I'm adding these here for archival purposes in case anyone out there still wants to learn about Sony's PS3 Debug / Test (DECH) and PlayStation 3 Reference Tool (DECR) from the original FAQ by CJPC on the old site.
PS3 Test / Tool FAQ
So, you have gotten your hands on a PS3 TEST - congratulations are in order!
Now, your unit may be know as a PS3 TEST, a PS3 DEV, a PS3 DEBUG, a PS3 DEBUGGER, its all the same unit. I may intermix on the names, but they are all the same unit!
1. What can my TEST do?
Simply put, your PS3 TEST can do just about everything your Retail PS3 can, with a few exceptions:
The TEST can:
First off, you need to know what you are doing, and you are going to need the *** - which will not be provided here, you can get it at http://www.scedev.net/ps3/
Upon grabbing that, and getting it set up properly, you should then upgrade your PS3 TEST to at least firmware version 2.00, as starting firmware 2.00 there is a Debugger Mode, which makes running code very easy.
Basically, in this debugger mode, you can execute and debug code from a PC, right to the PS3 with ease.
3. How do I dump the Hypervisor/Kernel?
You can not, at least not yet!
4. How do I play copied games?
Short answer is - you can not. Long answer is, you can (see the PS3 TEST / TOOL Debug Game Backup Guide below). Basically, somehow you need to obtain a debug signed executable(s), and use the original game disk to decrypt all of the content, then remaster it. Simply put, it is not worth it- if you have the original game, just use it. If you got a PS3 TEST for this reason, sell it here.
5. How do I use the BD Emulator?
First off, you need to have at least firmware version 2.00, furthermore you need to have the proper tools, namely the BD Image Generator to properly master the game. See below this FAQ for additional details.
6. What are all of these debug options, and what do they do?
Many of them are self explanatory, but in the near future, I will write something up in regards to these.
7. What are the benefits/losses of each firmware upgrade?
There are a few big mentions, 1.60? added support for Music/Pictures/Video support on the TEST, 2.00 added debugger mode, BD emu, and others. More details will come soon.
8. My game requires a patch - how can I play online?
You can try changing the NP environment under the debug settings from np to sp-int. NP is the Playstation Network (retail) , while sp-int is a developer one.
So, by changing it to sp-int, it will check the developer network for an update - hopefully you can find one, they tend to disappear quite quickly.
You can not use the "np" (retail psn) network as TEST's after 1.60 can not decrypt retail packages, so you would get an error on the PKG attempting to install!
9. How many different models of PS3 TEST's are there?
There are quite a few different models, not including prototypes. However the main models are the:
Legend:
A- America
J- Japan
S- Show (No Test Markings)
E- Unknown
DEH - Prototype
DECR - Final Unit
DEH-10000(AS-E) - Prototype PS3 TEST units. Feature a very translucent case (see-thru), no TEST markings at all. Some units feature PROTOTYPE stickers, while others do not (they were on the packing box, instead)
DECHA00(A/J)(S) - Just like a 60GB retail unit, Hardware B/C
DECHJ00(A/J)(S) - Like a 40GB retail unit, Only supported in SW ver 2.17 and later* Perhaps 2.30 and later, according to one of our DEVS
DECH-2000(A/J)(S) - Slim line debugger, features a 120GB HDD, HW like the current slim units
Other "off label" units do exist, they tend to be DEBUG firmware installed on the first run of retail systems for in house TESTING, so they may lack the proper stickers, however usually do have the proper TEST markings.
There are also a few other models, such as the AV Testing Tool, however the only major difference from above, is a firmware update, vs a console change. It allows mastered BD-ROM code to be run from BD-R, to facilitate the testing for BD movies / interactives, as well as to enable/disable HDCP, and to change the BD-ROM region.
9. What about other development kits?
There are many other development kits, which will be documented below.
CEB-10XX - The first PS3 development units, they were about the size of a end table, dual PSU's, have an Ethernet connector for debugging - but not via Ethernet, via a proprietary cabling (don't use an ethernet card to it!)
CEB-20XX - Smaller, but still bulky, about 4U in height, there were multiple revisions in this area, the main difference was the Graphics Adapter, CPU Speed and amount of Memory.
DEH-R1000/R1010/R1020 - Do not have too much information on these units, but they are just like the R1030's, but lack the prototype BD-ROM drive. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out.
DEH-R1030 - The Latest units with a prototype BD-ROM drive (half height, tray loaded) drives. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out.
