​

Earlier today, Yifan Lu, a well-known member of the Vita hacking scene famous for the Rejuvenate hack for the Dev Assistants, has announced that a new (native!) Vita homebrew enabler for the latest firmware version, as of writing (3.60), will be arriving tomorrow at "9:00AM UTC".

The new hack, known as "HENKaku", will require the following:

• A Vita/PSTV running 3.60
• A memcard with at least 10MB of free space (internal memory is currently not supported!)
• An FTP client
• An internet connection**

**Offline support is now available! Launch the exploit straight from the email app without the need for internet access at all! See the unofficial release thread for more details. (Internet connection still required for installation)


This is a small paragraph of Yifan Lu himself explaining what the properties of this new homebrew enabler does:

HENkaku simply lets you install homebrew as bubbles in LiveArea. It is a native hack that disables the filesystem sandbox. It installs molecularShell, a fork of VitaShell that lets you access the memory card over FTP and install homebrew packages (which we create as VPK files). With vita-toolchain, developers have access to the same system features licensed developers have access to as well as undocumented features that licensed developers cannot use (including overclocking the processors).

The hack has been released at http://henkaku.me ~ Furthermore, the hack is said to be exclusive to 3.60, and there is to be no backports for the time being.

Source: http://yifan.lu/2016/07/28/henkaku-vita-homebrew-for-everyone/

 

[yifan_lu]

@yifan_lu

I have been trying for hours to get the offline files to work properly, but I'm failing. The instructions on github is a bit vague in the running section. I'll just list the steps I did here and maybe you can point out my mistake (if any?)

So for the server, I have xampp setup with a folder for wiiu exploit hosting, and a folder for 3ds for spidertools hosting.
In addition to having an apache server, it also has PHP support so it supposedly should the only server I need.

So here is what I did:
1- Downloaded the source
2- Created a vita folder on my server
3- extracted and compiled the source using this command: "build.sh http://10.37.86.113:80/vita/ http://10.37.86.113:80/vita/pkg"
- Note: This IP is my internal IP, not my external IP
- Note2: Both are using port 80, which is what the apache server is using
4- I copy the entire "Host" folder to "vita" folder on my server
5- I run http://10.37.86.113:80/vita/exploit.html on my vita
6- I get the welcome screen, and when I press ok, I get the famous C2-12828-1 error

Now, I have tried clearing cookies, rebooting, rebuilding database and all other conventional methods mentioned (with the exception of memory card formatting), but nothing changes.
Henkaku.xyz works fine so my vita is also presumably fine.

So, what am I missing, I'm not quite understanding the "running" section in github (non-GO implementation).. am I supposed to do something for stage1 and stage2?
At one point, I thought I may have to run http://10.37.86.113:80/vita/stage2.php before exploit.html or something, but that returned the word "nope"

Once I get this up and running, I'll probably write a tutorial on how to get this working.

Thanks

http://10.37.86.113/vita/stage2.php

That's your first param to build.sh

 

[Madridi]

http://10.37.86.113/vita/stage2.php

That's your first param to build.sh

So:
- Do all of the above except change to this : build.sh http://10.37.86.113:80/vita/stage2.php http://10.37.86.113:80/vita/pkg
- Run: http://10.37.86.113:80/vita/exploit.html

Is that correct?
Nothing changed. I get the same result..

A user on wololo comments reported having success only with GO, and that the PHP didn't work with IIS for him on windows 8

Thanks for the help

 

[Madridi]

@yifan_lu

Just a follow up on the above. The setup you explained works fine with stage2.go .. php still doesnt work for whatever reason.
Now I'd need to figure out why PHP doesnt work..

 

[Sonic Angel Knight]

So can offline server hosting be ported to android with functional ftp not requiring filezilla?

 

[memomo]

Nice no surpris about the kernel access, we can write where standard user can't so it can be seen as a kind of privilege esclation I guess.

But we will have to think about what will we do when we will have access to full source code. Use it for HB only to get them better or going to evil piracy...

