Playstation 3 Executable Corruptions
by Foifur
Last updated
by Foifur
Last updated
This guide explains the process of corrupting PS3 executables using FileStub and RPCS3, the PS3 emulator. The PS3 used two different types of cores, with one main processor called the Power Processing Element (PPE) and eight co-processors called Synergistic Processing Element (SPE). These used different instruction sets, with the PPE using PowerPC (PPC), and the SPE using a unique instruction set simply called SPU ISA.
As corrupting PS3 games is a bit more laborious, this guide expects the user to already have an understanding of how to corrupt other game engines (especially GC/Wii games in Dolphin, as these use the same instruction lists).
With RPCS3, the PPC instructions are unfortunately precompiled with Ahead-of-Time (AOT) instead of Just-in-Time (JIT). What this means is that the instructions are not available to RPCS3-Vanguard for corruption (unlike the SPU ISA, which can be targeted by loading the SPE memory domains). The workaround to this is corrupting the PPC instructions before compilation using FileStub, and then running the game. The benefit to this is being able to use a newer version of RPCS3, which has added new features/better optimization over the years.
This guide assumes that you have already dumped your game and installed it into RPCS3.
An important first step if you are corrupting a disc based game: navigate to the folder the game is installed in (RPCS3/games/$game_name) and rename $game_name to the product code of that game (this can been seen under the Serial label in the Game List). This is required if you are using the helper .bat file described later in this guide.
Navigate to Utilities > Decrypt PS3 Binaries, then navigate to the folder that contains EBOOT.BIN (RPCS3/dev_hdd0/game/$product_code/USRDIR for HDD based games, and RPCS3/games/$product_code/PS3_GAME/USRDIR for disc based games). The folder containing the EBOOT.BIN will create a new file called EBOOT.elf.
One thing to note is that if there is a .self file in the folder (as seen above), you’ll want to either remove it from the folder or change it’s filetype so it is not .self. Without doing this, the cache will not generate correctly.
After this, you can navigate to File > Boot (S)Elf > Boot SELF/ELF and select the EBOOT.elf to start the game. Let this finish compiling the modules, then close out of the game and RPCS3.
The final step is to create a helper batch script that will automate the process of changing the compiled folder to the correct name. Whenever you apply a corruption, the cache folder’s name will change. The following code block is an example of a .bat file placed in the USRDIR folder, where the EBOOT.elf file is.
Once you’ve done all this, you’re ready to start corrupting the game!
Depending on the type of list you use, RPCS3 may still have to recompile some modules. From current tests, it appears that anything from the classic vector lists (Extended, One, Two, etc.) will not require recompilation, while lists that change instructions (such as math instructions/branches) will require it, with the intensity increasing the number of modules affected. As this causes new files to be generated, the folder can start to grow quite quickly. It’s recommended to keep a backup of the originally cached folder so that you can easily return to a smaller folder size after corrupting for a while.
Now that our workflow is set up, you can open the RTC launcher and install both Dolphin (for the PPC instruction lists) and FileStub if you have not already, then start FileStub. The first thing you will want to do is click on the gear wheel in the top right and select Big Endian.
After this, click on Advanced Options and under Target execution, select Execute other program from the dropdown and then click Edit Exec. Select your .bat file created earlier so that it will run every time a corruption is applied.
The final step is to click Browse target and select the EBOOT.elf file, then click Load targets into RTCV to begin corrupting.
Now in the Real-Time Corruptor window, click on Engine Config, and then under Advanced Tools and Plugins click on Package Downloader. Click on Lists and then download both the DolphinFloatInstructions_by_NullShock78 and DolphinFloatPassthrough_by_NullShock78.
Go back to Engine Config and then click My Lists. Click Import List File, then go to your RTC folder and find the path to the Dolphin installation (usually found at RTC/VERSIONS/RTCV_version/Dolphin/LISTS) and import all lists in the folder. Finally, click Refresh Lists.
One last time, go back to Engine Config and under Corruption Engine select Vector Engine. You are now ready to select your limiter/value lists and hit corrupt. Once clicked, the .bat file should run and automatically open up RPCS3.
