# henkaku Published articles for henkaku. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The First F00D Exploit DevFeed: [The First F00D Exploit]() Original publisher: [Read original article]() Author: yifanlu Published: 2019-01-11T08:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Exploit](), [Hacking](), [vulnerability](), [Security](), [Encryption](), [Hardware](), [cpu]() Tags: [article](), [bigmac](), [boot](), [encryption](), [exploit](), [f00d](), [hacking](), [hardware](), [heap-overflow](), [henkaku](), [processor](), [security](), [vita](), [vulnerability](), [writeup]() ### AI overview This technical article documents work on the first F00D exploit for the PlayStation Vita, including a memory-corruption vulnerability in a service and the role of F00D's private memory and cryptographic hardware accelerator. ### Source excerpt This article was originally written 2019-01-11 and published on 2019-07-29 for the third anniversary of HENkaku, the first Vita jailbreak. It documents the work we did in early 2017, just days after the seminal "octopus" exploit. Although the work is dated and does not open any new doors, the technical contents might be interesting for a particular audience. The original intention was to post this after someone else independently discovers the same vulnerability. There were many overt hints on the HENkaku wiki that the 0x50002 service was buggy but I underestimated the interest (or skills) that people would have in hacking an exotic processor that ultimately does nothing for people who just want to run homebrews or play pirated games. ## psvsd: Custom Vita microSD card adapter DevFeed: [psvsd: Custom Vita microSD card adapter]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-08-22T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Reverse Engineering](), [Hardware](), [USB](), [pcie](), [Kernel](), [boot]() Tags: [debug](), [development](), [enso](), [hacking](), [hardware](), [henkaku](), [kernel](), [pcb](), [pcie](), [reverse-engineering](), [usb](), [vita]() ### AI overview This article describes reverse engineering work on the PlayStation Vita's hardware and software, including identifying UART debug connections and examining USB capabilities across Vita models. It discusses the 3G modem's custom mini-PCIe connector and related board connections. ### Source excerpt One thing I love about Vita hacking is the depth of it. After investing so much time reverse engineering the software and hardware, you think you would run out of things to hack. Each loose end leads to another month long project. This all started in the development of HENkaku Ensō. We wanted an easy way to print debug statements early in boot. UART was a good candidate because the device initialization is very simple and the protocol is standard. The Vita SoC (likely called Kermit internally as we'll see later on) has seven UART ports. However, it is unlikely they are all hooked up on a retail console. After digging through the kernel code, I found that bbmc.skprx, the 3G modem driver contain references to UART. After a trusty FCC search, it turns out that the Vita's 3G modem uses a mini-PCIe connector but with a custom pin layout and a custom form factor. The datasheet gives some useful description for each pin, and UART_KERMIT seemed like the most likely candidate (there's also UART_SYSCON which is connected to the SCEI chip on the bottom of the board, which serves as a system controller and a UART_EXT which is not hooked up on the Vita side). So finding a debug output port was a success, but with the datasheet in front of me, the USB port caught my attention. Wouldn't it be neat to put in a custom USB device? ## HENkaku Ensō bootloader hack for Vita DevFeed: [HENkaku Ensō bootloader hack for Vita]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-07-31T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Reverse Engineering](), [Exploit](), [Vulnerabilities](), [boot](), [Security](), [Kernel]() Tags: [bootloader](), [cfw](), [enso](), [exploit](), [hack](), [hacking](), [hardware](), [henkaku](), [kernel](), [reverse-engineering](), [security](), [vita]() ### AI overview This article describes a bootloader buffer-overflow vulnerability in the PlayStation Vita. The exploit can overwrite a function pointer, patch the kernel before it boots, and is reported as affecting firmware versions 3.61 through 3.65, while installation requires kernel privileges and modification of the internal storage's MBR. ### Source excerpt When we (molecule) were reverse engineering the Vita's firmware years ago, one of the first vulnerabilities we found was in the bootloader. It was a particularly attractive vulnerability because it was early in boot (before ASLR and some other security features are properly initialized) and because it allowed patching the kernel before it booted (which expands what can be done with hacks). Unfortunately, the exploit required writing to the MBR of the internal storage, which requires kernel privileges. That means we would have to exploit the kernel (à la HENkaku) in order to install the exploit. (Before you ask, no it is not possible to install with a hardware mod because each Vita encrypts its NAND with a unique key. Also, there are no testpoints for the NAND, so flashing it is notoriously difficult... not as simple as the 3DS.) So, we mostly forgot about this vulnerability until quite recently when we finally all had some free time and decided to exploit it.