PSVita Digital Game/Cartridge Game/DLC/Savedata decryption on 3.60 (by Major_Tom)


We are constantly looking for guest bloggers at If you like to write, and have a strong interest in the console hacking scene, contact me either with a comment here, or in a PM on /talk!

44 Responses

  1. CPUzX


    My life has been rejuvenated because of this!

  2. andre104623

    Backups anyone?

  3. life

    So you no longer need to install the cartridge to memory card?
    Sounds so much simpler.

  4. sucker

    “Can’t find application.”
    Please help…

    • frostyrose

      you modified the tbl_uri wrong
      each ; represents a new cell so
      find NPXS10000 entry
      change the the flag to 1 and the scheme to ux0 write changes then copy the app.db back to the vita

      had the same error and after some troubleshooting got it to work

  5. cracker

    So what would happen if a whole dumped title were to be placed in the patch directory of another game? Hmmmm…

    • Reza

      As reading this I thought exactly that same idea if this is possible though I will upgrade from 3.52 cause I dont wanna lose my psp isos just yet if i cant get vita isos in return.

      • dimon

        Tried that, didn’t work. Got an error about the game being corrupted. But you can try if you want, maybe you’ll do something in other way.

  6. MagilsugaM

    Wooot! Hopefully we can get some rpgs undubbed soon!

  7. Ayu

    So I’m going to update my 3.51 vita to 3.60 soon.

    I have a multiplayer game here that I want to share to my other vita — I think we should now be able to easily copy the cart files into the memory card and run it from there? I expect that the cart needs to be there for initial authentication but I’m wondering how to execute the copied game files — as a patch of another game or through a new bubble perhaps? This should let me have a quick multiplayer game with someone who doesnt have a vita (or that vita game).

    Since the files have also been decrypted and we can make fan translations and custom patches, I think we can pass these patches now through lower firmware though failmail or through henkaku on lower versions. Think of the possibilities of more exploits through vita games!

    • With Cartridge based games, all the Game Data, excluding updates, is kept on the cart. It’s not like the PS4 where it just copies all the data to the system.

  8. frostyrose

    Tested one save mod and it works. going to try see what mods to the game i can do

    • Sucker

      Once you edited the save, what did you do?
      My current method has been this:
      >Decrypt save using Tom’s method
      >Grab data with Molecular’s FTP
      >Edit data
      >Drop it back into the savedata folder
      >PS Button, close out of the game via swipe
      I’ve been trying to mod Atelier Totori Plus for the last half hour, and when I finally managed to get it to stop erroring out upon startup all of my saves were missing from the “load game” option despite existing on my memcard.
      My theory is that the game does some sort of patch or version check and attaches that to one of the data files in the savedata directory in order to prevent users from using saves from one update, or something like that.
      Also, thanks for replying to my other post. Really helpful.

    • gameus

      Been having issues. I even followed the reply you put earlier. Now everytime I boot my vita up I get an error popping up “moleculrShell” could not install you cannot use the application that is on this PS vita card. Icon for the same application is already installed.

      Updated the app.db like you mentioned in another reply of yours.
      Changed flag to 1 and set scheme to “gro0” since I’m trying to do this on a cartridge. Re-uploaded app.db, restarted, re-ran HENkaku.

      I put the molecular shell files in
      -sce_sys (folder)

      Opened browser and typed in

      And getting Application not Found error. Any help is appreciated.

      • frostyrose

        was there already a patch folder for PCSE00408?
        i noticed that if the game had a patch folder already and i dragged molecular shell into it, the browser would not redirect to near.
        so i backed up the folder deleted the contents and put in only the molecular shell files.

        Haven’t tried cartridge mods yet going to do that now

        • frostyrose

          okay i misread your post (though what i said earlier might resolve an issue when you start the game istelf)
          you are trying to load gro0:/PCSE00408/
          but you missed the app so type gro0:app/PCSE00408

          • gameus

            I mistyped the post. I was launching “gro0:/app/PCSE00408/” I ran into a new issue now but I’m probably just going to try a digital game.

            The new issue, when I launch “gro0:/app/PCSE00408” Near launches then gives mne an error “Insert a PS Vita card that contains this application”. Vita card is definitely inserted. And just to be sure, I’m supposed to be using the ID off of the cartridge as the title id correct?

