1. Prodad
2. License Mtkey Vita Scene License Plate
3. License Mtkey Vita Scene License Verification

The exploit will allow us to play PS Vita, PSP, and PlayStation game backups, as well as homebrew software. The current Vita homebrew scene is very impressive, and many emulators for 8-bit and 16-bit consoles are available. This exploit can be installed on any PS Vita with software up to version 3.68.

Prodad

On 7/29/2017, all hacked Vitas on 3.60 spoofing the latest firmware (3.65) were blocked from console activation. This is particularly odd because the PSN passphrase did not change in 3.65. Additionally with the release of ensō added to the confusion of what happened. Here is the result of a preliminary investigation of the situation.

Upon game activation, the Vita displays an dialog that shows the error number E-80558325. This error number is used in SceNpKdc, which is found in vs0:external/np_kdc.suprx. The error code itself is created when the activation response is received:

Here, v5 is the return code and v45 is the string error code from the server converted to a number. The request made to Sony's server looks like the following

The request from a 3.65 stock console has the same headers and loginid and epassword (for the same account) so the only change visible to Sony is the challenge string c1.

The response you get on 3.60 is

Challenge

The challenge string is constructed in SceNpKdc with a call to SceLibKernel_9557D15C. Farther investigation shows that SceLibKernel_9557D15C likely has the following call type:

It is called with id = 0 and entropy set to uninitialized stack space. Tracing this call, you eventually arrive at a kernel function in SceSblGcAuthMgrPcactForDriver with the NID 0xB7AE58B9. This call looks like the following

It appears that data from aimgr_sm.self (F00D) along with in, rtc_seconds (the RTC in seconds), DMAC engine, and maybe other data are entangled together into a 112 byte sized block. Then a 20 byte SHA1-HMAC is computed over the buffer with some key. It is likely that the data itself is unimportant and just has to be random and console unique.

How Sony Blocked Activation

License Mtkey Vita Scene License Plate

There are at least two possible ways. First is that on 3.65, the random-looking data block has some specific structure that Sony looks for (or some console unique data in this block gives away the fact that the console is on 3.60). Second is that they changed the SHA1-HMAC key. If it is the latter case, then the next step is to find how this key is constructed. It is likely that the key is constructed in F00D and therefore spoofing it would require a F00D hack.

License Mtkey Vita Scene License Verification

Summary

• Activation block is unrelated to ensō and Sony likely decided to implement this patch on 7/29 specifically to confuse users.
• Bypassing this block might be possible with more investigation, but there has to be work done (I won't have the time to do it).
• If you have a 3.60 Vita that is already activated, you should back up tm0:npdrm/act.dat to your computer as soon as possible!