Vita’s PSP Flash dumps for grabs thanks to Wth

Developer Wth, who is also known as Yosh, has released an archive containing the PS Vita’s PSP emulator flashes. Thanks to Virtuous Flame and Zero1ne he was able to include more then one emulator flash. The archives includes a tool calles PSPCipher which is used to decrypt PSP files.

These files are interesting to anyone who is trying to find exploits for the PSP envirioment of the PS Vita. It’s not for use for our everyday user.


Quote:

Wth(a.k.a. Yosh), who is known for his port of VHBL to the Everybody’s Tennis exploit earlier this year, and also for his nice yMenu for VHBL, just released a dump of the psp emulator’s flash on the Playstation Vita.

The released files contain a dump of the psp emu on Vita firmwares 1.61, 1.67, and 1.69. Wth got help from PSP scene veterans Virtuous Flame and Zer01ne in order to get a dump from each specific firmware.
The last time such a Flash dump was released, it had been done by an anonymous developer, who later became famous by running PS1 games on the vita through the psp emulator. Wth also credits him for this release.

Related Read: PSX Games running on the PS Vita through a hack
Related read: PSX on the Vita: An interview with the mysterious Vita Hacker
This release doesn’t mean much immediately from the end users’s point of view. It won’t magically hack your vita. But it means wth is in possession of a Kernel exploit inside the psp emulator, joining the expanding circle of people who have a full access to the psp emu inside the Vita. Somehow, this put us closer to a PSP CFW on the Vita. Also, for hackers and developers, this gives a more up-to-date dump of the flash to work with.

PSP Cipher

The release also includes an updated version of PSP Cipher. PSP Cipher is an alternative to PRXDecrypter, which supports potentially more files than PRX Decrypter. This tool is used, as the name implies, to decrypt PSP files, such as eboots, or files in the flash. wth’s release includes some Vita specific keys. Quoting the readme:

PSPCipher by liquidzigong@a9vg.com(aka hrimfaxi)

It can decrypt PRX type 5 (0x2e5e12f0) when prxdecrypter 2.4 etc failed to handle. It’s a completely reimplemention version as mesg_led_02g.prx and memlmd_02g.prx from FW 6.20. So if you are clever to find DRM decryption key you can decrypt DRMed module with it.

The sample decrypts host0:/enc/EBOOT.BIN and save to host0:/dec/EBOOT.BIN. kbridge dir contains decryption implemention. Please see pspcipher.h to use the code.

The source is covered by GPLv3 to fight aginst Sony NPDRM.