Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Topics - Knofbath

Pages: [1]
1
Porting Metal Max Xeno from PS4 to PSVITA.

Game files are located in "romfiles.psarc", update files are in "patch01.psarc". I will refer to romfiles.psarc for the remainder of the guide.

Translation files include image assets in ".gxt" located in "\romfiles.psarc\menu\" and text files located in \romfiles.psarc\xls\data\" and "\romfiles.psarc\xls\npc\".

"\romfiles.psarc\xls\data\" files follow a format where data pointers are located in a ".arr" file, which point to text strings in a ".nam" file.

"\romfiles.psarc\xls\data\sysmsg_message.arr" contains 2-byte pointers
Code: [Select]
01 00 15 00 8C 00 A6 00 E0 00 49 01 A1 01 1C 02
77 02 D3 02 07 03 28 03 6E 03 85 03 A7 03 CF 03
E6 03 08 04 2F 04 50 04 7E 04 B0 04 C4 04 E5 04
0B 05 23 05 3A 05 64 05 98 05 CC 05 FC 05 21 06
52 06 6D 06 90 06 B0 06 D8 06 F6 06 0D 07 41 07
6F 07 DF 07 FB 07 20 08 36 08 59 08 81 08 B4 08
ED 08 1F 09 5A 09 93 09 CD 09 03 0A 46 0A 8B 0A
BC 0A FF 0A 3B 0B 73 0B A9 0B E4 0B 1B 0C 57 0C
A2 0C ED 0C 38 0D 83 0D CE 0D 19 0E 64 0E AF 0E
FC 0E 49 0F 96 0F E3 0F 00 10 21 10 3C 10 56 10

"\romfiles.psarc\xls\data\sysmsg_message.nam" contains text strings separated by NUL(00)
Code: [Select]
01 00 - In development. $WW
15 00 - Either no corresponding weapon is equipped, or you are out of bullets and big waves, but you can't use any weapons!$WW
8C 00 - $WCAttack won't reach!$WW
A6 00 - Even if you use $_I right now, it will have no effect!$WW
E0 00 - You were so close to defeating it. Use the experience you've gained this time and challenge it again.$WW
49 01 - If you make one more adjustment, you might be able to defeat it. I hope you succeed.$WW

Issues with porting the PS4 version to the PSVITA include pointers/strings that don't match the input expected by the game, and certain .nam files hard-coded within the eboot.bin.

Example error: Menu items descriptions are 2 pointers off from their expected locations. Fixing this requires comparison between the original JP/CHI game and the sysmsg_message (.arr/.nam) files from the PS4 localization.



.nam files hardcoded into the eboot.bin are:
  • \xls\data\ability_data.nam
  • \xls\data\ability_setumei.nam
  • \xls\data\btl_message.nam
  • \xls\data\encount_data.nam
  • \xls\data\skill_table.nam

To edit the eboot.bin, you need a fully decrypted and decompressed copy of the eboot.bin.
FAGDec with 0syscall6 gives the proper .ELF file, which you'll then need to pass through make_fself.exe from the leaked PSVITA devkit.

Pointers for ability_data.nam and ability_setumei.nam are located in a 10-byte struct within the eboot.bin. First 2 bytes are the ability_data.nam(ability name), second 2 bytes are the ability_setumei.nam(ability description).
Code: [Select]
01 00 01 00 00 01 05 0A 12 1E
05 00 23 00 00 01 03 07 0C 14
14 00 48 00 00 01 03 07 0C 14

Pointers for btl_message.nam are located as 2-bytes, side-by-side. Issues with this are more mismatches between JP/CHI and the PS4 English localization.
Pointers for encount_data.nam(the various monster encounter biomes) are located in a 40-byte struct.
Pointers for skill_table.nam are located in a 24-byte struct.

NPC dialog and text for scripted events are run from the \romfiles.psarc\xls\npc\ folder. All these ".msg" files seem to work with no modification.




Image Replacement

Vita images are stores in the *.gxt format, which is essentially a *.dds file with a different header.

