TaiHEN Vita

taiHen
taiHen
	File:Taihenvita.jpg
General
Author	Team Molecule
Type	Plugins
Version	0.11
License	MIT License
Last Updated	2018/02/21
Links
	Download
	Source

TaiHen is an advanced HEN which brings kernel access and plugins support.

What is TaiHEN (大変)?

taiHEN is a CFW framework for PS Vita™. When loaded with a kernel exploit, it acts as a common substrate for patching the system. taiHEN provides three main facilities:

It disables code signature checks to allow unsigned executables.
It exposes kernel peek/poke syscalls to user applications and allows loading of kernel modules.
Most importantly, it provides an API for hooking and replacing functions based off of substitute.

The last point means that developers can add custom patches to kernel, system applications, and games alike.

How To Install TaiHEN?

taiHEN requires a separate kernel exploit to run. Once the exploit loads taihen.skprx to the kernel, taiHEN will take care of the rest. Please refer to documentations for the exploit for more information.

Media

Screenshot

File:Taihenvita.jpg

Plugins

Plugins are loaded either into kernel after taiHEN is loaded or on demand when an application is launched. taiHEN reads the configuration file in ux0:tai/config.txt.

The configuration that determines the plugins to load and the load order can be found in ux0:tai/config.txt. The format is very simple and self explanatory.

# ignored line starting with #
# Kernel plugins are started with taiHEN and are in this section
*KERNEL
ux0:app/MLCL00001/henkaku.skprx
ux0:path/to/another.skprx
ux0:tai/plugin3.skprx
ux0:data/tai/plugin4.skprx
ux0:data/tai/plugin5.skprx
# titleid for SceSettings
*NPXS10015
ux0:app/MLCL00001/henkaku.suprx
ux0:data/tai/some_settings_plugin.suprx
# titleid for Package Installer
*NPXS10031
ux0:path/to/some_pkg_installer_plgin.suprx
# titleid for SceShell is special (does not follow the XXXXYYYYY format)
*main
ux0:app/MLCL00001/henkaku.skprx
ux0:data/tai/shell_plgin.skprx

The key things to note are:

# begins a comment, * begins a section, and any other character begins a path.
KERNEL is a special section name denoting to load a kernel plugin when taiHEN is started up. All other section names are the title id of the application/game in which to load the plugin at startup. Note that SceShell has a special title id of main.
In each section, there is a list of plugin paths that will be loaded in order. Paths can be anywhere but it is recommended that plugins reside in ux0:tai or ux0:data/tai. It is valid to have one plugin in multiple sections but the developer must ensure that the plugin knows which application it is loaded in if it needs to do things differently.

API

taiHEN exports an API interface both to kernel and to user. This interface is found in the [documentation pages](@ref taihen). You should also read the usage guide for more details. You can either download the release or build taiHEN yourself. After that, you can include taihen.h in your project and link with libtaihen_stub.a (for user modules) or libtaihen_kernel_stub.a (for kernel modules).

How To Build TaiHEN?

To build, you need the latest version of the toolchain with kernel support. Then just use CMake to build.

$ mkdir build && cd build
$ cmake ../
$ make

Changelog

(v.0.11) Add delayed config loading to allow config to be reloaded from module_start. The main use-case here is if a kernel module defined in *KERNEL wishes to refresh the config.

Previously there will be a use-after-free as it tries to free the old config while it is still being parsed. Now that's been fixed and it supports re-loading the config (delayed) after the first parse is complete.

(v.0.10)

Hold L at start of an application to skip loading user plugins. This also means that if you have Ensō and hold L at boot, you should skip loading of SceShell plugins as well.

(v.0.9)

Added recovery option to skip loading all plugins (kernel and user) by holding L1.
If using HENkaku from the web or with the offline installer, hold L1 after the bootstrap installer starts up.
If using Enso, hold L1 and power on the Vita. You can still reuse plugins by calling taiReloadConfig even if you started taiHEN without plugin loading.

(v.0.8)

Alternative config file at ur0:tai/config.txt loads if ux0:tai/config.txt is not found.

(v.0.7)

Fixed a memory leak where a reference was not decremented
Mitigation for a SCE bug that limits the number of plugins that can be loaded per application
API Change: When TAI_MAIN_MODULE is used, the first loaded module will always be returned. This should be transparent to most plugins except the main change is that you can use TAI_MAIN_MODULE for SceShell now.

(v.0.6)

Module is now compressed
API change: TAI_MAIN_MODULE can be passed as a parameter to functions that take a module name. This will resolve to the default main module (aka the eboot.bin of the loaded application).

(v.0.5) Add new developer exports module_get_by_name_nid, module_get_offset, module_get_export_func, and module_get_import_func for advanced users. Headers not provided because these functions are not recommended for normal users. Integrated latest version of substitute with bug fixes for certain types of function hooks.

(v.0.4)

Implemented clean-up of user hooks on process termination
Added more APIs for kernel module loading and process module loading
Fixed bug where stack size was too small in syscall leading to crash when hooking or unhooking (seen by suprx loading skprx)
Added checks to prevent hooking of unresolved weak imports (see docs for details on how to hook weak imports)
Fixed bug in assembling the outro for BL instructions (can be seen by crash when hooking app_start)
Fixed bug where taiGetModuleInfo does not retrieve all modules.
Fixed bug where kernel module stopping crashes

(v.0.3)

Fixed issue with user loading of kernel module not working
Minor stability fixes

(v.0.2)

NID poisoning disabled, allows for user hooks of imports
Configuration parsing/loading
Fixed race condition in sceKernelMemPoolCreate
Fixed bug in taiLoadKernelModule and related function

(v.0.1)

First Release.

External links

Github - https://github.com/yifanlu/taiHEN
VitaDB - https://vitadb.rinnegatamante.it/#/info/143