PSN PKG -> PSP OFW Manual by Yours Truly

************************************************************

sign_np v1.0.4 - Convert PSP ISOs to signed PSN PBPs.
               - Written by Hykem (C).

************************************************************

Usage: sign_np -pbp [-c] <input> <output> <cid> <key> [<startdat>] [<opnssmp>]
       sign_np -elf <input> <output> <tag>

- Modes:
[-pbp]: Encrypt and sign a PSP ISO into a PSN EBOOT.PBP
[-elf]: Encrypt and sign a ELF file into an EBOOT.BIN

- PBP mode:
[-c]: Compress data.
<input>: A valid PSP ISO image with a signed EBOOT.BIN
<output>: Resulting signed EBOOT.PBP file
<cid>: Content ID (XXYYYY-AAAABBBBB_CC-DDDDDDDDDDDDDDDD)
<key>: Version key (16 bytes, for Vita) or Fixed Key (0, for PSP)
<startdat>: PNG image to be used as boot screen (optional)
<opnssmp>: OPNSSMP.BIN module (optional)

- ELF mode:
<input>: A valid ELF file
<output>: Resulting signed EBOOT.BIN file
<tag>:
 0 - EBOOT tag 0x8004FD03 - 2.60
 1 - EBOOT tag 0xD91605F0 - 2.80
 2 - EBOOT tag 0xD91606F0 - 3.00 <- no need for OPNSSMP
 3 - EBOOT tag 0xD91608F0 - 3.10
 4 - EBOOT tag 0xD91609F0 - 5.00
 5 - EBOOT tag 0xD9160AF0 - 5.05
 6 - EBOOT tag 0xD9160BF0 - 5.55 <- recommended, doesn't need OPNSSMP
 7 - EBOOT tag 0xD91610F0 - 3.60
 8 - EBOOT tag 0xD91611F0 - 6.00
 9 - EBOOT tag 0xD91612F0 - Vita 1.6x
10 - EBOOT tag 0xD91613F0 - Vita 1.6x
11 - EBOOT tag 0xD91614F0 - Vita 1.6x
12 - EBOOT tag 0xD91615F0
13 - EBOOT tag 0xD91616F0
14 - EBOOT tag 0xD91617F0 - Vita 1.6x
15 - EBOOT tag 0xD91618F0 - Vita 1.6x
16 - EBOOT tag 0xD91619F0
17 - EBOOT tag 0xD9161AF0 - Vita 1.6x
18 - EBOOT tag 0xD9161EF0 - 5.00 PSP-3000
19 - EBOOT tag 0xD91620F0
20 - EBOOT tag 0xD91621F0
21 - EBOOT tag 0xD91622F0
22 - EBOOT tag 0xD91623F0
23 - EBOOT tag 0xD91624F0
24 - EBOOT tag 0xD91628F0 - 5.70 PSPgo
25 - EBOOT tag 0xD91680F0 - 6.30
26 - EBOOT tag 0xD91681F0 - 6.50?
27 - EBOOT tag 0xD91690F0 - 6.60



PSN PKG -> PSP OFW Manual by Yours Truly

Download PSN PKG and extract it.
  Use PkgView, PSN PKG Extractor & Decrypter etc.

Take DOCUMENT.DAT and EBOOT.PBP from extracted \USRDIR\CONTENT
  DOCUMENT.DAT can be used on PSP as is.
  EBOOT.PBP can be used as is in PPSSPP.

Rename EBOOT.PBP to NP.PBP

Run npdpc_fixed.exe in the same dir with NP.PBP
  This also dumps header.bin (for use with fake_np) and version_key.bin (Version Key in raw hex)

Extract \PSP_GAME\SYSDIR\EBOOT.BIN from extracted ISO
  Use 7-Zip, WinRAR, IsoBuster, Apache...