DEH-R1040 - The first units with a slot loaded drive. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out, as well as analog outputs. As you can tell, it is pretty much a final unit, to the point that, they look identical from the outside. See the picture for the DECR-1000 Below!
DECR-1000 - Final development kit. About 2U in height, rackmountable. Features 6 USB ports, two of the ports are marked for the "rear" , to simulate the missing rear USB ports on the retail PS3. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out. However, 2nd HDMI port, and 2 of the lan ports are covered. But, features analog audio outputs! Also has 512MB of system memory.
And, of course, the REAR of the DEH/DECR units (generally the same, sans 1-2 listed changes)
DECR-1400A - Newest kit, is the same case as a TEST PS3, has 512MB system ram vs the TEST's 256MB.
And, the Rear (has 2X LAN connectors, one for the PS3, one for DEV)
If you perhaps happen to have one of the above kits, or one that is not listed please mail me.
PS3 TEST / TOOL Debug Game Backup Guide
We get a lot of questions in the forums, asking how to run a backup of an original game on a DECH unit – and it is a complicated process. However, I finally decided to stop being lazy and write a nice guide for people to follow.
For starters, what you will need to get this done:
The leaked 1.60 is missing a key file for TEST user's, “dtnetm”. Namely, as of 1.60, TEST "debugging" was not supported - this feature was not fully added in until around 2.00. dtnetm basically runs on a PC, and facilitates communication between the PC and PS3. The PS3 TOOL has its own version of dtnetm that runs on the TOOL's CP. Since the PS3 TEST lacks a CP, it's necessary to run dtnetm on a PC to 'emulate' this aspect.
*** Setup
To start, install the ***, and get it up and running. Sony provides a nice guide on how to do this in the “Reference_System-Setup_e.pdf”. Of note, make sure to set the environmental variable DTNETM, to 127.0.0.1 (DTNETM=127.0.0.1) - this is explained in more detail further down. If you are using a PS3 Test, do NOT use the IP of your PS3 TEST. However, if you happen to have a PS3 TOOL, then use it's IP.
So, you should have the *** installed, and the environmental variable DTNETM set to 127.0.0.1. Once this is done, turn on your PS3 (in debugger mode) fire up the dtnetm app, and point it to the IP of your PS3, like so:
dtnetm -d IP_OF_YOUR_PS3
Keep that window open, in another window, go to your working directory (you may want to make a folder called work), and run bedbg -prepare.
Another window (dtccons) should also pop up. If not, ensure DTNETM is exported properly
Dtccons is basically the way you will be communicating with the PS3, it's output gets sent to the screen, and your input in that window goes to the PS3.
Dumping the PS3 Game
The easiest way to dump the game is to use a provided file, called cellftp.self. Although it has ftp in its name, it is not a ftp program - it works more like a simple shell through the debugger output, and allows simple put/get of files to and from the PS3.
Copy the file to your work directory (from earlier), and run: bedbg -nodebug cellftp.self
You should get a message in dtccons. If not, hit enter a few times, COMMAND> should pop up.
Issuing the “help” command will give you some usage examples, however for our purposes, stick in a BD-ROM, and type:
cd ../dev_bdvd/
This will change the directory to that of the BD-ROM.
Now, we want to get the PS3_GAME folder. You can do it simply by typing: put PS3_GAME
This will copy the entire PS3_GAME folder to your HDD in the directory in which you ran "bedbg -prepare" from. I'd make sure to have enough free space on your PC's HDD to let this happen. Of course depending on the game you may need anywhere from 4-50GB, and it could take some time.
Once it is done, it will return you to the COMMAND> prompt – from here you can simply type exit, and it will say goodbye.
Decrypting Executables
Games made prior to firmware 2.10, you could simply run the executables, dump them out of memory, and rebuild – it worked most of the time, was a bit of the pain, but it worked. Of course, since then Sony closed that hole – so now its a bit more challenging. Luckily, Sony provides patches for most games, online, through one of a handful of environments.
There are different NP (PlayStation Network) Environment:
np – PlayStation Network (ie, retail)
sp-int – Sony PlayStation Initial Environment
prod-qa – Production Quality Assurance Environment
There are also a few others (ei-np, q-spint, q-pqa, q-pmgt, pmgt, r-spint, ei-pmgt, r-pqa, r-pmgt, r-np, q2-spint, q2-pqa, q2-pmgt, mgmt, h-pmgt, q2-np, rc, etc), however those are all internal networks – and can not be accessed without a PS3 TEST/TOOL in internal mode.