GXT header, courtesy of froid_san:
Code: [Select]
47 58 54 00 = ID string (GXT)
03 00 00 10 = version (3.01)
01 00 00 00 = number of texture in the file (1)
40 00 00 00 = Offset of the texture data/ header size (0x40)
00 FC 07 00 = Total size of the Textures (0x7FC00)
00 00 00 00 = Number of 16 entry palettes (P4) (0x0)
01 00 00 00 = Number of 256 entry palettes (P8)  (0x1)
00 00 00 00 = Padding (0x00000000)

40 00 00 00 = Offset of the single texture data (0x40)
00 F8 07 00 = Size of the single texture data (0x7FC00)
00 00 00 00 = Index of the palette (0x0)
00 00 00 00 = Texture flags/Not used?
00 00 00 60 = Texture Type
00 50 00 95 = Texture Base Format
C0 03 = Width (960)
20 02 = Height (544)
01 00 = Mipmaps (0x1)
00 00 = Not Used?/Padding


Texture type (GXT)
0x00 = SWIZZLED
0x40 = CUBE
0x60 = LINEAR
0x80 = TILED
0x0C = LINEAR STRIDED

Texture base format 0x34
00 00 00 85 = DXT1 no alpha
00 00 00 86 = DXT3
00 00 00 87 = DXT5
10 00 04 00 = 1555
00 00 00 10 = ARGB4444
00 10 00 0C = ARGB8888
00 00 00 0C = ABGR8888
00 50 00 0C = XRGB888
00 10 00 98 = RGB888
00 10 00 05 = RGB565
00 50 00 04 = RGB555
00 10 00 02 = RGB4444
00 10 00 04 = ARGB 1555
00 10 00 95 = palette ABGR 8bpp | 256 colors
00 00 00 95 = palette ARGB 8bpp | 256 colors
00 50 00 00 = L8
00 60 00 00 = A8
00 20 00 07 = A8L8
00 30 00 07 = L8A8
00 50 00 09 = L16

PS4 images are stored in a very similar *.gnf format.

To Extract Vita images use Scarlet.  https://github.com/xdanieldzd/Scarlet
To Extract PS4 images, use Noesis and export to *.dds. https://richwhitehouse.com/index.php?content=inc_projects.php&showproject=91
Edit/Resize PS4 images with your favorite image editor. (I used Paint.NET)
To Convert *.dds to *.gxt, use psp2gxt.exe from the leaked Vita or PS3 SDK.
  • If you are getting "Invalid UBC texture width", then your *.dds is in the wrong format. (MMX uses DXT5 and ABGR8888 for all images, best to check the original GXT header for which to use.)

Metal Max Xeno also uses some magic bits to layer images. The magic bits are at the end of the source GXT file. They seem to subdivide the image into horizontal and vertical slices, so this one is 1x horizontal and 50x(hex 32) vertical.



I just used a hex editor to copy them to the new GXT file created by psp2gxt.exe.

The last few images were hidden away in *.pack files, which seem to be a container file with *.gxt, *.mdl and *.anim files.

I used a set of quickbms scripts made by froid_san (see attachment) to extract the *.gxt images and replace them with converted and resized files from the PS4 *.pack. (PS4 *.mdl files didn't work on Vita, probably due to different sized images.)

Images imported back into the *.pack should be the exact same size as the exported ones. (I was getting size differences due to not having mipmaps in my imports).

2
PS Vita / [CHOVY] Valkyria Chronicles 3 translation (not working)
« on: August 28, 2019, 01:33:10 AM »
Senjou no Valkyria 3: Extra Edition translation by "Valkyria Chronicles 3 Translation Project"
http://www.romhacking.net/translations/3562/
https://vc3translationproject.wordpress.com/

Translation file changes:
1. \PSP_GAME\SYSDIR\EBOOT.BIN               - seems to load prometheus.prx then EBOOT.OLD
2. \PSP_GAME\SYSDIR\prometheus.prx       - UMD plugin used in 5.50 prometheus CFW
3. \PSP_GAME\SYSDIR\EBOOT.OLD              - EBOOT.BIN with unknown changes
4. \PSP_GAME\SYSDIR\BOOT.BIN                 - resized and empty, not important
5. \PSP_GAME\PIC0.PNG                              - English text
6. \PSP_GAME\INSDIR\DATA.BIN                  - decrypted DATA.BIN, much larger than original

