Heads up: Horizon Forbidden West available for Preorder on Amazon: PS5 - PS4 (affiliate link)

PSVita Digital Game/Cartridge Game/DLC/Savedata decryption on 3.60 (by Major_Tom)


We are constantly looking for guest bloggers at wololo.net. If you like to write, and have a strong interest in the console hacking scene, contact me either with a comment here, or in a PM on /talk!

44 Responses

  1. CPUzX says:


    My life has been rejuvenated because of this!

  2. andre104623 says:

    Backups anyone?

  3. life says:

    So you no longer need to install the cartridge to memory card?
    Sounds so much simpler.

  4. sucker says:

    “Can’t find application.”
    Please help…

    • frostyrose says:

      you modified the tbl_uri wrong
      each ; represents a new cell so
      find NPXS10000 entry
      change the the flag to 1 and the scheme to ux0 write changes then copy the app.db back to the vita

      had the same error and after some troubleshooting got it to work

  5. cracker says:

    So what would happen if a whole dumped title were to be placed in the patch directory of another game? Hmmmm…

    • Reza says:

      As reading this I thought exactly that same idea if this is possible though I will upgrade from 3.52 cause I dont wanna lose my psp isos just yet if i cant get vita isos in return.

      • dimon says:

        Tried that, didn’t work. Got an error about the game being corrupted. But you can try if you want, maybe you’ll do something in other way.

  6. MagilsugaM says:

    Wooot! Hopefully we can get some rpgs undubbed soon!

  7. Ayu says:

    So I’m going to update my 3.51 vita to 3.60 soon.

    I have a multiplayer game here that I want to share to my other vita — I think we should now be able to easily copy the cart files into the memory card and run it from there? I expect that the cart needs to be there for initial authentication but I’m wondering how to execute the copied game files — as a patch of another game or through a new bubble perhaps? This should let me have a quick multiplayer game with someone who doesnt have a vita (or that vita game).

    Since the files have also been decrypted and we can make fan translations and custom patches, I think we can pass these patches now through lower firmware though failmail or through henkaku on lower versions. Think of the possibilities of more exploits through vita games!

    • Thomas Wade says:

      With Cartridge based games, all the Game Data, excluding updates, is kept on the cart. It’s not like the PS4 where it just copies all the data to the system.

  8. frostyrose says:

    Tested one save mod and it works. going to try see what mods to the game i can do

    • Sucker says:

      Once you edited the save, what did you do?
      My current method has been this:
      >Decrypt save using Tom’s method
      >Grab data with Molecular’s FTP
      >Edit data
      >Drop it back into the savedata folder
      >PS Button, close out of the game via swipe
      I’ve been trying to mod Atelier Totori Plus for the last half hour, and when I finally managed to get it to stop erroring out upon startup all of my saves were missing from the “load game” option despite existing on my memcard.
      My theory is that the game does some sort of patch or version check and attaches that to one of the data files in the savedata directory in order to prevent users from using saves from one update, or something like that.
      Also, thanks for replying to my other post. Really helpful.

    • gameus says:

      Been having issues. I even followed the reply you put earlier. Now everytime I boot my vita up I get an error popping up “moleculrShell” could not install you cannot use the application that is on this PS vita card. Icon for the same application is already installed.

      Updated the app.db like you mentioned in another reply of yours.
      Changed flag to 1 and set scheme to “gro0” since I’m trying to do this on a cartridge. Re-uploaded app.db, restarted, re-ran HENkaku.

      I put the molecular shell files in
      -sce_sys (folder)

      Opened browser and typed in

      And getting Application not Found error. Any help is appreciated.

      • frostyrose says:

        was there already a patch folder for PCSE00408?
        i noticed that if the game had a patch folder already and i dragged molecular shell into it, the browser would not redirect to near.
        so i backed up the folder deleted the contents and put in only the molecular shell files.

        Haven’t tried cartridge mods yet going to do that now

        • frostyrose says:

          okay i misread your post (though what i said earlier might resolve an issue when you start the game istelf)
          you are trying to load gro0:/PCSE00408/
          but you missed the app so type gro0:app/PCSE00408

          • gameus says:

            I mistyped the post. I was launching “gro0:/app/PCSE00408/” I ran into a new issue now but I’m probably just going to try a digital game.

            The new issue, when I launch “gro0:/app/PCSE00408” Near launches then gives mne an error “Insert a PS Vita card that contains this application”. Vita card is definitely inserted. And just to be sure, I’m supposed to be using the ID off of the cartridge as the title id correct?

      • strusic says:

        Got exact the same problem while trying to dump Persona 4 files from retail cart.
        Also cart icon that is in right upper corner got molecular shell icon instead of persona one.