IE for PlayStation Plus: http://nsx.mgmt.grs.dl.playstation.net/grs/common/yT5zMQW3b2mCbQ7w/c/NSXWSV/NSXWSV-PN.P3.GAME.FR-BILLBOARD0000001.xml
For the sake of this guide, we are focusing on the accessible ones above. Of course, any package on the “np” (the retail) environment is encrypted with the retail package keys – short of an internal box, any TEST/TOOL over 1.60 will not be able to decrypt these. You could get the packages, downgrade, install, and upgrade again if needed, but it is of course, a pain to do.
There are however the sp-int and prod-qa environments which tend to have (for a short time) packages that a debug unit can decrypt. The biggest problem, is that they tend to only be available for a short time.
So the trick becomes: Do you get a nice debug patch quickly which you can then decrypt, and re-use the SELF(s) to burn to disc, or boot from HDD. Or do you get a retail package, downgrade, become limited to where you can run it from – best bet is to find the debug package!
Getting a Debug Package
Update: Those who know their PS3 Game's Title ID and are seeking PS3 Game Update Packages can now use this simple guide to grab them while they last... since several clone pages and apps are already available it's likely Sony will kill the fun soon though.
PlayStation Updaters (XML Files) and Resources
You're asking “How do I find a debug package?”.
Boot up your PS3 to the XMB, make sure in debug settings that NP environment is set to “sp-int” or “prod-qa”, sign into PSN (with sp-int or prod-qa credentials, you can use the quick sign-up), and launch the game. If your in luck, it will say an update is available – download it!
To get the URL you have a few options. You could either sniff out the connection with something like Wireshark - that takes a bit more setup. Other times the URL is actually passed right to dtccons - so make sure you have the debugging windows open. Or, you could use any number of the PS3 Proxy applications to grab the link.
Package Extracting
Assuming you were lucky enough to get the link – now, using the tool “make_package_npdrm” from the ***, you can extract the debug package:
make_package_npdrm -x PACKAGE-NAME.PKG
This will create a folder with the TITLE ID, which should, hopefully contain development versions of all of the executable files on disc. Alas, if not you are out of luck (for now), as you need to replace ALL encrypted executables with their non-encrypted development equivalents. Lets assume, that your game only needed one, EBOOT.BIN.
Copy out the eboot.bin, and run “unfself” on it: unfself EBOOT.BIN MyDecryptedGameName.elf
You will then have a nice, decrypted, ELF – now lets re-fake self it: make_fself MyDecryptedGameName.elf NewEBOOT.BIN
Of course, you can't just copy the original EBOOT over, as it is in NPDRM format (which run's from HDD), vs. running from wherever you want (PC, HDD, BD).
Now, to run it from a BD, you can simply remaster it with the BD Generator tool in the ***, its fairly self explanatory - however if you want to save a disc, you can actually run it from your PC!
That PS3_GAME folder in your work directory can be served right up to the PS3 – you just need to (depending on the game) tweak the executable a bit. Basically, open up the “MyDecryptedGameName.elf” in a hex editor, look around for “dev_bdvd” entries, and replace them with “app_home”, then run make_fself on the ELF like stated above, and replace the Main EBOOT.BIN with your newly created one. Most games, and your set!
To get the game running from here, simply boot the system to the XMB, scroll down to “app_home/ps3_game” in the Game section, and hit X!
Final Thoughts
Of course, its not always that easy – assuming you only could find a retail package, you can still get the game running, but its a more involved process. You need to of course be able to install the package first. That means, either an old (60gb) TEST, an old TOOL, or a box in internal mode - it narrows the playing field.
Then, you can remaster the game to a disc pretty much the same way, but the system will run the executables that were installed from the patch PKG (automatically) from the HDD, vs the BD drive since it sees the data as a 'patch'. This way is a bit sloppy however, and its advised to find a real, development package – help the community and share the link for the debug package!
From Pastebin.com: http://ps4-system.sec.np.dl.playstation.net/ps4-system/timezone/np/
Only thing related I found that isn't over TLS, it's in shellcore.
PS3 Test / Tool FAQ
So, you have gotten your hands on a PS3 TEST - congratulations are in order!
