PS3 Hacking the Singstar DLC encryption for backup/custom songs?

[dittnamn]

As the Singstar servers now are shut down, I started looking into copying my downloaded songs to a different console in case the old one breaks. I managed to copy everything, and got it working on a second console after spoofing the PSID to the one of the old console, and modifying the xRegistry.sys to get the same user ID (0000000X) as on the old console. I also copied a few more files, so I'm a bit unsure if there's something more that's needed to make it work. The savefile doesn't seem to be needed.

Now, I also would like to copy the DLC from my other console so that I have them all on one console, but there seems to be some sort of DRM/encryption on the songs. I will do some more experimenting, but I'd be happy for some pointers in the right direction. If we can get this working, it should also make it possible to add custom songs to the game.

All the encrypted DLC files are located inside /dev_hdd0/game/BCES00011SINGSTARFAMILY/DownloadSong/ as .pkg.drm files and there's also extracted files from the songs (preview, cover, etc.) inside /dev_hdd0/game/BCES00011SINGSTARFAMILY/SongCache/. These files are not encrypted, but doesn't contain the full songs.

The PSID is obviously part of the key to the encryption, and probably also the user ID. Does anyone have any clue on how the encryption is made?

 

[kcuff0dog]

Sweet baby Jesus, someone please help OP [I don't have the knowledge to do it myself ]

 

[Berion]

@dittnamn Why do You think that "obviously PSID is part of encryption"? What experiment You have made proofs that?

Maybe those *.pkg.drm are just ordinary *.edat or *.mself files? Have You tried unpack/decrypt them?

 

[harry gtking]

is there a thing i can download to give me custom songs easily on beat saber on psvr?

 

[PhoenixARC]

@dittnamn Why do You think that "obviously PSID is part of encryption"? What experiment You have made proofs that?

Maybe those *.pkg.drm are just ordinary *.edat or *.mself files? Have You tried unpack/decrypt them?

also good to note that checking headers in a hex editor is a good idea too, gives a good starting point.

 

[GDMorry]

As the Singstar servers now are shut down, I started looking into copying my downloaded songs to a different console in case the old one breaks. I managed to copy everything, and got it working on a second console after spoofing the PSID to the one of the old console, and modifying the xRegistry.sys to get the same user ID (0000000X) as on the old console. I also copied a few more files, so I'm a bit unsure if there's something more that's needed to make it work. The savefile doesn't seem to be needed.

Now, I also would like to copy the DLC from my other console so that I have them all on one console, but there seems to be some sort of DRM/encryption on the songs. I will do some more experimenting, but I'd be happy for some pointers in the right direction. If we can get this working, it should also make it possible to add custom songs to the game.

All the encrypted DLC files are located inside /dev_hdd0/game/BCES00011SINGSTARFAMILY/DownloadSong/ as .pkg.drm files and there's also extracted files from the songs (preview, cover, etc.) inside /dev_hdd0/game/BCES00011SINGSTARFAMILY/SongCache/. These files are not encrypted, but doesn't contain the full songs.

The PSID is obviously part of the key to the encryption, and probably also the user ID. Does anyone have any clue on how the encryption is made?

This is exactly what I'm looking for.
PS3 SingStar servers are down and I paid for 192 SingStar Tracks!

My PS3 is behaving in quite a dodgy manner and I'd like to transfer everything onto a better unit.

By the sounds of your post you suceeded with one PS3 and were trying with a second? for give me if I got that part wrong...
I'd love some more information on how I can get all my SingStar downloaded content of the dodgy unit onto my more trusted unit :P

 

[GDMorry]

I managed to copy everything, and got it working on a second console after spoofing the PSID to the one of the old console, and modifying the xRegistry.sys to get the same user ID (0000000X) as on the old console.

I have done the same and have all the content .pkg.drm etc. I have same console ID/IDPS and PSID. I have the same "/setting/user/00000001/account/utf8name" and "/setting/user/00000001/npaccount/accountid" EXCEPT the "/setting/user/00000001" is now "/setting/user/00000009"

I can run SingStar and ALL 192 downloaded track play their previews etc. but when I go to play one of these tracks I get the error:

"This song cannot be played because its owner has been deleted. To play the song, first delete it via Delete Songs in Settings, and then download it again from the SingStar™."

modifying the xRegistry.sys to get the same user ID (0000000X) as on the old console.

How can you modifying the xRegistry.sys to get the same user ID?

How do I change my user/number to 01? is this the cause??

 

[sandungas]

The easyest way to return to user 00000001 is to format the hdd in PC
After that, when you create a new user in the PS3 is going to be given number 00000001

You are lucky that you had your content tied to user 00000001 btw, because thats the most simple and straightforward identifyer
I mean.. you are the owner of the console, right ?... so you should be user 1

 

[GDMorry]

I went a slightly different route ..... After creating a new user and deleting the User with the same ID/Name I needed I deleted all of the \dev_flash2\ files and copied the backup files from the donor PS3 (Risky I know)
This contained the original PS3's xRegistry.sys and it's backup etc. Upon reboot I had the user name and ID I needed and it was the correct "/setting/user/00000001/account/utf8name" etc.

