Top Menu

As you have probably seen, a small PoC webkit exploit for 2.60 was released for the psvita. You can test your vita yourself by visiting the link here:

At first the exploit only supported 2.60, which happens to be the firmware my vita is on. The exploit now supports up-to version 3.18 and code execution demo with ROPTool will be shown over the next while.

Lets talk about how this all came to be. Thanks to a tweet from @yifanlu, news exploded onto the internet about this hack and what it means for the vita. Problem is, most of you don’t know what it means for the vita and franky, nor do I. I’ve been working with webkit for over 2 years now but there are many other brains behind the scenes doing work, which I would like to talk about.

First off, there is Codelion or @BBalling1. He is a strong driving force in a small development group that just struggled to gain momentum. People left, people lost interest. This guy managed to keep in the game and deserves as much credit as you give me. He even posted a description of the exploit on his twitter over a week ago, so make sure to follow him.

Secondly, there is Josh Axey @Josh_Axey, another member of the group. As I said, people lost interest the group cohesion broke and people worked on their own. This guy also made use of the packetstorm webkit bug.

Thirdly, @Archaemic. I haven’t spoken to this guy, but I can take yifan’s word that he has been working on the exploit for a long time and even has produced dumps from as early as April, goodjob man!

Thank you all for the praise, but I would like these guys to get a mention too, they are hardworkers and probably spent a lot of time on this bug too. If you’re interested in getting involved either drop me or any of these guys a tweet, I’m sure they’ll be glad to get a few extra devs.



About The Author


  1. Thanks to all the known & unknown people involved in the scene.

  2. Good job guys.

    You convinced me to give a look into this. I’ll need some time to be up to date with ARM architecture but I’m fixing this :p

    If you could additionnally give me some hints about the content of your 4 gadgets used in your POC, it would be a great help.
    Thanks and sorry to jump on the bandwagon.

  3. I think you lost me at :

    // prepare JSFunction which will be refered by u32.m_impl
    var f = new Function(” return 876543210 + ” + (_cnt++) + “;”);
    f.prop2 = u2d(0x40000000,0x40000000); // a new value for u32.length

    I can’t get what the goal of this function : ” return 876543210 + ” + (_cnt++) + “;”

  4. Ok I think I got the whole idea of your code :
    u32.toString(0xDEADBEEF, 0xDEADBEEF, 0xDEADBEEF); is actually doing memcpy(0xDEADBEEF, 0xDEADBEEF, 0xDEADBEEF); isn’t it ?

    I just got lost with the way you override the properties of the original object and finally map the gadgets on it, but it’s probably my lack of knowledge about javascript syntaxe…

  5. Hi davee when ever i open this site ( and hit convert button on my vita it reboots it self and my vita is on 3.15FW.

  6. Hey There. I found your weblog using msn. That is a really neatly written article.
    I will make sure to bookmark it and return to read more of your useful info.
    Thanks for the post. I’ll definitely comeback.

  7. Hey! Ive a vita on 1.51 so of theres anything i can help you with, domt hesitate to contact me 🙂 cheers

  8. Hey just wanted to give you a quick heads up.
    The text in your content seem to be running off the scredn in Firefox.
    I’m not sure if this is a formatting issue or something to do with web browser compatibility but I figured I’d post to let you
    know. Thhe design look great though! Hope you get the issue fixed soon. Thanks

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>