Originally Posted by randalf
Oh ok thanks randalf. So does it matter if the K_licensee is correct or not. I'm thinking that all details should be the same as the demo. This ensures that everything looks the same as the PSN download. I think it's better than having all the same K_licensee. At least this way it's the same as the PSN Demo.
Well this is what I was going to post last night anyway.
Ok, well I've found the K_Licensee file. Hooray
Even though I've still can't rebuild the bloody Backup Mangaer pkg. Anyway, at least this is progress, and I think hides the Backup Manager even more, if Sony do check the K_Licensee along with the Content ID.
I had wondered how Randalf had known the K_Licensee for the debug version of Pain. So I thought I'd have a look at the PKG with make_package_npdrm.
Also big thanks and help to Zerotacq as I was able to use his 010 Editor PKG Template. I installed 010 Editor and after thumbling around (only previosly used Hex Workshop) used the Template. When using the Template you'll see char QA_Digest  and some weird letters. It's at offset 60h to 70h. It's below the char uid  which shows the Content ID.
Opened Debug file Pain.pkg. So open up cmd and went to the PS3 SDK folder
make_package_npdrm -c debug.pkg
(make_package_npdrm only opens debug files. If tried on the Retail Game Demo it just states that is's been Finalised - however you might be able to be hex edit 0x80000001 (Finalized) as seen in the PKGTemplate from Zerotacq - but I haven't got that far as yet. I would imagine that if that was the case - you'd be able to extract retail PKG - though I'm guessing that it'll be more to it than that.
Once issued the command, you see Checker Revision, Package Filename, Content ID, DRM Type, Content Type, PackageVersion, # QA_Digest, #Package by
The QA_Digest is the K_Licensee file. It opened the pkg as it was a debug pkg.
So now I wanted the Retail Game Demo 'Blur'. But got the Finalised error. So opened up the 010 Editor and copied the 'Blur' retail hex from offset 60h - 70h [16 double digets for the noobs out there like myself] and then pasted into the debug PKG, which was Pain. Remember the make_package_npdrm opens up debug pkg.
Ran the make_package_npdrm on the debug 'Pain' again (with the edited hex) and up shows a new QA_Digest - that of Blur Demo. Success.
Just to check that it wasn't a random number created by file sizes or hex code - like a CRC. I used a debug patch pkg of Pain vs the full game of debug Pain. Both original untouched QA_Digest ( K_Licensee) numbers were different, but after doing the edit, they were both the same, hence that it works.
Oh and while you have the hex editor open, also copy at offset C0h - 0120h [last bytes should be 00 00 - it's before more crazy hex code]. I think this might be the DRM type, Package Version and other info, which would also been needed to be truly hidden. I tested it and the Package Version changed [Currently writting a tutorial which will detail everything]
So why all this. It's been a theory of mine that Sony could also check the K_Licensee file too, along with the Content ID and pretty much any other info contained in the SFO file. I'm guessing that this would get logged on their servers as well as your console and if a miss match occurs, then the console is flagged. When a Demo is downloaded from the PSN store, it activates at their end as well as yours, so therefore all details have to be correct to be well hidden. Everything has to match. [though with what randalf states above, might not be the case, but at least it's more closer to the original pkg, than the LAUN1234 backup manager.pkg
Now the only thing I don't know about and hopefully someone could point me in the right direction, is the K_Licensee created on the fly. Umm I'll explain this way. I got the PKG from the Retail PKG release of this site. It had a K_Licensee number. Now would this number change if I download the actual PKG demo from my console. So therefore the K_Licensee is actually a serial number, or you're personally Licensee file.
Oh and also - If running in Windows 7, run as Admin, and also note that when opening the edited PKG, you'll get a 'This application has requested... please contact etc'. It won't show the directories. Also probably best to NOT run 'cmd' in Compatibilty Mode, as from past experiences the cmd would close down. Also just a warning, but windows might freeze, like mine just has. But at least you can write down the K_Licensee number [QA_Digest]
Hope this helps and I think I'm closer to actually having a well hidden Backup Manager. Big thanks to Zerotacq as that saved heaps of time.
I've also created a tutorial for the ninja backup manager
, so check that out and if possible, give it a go. Thanks