Fixes required for CHOVY:
1. Delete EBOOT.BIN and prometheus.prx, obsolete method of loading altered files.
2. Rename EBOOT.OLD to EBOOT.BIN and resign/replace.
3. DATA.BIN - unknown if changes needed

2. Rename EBOOT.OLD to EBOOT.BIN and resign/replace.

EBOOT.OLD is an unsigned ELF file, appears to be a modified version of the JP EBOOT.BIN

So, let's resign it using the same signature as the JP EBOOT.BIN
Code: [Select]
0000 : 7E  50  53  50  00  00  00  00  01  01  6F  64  69  6E  5F  70   ~PSP......odin_p
0010 : 73  70  00  00  00  00  00  00  00  00  00  00  00  00  00  00   sp..............
0020 : 00  00  00  00  00  00  01  02  FC  1B  68  00  50  1D  68  00   ..........h.P.h.
0030 : E0  9C  38  00  5C  63  49  00  C8  84  04  00  10  00  80  00   ..8.\cI.........
0040 : 00  00  00  00  00  00  00  00  D0  91  52  00  00  00  00  00   ..........R.....
0050 : 00  00  00  00  D0  91  52  00  B0  D3  04  00  00  00  00  00   ......R.........
0060 : 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00   ................
0070 : 00  00  00  00  00  00  00  00  10  05  03  06  09  00  00  00   ................
0080 : 17  2C  73  B4  DE  1C  65  AA  91  1D  25  33  E5  C9  9D  73   .,s...e...%3...s
0090 : 2F  0B  8A  EF  A7  A0  93  BC  7A  BA  BF  0F  87  22  40  6E   /.......z...."@n
00A0 : 2F  6B  F7  A4  CA  C2  29  F4  F8  1F  A0  FF  27  A0  67  19   /k....).....'.g.
00B0 : FC  1B  68  00  80  00  00  00  00  00  00  00  00  00  00  00   ..h.............
00C0 : 2B  E0  52  2C  ED  E5  D2  04  36  F6  40  DA  DB  77  90  FC   +.R,[email protected]
00D0 : [b]F0  13  16  D9[/b]  00  00  00  00  00  00  00  00  00  00  00  00   ................

Looks like <tag> 5 (D91613F0), so:
Code: [Select]
sign_np.exe -elf EBOOT.OLD EBOOT.BIN 5
Initializing KIRK engine...

Resigning EBOOT file with tag D91613F0
Done!

Problem:

So, we insert resigned EBOOT.BIN, PIC0.PNG, and DATA.BIN into the JP ISO. Convert with CHOVY-SIGN, transfer with QCMA.

But, the game black screens on us. (Note: This CHOVY dump does work in Adrenaline. ISO works in Adrenaline as well.)

Quote
Q: Why is it not running/why am I getting a black screen on “insert CFW here.”

A: We don’t know. We don’t have the time to test and release a patch that’s compatible with every CFW, so please use a different one. For reference, our programmer is using a phat PSP (PSP-1000) with 5.50 prome-2 CFW.

The 2 possibilities for fixing it are:
1. Fix the EBOOT.OLD/BIN to clean up whatever programming error is fucking shit up.

2. Re-encrypt the DATA.BIN and see i that fixes the PSPEMU issue or try to pass it to JP EBOOT.BIN.

I did try the program from this thread, but it attempts to write to 0x00000000 and fails silently when fed unenrypted VC3 DATA.BIN.
https://gbatemp.net/threads/pgd-encrypter.432029/

3
PS Vita / [CHOVY] Super Robot Wars A Portable translation
« on: August 28, 2019, 12:16:41 AM »
Super Robot Wars A Portable translated to English by Steel Soul
http://www.romhacking.net/translations/3658/