Now, your unit may be know as a PS3 TEST, a PS3 DEV, a PS3 DEBUG, a PS3 DEBUGGER, its all the same unit. I may intermix on the names, but they are all the same unit!
1. What can my TEST do?
Simply put, your PS3 TEST can do just about everything your Retail PS3 can, with a few exceptions:
The TEST can:
- Run debug code from HDD, BD/DVD, PC
- Run retail code from HDD, BD
- Playback any Blu-Ray Movies from Blu-Ray Disc
- Playback any DVD Movies from DVD
- Download Retail game patches
- Run Retail firmware
- Play Copied Games [see #4]
First off, you need to know what you are doing, and you are going to need the *** - which will not be provided here, you can get it at http://www.scedev.net/ps3/
Upon grabbing that, and getting it set up properly, you should then upgrade your PS3 TEST to at least firmware version 2.00, as starting firmware 2.00 there is a Debugger Mode, which makes running code very easy.
Basically, in this debugger mode, you can execute and debug code from a PC, right to the PS3 with ease.
3. How do I dump the Hypervisor/Kernel?
You can not, at least not yet!
4. How do I play copied games?
Short answer is - you can not. Long answer is, you can (see the PS3 TEST / TOOL Debug Game Backup Guide below). Basically, somehow you need to obtain a debug signed executable(s), and use the original game disk to decrypt all of the content, then remaster it. Simply put, it is not worth it- if you have the original game, just use it. If you got a PS3 TEST for this reason, sell it here.
5. How do I use the BD Emulator?
First off, you need to have at least firmware version 2.00, furthermore you need to have the proper tools, namely the BD Image Generator to properly master the game. See below this FAQ for additional details.
6. What are all of these debug options, and what do they do?
Many of them are self explanatory, but in the near future, I will write something up in regards to these.
7. What are the benefits/losses of each firmware upgrade?
There are a few big mentions, 1.60? added support for Music/Pictures/Video support on the TEST, 2.00 added debugger mode, BD emu, and others. More details will come soon.
8. My game requires a patch - how can I play online?
You can try changing the NP environment under the debug settings from np to sp-int. NP is the Playstation Network (retail) , while sp-int is a developer one.
So, by changing it to sp-int, it will check the developer network for an update - hopefully you can find one, they tend to disappear quite quickly.
You can not use the "np" (retail psn) network as TEST's after 1.60 can not decrypt retail packages, so you would get an error on the PKG attempting to install!
9. How many different models of PS3 TEST's are there?
There are quite a few different models, not including prototypes. However the main models are the:
Legend:
A- America
J- Japan
S- Show (No Test Markings)
E- Unknown
DEH - Prototype
DECR - Final Unit
DEH-10000(AS-E) - Prototype PS3 TEST units. Feature a very translucent case (see-thru), no TEST markings at all. Some units feature PROTOTYPE stickers, while others do not (they were on the packing box, instead)
DECHA00(A/J)(S) - Just like a 60GB retail unit, Hardware B/C
DECHJ00(A/J)(S) - Like a 40GB retail unit, Only supported in SW ver 2.17 and later* Perhaps 2.30 and later, according to one of our DEVS
DECH-2000(A/J)(S) - Slim line debugger, features a 120GB HDD, HW like the current slim units
Other "off label" units do exist, they tend to be DEBUG firmware installed on the first run of retail systems for in house TESTING, so they may lack the proper stickers, however usually do have the proper TEST markings.
There are also a few other models, such as the AV Testing Tool, however the only major difference from above, is a firmware update, vs a console change. It allows mastered BD-ROM code to be run from BD-R, to facilitate the testing for BD movies / interactives, as well as to enable/disable HDCP, and to change the BD-ROM region.
9. What about other development kits?
There are many other development kits, which will be documented below.
CEB-10XX - The first PS3 development units, they were about the size of a end table, dual PSU's, have an Ethernet connector for debugging - but not via Ethernet, via a proprietary cabling (don't use an ethernet card to it!)
CEB-20XX - Smaller, but still bulky, about 4U in height, there were multiple revisions in this area, the main difference was the Graphics Adapter, CPU Speed and amount of Memory.
DEH-R1000/R1010/R1020 - Do not have too much information on these units, but they are just like the R1030's, but lack the prototype BD-ROM drive. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out.
DEH-R1030 - The Latest units with a prototype BD-ROM drive (half height, tray loaded) drives. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out.
