Part 1: Getting mr.gas’ PFS Protection bypass trick working
1: Launch molecularShell and start the FTP server by pressing "select".
2: Launch your FTP client, connect to your Vita (the IP and port are on your vita's screen), navigate to "ur0:shell/db/" and download "app.db" from your Vita
3: Install "DB Browser for SQLite" if you don't already have it, then double-click your "app.db"
4: Click the "Browse Data" tab, and change the "Table" drop-down menu to "tbl_uri"
5: Click "New Record" twice and fill them both in to look like this: http://prntscr.com/c1f13d
6: Change the "Table" drop-down menu to "tbl_appinfo" and type "NPXS10000" into the "filter" field just below "titleId" and "vs0:app/NPXS10000/" in the filter field just below "val"
7: Your window should now look something like this: http://prntscr.com/c1f4y4
8: Look for the row that says "vs0:app/NPXS10000/eboot.bin" and change that to "vs0:app/NPXS10027/eboot.bin"
9: Finally, click "Write Changes" and send your newly modified app.db back to your vita the same way you downloaded it, just in reverse.
Part 2: Preparing to Dump and Edit decrypted game saves and files
1: You need a copy of molecularShell before going any further, so go to "ux0:/app" and copy "MLCL00001" somewhere you will remember on your computer.
2: At this point, you need to figure out your target application's Title ID, the easiest way to do this is to type the name of your game or application in under "val" while in "tbl_appinfo", and reading the result under "titleId", for example: http://prntscr.com/c1fa5v
3: Start by navigating to "ux0:/patch/" and finding the folder labeled with the title Id you found in the last step, if there is no folder create one yourself and skip to step 6.
4: Copy everything inside the folder somewhere safe (it would be a good idea to copy it to a seperate folder labled with the name of the game/app you are working on), make sure to wait until everything is copied before going to step 5
5: Delete EVERYTHING in the folder titled with your game's Title ID on your Vita, doesn't matter what it is, just delete it.
6: Copy the contents of MLCL00001 you downloaded in step 1 to the folder on your vita.
Part 3: FINALLY Downloading the Decrypted Files to edit/replace.
1: Start the web browser and type "ux0:app/[YOURTITLEID]" into the address bar, replacing [YOURTITLEID] with the Title ID you got from Part 2's Step 2, If you did all the previous steps correctly, you should now see the Near application open up and then open to the user manual for your application.
2: Try opening your application, instead you will be greeted with molecularShell, press select as usual to launch the FTP server.
3: Finally, you now have access to the decrypted versions of your target application's files. (or at least everything but the patch files, UPDATE THIS TUTORIAL WHEN WOLOLO RELEASES HIS METHOD FOR DECRYPTING PATCH FILES)
If your FTP utility doesn't immediately show the new root directories when you connect to it again, here they are so you can manually move to them:
app0: (the contents of your application's files mixed in with molecularShell and whatever DLC you've downloaded )
addcont0: (this is where you can find JUST the DLC by itself)
savedata0: (This is where the files most of you are interested in are)
Thanks to:
mr.gas (for the originating tutorial, and for absolutely breaking the vita's encryption on at least a game-by-game level, with a silly, hacky solution)
Wololo (for *cough*Halfassedly*cough* updating mr.gas' tutorial to work with HENKaku, P.S. FIX YOUR FORUMS, I SHOULDN'T BE LOGGED OUT FOR SPENDING 2 HOURS WRITING, ONLY TO HAVE MY WORK LOST)
Chrome (and by extension, google, for caching the entire tutorial in a way that it was easily recoverable, so I wouldn't have to write the entire thing again.)
Gaben Newell (for breaking Steam long enough to make me bored enough to write this monstrosity of a tutorial, and a bit longer to recover it from being lost)
and lastly, but undeniably most importantly Team Molecule, especially my boy YifanLu <3 you, you badass ***.
Advertising