How to Decrypt PS3 EBOOT.BIN or SELF Files in Windows

[moja]

Can't edit the decrypted .elf file correctly because Unself for windows doesn't decrypt everything correctly. I think the working modded EBOOT.BINS are created by people using the linux version of the same tools.

The linux versions produce the same results. There is a step missing that no one is talking about.

[jamdobbs]

fantastic guard +rep..

[Briesmi]

it works fine in windows ! but you cant decrypt NP-DRM eboot's...

[jwc2003]

i've followed the guide and can decrypt the ebbot.bin to eboot.elf, then i change the data round and put as 02 for unencrypted etc and the 8000 for fself. But then when i try and use the eboot it does not work, just sends me back to xmb with no error.

I have got the original eboot.bin from gt5 euro version, decrypted it and the data is different than the released eboot.bin...

for example the first offset that is different - on my decrpyted copy shows

000009A0 - 000000000000004800000000018D2D88

where as on the released eboot.bin, which does work on my copy shows

000009A0 - 000000000000004000000000018D2588

that's one of a few differences ive noticed. but how come the results are different?

I'm using cygwin with the latest key package, and ive checked the keys and they are right. Tried 4 different eboots and everyone does the same thing, starts to load then goes back to xmb with no error.

Any ideas anyone?

[r0m]

It looks like the tools don't decrypt internal SELFs correctly. IDA shows this within ps2_softemu.elf:

_____:00000070                                         # sub_84364+468o ...
.unk_____:00000090 # ---------------------------------------------------------------------------
.unk_____:00000090
.unk_____:00000090 loc_90:                                 # DATA XREF: .unk_____:loc_168w
.unk_____:00000090                                         # .unk_____:loc_174r ...
.unk_____:00000090                 cmplwi  cr4, %r0, 0
.unk_____:00000094
.unk_____:00000094 # =============== S U B R O U T I N E =======================================
.unk_____:00000094
.unk_____:00000094
.unk_____:00000094                 .globl start
.unk_____:00000094 start:                                  # CODE XREF: startj
.unk_____:00000094                                         # DATA XREF: .unk_____:00018850o ...
.unk_____:00000094                 b       start
.unk_____:00000094 # End of function start
.unk_____:00000094
.unk_____:00000094 # ---------------------------------------------------------------------------
.unk_____:00000098 dword_98:       .long 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
.unk_____:00000098                                         # DATA XREF: .unk_____:0001C10Co
.unk_____:00000098                                         # .unk_____:000FBAF4o ...
.unk_____:00000100 # ---------------------------------------------------------------------------
.unk_____:00000100
.unk_____:00000100 loc_100:                                # DATA XREF: sub_151308+40o
.unk_____:00000100                                         # sub_15325C+54o ...
.unk_____:00000100                 ld      %r3, 0x1A0(%r0)
.unk_____:00000104

This code fragment (ELF's entry point) looks like it was corrupted in some way.

[prime2009]

I must add this does not work for npdrm eboot self files.

Everyone is using v1.00 off disc, but after you update a game or if you want the latest version this won't work as unself is bonked. Can't handle it. I am trying to figure out if someone has a working unself but noone is talking, very secret.

[SexyVampiire]

pulled the eboot off of the games disc and followed the instructions as demonstrated, And got

self_decrypt_header failed
error: No such file or directory

Found out I was using the wrong eboot, Got the proper one and now I get the error

"Invalid Type 00000008
perror no error"

[JW117]

The file appears to be SPP (NFI what that means). Looking at the tools.h (from fail0verflows repo) file you can see all the known key types

where do i need to place that attachment?

i'm trying to decrypt a eboot bin but i got the 00000008 error as well.

[soulmonger]

Sorry for the noob question.

But how do you transfer the eboot.bin and other info from the disc in the ps3 to the pc on FW 3.55jb?

[LimpX]

$ unself EBOOT.SELF EBOOT.ELF
open EBOOT.SELF
perror: No such file or directory

why?