# HENkaku Ensō bootloader hack for Vita

DevFeed: [HENkaku Ensō bootloader hack for Vita](<https://devfeed.tech/articles/henkaku-enso-bootloader-hack-for-vita-22350.md>)

Original publisher: [Read original article](<https://yifan.lu/2017/07/31/henkaku-enso-bootloader-hack-for-vita/>)

Author: yifanlu

Published: 2017-07-31T07:00:00Z

Content type: article

Language: en

Sources: [Yifan Lu](<https://devfeed.tech/sources/yifan-lu.md>)

Topics: [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [boot](<https://devfeed.tech/topics/boot.md>), [Security](<https://devfeed.tech/topics/security.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>)

Tags: [bootloader](<https://devfeed.tech/tags/bootloader.md>), [cfw](<https://devfeed.tech/tags/cfw.md>), [enso](<https://devfeed.tech/tags/enso.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [hack](<https://devfeed.tech/tags/hack.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [hardware](<https://devfeed.tech/tags/hardware.md>), [henkaku](<https://devfeed.tech/tags/henkaku.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [security](<https://devfeed.tech/tags/security.md>), [vita](<https://devfeed.tech/tags/vita.md>)

## AI overview

This article describes a bootloader buffer-overflow vulnerability in the PlayStation Vita. The exploit can overwrite a function pointer, patch the kernel before it boots, and is reported as affecting firmware versions 3.61 through 3.65, while installation requires kernel privileges and modification of the internal storage's MBR.

## Source excerpt

When we (molecule) were reverse engineering the Vita's firmware years ago, one of the first vulnerabilities we found was in the bootloader. It was a particularly attractive vulnerability because it was early in boot (before ASLR and some other security features are properly initialized) and because it allowed patching the kernel before it booted (which expands what can be done with hacks). Unfortunately, the exploit required writing to the MBR of the internal storage, which requires kernel privileges. That means we would have to exploit the kernel (à la HENkaku) in order to install the exploit. (Before you ask, no it is not possible to install with a hardware mod because each Vita encrypts its NAND with a unique key. Also, there are no testpoints for the NAND, so flashing it is notoriously difficult... not as simple as the 3DS.) So, we mostly forgot about this vulnerability until quite recently when we finally all had some free time and decided to exploit it.