Originally posted by another user
I was bored and noticed this pattern it has. A fact: If you reverse the whole thing, you'll be able to find the NPDRM key for that firmware version it was encrypted with. Good luck! The eboot is big. I used the 1.02 debug EBOOT but it should work for any. Basically, everything after the .ELF string is the decrypted EBOOT.ELF code.
Start with the debug EBOOT. Once you find the NPDRM key in that (3.55), the same offset it is in that EBOOT should be in the other 1.13 EBOOT (3.72?). Then you'll have the NPDRM key for that firmware. I was sleepy when I wrote this so I may have explained it wrong; good luck.
Originally posted by another user
Encrypted EBOOT - Decrypted EBOOT
0x90-0xB6 - 0x00-0x26
0xB8-0xDA - 0x28-0x4A
Remember, it's to get you started with reversing it. The 0x90-0B6 is the same code in the decrypter EBOOT 0x00-0x26. If anyone wants me to finish, you better give me $200

.
PS:
I'll do this for MW3 once I'm done with my other project. For MW3, since I don't have a decrypted EBOOT for it, I'll have to do it from scratch which is harder. At least I'd be able to code a EBOOT from SCRATCH.