Vita Guides - Revision history

Admin: /* What kind of QAF Tokens are there and what do they do */

2026-03-14T12:21:07Z

What kind of QAF Tokens are there and what do they do

← Older revision		Revision as of 14:21, 14 March 2026
Line 61:		Line 61:
	\| QAF_QATEAM_FULL_E \|\| <code>11 00 00 00 00 00 0F 04 64 00 00 00 04 00 00 03</code> \|\| for "QualityAssurance Team" units		\| QAF_QATEAM_FULL_E \|\| <code>11 00 00 00 00 00 0F 04 64 00 00 00 04 00 00 03</code> \|\| for "QualityAssurance Team" units
	\|-		\|-
	\| QAF_SYS_DEV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 01 06 03 03 01</code> \|\| ~~for DevKits used~~ for "System Development"		\| QAF_SYS_DEV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 01 06 03 03 01</code> \|\| for "System Development"
	\|-		\|-
	\| QAF_MGVIDEO_DEV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 02 03 01</code> \|\| ~~for DevKits used~~ for "MagicGate Video Development"		\| QAF_MGVIDEO_DEV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 02 03 01</code> \|\| for "MagicGate Video Development"
	\|-		\|-
	\| QAF_MGVIDEO_ADV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 03 03 01</code> \|\| ~~for DevKits used~~ for "MagicGate Video Development"		\| QAF_MGVIDEO_ADV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 03 03 01</code> \|\| for "MagicGate Video Development"
	\|-		\|-
	\| QAF_MGVIDEO_DEV_E \|\| <code>todo</code> \|\|		\| QAF_MGVIDEO_DEV_E \|\| <code>todo</code> \|\| for "MagicGate Video Development"
	\|}		\|}
	The "_E" / or "_I" suffix indicates the Firmware the token is for. (External / Internal)		The "_E" / or "_I" suffix indicates the Firmware the token is for. (External / Internal)

Admin: /* What kind of QAF Tokens are there and what do they do */

2026-03-14T12:13:38Z

What kind of QAF Tokens are there and what do they do

← Older revision		Revision as of 14:13, 14 March 2026
Line 61:		Line 61:
	\| QAF_QATEAM_FULL_E \|\| <code>11 00 00 00 00 00 0F 04 64 00 00 00 04 00 00 03</code> \|\| for "QualityAssurance Team" units		\| QAF_QATEAM_FULL_E \|\| <code>11 00 00 00 00 00 0F 04 64 00 00 00 04 00 00 03</code> \|\| for "QualityAssurance Team" units
	\|-		\|-
	\| QAF_SYS_DEV_I\|\| <code>33 00 00 00 00 00 07 05 73 01 00 01 06 03 03 01</code> \|\| for DevKits used for "System Development"		\| QAF_SYS_DEV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 01 06 03 03 01</code> \|\| for DevKits used for "System Development"
	\|-		\|-
	\| QAF_MGVIDEO_DEV_I\|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 02 03 01</code> \|\| for DevKits used for "MagicGate Video Development"		\| QAF_MGVIDEO_DEV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 02 03 01</code> \|\| for DevKits used for "MagicGate Video Development"
	\|-		\|-
	\| QAF_MGVIDEO_ADV_I\|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 03 03 01</code> \|\| for DevKits used for "MagicGate Video Development"		\| QAF_MGVIDEO_ADV_I \|\| <code>33 00 00 00 00 00 07 05 73 01 00 11 06 03 03 01</code> \|\| for DevKits used for "MagicGate Video Development"
			\|-
			\| QAF_MGVIDEO_DEV_E \|\| <code>todo</code> \|\|
	\|}		\|}
	The "_E" / or "_I" suffix indicates the Firmware the token is for. (External / Internal)		The "_E" / or "_I" suffix indicates the Firmware the token is for. (External / Internal)

Admin: /* How to check if a DevKit has been activated before & when */

2026-03-12T12:55:07Z

How to check if a DevKit has been activated before & when

← Older revision		Revision as of 14:55, 12 March 2026
Line 12:		Line 12:

	== How to check if a DevKit has been activated before & when ==		== How to check if a DevKit has been activated before & when ==
			The Battery trick won't work when the device has never been activated before. It will show "device is expired" as well.