Translation file changes: 
1. \PSP_GAME\SYSDIR\EBOOT.BIN       - ??? probably lots of stuff modified
2. \PSP_GAME\SYSDIR\BOOT.BIN         - not important, just a copy of the translated EBOOT.BIN   
3. \PSP_GAME\ICON0.PNG                   - altered to english lettering, 32 bit color depth   
4. \PSP_GAME\PARAM.SFO                   - altered to English title 
5. \PSP_GAME\USRDIR\dummy.bin       - now contains some translation stuff   
6. \PSP_GAME\USRDIR\shared.bin       - translated assets 
7. \PSP_GAME\USRDIR\window.bin      - translated assets 
8. \PSP_GAME\USRDIR\graphic.bin       - translated assets 
9. \PSP_GAME\USRDIR\map.bin           - translated assets 
10. \PSP_GAME\USRDIR\battle.bin       - translated assets

Fixes required for CHOVY-SIGN:
1. EBOOT.BIN - replace w/signed version 
2. ICON0.PNG - isn't on correct color depth and blocks transfer to PSVITA.
3. PARAM.SFO - title length of 95 ??? , blocks transfer to PSVITA.
4. Starting with JP ISO, reinsert all translation assets using UMDGen.
5. Match LBA addresses of USRDIR *.bin to match translated ISO

1. Sign EBOOT.BIN and replace \PSP_GAME\SYSDIR\EBOOT.BIN
Code: [Select]
sign_np.exe -elf EBOOT.BIN EBOOT_signed.BIN 9
Initializing KIRK engine...

Resigning EBOOT file with tag D91628F0
Done!

2. Replace \PSP_GAME\ICON0.PNG with 24 bit color depth image
See Attachment

3. Replace \PSP_GAME\PARAM.SFO with edited JP PARAM.SFO
See Attachment

4. Using UMDGen 4.00, drag and drop translation assets into JP ISO (following order at top is safest).

5. Manually shift LBA addresses of \PSP_GAME\USRDIR\ *.bin to match translated ISO.

Start at \PSP_GAME\USRDIR\dummy.bin and work downward


md5

Original JP ISO md5:
982f761fecca87e5919ab0c743c7ddda

Translation ISO md5:
83bb7560a12d7032ed7ca9388d7fe97a

Translation ISO w/CHOVY fixes md5:
1a33c0f06b6bbc75e7a16c105df617da

xdelta:

Translation ISO > CHOVY fix
See Attachment

4
Problem: Translations don't work on CHOVY.

Example: Super Robot Wars A Portable translated to English by Steel Soul
http://www.romhacking.net/translations/3658/

Actual problems: Many.
1. EBOOT.BIN isn't signed and thus doesn't run in PSPEMU.
2. ICON0.PNG isn't on correct color depth and blocks transfer to PSVITA.
3. Something is wrong with PARAM.SFO and blocks transfer to PSVITA.
4. ???



Fixing 2+3 is simple, and can be done from the QCMA folder before transferring to the PSVITA. The real problem is needing to sign the EBOOT.BIN.

Problem 1 is harder to fix.

Step 1 - Extract and sign EBOOT.BIN.

Example of unsigned EBOOT.BIN:
Code: [Select]
0000 : 7F  45  4C  46  01  01  01  00  00  00  00  00  00  00  00  00   .ELF............
0010 : 02  00  08  00  01  00  00  00  70  9F  9D  08  34  00  00  00   ........p...4...
0020 : 50  7F  23  00  01  30  A2  10  34  00  20  00  01  00  28  00   P.#..0..4. ...(.
0030 : 18  00  01  00  01  00  00  00  60  00  00  00  00  40  80  08   ........`[email protected]
0040 : D0  86  1D  00  F0  7E  23  00  00  22  45  00  07  00  00  00   .....~#.."E.....
0050 : 10  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00   ................
0060 : 08  00  E0  03  00  00  00  00  08  00  E0  03  00  00  00  00   ................
0070 : E0  FF  BD  27  1C  00  BF  AF  18  00  B3  AF  14  00  B2  AF   ...'............
0080 : 10  00  B1  AF  21  90  C0  00  21  88  E0  00  18  00  51  02   ....!...!.....Q.
0090 : 0C  00  B0  AF  21  98  A0  00  12  18  00  00  08  00  20  12   ....!......... .
00A0 : 21  80  83  00  23  80  12  02  21  20  00  02  09  F8  60  02   !...#...! ....`.
00B0 : FF  FF  05  24  FF  FF  31  26  FB  FF  20  56  23  80  12  02   ...$..1&.. V#...
00C0 : 1C  00  BF  8F  18  00  B3  8F  14  00  B2  8F  10  00  B1  8F   ................
00D0 : 0C  00  B0  8F  08  00  E0  03  20  00  BD  27  C0  FF  BD  27   ........ ..'...'
00E0 : 1C  00  BF  AF  18  00  B3  AF  14  00  B2  AF  10  00  B1  AF   ................

