61w ago - Following up on the
PSP SaveGame Exploit on PS Vita from a few days ago, today PlayStation Vita hacker
wololo reports that
Davee has obtained PSP Kernel access on PS Vita through another exploit with a PS Vita PSP HEN demo video and details below!
To quote: Famous PSP dev Davee just posted a YouTube video showing him running PSP homebrews on a Vita. I initially thought “well, not a big surprise, he’s running his own port of VHBL to some random exploited game”, but it turns out this is much more interesting than that, as he managed to get a PSP Kernel exploit running on the PSP Emulator.
Davee had hinted a few days ago on twitter that he had PSP User mode access, but it’s a surprise to see Kernel mode today. What this means to the end user is full homebrew compatibility (unlike VHBL which is hit and miss), and potentially down the road, PSP iso loaders (the video actually shows a psp iso running). Check his video below:
The video shows a minimalist interface called “PRX Loader” which seems to be used to run the homebrews. No word from Davee yet on a release date.
Update: The end of the video also shows some gameplay of Ratchet and Clank, which indicates Davee already has PSP isos working to some extent on this exploit.
I don’t know what impact this will have on wth's release for VHBL. We had actually started the process, but Davee’s work might make VHBL fairly irrelevant. I’ll try to contact the involved people to know what to do next about that.
Congrats Davee, exciting times ahead! Thanks to Yoti for the tip!
From his blog via lolhax.org/2012/03/21/ps-vita-psp-hen/ to quote:
First thing first, huge thanks to Proxima and some1. They’ve provided key utilities and advice for this research. So, yeah, it was really only a matter of time till this kind of thing happened. Sony dont just emulate the userland process of a PSP game, they emulate the entire kernel albeit, a modified kernel. The PSP emu has limited access to hardware, with interfacing the hardware done via a Kermit module. Kermit is a old-timers transmission protocol, likely used to talk to the native Vita.
The PS Vita, is a nifty little device, and the PSP emulator is a good target to get a huge library of homebrew. Check out the video below for a demonstration of what can be achieved.
You can see, that it works! The benefit is that HEN can access the core of the kernel, allowing almost seamless compatibility. However, as you may know, VHBL cannot run Lamecraft. Nor can this HEN currently. Lamecraft uses the OSK interface which has been replaced with Vita’s OSK. It’s likely a software error in the PSP kernel from the arguements passed in the homebrew.
There is other things, and perhaps i’ll make a post for them another time, but for now, later.
-Davee
Finally, from YouTube, to quote: Hi I'm Davee, and this is what happens when you emulate the entire psp kernel in the PS Vita. You can get a HEN! For technical information, contact on at lolhax.org Alternatively, visit #hellcat on irc.hellcat.net
Shout out:
- some1
- Proxima
- npt
- girlfriend, emma
- dog, cosmo.
- PSP homebrew developers
P.S. This isn't a huge achievement, but kernel access does grant us access to the sceKermit library
im a new user...
To quote from his blog (linked above): "Turns out he's not just a green frog! So, I've been throwing this word around recently and it's probably about time I explain. Kermit, either a protocol or perhaps a funny name (see KIRK/SPOCK) is a communication interface for the PSP emu. Specifically it allows the PSP to talk to the host.
Now, I can tell there aren't as many developers here, so I'll try to simplify for the curious minds but this stuff is pretty complicated. I'll only explain the API in detail as the lower level still need a little bit of clearing up, but here goes.
Ok, Kermit is here so that the emu can communicate to the host to share resources and other vitality. Perhaps the primary reason is that of hardware; the PSP emu is excluded from many hardware devices. So kermit sets in and allows the system to talk to the vita in order to use the hardware. Blabbering aside, this is the hardware that kermit seems to be responsible for:
• Memory stick
• Flash filesystem
• DMA
• LCD
• GE
• IDStorage
• Audio
• Camera
• Power Control
• USB
• OSK
• WLAN
• RTC
• ... more
Interestingly, the kermit communication isn't used for headphone remote or controller inputs.
In order to understand how kermit functions, it's important to explore the usage of the API. Starting with the power house tool:
int sceKermit_driver_4F75AA05(KermitPacket *packet, u32 cmd_mode, u32 cmd, u32 argc, u32 allow_callback, u64 *resp)
What is important to note is that the packet arguements are 64-bit wide (not 32) and little endian encoded. There is a maximum of 13 arguements that can be passed to the host.
Sometimes, it is needed to send more than the 13 arguements worth of data. This is where kermit provides an API for memory. Shown below:
void sceKermitMemory_driver_AAF047AC(KermitPacket *packet, u32 argc, u8 *buffer, u32 buffer_size, u32 io_mode);
void sceKermitMemory_driver_80E1240A(u8 *data, u32 len);
void sceKermitMemory_driver_90B662D0(u8 *data, u32 data_size);
sceKermitMemory_driver_80E1240A and sceKermitMemory_driver_90B662D0 are the opposites of each other, providing input and output respectfully. This API is incredibly simple and is used to send multiple buffers to kermit prior and following a command.
These are pretty crap descriptions, but as you can see it's a very command and transfer sort of interface. You tell it you have data you want to give it, you signal it and then it tells you where it's put it.
https://github.com/DaveeFTW/vita_kermit
There is some source code describing in more codey ways. Also there are small reverses of functions used in the kermit. As you can see it works on a sort of circular queue of semaphores in the core. Have a "peek".
Thanks to Proxima + some1"
Finally, he also Tweeted the following: There is a bug in the vita. If you turn it upside down it zips the gsensor and runs xml format vita games. Really cool.
More PlayStation 3 News...