Decrypt extracted EBOOT.BIN
  Use PRXdecrypter on PSP to decrypt
  Use EDecrypt on PSP to decrypt and optionally patch ELF for firmware 5.00
  Use Jpcsp or PPSSPP on PC to decrypt
  Size of decrypted EBOOT.BIN must match the size of BOOT.BIN (raw ELF or empty) in ISO

Sign and encrypt ELF (decrypted EBOOT) using EBOOT tag 2 (0xD91606F0):
sign_np -elf BOOT.ELF EBOOT.BIN 02
  Tag 2 introduced in FW 3.00 does not need (and removes the requirement to use) OPNSSMP module.
  Original tag is reported by PRXdecrypter and can be seen in hex editor in encrypted EBOOT.

Inject resigned EBOOT into extracted ISO
  Apache3 works fine, but most people will generally use UMDGen
  Note that signed EBOOT becomes larger and may overwrite the following file in custom ISOs!

Convert ISO to PBP:
sign_np -pbp -c NPUH-10184.iso EBOOT.PBP UP1063-NPUH10184_00-GENRATIONOFCAOS6 0 STARTDAT.PNG
  OR
sign_np -pbp NPUH-10184.iso EBOOT.PBP UP1063-NPUH10184_00-GENRATIONOFCAOS6 0 STARTDAT.PNG
  STARTDAT can be used from another game (if generic), PICx.PNG from this game or omitted at all.
  Compression is not required for PSP, but can be used to save space on Memory Stick if need be.

Place resulting PBP to \PSP\GAME\NPUH10184 directory
  Dir name does not have to match CID even on OFW but they match in officially downloaded games.

Position of the game in XMB list is determined by modification time of its directory.
Size of the game shown in XMB is the size of the whole game directory.




It seems that it's producing mixed results though. A few notes:
- If you're trying to run the EBOOTs on a PSP with OFW always use the fixed key (0). The PSP accepts the 0x3 flag so there's no need to use any other game's key.
- Some games seem to be failing to load after being signed with sign_np. This is probably an issue with either the compression algorithm or memory alignment (yes, the Vita is specially picky with that). I'm still trying to figure out what's wrong for those cases.
- Another important issue is the ISO's EBOOT.BIN file. Some tags require a valid OPNSSMP file to be added to the EBOOT.PBP, so be sure to either include the OPNSSMP file in the final image or just resign the EBOOT.BIN using a tag that doesn't need it (0xD9160BF0 is a good candidate for this).
- On a side note, if you have a blacklisted game installed, that won't work as base. The Vita will refuse to load anything that has it's content ID or version key.
- Also, it's quite possible that some games can't be used properly as "base" due to the OPNSSMP module.
To test this, grab the base game's EBOOT.PBP and open it up in an hex editor.
Search for a "PGD" string which will be the encrypted OPNSSMP module.
You can now copy the full PGD image (starts with the PGD magic and finishes right before some NULL padding) to a new binary file and decrypt it with pgdecrypt by tpunix.
It should give you a "~PSP" module that you can now include in your new image.
To do this just call sign_np as:
sign_np -pbp NP.ISO EBOOT.PBP [CONTENT ID] [VERSION KEY] OPNSSMP.BIN
The module will be re-encrypted with the new version key and will be loaded by the pspemu.
Also, you can include your own custom boot screen by doing something similar:
sign_np -pbp NP.ISO EBOOT.PBP [CONTENT ID] [VERSION KEY] STARTDAT.PNG
Or even include both OPNSSMP and boot screen files at once:
sign_np -pbp NP.ISO EBOOT.PBP [CONTENT ID] [VERSION KEY] OPNSSMP.BIN  STARTDAT.PNG

The np_flags can be described as:
01 00 00 00 -> License is bound to Memory Stick and uses Version Key
01 00 00 01 -> License is bound to Memory Stick and uses Fixed Key
02 00 00 00 -> License is bound to Network and uses Version Key
02 00 00 01 -> License is bound to Network and uses Fixed Key
03 00 00 00 -> License is bound to the file itself and uses Version Key
03 00 00 01 -> License is bound to the file itself and uses Fixed Key
The Memory Stick ones are never used (only present in the PSP's kernel code).
Normally the 03 flag, which binds the license to the file itself, uses the Fixed Key in the PSP, but I've seen a few games that use the Version Key instead.
I still need to figure out what is the meaning of this in the Vita itself, but it's very likely that those games don't work due to the flags indeed.