What's new

Tutorial How to Mod Borderlands 3 PS4 saves

P

ProtoBuffers

Taking a break for unknown amount of time...
Premium
Messages
1,083
Reaction score
523

Requirements:
1. PC
2. "Jailbroken" PS4 5.05/6.72
3. FTP (I use filezilla and windows file explorer)
4. Save Mounter - https://www.psxhax.com/threads/playstation-4-save-mounter-homebrew-utility-by-chendochap.6076/
Steps:
1. Start bin loader on exploited PS4 and start save mounter.
2. Start FTP on exploited PS4 and connect.
3. Go to mnt/pfs/ on your FTP
4. Mount your Borderlands 3 save or create a new one (requires one to start).
5. Grab mounted save (will just be a number) and place it on your PC.
6. Open http://bl3editor.com/#/ and edit your file (remember to save your character!
7. Click on the download button and you will get a file named _edited.sav
8. Rename _edited.sav to the original # or a new # (read additional info [remember to change param.sfo if you change the #)
9. Replace your save in mounted PS4 with the edited one.
Additional info:
Modding Profiles - In order for the profile to load into the save editor save will have to be named profile.sav; after editing rename back to profile and place on your mounted profile save.
Changing UUID - the param.sfo (starts at 15C) endian is always flipped so use this website if you do not know how to flip endian https://jmacwhyte.github.io/hexflip/
Swapping slots - the param.sfo (starts at 9F8) contains the character slot information; the character slot and param must be identical! Save has to be created via save mounter if you want to have a slot past 50 (I suggest the file size of 11MB)

CaN I MoD oN oFw (official firmware [past 6.72])?:
TLDR: NO!

PS4 saves have multiple encryptions first is the masterkey (skippable via mounting the save to a PS4s CPU [method I use {MASTERKEYS ARE NOT PUBLIC AND NO YOU CAN NOT HAVE THEM}]) and the pfsskeys which are 18 keys split into 2 different encryptions both having 2 different types of encryption as well. Masterkey can only be used after pfsskeys have been removed and it has to dump the save chunk to sce_sys and the save file itself. Sce_sys contains the param, IMG, imgloader, and keystone.

Very long process and most games also have their own encryption after which is usually located in the games eboot unless the game has a boot loader (like bl:thc) which uses .elf files which are usually also encrypted.


BuT tHeRe Is FrEe SaVe DeCrYpTiOn ToOlS:
To remove your pfsskey not the master keys...


Please feel free to message me if you have any questions!​
 
Last edited:
P

ProtoBuffers

Taking a break for unknown amount of time...
Premium
Messages
1,083
Reaction score
523
Decrypted saves past 1.00 can now be loaded into the editor!
 
Top Bottom