The below was posted on ps3hax by JjKkYu, i just copy/pasted the whole article
This is a script of sectool to resign the <=3.60 or decrypted EBOOT.BIN for 4.21CFW use.
1. Extract the 4.21 EBOOT Resigner.zip.
2. Put EBOOT.BIN into the extracted folder.
3. Run resigner.bat to resign EBOOT, you may need to choose encrypt type.
4. If you chose NPDRM type, you need to enter Content-ID.
5. The original EBOOT.BIN will be renamed to EBOOT.BIN.BAK.
This script is tested on BD4.21 CFW, and it should work on Rogero 4.21.
Some game also contains decrypted self or sprx file, you need to resign them manually.
Credit to badzbb.
Thanks for the image poorguy