Attempting to crack savefile encryption (MagicGate) - PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums

echeese · #1 (**permalink**) 11-20-2005, 03:47 PM

Hey everyone, I've been trying to figure out how MagicGate encryption works, because if we can get it to work then we could edit save files and find buffer overflows and hack the PSP (much like the xbox softmod)

Anyways, I was checking out the PARAM.SFO of 2 GTA:LCS saves that I took at the same point in the game (I saved twice)

It was pretty much the same, but at 0x55D, I found a 16 bit thing (I'm guessing a key)

Later on in the file, I found 3 more at:
0x11C0
0x11D0
0x1220

I'm guessing one (or more) contributes to the save file's key...

The DATA.BIN must be encrypted, because only one variable changed between saves (time) and I found the 2 bins were 99% changed between saves. If anyone has any ideas, please let me know

EDIT: After some experimentation, I've found that the SFO itself must be hashed or something
EDIT2: I think it may use VSH encryption or hashing. Not sure exactly what this is but I intend to find out.

Milkman · #2 (**permalink**) 11-24-2005, 08:18 PM

that great man just keep up the good work i guess

coolio69 · #3 (**permalink**) 11-26-2005, 02:01 AM

Quote:

Originally Posted by echeese

Hey everyone, I've been trying to figure out how MagicGate encryption works, because if we can get it to work then we could edit save files and find buffer overflows and hack the PSP (much like the xbox softmod)

Anyways, I was checking out the PARAM.SFO of 2 GTA:LCS saves that I took at the same point in the game (I saved twice)

It was pretty much the same, but at 0x55D, I found a 16 bit thing (I'm guessing a key)

Later on in the file, I found 3 more at:
0x11C0
0x11D0
0x1220

I'm guessing one (or more) contributes to the save file's key...

The DATA.BIN must be encrypted, because only one variable changed between saves (time) and I found the 2 bins were 99% changed between saves. If anyone has any ideas, please let me know

EDIT: After some experimentation, I've found that the SFO itself must be hashed or something
EDIT2: I think it may use VSH encryption or hashing. Not sure exactly what this is but I intend to find out.

HOW DO YOU OPEN .BIN AND .SFO FILES

?

echeese · #4 (**permalink**) 11-26-2005, 09:35 PM

With a hex editor

iball · #5 (**permalink**) 11-26-2005, 09:43 PM

Ummm...you guys do know that Sony implemented a new type of savegame module in 2.0, right?
It's fairly common knowledge by now. Erant - at least I think that's who found it - over on maxconsole.net figured it out.