	=== via Neighborhood ===		=== via Neighborhood ===
	Download this custom [http://wiki.corcovado.info/downloads/psp2ctrl.exe psp2ctrl.exe] (might require .net 4.5.2)<br>		Download this custom [http://wiki.corcovado.info/downloads/psp2ctrl.exe psp2ctrl.exe] (might require .net 4.5.2)<br>
Line 19:		Line 21:
	<br><br>		<br><br>
	New alternative [http://wiki.corcovado.info/downloads/DipswTool.exe DipswTool.exe] (https://github.com/Princess-of-Sleeping/PSP2DipswTool/tree/master)<br>		New alternative [http://wiki.corcovado.info/downloads/DipswTool.exe DipswTool.exe] (https://github.com/Princess-of-Sleeping/PSP2DipswTool/tree/master)<br>

			=== via JIG ===
			https://github.com/SKGleba/bert<br>
			"unlock-nvs"<br>
			"nvs-read 0x520 0x20"<br>

	=== via Homebrew ===		=== via Homebrew ===
Line 27:		Line 34:
	At 0x8 is the (int) counter of activations.<br>		At 0x8 is the (int) counter of activations.<br>
	At 0xC the start date in Unix format and at 0x10 the end date in Unix format.		At 0xC the start date in Unix format and at 0x10 the end date in Unix format.


	== How to check if there is a QAF token installed ==		== How to check if there is a QAF token installed ==

Admin: /* How to check if a DevKit's Firmware is Internal/External */

2026-03-12T12:48:22Z

How to check if a DevKit's Firmware is Internal/External

← Older revision		Revision as of 14:48, 12 March 2026
Line 4:		Line 4:
	\|}		\|}
	== How to check if a DevKit's Firmware is Internal/External ==		== How to check if a DevKit's Firmware is Internal/External ==
	The first and most noticeable indication would be a very long activation period as internal firmware kits often come with a QAF Token.<br>		The first and most noticeable indication would be a very long activation period as internal firmware kits often come with a QAF Token. (but its not always the case!)<br>
	If the ~~firmware~~ is missing App_Home and the test AppStores it is most likely a CEX_FOR_TOOL build which is internal.<br>		If its activated and the LiveArea is missing App_Home and the test AppStores it is most likely a CEX_FOR_TOOL build which is always internal.<br>
	<br>		<br>
	Easiest test is to try insert a game cartridge. If there is an error it is most likely internal as the decryption keys are different between Internal and External. (Error Code: C1-6761-0 "Could not install" likely. The kit doesn't need to be activated for that)<br>		Easiest test is to try insert a game cartridge. If there is an error it is most likely internal as the decryption keys are different between Internal and External. (Error Code: C1-6761-0 "Could not install" likely. The kit doesn't need to be activated for that)<br>
	<br>		<br>
	To 100% confirm "internal", the kit needs to be dumped and the modules checked though. On emmc dumps you can hex-search for <code>83 FF AD 6D 24 F3 39 64 A0 61 78 8D A0 68 3B 19</code> which is the start of a metadata block only present in Internal Firmwares.		To 100% confirm "internal", the kit needs to be dumped and the modules checked though. On emmc dumps you can hex-search for <code>83 FF AD 6D 24 F3 39 64 A0 61 78 8D A0 68 3B 19</code> which is the start of a metadata block only present in Internal Firmwares.