      • strusic

        Got exact the same problem while trying to dump Persona 4 files from retail cart.
        Also cart icon that is in right upper corner got molecular shell icon instead of persona one.

        • frostyrose

          for my titleids i use bubble studio ( and check the id of the bubble from my app.db file . Since cartridge based games install a bubble i can get the id that way.

          or go to and search the game name the serial column (minus the -) is the titleid

          @strusic sounds like you accidentally overwrote the wrong persona 4 folder on the memory card

  9. Lol

    Wololo says they don’t support piracy. Keeps posting about inevitable piracy. Prob for ad revenue

  10. A W

    Wow, that was extremely simple. Never did any PSP/Vita homebrew but got it working and dumping my game cart in like 20 minutes.

  11. Anonymous s

    OMG these developer/hacker I give them my respect to the job they have achieved

  12. TheRealSlimShady

    Been walking on journey of 1000 miles for vita piracy…….Piracy is just a mile away now!

  13. Anon

    Is this really meant to work for cartridges? Because as far as I know, cartridges aren’t re-writable and it indeed did not work for me as the cartridges files were still encrypted for me (I tried the guide with a digital game and it worked, FYI

  14. flame

    I tried a couple Japanese games and it did not work.
    I got all the way up to “your decrypted game files will be present.” That’s the rub, they’re not present.

  15. Anon3

    damn i get lost on the first part ” mr.gas’ old trick for bypassing pfs protection on old fw” i dont know if this part is needed or not


    Would the PSVita games released by the warez group PSicO for the Cobra BlackFin be able to launched with HENkaku? I thought they were downloadable, and encryption / DRM removed? Could we just launch these like we could and other home brew app?

    • Anon

      No, that thing doesn’t remove DRM, it just performs game cart license validation remotely (as opposed to the normal/local check of the cart inserted into a Vita’s slot). It also doesn’t work on 3.60, and HENkaku doesn’t work on any firmware other than 3.60.

  17. KiraSlith

    Alright Wololo, You’ve gotta share your patch dumping method and reformat that tutorial so its not so confusing for novices. took me a few tries to realize you have to completely delete the patch folder’s contents and then replace it with molecularShell and not just copy it into the patch directory leaving the rest intact. If you’d like I can write a tutorial myself with enough info a total novice can do it.

  18. Dragaron

    So I dumped Ys – Memories of Celceta [PCSE00245]’s gamecard through FileZilla using the decryption method above.

    1) Is there any reason to dump the other folders (gc, license, and psp2), or is only the [PCSE00245] folder within app valuable?

    2) Is there a way to play the decrypted dump from the memory card. I tried uploading the [PCSE00245] folder onto the memory card at ux0:/app/[PCSE00245], and once the game card is removed, I keep getting the error stating that the card is needed when I tap the bubble. I also tried starting from MolecularShell, and no dice.

    • Dragaron

      FYI, I am not asking this for the sake of piracy (although I am not judging anyone indulges in piracy), since I do own 28 Vita gamecards, and countless PSN titles, and just want to be able to put a good 15 or so backups on my memory card instead of toting around this stupid game case along with the Vita everywhere. Thanks for anyone that reads this and responds.

  19. Dimon

    How did you managed to do it? I get error C2-13700-1 each time near tries to open after I enter the path in browser. I’m sure I changed NPXS10000 eboot.bin path to NPXS10027 (I’ve changed the row with key 3022202214 using DB browser if it matters

  20. awe215

    i WASN’T able to find the saves for borderlands 2 on the vita using this method. Replacing everything in /patch/PCSE00383 would only show an empty directory when using this method.


    IF you use VITA SHELL (0.7) in place of molecular shell (follow the same method above and copy the vita shell files into BL2 patch instead) you can browse to savedata0: and the decrypted files will be there 🙂

  21. savethevita

    Can I use this metod to transfer savedata between two accounts?

  22. There is certainly a great deal to learn about this topic. I really like all the points you’ve made.

  23. Karim

    if a game has no patch folder what should i do. i tried creating one myself but when i boot persona 4. the game starts not the molecular shell. i did everything. modified the app.db and opened the game manual in near and didnt close it. started the game but molecular shell wont boot.

Leave a Reply

Your email address will not be published. Required fields are marked *

Most comments are automatically approved, but in some cases, it might take up to 24h for your comments to show up on the site, if they need manual moderation. Thanks for your understanding