The exploit factory

March 18th, 2012, 22:05 Posted By: wraggster

via http://wololo.net/wagic/2012/03/18/the-exploit-factory/

I just submitted an update to file “gen_exploit_config.rb” in the HBL svn, you can find the file here.That file is experimental (and also in need of some massive cleanup), but basically it should generate almost everything that is needed to get VHBL to compile and run (including, and especially, on the PS Vita) assuming you already have an exploit and the associated binary loader.
This is still experimental, and I need to update the “how to port HBL” tutorial with this new information, but mid term this should allow you to port HBL to your game exploit in about 5 minutes (compared to about 1 week for people without experience now).
If you have a user mode exploit and want to give it a try, here is a quick How to. Note: You need to be running on a PSP with a 6.60 firmware (CFW of course) for this to be 100% compatible with the Vita:

1. Write your binary loader
2. While displaying your hello world in psplink, type malloc 2 test l 204800, this will give you an address to load HBL. Note down this address
3. still in the same psplink session, type uidlist > uidlist.txt in order to save the current essential UID information
4. still in the same session, type savemem 0×08800000 0×01800000 memdump.bin to dump the user memory
5. copy the file uidlist.txt and the file memdump.bin to the tools folder of HBL (where gen_exploit_config.rb is). Make sure uidlist.txt is encoded in unix format, convert it if that’s not the case.
6. Copy the file sdk.S from your exploit into the tools folder of HBL. you should now have, in addition to gen_exploit_config.rb, uidlist.txt, sdk.S, and memdump.bin
7. run gen_exploit_config.rb. It should create an “output” folder which will have most of the necessary files for HBL compilation
8. Edit the 2 “TODO” sections of output/exploit_config.h, one with the HBL address you obtained above, the other one with the id of your game (e.g. UCUS12345)
9. Copy the files from the output folder to your exploit folder in HBL, follow the HBL port tutorial to get the 1 or 2 missing files, and Compile
10. Profit

There are 0 comments - Join In and Discuss Here