NOW I got further than ever, even detected no mic etc. Plugged in mic and started -=- got to the "Get Ready" ... Then Back to menu

Not quite there yet ... something I have done may have locked me out .. or it's just the DRM protection ??

 

[sandungas]

I went a slightly different route ..... After creating a new user and deleting the User with the same ID/Name I needed I deleted all of the \dev_flash2\ files and copied the backup files from the donor PS3 (Risky I know)
This contained the original PS3's xRegistry.sys and it's backup etc. Upon reboot I had the user name and ID I needed and it was the correct "/setting/user/00000001/account/utf8name" etc.

NOW I got further than ever, even detected no mic etc. Plugged in mic and started -=- got to the "Get Ready" ... Then Back to menu

Not quite there yet ... something I have done may have locked me out .. or it's just the DRM protection ??

There is an option inside the recovery menu to reset all the settings that appears in [XMB]->[Settings] category to default values

By doing that you are going to lose all the settings that appears in that XMB column, but only takes a couple of mionutes to reconfigure them
All that settings are stored in xregistry.sys so is some kind of "cleanup" of it
My hope is this is going to delete also the settings and info stored from peripherals (your mic)

Im guessing is not detecting the mic well because you have "transplanted" the xregistry.sys from other console, maybe it had another mic configured in it (or the same mic but in a different way) and is not loading that setting right

 

[GDMorry]

There is an option inside the recovery menu to reset all the settings that appears in [XMB]->[Settings] category to default values

Hey thanks.
I've already done that and no joy. I can run the games and tracks fine of the discs etc. just not my store downloaded content.

 

[sandungas]

Ohh ok, i thought you was having a problem with the mic now

 

[GDMorry]

Ohh ok, i thought you was having a problem with the mic now

Haha yeah I re-read it and that's what it sounded like sorry.

Anyway -=- GOOD NEWS I DONE IT

I've got it all working. Long story short, I somehow lost the Console ID/IDPS & PSID, they reverted back to the consoles original - it must have been when I uninstalled the WebMan pkg??

Here's what I did

1. CFW (CFW 4.87.2 Evilnat Cobra [CEX]) on my Dodgy PS3 so I could ftp into it and get all the "dev_hdd0" files!

Especially the "dev_hdd0\game\BCES00011SINGSTARFAMILY" folder!
Only one file (/dev_hdd0/game/BCES00011SINGSTARFAMILY/USRDIR/DownloadSong/Pack0_100HR5.pkg.drm) refused to copy over and it seemed to have some sort of cyclic redundancy protection (it wouldn't ftp or copy to usb drive.... or even WebMan download? it kept restarting to the point of a 65Mb file being 1.5Gb?)

2. CFW on donor PS3 and a larger HDD installed.
3. WebMan (webMAN_MOD_1.47.33_Installer.pkg.706.v1.47.33_brewology_com.pkg) installed and used on both PS3's to copy and change IDPS & PSIDs.
4. FTP'd all of /dev_hdd0 onto Donor PS3
5. Created new User account and Deleted my original account (Donor PS3 made it user/00000009)
6. Deleted ALL files in donor PS3 "\dev_flash2" then FTP'd ALL original PS3's "\dev_flash2\" files over! I wanted to use the xRegistry.sys and it worked and changed my User ID and user/00000001 etc.
7. Rechecked and changed the Console ID/DPS & PSID's again to the original PS3's​

Hope this helps anyone else that feels ripped off with the SingStar store being taken down etc.
It is the one thing that made me go down this route I paid for 192 downloaded tracks and was at risk of losing them all if this dodgy PS3 dies.
I have cloned the original drive but that no use with a YLOD and it wouldn't work in any other console!

I now have a decent back up and a way of keeping my downloaded content alive! .... with the bonus of a backwards compatible PS3 and plenty of room to put my entire collection onto my PS3

 

[mattwookie]

GDMorry this is the best news I have had in the past 6 months. Last year my house was struck by lightning and I lost my ps3 slim that had about 200 singstar downloads on it. Luckily my old ps3 fat still had 130 songs on it but I need to move these to a more reliable console. I really can't thank you enough for the outline above and congratulations on the successful transfer. I hope to follow your success soon. Please continue to follow this topic as I am surely going to have some questions.

 

[GDMorry]

Please continue to follow this topic as I am surely going to have some questions.

More than happy to assist in anyway I can.

I was lucky enough to have made a sector by sector clone of my PS3s HDD = I have a stand alone disk cloner (Just in case)
Then I managed to FTP into dodgy PS3 and get a copy of all but one of the files onto my PC.

