be found in ux0:patch/<title-id>/. The EBOOT that can be found in ux0:app/<title-id>/ will always be the 1.00 EBOOT, whereas the ux0:patch/<title-id>/ EBOOT will always be the EBOOT from the last installed update. Refresher should always use the patch EBOOT if it's available, and I think it wouldn't hurt for it to also inform the user of which one it is grabbing.

PS Vita EBOOTs are under two layers of encryption. First there's the game-wide encryption, and then there's the EBOOT encryption. Luckily there are already open source programs that have reverse engineered both the encryption layers.

The game wide encryption is typically decrypted right now with a PSVita application called FAGDec. The source code to FAGDec can be found here: https://github.com/CelesteBlue-dev/PSVita-RE-tools/tree/master/FAGDec/src

The second layer, the EBOOT specific encryption, can be decrypted with a program called vita-unmake-fself. Source code: https://github.com/CelesteBlue-dev/PSVita-RE-tools/tree/master/vita-unmake-fself

Refresher should now have an ELF EBOOT and be able to perform a patch like with any other EBOOT.

After the ELF has been patched, Refresher should encrypt it back to an EBOOT.bin, and this is what vita-elf-injector can do. Source code can be found here: https://github.com/CelesteBlue-dev/PSVita-RE-tools/tree/master/elf_injector/src

rePatch

rePatch is a PS Vita plugin, and it's required to mod PS Vita games. rePatch essentially makes a second ux0:patch folder, with the only difference being that the files here should not have the game-wide encryption, and Refresher should, in my opinion, warn the user if rePatch isn't installed since the patched EBOOT won't work if it isn't.

I believe that finding the user's installed plugins should be a simple matter of checking the plugin config file at either ux0:tai/config.txt or ur0:tai/config.txt, but because I'm not fully sure, you can check out the following PS Vita homebrew source code which has the ability to list the user's installed plugins: https://github.com/ONElua/AutoPlugin2

Refresher should put the patched EBOOT in ux0:rePatch/<title-id>/

There are multiple versions and forks of rePatch available, but all of them work just fine for the purposes of this tool in my experience. https://github.com/SonicMastr/rePatch-reLoaded

0syscall6

0syscall6 is a plugin that is sometimes mandatory to be able to boot a modified EBOOT. I've not done much research into exactly why it helps or if it's even exactly needed here, but I'll include it here for good measure. https://github.com/SKGleba/0syscall6

Fetching installed games

Fetching all the games on a PS Vita can be done in multiple places, but I believe that fetching them from ux0:appmeta is the best way. ux0:appmeta contains a folder for every game, which contain the game icon, game title and version number (as well as other less relevant data). The contents of these folders are encrypted, and while I've not been able to find a small program where its only purpose is to decrypt these files, VitaShell does support decrypting these, and its source code can be found here: https://github.com/TheOfficialFloW/VitaShell

[jvyden]

I think it's best to leave installing rePatch/0syscall6 to the user, but we should definitely warn about it if they aren't installed if we can.

Can the state of the plugins be determined over FTP? Oops, it would help if I could read.

I've not done much research into exactly why it helps or if it's even exactly needed here, but I'll include it here for good measure.

I would imagine it's required to circumvent miscellaneous checks on encryption/hashes. That library seems to handle such checks according to the GitHub repository's README.

Edit: Thinking about it, given the fact that we don't apply the game layer of encryption, it's possible that this library skips checking for this layer of encryption.

[jvyden]

The good news is that both VitaShell and the whole PSVita-RE-tools repos are both licensed under GPLv3, so we're safe to distribute binaries for those with Refresher.

I think the next step is talking to some VitaShell developers about reading app metadata, and then we have a solid plan for Vita.

[jvyden]

Can you upload some samples of the relevant appmeta files in question?

[turecross321]

For sure. Here's a zip archive with both an encrypted and a decrypted version of the appmeta for the European version of LBP Vita 1.22. appmeta.zip

[jvyden]

Structure looks the same as PS3, just need to decrypt icon0.png and param.sfo

[Yoti]

ur0:appmeta isn't encrypted.

[jvyden]

@Beyley Is the Allefresher port as a Vita kernel module meant to supersede the patching methods described in this issue? If so, feel free to close this in favor of an issue in that repository.

[Beyley]

@Beyley Is the Allefresher port as a Vita kernel module meant to supersede the patching methods described in this issue? If so, feel free to close this in favor of an issue in that repository.

Ideally yes, it will completely supersede the need for direct EBOOT patching on real hardware, although we may need to keep EBOOT patching as an option for vita3k, whenever that gets stable and adds infrastructure support, as tmk they dont have a plugin system yet, but yes for remote patching, i want Allefresher to take over, so i'll close this