PSXHAX.COM website and domain for sale. Contact Us with your offer!
PSXHAX - PSXHACKS: PSX HAX - PSX HACKS - PLAYSTATION HAX - PLAYSTATION HACKS
UkakNEH: HENkaku PS Vita Jailbreaking Exploit Reversed by H
The PlayStation Vita jailbreaking exploit known as HENkaku has been in the wild around a week and wololo now reports that a 'mysterious' user by the name of H has shared a Pastebin partially reverse-engineering HENkaku with details below. 
To quote from the Pastebin: HENkaku exploit teardown - Part 1
- Stage 1 (browser exploit):
Visiting http://henkaku.xyz and pressing the "Install" button results in a server side useragent check. If the browser's useragent matches the one of a PS Vita/PSTV on the latest firmware version (3.60), the user is redirected to http://go.henkaku.xyz and an exploit is deployed.
This exploit re-uses elements from the older public exploits (heap spraying method, sort() bug, scrollLeft attribute manipulation) and pairs them with a new heap corruption technique.
Team molecule renamed variables and methods to provide a simple obfuscation layer on the HTML code.
You can find the partially reversed code (focusing on the most crucial portions) here: http://pastebin.com/bYA4xGaQ
Similarly to older exploits, this allows to corrupt an object's vtable and achieve ROP inside the SceWebkit module. Offsets for libraries and relevant ROP gadgets are fetched from a javascript file (http://go.henkaku.xyz/payload.js) during the last stage of the exploit.
Team molecule implemented a dynamic method to relocate gadgets and functions' offsets for each module after their base addresses' are found (by looking at SceWebkit's import stubs).
- Stage 2 (ROP payload 1):
At this stage, the browser exploit has layed out the memory space to start the first ROP payload which is reconstructed from the payload.js file. The payload.js file contains two arrays, one containing the payload's binary data and another containing the relocation type for each word.
By crossing this information the exploit reads the payload and relocates all code offsets to their target module's address space by adding the module's base address to them:
To quote from the Pastebin: HENkaku exploit teardown - Part 1
- Stage 1 (browser exploit):
Visiting http://henkaku.xyz and pressing the "Install" button results in a server side useragent check. If the browser's useragent matches the one of a PS Vita/PSTV on the latest firmware version (3.60), the user is redirected to http://go.henkaku.xyz and an exploit is deployed.
This exploit re-uses elements from the older public exploits (heap spraying method, sort() bug, scrollLeft attribute manipulation) and pairs them with a new heap corruption technique.
Team molecule renamed variables and methods to provide a simple obfuscation layer on the HTML code.
You can find the partially reversed code (focusing on the most crucial portions) here: http://pastebin.com/bYA4xGaQ
Similarly to older exploits, this allows to corrupt an object's vtable and achieve ROP inside the SceWebkit module. Offsets for libraries and relevant ROP gadgets are fetched from a javascript file (http://go.henkaku.xyz/payload.js) during the last stage of the exploit.
Team molecule implemented a dynamic method to relocate gadgets and functions' offsets for each module after their base addresses' are found (by looking at SceWebkit's import stubs).
- Stage 2 (ROP payload 1):
At this stage, the browser exploit has layed out the memory space to start the first ROP payload which is reconstructed from the payload.js file. The payload.js file contains two arrays, one containing the payload's binary data and another containing the relocation type for each word.
By crossing this information the exploit reads the payload and relocates all code offsets to their target module's address space by adding the module's base address to them:
- Relocation type 0 -> Plain data stored inside the ROP space itself. No relocation needed.
- Relocation type 1 -> Offset inside the ROP payload's stack.
- Relocation type 2 -> Offset...
Official HENkaku PS Vita Jailbreak Exploit Site Now at HENkaku.me
Today PlayStation Vita hacker Yifan Lu tweeted that the original Henkaku domain https://henkaku.xyz/ has been taken down and redirects to their new home located at https://henkaku.me/ to continue the PS Vita 3.60 jailbreak exploit love! 
Also similar to the VPK Files Archive from haxxeyHD located at http://haxxey.com/vpkmirror/, there is a growing PlayStation Vita VPK repository in the official Showcase which currently includes:
Also similar to the VPK Files Archive from haxxeyHD located at http://haxxey.com/vpkmirror/, there is a growing PlayStation Vita VPK repository in the official Showcase which currently includes:
- GenesisPlusVITA by Frangar (GIT)
- VITA-8 by xerpi (GIT)
- Numpty Physics for Vita by meetpatty (GIT)
- Snes9xVITA by skogaby (GIT)
- Flood It! by romain337 (GIT)
- VitaTester by SMOKE (GIT)
- BreakVeetOut by InvalidExcepti0n (GIT)
- CATSFC-libretro Vita by skogaby (GIT)
- Vita Doom by Netrix (GIT)
- HandyVITA by Frangar (GIT)
- NeopopVITA by Frangar (GIT)
- SMSplusVITA by Frangar (GIT)
- FTPVita by xerpi (GIT)
- realboy by xerpi (GIT)
- vitahelloworld by xerpi (GIT)
- mGBA by endrift...
