https://github.com/skgleba/psp2spl

A custom tiny lv0 framework for Playstation Vita
https://github.com/skgleba/psp2spl

Last synced: 17 days ago
JSON representation

A custom tiny lv0 framework for Playstation Vita

• Host: GitHub
• URL: https://github.com/skgleba/psp2spl
• Owner: SKGleba
• License: mit
• Created: 2020-05-17T15:05:17.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2024-01-29T08:48:37.000Z (10 months ago)
• Last Synced: 2024-05-01T21:53:55.853Z (7 months ago)
• Language: C
• Homepage:
• Size: 21.5 KB
• Stars: 4
• Watchers: 3
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

README

        
# psp2spl

Custom tiny lv0 framework for Playstation Vita/TV

# Usage

1) Put psp2spl.skprx in ur0:tai/

2) Add a line to ux0: or ur0: /tai/config.txt under *KERNEL

	- ur0:tai/psp2spl.skprx

3) Reboot

## Basic info for developers

### This framework's only task is to run lv0 code when requested: check [spl_exec_code] in main.c

### For any more advanced tasks use psp2renga - https://github.com/SKGleba/psp2renga

	- For all communication ARM<->FRAMEWORK the secure kernel enc addr in Venezia SPRAM is used.

		- In spl it is referred to as "commem" or "corridor", spl uses only first 32 bytes of it for config.

	- There is one patch used: fcmd_handler() hook - After ARM command is received, before executing it.

	- At every sleep/resume the crypto processor is reset, commem is reset too.

	- The framework is injected by exploiting update_sm::0x50002 and is stored @0x00809e00

# Credits

	- Team Molecule for the update_sm 0x50002 exploit and help over discord

	- Team Molecule for HenKaku, TaiHen and Enso

	- TheFlow0 for help with the sleep-resume stuff