My "dodgy" PS3 is a CECH2502A & The Donor PS3 is a CECHC02 (Fat older PS3)

I found this company who appear to be able to rescue just about any PS3 if your slim is completely dead they might be able to help? ps3specialist dot com

Also a couple of youtube dot com links

CFW (CFW 4.87.2 Evilnat Cobra [CEX]) with download links watch?v=OrVSyRG6INI
WebMAN watch?v=A0MLCPssa-E or watch?v=0CLBQRZc3gY
FTP to PS3 watch?v=bFLa9fw1DpY

 

[pinky]

it reminds me a bit of the trials custom tracks on the 360. those are all read as normal dlc though, and I have hundreds, if not thousands, of them on my system. I wish I could help here though, but I haven't looked at the game.

 

[mattwookie]

More than happy to assist in anyway I can.

I was lucky enough to have made a sector by sector clone of my PS3s HDD = I have a stand alone disk cloner (Just in case)
Then I managed to FTP into dodgy PS3 and get a copy of all but one of the files onto my PC.

My "dodgy" PS3 is a CECH2502A & The Donor PS3 is a CECHC02 (Fat older PS3)

I found this company who appear to be able to rescue just about any PS3 if your slim is completely dead they might be able to help? ps3specialist dot com

Also a couple of youtube dot com links

CFW (CFW 4.87.2 Evilnat Cobra [CEX]) with download links watch?v=OrVSyRG6INI
WebMAN watch?v=A0MLCPssa-E or watch?v=0CLBQRZc3gY
FTP to PS3 watch?v=bFLa9fw1DpY

Ps3 specialist is the best, he saved my PS3 fat twice in the past 10 years and is the only reason I still have 130 Singstar downloads. During my panic with the lightning strike I totally forgot about Ps3 specialist and shipped my console to Sony for repair but Sony does not repair they just replace. I just was not thinking straight as I lost about $10k of electronics so it is my fault. Thank you for the video links . I will try my best to complete this project tonight.

 

[Berion]

How can you modifying the xRegistry.sys to get the same user ID?

What is "user ID"? "User number" and "NP Account ID" can be changed in xRegistry.sys. Every user has it's own category listing.

copied the backup files from the donor PS3 (Risky I know)

It is not risky at all.

refused to copy over

Attach HDD to PC and copy it via Linux (You need EID Root Key of course to deal with encryption).

You can even copy to FAT32 or NTFS with illegal symbols (but change this before You switch to Windows ).

- - -
After such transplantation, You should delete cache about someone else mentioned before. Maybe that's the problem. But anyway, based on information in this thread, it looks like songs are in EDAT (tied to user and console) so they need to be resigned or else will never works.

 

[mattwookie]

I got it to work just as GDMorry described without needing to copy over \dev_flash2.

Here's what I did -

1. Installed CFW (CFW 4.87.2 Evilnat Cobra [CEX]) on my PS3 Fat that had the Singstar Song Files and then added CFW to the PS3 Slim that would receive the Singstar Song Files.
2. Installed Multiman (mmCM) on PS3 Fat and opened program to verify FTP was activated.
3. Installed Filezilla on my computer to copy "dev_hdd0\game\BCES00011SINGSTARFAMILY" from PS3 Fat to my computer.
4. Installed Multiman (mmCM) on PS3 Slim and opened program to verify FTP was activated.
5. Using Filezilla I then copied the "BCES00011SINGSTARFAMILY" directory from the computer using Filezilla FTP to the "dev_hdd0\game\" folder on the PS3 Slim.
6. I exited Multiman, rebooted PS3, started Singstar and verified that the song previews loaded. At this point if you try to start a song it will simply crash and return you to song selection menu.
7. I installed PSN Patch on both PS3 Fat and PS3 Slim to obtain the IDPS and PSID of each machine. Be sure to take a picture as you will need this information on the next step.
8. I installed WebMan MOD (webMAN_MOD_1.47.33_Installer.pkg.706.v1.47.33_brewology_com.pkg) on the PS3 Slim and loaded the full version by pressing "X" and then holding L1 until it reboots the PS3 (This set my PS3 fan into hyper overdrive immediately and I thought my system was going to melt down).
9. I then opened the "webMAN Games" folder on the XMB (in the Game tab) and selected webMAN Setup. At this point it is best to open your web browser on a computer or other device on your network and enter the IP address of your PS3 in the address line. This will download the webMan menu screen from your PS3.
10. I then clicked on the "Setup" tab and then deselected the "Enable dynamic fan control" and it defaulted back to "SYSCON" and the fan settled down to normal behavior.
11. Next look further down the same screen for "IDPS & MEM Setup". Here is where I typed in the IDPS and PSID of the PS3 Fat. Be sure the check marks on the left side are checked for each entry and then select save at the bottom and the PS3 should restart. This will spoof the PS3 Fat on the PS3 Slim.
12. I loaded the Singstar game and now all songs worked perfectly.

I want to thank dittnamn, GDMorry, sandungas, and Berion for helping making this problem go away. Now to figure out how to add song files from the 20+ PS2 and PS3 Singstar disks to the digital Singstar app and make this more like a Jukebox of songs.

 

[Berion]

Could You try decrypt those packages as *.edat? Maybe it is nothing extraordinary and all can be make easily "IDPS free".