Here is a way to get the savadata encryption keys for 2.0+ games using devhook.
It is complicated, mostly because the firmware files are copyrighted so they can't be included.
1st:backup ms0:/dh/250/flash0/kd (dumping the savedata key will lockup the game)
2nd:Copy e.prx, pspbtcnf.txt, and pspbtcnf_game.txt to ms0:/dh/250/flash0/kd
3rd:get a decrypted dump of 2.5 firmware(using psar dumper) and copy vsh/module/chnnlsv.prx to the root of the memorystick and kd/utility.prx to ms0:/dh/250/flash0/kd
4th:Use a hex editor to edit utility.prx overwrite 0x32a8 with 0x0d 0x00 0x00 0x00
5th:Start up the game and when the savedata starts to load the game will crash and key.bin and struct.bin will be written to the root of the memorystick (wait until the memorystick light is done flashing before taking the battery out)
Encrypt and decrypt are samples from the pspsdk to modify savedata with keys on a 1.5 .
The source will need to be modified to decrypt the new keys.
utility.prx is modified to cause a breakpoint when sceUtilitySavedataInitSta rt is called and
e.prx installs an exception handler that dumps (*a0) and (*a0+0x5dc) during a breakpoint