Bruteforce KLicense Tools Discussion

[opoisso893]

If you need to patch a PARAM.SFO from a batch file, use my latest PARAM.SFO Editor 2.5.3 like this:

PARAM_SFO_Editor.exe "PARAM.SFO" "PS3_SYSTEM_VER" "3.40"

Little mistake in your command line example : replace "3.40" by "3.4000" or your PS3_SYSTEM_VER will be 00,1528 and not 3.4000

[aldostools]

removed post

[opoisso893]

Hello opoisso893,
Note: there could be some issues if your regional settings is using comma (instead of period) as decimal separator.

It's ok. It was my regional settings (french).

[catalinnc]

@aldostools

i have noticed that for a big eboot.elf after tens of hours of processing using the tried_keys list for finding if a key was already used is much much slower that simply trying that key!!!

could you add an option like "dont use tryed_keys list"?...this option should not generate a tried_keys list (and as a result the step of finding if a key was already used will be skipped)...this way we can have a "pure" bruteforce mode...
_

[M@tsumot0]

@aldotool i think have found something interesting for you, check this out.
MGS_PW.elf from ExetrimALL fix for Metal Gear Solid HD

This ELF is patched like a EBOOT.ELF (PICTURE 2)
MGS3.self or MGS2.self, BOOTLOADER.self don't need patch like this.
if you can explain this, I am interested in this information.
without these changes Peace Walker (MGS_PW.self) don't work!

Sorry about my English >_<

[aldostools]

removed post

[andreus]

@aldostools, so let me see if i can summarize how to use your tools.

[deank]

@aldotool i think have found something interesting for you, check this out.
MGS_PW.elf from ExetrimALL fix for Metal Gear Solid HD

This ELF is patched like a EBOOT.ELF (PICTURE 2)
MGS3.self or MGS2.self, BOOTLOADER.self don't need patch like this.
if you can explain this, I am interested in this information.
without these changes Peace Walker (MGS_PW.self) don't work!

Sorry about my English >_<

Changes show patching a call to a function (bl) - the call is removed by replacing the instruction with NOP (60 00 00 00).
The second screen show changing the SDK value in .sys_proc_param from 00 36 00 01 to 00 34 00 01 (for SDK 3.40) and IMPROPER change of the next PRX section (from 00 36 00 01 to 00 35 50 01).

[Abkarino]

could i fix 3.60 update for any game and just extract its eboot/self/sprx then replace it in backup directory without installing patched update package? so i can run it directly without needing for installing update package.

[catalinnc]

@aldostools thanks a lot for the new version...

i have to insist that bruteforce+testklic is not finding keys!

try Far Cry 2 BLUS30178...the key is at 67314 (0x000106F2)...

complete info:

Far Cry 2 [BLUS30178] [NPUB30523]

Decrypt: GAME.SELF
Content ID: UP0001-BLUS30178_00-FARCRY2PATCHV104
Done! Offset: 67314 -> 0x000106F2
Key found: 7613AB8E948211DD8203AE9856D89593

_

for statistics comlete info for Assassin's Creed Brotherhood [BLES00909]:

Decrypt: mp_scimitar_fin.self
Content ID: EP0001-BLES00909_00-AC2TITLEUPDATE05
Done! Offset: 67004 -> 0x000105BC
Key found: 1193590B4DDE4F5B8E44F5F14877D0B6

_