I wish if we could utilise kernel access to have some sort of EmuNAND

That would be awesome

 

[chocoboss]

Emunand or a kind of devhook ( back on 1.50 psp ) can be cool to get updated version of the vita. Something that would be nice is a perma patch so we don't need to launch brower bla bla bla. Signature / licence check patch can be cool also but we all know where it will lead lol

 

[perkel]

Does 3DS hardware allowed for emunand or emunand is possible as long as there is kernel access ?

 

[Scarlet]

Does 3DS hardware allowed for emunand or emunand is possible as long as there is kernel access ?

Well... 3DS already has emuNAND, so yeah? Anyway, this surely isn't the right place to discuss this.

 

[Swiftloke]

Does 3DS hardware allowed for emunand or emunand is possible as long as there is kernel access ?

If you take over the arm9 (security processor) then yeah you can use emuNAND on it. Not sure why you're asking here though.

 

[perkel]

Well... 3DS already has emuNAND, so yeah? Anyway, this surely isn't the right place to discuss this.

? No 3DS doesn't have emunand from Nintendo. Emunand was made by gateway people.
What i am wondering is if somehow 3DS hardware was special in sense that it allowed for creatinon of emunand.

Also ton of people read all forums not only 3ds ones.

 

[Swiftloke]

? No 3DS doesn't have emunand from Nintendo. Emunand was made by gateway people.
What i am wondering is if somehow 3DS hardware was special in sense that it allowed for creatinon of emunand.

Also ton of people read all forums not only 3ds ones.

It's nothing to do with hardware. Once we have our own code running on arm9, we can set it up to redirect NAND read/writes to the SD card, as arm9 is what controls that.

 

[perkel]

Emunand or a kind of devhook ( back on 1.50 psp ) can be cool to get updated version of the vita. Something that would be nice is a perma patch so we don't need to launch brower bla bla bla. Signature / licence check patch can be cool also but we all know where it will lead lol

I think that would require boot access which is still not hacked and judging by what people said about Vita security it probably won't be for a long time.

3DS boot was hacked because nintendo didn't secure it properly.

 

[Scarlet]

Also ton of people read all forums not only 3ds ones.

Sure, but the 3DS forums are there to discuss... 3DS things? And the Vita forum for Vita things. Anyway, I'll leave it at that ♪

 

[perkel]

It's nothing to do with hardware. Once we have our own code running on arm9, we can set it up to redirect NAND read/writes to the SD card, as arm9 is what controls that.

In other world kernel access ? or just arm9 arm11 specific hardware setup that allowed this ?

 

[Swiftloke]

In other world kernel access ? or just arm9 arm11 specific hardware setup that allowed this ?

Umm what do you mean?

 

[perkel]

Sure, but the 3DS forums are there to discuss... 3DS things? And the Vita forum for Vita things. Anyway, I'll leave it at that ♪

But we are talking about Vita here getting emunand. You can't talk emunand without 3DS and how this was achieved...

 

[DrDaxxy]

It's nothing to do with hardware. Once we have our own code running on arm9, we can set it up to redirect NAND read/writes to the SD card, as arm9 is what controls that.

Once you can get your code to be executed on arm9 during the boot process.

 

[Swiftloke]

Once you can get your code to be executed on arm9 during the boot process.

Not nessescarily. Remember, the DS profile exploit, menuhax, and every other *hax can all be used to achieve emuNAND, and they take over while the system is already running. Though i don't really know how emuNAND works, I do know there's no need for arm9 to be taken over during boot.

 

[perkel]

Once you can get your code to be executed on arm9 during the boot process.

So they need to get into system boot very early and switch which system gets loaded.
So it isn't just kernel access but hack that gets into system startup very early...

damn i hoped this was achieved only by kernel access.

 

[Swiftloke]

So they need to get into system boot very early and switch which system gets loaded.
So it isn't just kernel access but hack that gets into system startup very early...

damn i hoped this was achieved only by kernel access.

No, he's wrong. You don't have to hijack arm9 before system boot.