        • frostyrose says:

          for my titleids i use bubble studio (https://anthe.studio/bubblestudio/) and check the id of the bubble from my app.db file . Since cartridge based games install a bubble i can get the id that way.

          or go to http://psvitadb.com/ and search the game name the serial column (minus the -) is the titleid

          @strusic sounds like you accidentally overwrote the wrong persona 4 folder on the memory card

  9. Lol says:

    Wololo says they don’t support piracy. Keeps posting about inevitable piracy. Prob for ad revenue

    • Swegl0rdZZ says:

      how is this piracy lmao

      the dumped games can’t be used on any other console than yours (yet tho)

  10. A W says:

    Wow, that was extremely simple. Never did any PSP/Vita homebrew but got it working and dumping my game cart in like 20 minutes.

  11. Anonymous s says:

    OMG these developer/hacker I give them my respect to the job they have achieved

  12. TheRealSlimShady says:

    Been walking on journey of 1000 miles for vita piracy…….Piracy is just a mile away now!

  13. Anon says:

    Is this really meant to work for cartridges? Because as far as I know, cartridges aren’t re-writable and it indeed did not work for me as the cartridges files were still encrypted for me (I tried the guide with a digital game and it worked, FYI

    • Anon2 says:

      I believe you can copypaste everything into the patch folder, but i can’t even launch my gro0 game 🙁

  14. flame says:

    I tried a couple Japanese games and it did not work.
    I got all the way up to “your decrypted game files will be present.” That’s the rub, they’re not present.

    • flame says:

      I tried dumping cartridge Celceta USA and that worked. Is there something USA-specific about the hack?

    • flame says:

      I’m an idiot. I got .psarc files. I wasn’t expecting that, but those are actually the files. OK, thanks for the guide.

    • flame says:

      Some games will not work. Appears to be newer games. Symptoms: Near closes when you launch the game.

  15. Anon3 says:

    damn i get lost on the first part ” mr.gas’ old trick for bypassing pfs protection on old fw” i dont know if this part is needed or not


    Would the PSVita games released by the warez group PSicO for the Cobra BlackFin be able to launched with HENkaku? I thought they were downloadable, and encryption / DRM removed? Could we just launch these like we could and other home brew app?

    • Anon says:

      No, that thing doesn’t remove DRM, it just performs game cart license validation remotely (as opposed to the normal/local check of the cart inserted into a Vita’s slot). It also doesn’t work on 3.60, and HENkaku doesn’t work on any firmware other than 3.60.

  17. KiraSlith says:

    Alright Wololo, You’ve gotta share your patch dumping method and reformat that tutorial so its not so confusing for novices. took me a few tries to realize you have to completely delete the patch folder’s contents and then replace it with molecularShell and not just copy it into the patch directory leaving the rest intact. If you’d like I can write a tutorial myself with enough info a total novice can do it.

  18. Dragaron says:

    So I dumped Ys – Memories of Celceta [PCSE00245]’s gamecard through FileZilla using the decryption method above.

    1) Is there any reason to dump the other folders (gc, license, and psp2), or is only the [PCSE00245] folder within app valuable?

    2) Is there a way to play the decrypted dump from the memory card. I tried uploading the [PCSE00245] folder onto the memory card at ux0:/app/[PCSE00245], and once the game card is removed, I keep getting the error stating that the card is needed when I tap the bubble. I also tried starting from MolecularShell, and no dice.

    • Dragaron says:

      FYI, I am not asking this for the sake of piracy (although I am not judging anyone indulges in piracy), since I do own 28 Vita gamecards, and countless PSN titles, and just want to be able to put a good 15 or so backups on my memory card instead of toting around this stupid game case along with the Vita everywhere. Thanks for anyone that reads this and responds.

  19. Dimon says:

    How did you managed to do it? I get error C2-13700-1 each time near tries to open after I enter the path in browser. I’m sure I changed NPXS10000 eboot.bin path to NPXS10027 (I’ve changed the row with key 3022202214 using DB browser if it matters

    • Dimon says:

      I’ve solved the problem. It seems you should not add ux0 and gro0 recrords to app.db at the same time.

  20. awe215 says:

    i WASN’T able to find the saves for borderlands 2 on the vita using this method. Replacing everything in /patch/PCSE00383 would only show an empty directory when using this method.


    IF you use VITA SHELL (0.7) in place of molecular shell (follow the same method above and copy the vita shell files into BL2 patch instead) you can browse to savedata0: and the decrypted files will be there 🙂

  21. savethevita says:

    Can I use this metod to transfer savedata between two accounts?

  22. There is certainly a great deal to learn about this topic. I really like all the points you’ve made.

  23. Karim says:

    if a game has no patch folder what should i do. i tried creating one myself but when i boot persona 4. the game starts not the molecular shell. i did everything. modified the app.db and opened the game manual in near and didnt close it. started the game but molecular shell wont boot.

  1. August 4, 2016

    […] Some1CP stopped by our forums to release a full tutorial on how to “undub”  Persona 4 Golden on PS Vita. This is something that’s now doable thanks to the HENkaku hack and Major_Tom‘s recent explanations on how to mod PS Vita games. […]