	== How to check if a DevKit has been activated before & when ==		== How to check if a DevKit has been activated before & when ==

Admin at 12:40, 12 March 2026

2026-03-12T12:40:22Z

← Older revision		Revision as of 14:40, 12 March 2026
Line 4:		Line 4:
	\|}		\|}
	== How to check if a DevKit's Firmware is Internal/External ==		== How to check if a DevKit's Firmware is Internal/External ==
	The first and most ~~noticeabel~~ indication would be a very long activation period as internal firmware kits often come with a QAF Token.<br>		The first and most noticeable indication would be a very long activation period as internal firmware kits often come with a QAF Token.<br>
	If the firmware is missing App_Home and the test AppStores it is most likely a CEX_FOR_TOOL build which is internal.<br>		If the firmware is missing App_Home and the test AppStores it is most likely a CEX_FOR_TOOL build which is internal.<br>
	If the kit is deactivated however you'd need to activate it and try to run a game cartridge. If there is an error it is most likely internal as the decryption keys are different between Internal and External.<br>
	<br>		<br>
	To 100% confirm the kit needs to be dumped and the modules checked though. On emmc dumps you can hex-search for <code>83 FF AD 6D 24 F3 39 64 A0 61 78 8D A0 68 3B 19</code> which is the start of a metadata block only present in Internal Firmwares.		Easiest test is to try insert a game cartridge. If there is an error it is most likely internal as the decryption keys are different between Internal and External. (Error Code: C1-6761-0 "Could not install" likely. The kit doesn't need to be activated for that)<br>
			<br>
			To 100% confirm "internal", the kit needs to be dumped and the modules checked though. On emmc dumps you can hex-search for <code>83 FF AD 6D 24 F3 39 64 A0 61 78 8D A0 68 3B 19</code> which is the start of a metadata block only present in Internal Firmwares.

Admin: /* How to extract A Firmware PUP watermark */

2024-06-19T16:19:26Z

How to extract A Firmware PUP watermark

← Older revision		Revision as of 18:19, 19 June 2024
Line 159:		Line 159:
	== How to extract A Firmware PUP watermark ==		== How to extract A Firmware PUP watermark ==
	Extract the SCEWM segment from PUP<br>		Extract the SCEWM segment from PUP<br>
	Use <code>openssl enc -d -aes-128-cbc -K BFD5EA9F91AE9AF23565E534C4823B72 -iv CE16937E97A3349F143C8FB6AA219528 -in wm.bin -out wm.~~out~~</code> ~~to decrypt~~		Use to decrypt
			normal: <code>openssl enc -d -aes-128-cbc -K BFD5EA9F91AE9AF23565E534C4823B72 -iv CE16937E97A3349F143C8FB6AA219528 -in package_scewm.wm -out package_scewm.bin -nopad</code><br>
			debugger-key: <code>openssl enc -d -aes-128-cbc -K AB7097356FDD49D83878540167F0C4AD -iv 85537C5A56BD15DF0EB5F7F0D9E276E6 -in package_scewm.wm -out package_scewm.bin -nopad</code>

	== How to decrypt vs0:vsh/etc/index.dat ==		== How to decrypt vs0:vsh/etc/index.dat ==

Admin: Admin moved page Guides to Vita Guides without leaving a redirect

2024-01-15T18:23:49Z

Admin moved page Guides to Vita Guides without leaving a redirect

← Older revision	Revision as of 20:23, 15 January 2024
(No difference)

Admin at 18:23, 15 January 2024

2024-01-15T18:23:38Z

← Older revision		Revision as of 20:23, 15 January 2024
Line 1:		Line 1:
			[[Category:Vita]]
	{\| align="right" style="padding-left:20px"		{\| align="right" style="padding-left:20px"
	\| __TOC__		\| __TOC__

Admin: /* How to dump a DevKit */

2023-11-07T17:34:24Z

How to dump a DevKit

← Older revision		Revision as of 19:34, 7 November 2023
Line 87:		Line 87:

	== How to dump a DevKit ==		== How to dump a DevKit ==
	~~emmc~~.~~img + nvs~~ / ~~snvs~~
			<b>NGS Exploit files:</b> https://www.mediafire.com/folder/7h2n6rqu5rqks/NGS<br>
			<b>Devdumpers skprxs:</b> https://github.com/SKGleba/VitaTools/tree/main/devdumper/build<br>