RetroArch (Latest Version) for PS3 CEX / DEX and HENkaku PS Vita Port
Earlier this year the LibRetro Team released RetroArch v1.3 for PS3, PSP, PS Vita and PlayStation TV and now they are back with a RetroArch 1.3.6+ Beta for PS3 CEX / DEX via Ezi0 and a HENkaku port for PS Vita! 
Download: RetroArch.PS3.v1.3.6.PLUS.BETA.FOR.CEX.PS3.pkg (171.5 MB) / RetroArch.PS3.v1.3.6.PLUS.BETA.FOR.DEX.PS3.pkg (278.5 MB) / 2016-08-03_RetroArch.7z (33.0 MB)
Below is a RetroArch v1.3.6+ Beta demo video, and from the official PlayStation 3 release page to quote:
RetroArch 1.3.6+ beta release for PlayStation3!
The PlayStation 3 port is back after it was decommissioned for a long time. Consider this a beta version in anticipation of the upcoming 1.3.7 version which will be further fleshed out.
What doesn’t work yet
This version can be considered a beta release. Here are the current issues:
...
Download: RetroArch.PS3.v1.3.6.PLUS.BETA.FOR.CEX.PS3.pkg (171.5 MB) / RetroArch.PS3.v1.3.6.PLUS.BETA.FOR.DEX.PS3.pkg (278.5 MB) / 2016-08-03_RetroArch.7z (33.0 MB)
Below is a RetroArch v1.3.6+ Beta demo video, and from the official PlayStation 3 release page to quote:
RetroArch 1.3.6+ beta release for PlayStation3!
The PlayStation 3 port is back after it was decommissioned for a long time. Consider this a beta version in anticipation of the upcoming 1.3.7 version which will be further fleshed out.
What doesn’t work yet
This version can be considered a beta release. Here are the current issues:
- You cannot scan for content as of right now. Instead, for now you should just load content directly from the filesystem.
- To be able to use zipped ROMs on emulators like SNES9x and other similar emulators, always use ‘Open Archive As Folder’, then select the ROM you want to use. Don’t use ‘Load Archive With Core’ which won’t work for now.
- If you go to ‘Information’ -> ‘Core Information’, it currently doesn’t show anything. Not a big deal for now but something we will want to fix later on regardless.
- None of the ‘downloading’ features right now will work in the PS3 port. Our networking stack code for PS3 apparently requires some customizations still. If there are any PS3 devs who can help with this, by all means.
...
Risk Urban Assault PS4 Now Live on PlayStation Store, RAWR PSN!
Risk Urban Assault on PS4 takes place in a post-apocalyptic world, where you must rally armies to march across famous cities around the world leading your troops to victory!
Here's the scoop from Grace Chen on what else is new on PlayStation Store this week:
PS4 Games
Here's the scoop from Grace Chen on what else is new on PlayStation Store this week:
PS4 Games
- Abzu - $19.99
- APE ESCAPE 2 (PS2) - $9.99
- Cannon Brawl - $9.99
- Gal Gun Double Peace - $59.99
- Nightmares From the Deep: The Cursed Heart - $9.99
- Overcooked - $16.99
- Risk Urban Assault - $14.99
- Tricky Towers - $14.99
- Risk Urban Assault - $14.99
- Gal Gun Double Peace - $39.99
- Laser Disco Defenders - $9.99
| Console | Bundle | Price |
| PS4 | GAL*GUN: DOUBLE PEACE DLC SET 1 | $14.99 |
| PS4 | GAL*GUN: DOUBLE PEACE SPECIAL EDITION DLC SET | $14.99 |
| PS4 | LAYERS OF FEAR: MASTERPIECE EDITION | $22.99 |
| PS4 | TOM CLANCY’S THE DIVISION STREETS OF NEW YORK OUTFIT BUNDLE | $14.99 |
| Platform | Title | Sale Price | Original Price |
| PS4 | ABYSS ODYSSEY: EXTENDED DREAM EDITION | $7.49 | $14.99 |
| PS4 | ASSASSIN’S CREED CHRONICLES TRILOGY | $14.99 | $24.99 |
| PS4 | ASSASSIN’S CREED SYNDICATE | $19.79 | $59.99 |
| PS4 | ASSASSIN’S CREED SYNDICATE GOLD EDITION | $29.69 | $89.99 |
| PS4 | BATTLEFIELD 4: CHINA RISING | $0.00 | $14.99 |
| PS4 | DISHONORED: DEFINITIVE EDITION | $11.99 | $19.99 |
| PS4 | DOOM | $29.99 | $59.99 |
| PS4 | FALLOUT 4 | $29.99 | $59.99 |
| PS4 | FALLOUT 4 DIGITAL DELUXE BUNDLE | $76.99 | $109.99 |
| PS4 | FALLOUT 4: AUTOMATRON | $7.49 | $9.99 |
| PS4 | FALLOUT 4: SEASON PASS | $39.99 | $49.99 |
| PS4 | FALLOUT 4: CONTRAPTIONS WORKSHOP | $3.74 | $4.99 |