DEH-R1040 - The first units with a slot loaded drive. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out, as well as analog outputs. As you can tell, it is pretty much a final unit, to the point that, they look identical from the outside. See the picture for the DECR-1000 Below!
DECR-1000 - Final development kit. About 2U in height, rackmountable. Features 6 USB ports, two of the ports are marked for the "rear" , to simulate the missing rear USB ports on the retail PS3. Like all of the other TOOL Prototypes (DEH) feature 2X HDMI ports, 3X LAN ports (+1 DEV LAN), AV multi out + VGA out. However, 2nd HDMI port, and 2 of the lan ports are covered. But, features analog audio outputs! Also has 512MB of system memory.
And, of course, the REAR of the DEH/DECR units (generally the same, sans 1-2 listed changes)
DECR-1400A - Newest kit, is the same case as a TEST PS3, has 512MB system ram vs the TEST's 256MB.
And, the Rear (has 2X LAN connectors, one for the PS3, one for DEV)
If you perhaps happen to have one of the above kits, or one that is not listed please mail me.
PS3 TEST / TOOL Debug Game Backup GuideWe get a lot of questions in the forums, asking how to run a backup of an original game on a DECH unit – and it is a complicated process. However, I finally decided to stop being lazy and write a nice guide for people to follow.
For starters, what you will need to get this done:
- A PS3 Development Station (ie, a PS3 Test / PS3 Tool)
- The PS3 *** (Ideally, something around 1.6-2.0ish, although others will work)
- Original Game Disc
- Time
The leaked 1.60 is missing a key file for TEST user's, “dtnetm”. Namely, as of 1.60, TEST "debugging" was not supported - this feature was not fully added in until around 2.00. dtnetm basically runs on a PC, and facilitates communication between the PC and PS3. The PS3 TOOL has its own version of dtnetm that runs on the TOOL's CP. Since the PS3 TEST lacks a CP, it's necessary to run dtnetm on a PC to 'emulate' this aspect.
*** Setup
To start, install the ***, and get it up and running. Sony provides a nice guide on how to do this in the “Reference_System-Setup_e.pdf”. Of note, make sure to set the environmental variable DTNETM, to 127.0.0.1 (DTNETM=127.0.0.1) - this is explained in more detail further down. If you are using a PS3 Test, do NOT use the IP of your PS3 TEST. However, if you happen to have a PS3 TOOL, then use it's IP.
So, you should have the *** installed, and the environmental variable DTNETM set to 127.0.0.1. Once this is done, turn on your PS3 (in debugger mode) fire up the dtnetm app, and point it to the IP of your PS3, like so:
dtnetm -d IP_OF_YOUR_PS3
Keep that window open, in another window, go to your working directory (you may want to make a folder called work), and run bedbg -prepare.
Another window (dtccons) should also pop up. If not, ensure DTNETM is exported properly
Dtccons is basically the way you will be communicating with the PS3, it's output gets sent to the screen, and your input in that window goes to the PS3.
Dumping the PS3 Game
The easiest way to dump the game is to use a provided file, called cellftp.self. Although it has ftp in its name, it is not a ftp program - it works more like a simple shell through the debugger output, and allows simple put/get of files to and from the PS3.
Copy the file to your work directory (from earlier), and run: bedbg -nodebug cellftp.self
You should get a message in dtccons. If not, hit enter a few times, COMMAND> should pop up.
Issuing the “help” command will give you some usage examples, however for our purposes, stick in a BD-ROM, and type:
cd ../dev_bdvd/
This will change the directory to that of the BD-ROM.
Now, we want to get the PS3_GAME folder. You can do it simply by typing: put PS3_GAME
This will copy the entire PS3_GAME folder to your HDD in the directory in which you ran "bedbg -prepare" from. I'd make sure to have enough free space on your PC's HDD to let this happen. Of course depending on the game you may need anywhere from 4-50GB, and it could take some time.
Once it is done, it will return you to the COMMAND> prompt – from here you can simply type exit, and it will say goodbye.
Decrypting Executables
Games made prior to firmware 2.10, you could simply run the executables, dump them out of memory, and rebuild – it worked most of the time, was a bit of the pain, but it worked. Of course, since then Sony closed that hole – so now its a bit more challenging. Luckily, Sony provides patches for most games, online, through one of a handful of environments.
