1. Decrypt the EBOOT.BIN to EBOOT.ELF with scetool.

Code:

./scetool -d EBOOT.BIN EBOOT.ELF

2. Open the EBOOT.ELF in a hex editor. Once the ELF is open in the hex editor you are going to do a search for a string of code and this string of code will change depending on what firmware version it was signed for originally.

Code:

The full string you are looking for looks like, 00 00 00 24 13 BC C5 F6 00 33 00 00 00 44 for 4.41 with the part you want to worry about changing is { 00 33 00 00 00 ?? }
Examples of different  firmwares strings: 

3.41 = 00 33 00 00 00 33 (I think this is actually for 3.31 but works if you use it for 3.41 and above)
3.60 = 00 33 00 00 00 36
4.00 = 00 33 00 00 00 40
4.2x = 00 33 00 00 00 42
4.5x = 00 33 00 00 00 45
If you see the pattern you will need to change 00 33 00 00 00 45 to 00 33 00 00 00 33 to work on firmware 3.41 and 3.55. If you are signing for 4.21 and up change the string to 00 33 00 00 00 42
Recently I have found more than one occurrence of 00 33 00 00 00 ?? so make sure the one you are changing is preceded by  00 00 00 24 13 BC C5 F6

Save the changes to the EBOOT.ELF

3. Resigning the EBOOT.ELF to EBOOT.BIN. There are a couple of ways to sign the files for retail disc or NPDRM.

First for a retail disc for 3.41/3.55 using scetool.

Code:

./scetool -v --sce-type=SELF --compress-data=TRUE --skip-sections=FALSE --key-revision=01 --self-auth-id=1010000001000003 --self-add-shdrs=TRUE --self-vendor-id=01000002 --self-app-version=0001000000000000 --self-type=APP   --self-fw-version=0003004000000000 --encrypt EBOOT.ELF EBOOT.BIN

Next for retail disc 4.21 and higher using scetool.

Code:

./scetool -v --sce-type=SELF --compress-data=TRUE --skip-sections=TRUE --key-revision=10 --self-auth-id=1010000001000003 --self-vendor-id=01000002 --self-type=APP --self-app-version=0001000000000000 --self-fw-version=0003006000000000 --encrypt EBOOT.ELF EBOOT.BIN

Next is for NPDRM 3.41/3.55 and you will need the contentID for this and insert in the "--np-content-id=" where it is XXYYYY-AAAABBBBB_CC-DDDDDDDDDDDDDDDD now.

Code:

./scetool -v --sce-type=SELF --compress-data=TRUE --skip-sections=FALSE --key-revision=01 --self-auth-id=1010000001000003 --self-add-shdrs=TRUE --self-vendor-id=01000002 --self-app-version=0001000000000000 --self-type=NPDRM --self-fw-version=0003004000000000 --np-license-type=FREE --np-content-id=XXYYYY-AAAABBBBB_CC-DDDDDDDDDDDDDDDD --np-app-type=UEXEC --np-real-fname=EBOOT.BIN --encrypt EBOOT.ELF EBOOT.BIN

Next is for NPDRM 4.21+ and you will need the contentID for this and insert in the "--np-content-id=" where it is XXYYYY-AAAABBBBB_CC-DDDDDDDDDDDDDDDD now.

Code:

./scetool -v --sce-type=SELF --compress-data=TRUE --skip-sections=TRUE --key-revision=10 --self-auth-id=1010000001000003 --self-add-shdrs=TRUE --self-vendor-id=01000002 --self-type=NPDRM --self-app-version=0001000000000000 --self-fw-version=0003006000000000 --np-license-type=FREE --np-content-id=XXYYYY-AAAABBBBB_CC-DDDDDDDDDDDDDDDD --np-app-type=EXEC --np-real-fname=EBOOT.BIN --encrypt EBOOT.ELF EBOOT.BIN

Now all that is left is to place the fixed EBOOT.BIN in the game folders USRDIR or make a new .pkg for the NPDRM fixed EBOOT.BIN install and enjoy.
Hope this helped! 