Psp2renga Vita

psp2renga
General
Author	SKGleba
Type	Developments
Version	1.2
License	MIT License
Last Updated	2019/12/23
Links
Download
Website

Psp2renga is a custom lv0 framework for Playstation Vita/TV.

Usage (end-user)

• Put psp2renga.skprx in ur0:tai/
• Add a line to ux0: or ur0: /tai/config.txt under *KERNEL
  • ur0:tai/psp2renga.skprx
• Reboot

For developers

psp2renga requires taihen.

Basic info

• For all communication ARM<->FRAMEWORK the Camera SRAM (p: 0x1C000000 - 0x1C1FE000) or a custom-mapped phycont block is used.
  • In renga it is referred to as "commem" or "corridor".
• There are two patches used:
  • run_sm::set_state(5) hook - After SM load, before jumping to it.
  • fcmd_handler() hook - After ARM command is received, before executing it.
• At every sleep/resume the crypto processor is reset, commem is reset too.
• The framework is injected by exploiting update_sm::0x50002
• If logging is enabled, psp2renga creates a log in "ux0:data/0psp2renga.log".

Commem layout

• 0x0-0x200: Framework config.
• 0x200-0x500: Entry manager, run_sm hook jumps there.
• 0x500-0xD0000: 12 0x10000 entry blocks, one additional smaller block.
• 0xD0000-0xF0000: Reserved for any-time-run code, fcmd_handler hook jumps there.
• 0xF0000-0x1FE000: Unused.

Usage

• For kernel-exports check /Include/renga-funcs.h
• For user-exports check /Include/renga_user-funcs.h
• For important defines check /Include/renga-defs.h
• You may use lv0_loader.vpk (/User/app/) to easily run your own MeP payloads.
• You may use renga.suprx (/User/plugins/) to easily switch between Camera SRAM and the phycont block.
  • Add the _settings one to SceSettings, there will be a new entry in Settings->System
  • Add the _forcephy or _forcesram to target apps, either phycont or sram mode will be forced.

Changelog

v1.2

• Changelog [NMF]:
  • Removed irq_handler hook, added fcmd_handler hook instead => stability++.
  • Added support for custom-paddr framework banks (phycont/cSRAM) => compatibility++.
  • Optimized code exec.
• Changelog [NMP]:
  • Removed TaiHen requirements.
  • Added ussm caching (optional) => stability++.
  • Added support for custom-paddr commem => compatibility++.
  • Moved the setup payloads to venezia SPRAM.
  • Optimized the exploit/code exec.
• Changelog [RENGA]:
  • Added renga_xet_bank for phycont/sram switching
  • Added renga_mepcpy
  • Now renga runs by default on PhyCont (add the _forcesram plugin to SceShell if you want all-time SRAM)
  • Added 3 user plugins: _settings; _forcephy; and _forcesram.
  • Updated the lv0loader

v1.0

• First Release.

Credits

• Team Molecule for the update_sm 0x50002 exploit and help over discord
• Team Molecule for HenKaku, TaiHen and Enso
• xerpi for the vita-baremetal-loader
• CelesteBlue for the ssmgr-resume hook

External links

• Github - https://github.com/SKGleba/psp2renga