Well this took some time but we have it sorted out, CJPC posted a while back ago that an eboot.bin had been decypted from memory. The bad thing about this is that it is verry difficult to figure out how the file was before it was loaded and to put it back to an executalbe file. Well after HRS and sleepless nights this has been sorted and put in an easy to do map. The following is an example of the the file location offsets located in the elf header. Based on this the file can be rebuilt in a matter of mins.
Note: This is just an example of how it could be done the memory offset loactions can change a bit from file to file so one would have to double check there mem dump for sections if the offset table does not match up but this map was used on 3 differnt eboot.bin's so far hope this explains it a bit for ya.
thanks to CJPC and IDONE