	=== with activation via Neighborhood ===		=== with activation via Neighborhood ===
Line 93:		Line 95:
	2) enable devmode (via for example <code>psp2ctrl set-setting integer bootparam:/development_mode 1</code>)<br>		2) enable devmode (via for example <code>psp2ctrl set-setting integer bootparam:/development_mode 1</code>)<br>
	3) run "ngs_exploit_XXX.self"<br>		3) run "ngs_exploit_XXX.self"<br>
	~~<br>~~
	~~NGS Exploit files: https://www.mediafire.com/folder/7h2n6rqu5rqks/NGS<br>~~
	~~Devdumpers: https://github.com/SKGleba/VitaTools/tree/main/devdumper/build<br>~~

	=== without activation ===		=== without activation ===
	use Henkaku / Henlo		0) use Henkaku / Henlo (make sure to have a memorycard with 4GB of free space)<br>
	~~load devdumper~~ skprx ~~via plugin loader for example~~		1) Install [http://wiki.corcovado.info/downloads/plugin_loader.vpk plugin_loader.vpk]<br>
			2) Rename "devdump_xxxxxx_ux0data.skprx" to "kplugin.skprx" and put into "ux0:data/tai/" folder<br>
			3) Run Plugin Loader App (it will dump in the background)
			<br>

	== How to dump a MemoryCard ==		== How to dump a MemoryCard ==

Admin: /* How to fake re-activate a DevKit */

2023-11-07T17:24:23Z

How to fake re-activate a DevKit

← Older revision		Revision as of 19:24, 7 November 2023
Line 67:		Line 67:

	=== via Software ===		=== via Software ===
	Download this custom [http://wiki.corcovado.info/downloads/psp2ctrl.exe psp2ctrl.exe] (might require .net 4.5.2)<br>		<s>Download this custom [http://wiki.corcovado.info/downloads/psp2ctrl.exe psp2ctrl.exe] (might require .net 4.5.2)<br>
	<code>psp2ctrl.exe get-setting kernel:/bootparam</code> will return something <code>45 03 C7 63 01 13 04 00 45 03 C7 63 00 00 00 00 01 00 00 80 00 00 00 01 00 00 04 00 18 00 00 38 <binary>:System.Byte[]</code>		<code>psp2ctrl.exe get-setting kernel:/bootparam</code> will return something <code>45 03 C7 63 01 13 04 00 45 03 C7 63 00 00 00 00 01 00 00 80 00 00 00 01 00 00 04 00 18 00 00 38 <binary>:System.Byte[]</code>
	where "45 03 C7 63" is the CP Unix timestamp that you need to replace. Use / calculate one that is earlier than the CP timestamp! Then write back via <code>psp2ctrl.exe set-setting binary kernel:/bootparam "XX XX XX XX XX XX .."</code>		where "45 03 C7 63" is the CP Unix timestamp that you need to replace. Use / calculate one that is earlier than the CP timestamp! Then write back via <code>psp2ctrl.exe set-setting binary kernel:/bootparam "XX XX XX XX XX XX .."</code>
	<br><br>		<br><br>
	New alternative [http://wiki.corcovado.info/downloads/DipswTool.exe DipswTool.exe] (https://github.com/Princess-of-Sleeping/PSP2DipswTool/tree/master)<br>		New alternative [http://wiki.corcovado.info/downloads/DipswTool.exe DipswTool.exe] (https://github.com/Princess-of-Sleeping/PSP2DipswTool/tree/master)<br></s>

	=== via Hardware ===		=== via Hardware ===
	Remove the Battery for a couple seconds and set the earliest possible date in setup. (You can re-de-activate via setting time via Internet)		Remove the Battery for a couple seconds and set the earliest possible date in setup. (You can re-de-activate via setting time via Internet)


	== How to re-activate a TestKit ==		== How to re-activate a TestKit ==