CHOVY-SIGN includes a tool to resign ELF files like EBOOT.BIN.

Open up cmd.exe window
Code: [Select]
<path to CHOVY-SIGN>\sign-np.exe -elf <input> <output> <tag>

Usage:
       sign_np -pbp [-c] <input> <output> <cid> <key>
                    <startdat> <opnssmp>
       sign_np -elf <input> <output> <tag>

- Modes:
[-pbp]: Encrypt and sign a PSP ISO into a PSN EBOOT.PBP
[-elf]: Encrypt and sign a ELF file into an EBOOT.BIN

<tag>
  0 - EBOOT tag 0xD91609F0 - 5.00 eboot.bin
  1 - EBOOT tag 0xD9160AF0 - 5.50 eboot.bin
  2 - EBOOT tag 0xD9160BF0 - 5.55 eboot.bin
  3 - EBOOT tag 0xD91611F0 - 6.10 eboot.bin
  4 - EBOOT tag 0xD91612F0 - 6.20 eboot.bin
  5 - EBOOT tag 0xD91613F0
  6 - EBOOT tag 0xD91614F0
  7 - EBOOT tag 0xD91615F0
  8 - EBOOT tag 0xD91624F0
  9 - EBOOT tag 0xD91628F0
  10 - EBOOT tag 0xD91680F0
  11 - EBOOT tag 0xD91681F0 -  6.36 eboot.bin

I used <tag> 9, since I was aiming for a 6.35 game.
Code: [Select]
D:\Emulation\PSVITA\CHOVY-SIGN\tools>sign_np.exe -elf d:\Emulation\PSP\ISO\SRW\EBOOT.BIN d:\Emulation\PSP\ISO\SRW\EBOOT_signed.BIN 9
Initializing KIRK engine...

Resigning EBOOT file with tag D91628F0
Done!

Step 2 - Insert signed EBOOT.BIN into ISO using UMDGen.

This is where the real problems start. UMDGen is "okay" when starting with an official ISO, but if you make a new ISO then UMDGen will be lacking proper structure.

Open original JP ISO in UMDGen.
    1. Replace EBOOT.BIN with signed EBOOT.BIN.
    2. Replace other translation files with their translated equivalents.
    3. Replace ICON0.PNG. (Because it was 32 bit color depth, and we have a max of 24 bit color depth)
      *(You could also let the original JP ICON0.PNG stay)
    4. Extract, modify, and replace PARAM.SFO.
    5. Save uncompressed (*.iso)

Step 3 - Test your ISO in PPSSPP.

CHOVY is finicky about ISOs, but you want to make sure that the ISO works before wasting too much time.

Step 4 - Convert ISO to CHOVY dump and QCMA over to Vita.

If everything has gone correctly, you should have a working CHOVY dump.

But wait, if your were following along with this guide, you'll have noticed that everything went horribly wrong in Step 3.

[Troubleshooting]

This is the hard part.

Signing error - The game will immediately exit to XMB upon launch. No error message given.
Resolution: Attempt to resign the game with another <tag>. I had bad luck with tags 10 and 11, tag 9 seemed pretty reliable.

 SRW A Portable failed at Step 3, installing it as a CHOVY dump to VITA will give you an error on run.

Code: [Select]
C1-2858-3    エラーが起きました。        0x80010089    SCE_ERROR_ERRNO_ECASECLASH
Hours of troubleshooting later. This turns out to be an error related to the translation assets.

Long story short, the EBOOT.BIN is looking for translation assets directly from LBA addresses. So to fix it, we need to get the files to the correct address.

Open up original translation ISO in UMDGen, open up your modified translation ISO, go to "Layout" in modified ISO, and manually shift LBA by right-clicking on the file and "Move to LBA..." using addresses from the other ISO.


Pages: [1]