There are different NP (PlayStation Network) Environment:
np – PlayStation Network (ie, retail)
sp-int – Sony PlayStation Initial Environment
prod-qa – Production Quality Assurance Environment
There are also a few others (ei-np, q-spint, q-pqa, q-pmgt, pmgt, r-spint, ei-pmgt, r-pqa, r-pmgt, r-np, q2-spint, q2-pqa, q2-pmgt, mgmt, h-pmgt, q2-np, rc, etc), however those are all internal networks – and can not be accessed without a PS3 TEST/TOOL in internal mode.
IE for PlayStation Plus: http://nsx.mgmt.grs.dl.playstation.net/grs/common/yT5zMQW3b2mCbQ7w/c/NSXWSV/NSXWSV-PN.P3.GAME.FR-BILLBOARD0000001.xml
For the sake of this guide, we are focusing on the accessible ones above. Of course, any package on the “np” (the retail) environment is encrypted with the retail package keys – short of an internal box, any TEST/TOOL over 1.60 will not be able to decrypt these. You could get the packages, downgrade, install, and upgrade again if needed, but it is of course, a pain to do.
There are however the sp-int and prod-qa environments which tend to have (for a short time) packages that a debug unit can decrypt. The biggest problem, is that they tend to only be available for a short time.
So the trick becomes: Do you get a nice debug patch quickly which you can then decrypt, and re-use the SELF(s) to burn to disc, or boot from HDD. Or do you get a retail package, downgrade, become limited to where you can run it from – best bet is to find the debug package!
Getting a Debug Package
Update: Those who know their PS3 Game's Title ID and are seeking PS3 Game Update Packages can now use this simple guide to grab them while they last... since several clone pages and apps are already available it's likely Sony will kill the fun soon though.
PlayStation Updaters (XML Files) and Resources
You're asking “How do I find a debug package?”.
Boot up your PS3 to the XMB, make sure in debug settings that NP environment is set to “sp-int” or “prod-qa”, sign into PSN (with sp-int or prod-qa credentials, you can use the quick sign-up), and launch the game. If your in luck, it will say an update is available – download it!
To get the URL you have a few options. You could either sniff out the connection with something like Wireshark - that takes a bit more setup. Other times the URL is actually passed right to dtccons - so make sure you have the debugging windows open. Or, you could use any number of the PS3 Proxy applications to grab the link.
Package Extracting
Assuming you were lucky enough to get the link – now, using the tool “make_package_npdrm” from the ***, you can extract the debug package:
make_package_npdrm -x PACKAGE-NAME.PKG
This will create a folder with the TITLE ID, which should, hopefully contain development versions of all of the executable files on disc. Alas, if not you are out of luck (for now), as you need to replace ALL encrypted executables with their non-encrypted development equivalents. Lets assume, that your game only needed one, EBOOT.BIN.
Copy out the eboot.bin, and run “unfself” on it: unfself EBOOT.BIN MyDecryptedGameName.elf
You will then have a nice, decrypted, ELF – now lets re-fake self it: make_fself MyDecryptedGameName.elf NewEBOOT.BIN
Of course, you can't just copy the original EBOOT over, as it is in NPDRM format (which run's from HDD), vs. running from wherever you want (PC, HDD, BD).
Now, to run it from a BD, you can simply remaster it with the BD Generator tool in the ***, its fairly self explanatory - however if you want to save a disc, you can actually run it from your PC!
That PS3_GAME folder in your work directory can be served right up to the PS3 – you just need to (depending on the game) tweak the executable a bit. Basically, open up the “MyDecryptedGameName.elf” in a hex editor, look around for “dev_bdvd” entries, and replace them with “app_home”, then run make_fself on the ELF like stated above, and replace the Main EBOOT.BIN with your newly created one. Most games, and your set!
To get the game running from here, simply boot the system to the XMB, scroll down to “app_home/ps3_game” in the Game section, and hit X!
Final Thoughts
Of course, its not always that easy – assuming you only could find a retail package, you can still get the game running, but its a more involved process. You need to of course be able to install the package first. That means, either an old (60gb) TEST, an old TOOL, or a box in internal mode - it narrows the playing field.
Then, you can remaster the game to a disc pretty much the same way, but the system will run the executables that were installed from the patch PKG (automatically) from the HDD, vs the BD drive since it sees the data as a 'patch'. This way is a bit sloppy however, and its advised to find a real, development package – help the community and share the link for the debug package!
From Pastebin.com: http://ps4-system.sec.np.dl.playstation.net/ps4-system/timezone/np/
Only thing related I found that isn't over TLS, it's in shellcore.
