KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agent #developer-tools #codex #typescript #cli #deepseek-harness #claude-code #ai-agents #mcp #rust

enso_ex

★ 229 Open GitHub ↗

Untethered jailbreak and CFW loader for PlayStation Vita/TV units on firmware 3.65

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# enso_ex
### Untethered jailbreak and CFW loader for PlayStation Vita/TV units on firmware 3.65

## Features
### Custom kernel loader
Provided is a kernel loader that replicates vanilla functionality with added support for a custom module list read from a text file. 
Custom modules are loaded after the base kernel, but started before the base kernel - this allows the modules to function as 'plugins' and patch the base kernel in a pristine state. 
The provided loader also passes a hooking/patching 'API' from enso_ex to the user's custom modules, detailed in the developer readme.

### Support for unsigned base kernel modules
In conjunction with enso_ex's custom kernel loader, this allows the user to add their own *.skprx plugins to the base kernel. 
It is also possible to outright replace base kernel modules with decrypted/unsigned alternatives. 
By default, provided are two plugins - a homebrew enabler and a bootlogo replacer, their functionality is detailed later in this readme. 
 
### Code execution on the bootloader level
Before the kernel loader, enso_ex attempts to load and run a raw code blob from the os0 partition. 
This is intended to be used as an enso_ex extension that alters core information or functionality such as Firmware version, ConsoleID, QA flags, security coprocessor behavior, etc.

### SD2VITA-based recovery
Included is a bootloader-level recovery mechanism.
When triggered, enso_ex will initialize and use the sd2vita as an emmc replacement, os0 replacement, or source of a recovery code blob. 
This feature provides a safeguard against any kind of filesystem corruption, partition wipes, update failures, enso_ex bugs, and much more. 
It also opens doors to more advanced mods and tinkering, such as hybrid firmware or 'dual nand'.

### Kernel module load/start errors are ignored
enso_ex "forces" base kernel boot, even if some modules fail to load or start. 
This feature provides an additional recovery layer and unlocks the ability to boot vanilla firmwares of different types, such as testkit firmware on a retail unit.

### Miscellaneous boot toggles
A few useful toggles, triggered by holding certain key combinations, are detailed in the recovery readme.
 - emuMBR: use a different block as MBR
 - bootarea write-lock: block writes to the MBR, bootloaders, and enso_ex
 - EMMC recovery: load and run a code blob from EMMC
 - Adi-os0: disable os0 init, useful in case of a serious misshap.

## Installation and configuration
Provided is a VPK file containing the enso_ex installer, which has the following options:

### Install/reinstall the hack
This option will:
 - create a type-specific `boot_config.txt` in `ur0:tai/`
 - prepare the enso_ex installation in `ux0:eex/`
 - synchronize enso_ex plugins
 - install enso_ex core
 - update the enso_ex recovery

### Uninstall the hack
This option will uninstall enso_ex core and remove `ur0:tai/boot_config.txt`

### Fix boot configuration
This option will create a type-specific `boot_config.txt` in `ur0:tai/`

### Synchronize enso_ex plugins
This option will:
 - remove deprecated extensions
 - remove `os0:ex/`
 - copy `ux0:eex/boot/*` to `os0:`
 - if `e2x_ckldr.skprx` or `bootmgr.e2xp` are not present in `ux0:eex/boot/`, they will be removed from `os0:`
 - copy `ux0:eex/custom/*` to `os0:ex/`
 
### Update the enso_ex recovery
This option will:
 - if exists, write `ux0:eex/recovery/rconfig.e2xp` to EMMC block 4
 - if exists, write `ux0:eex/recovery/rblob.e2xp` to EMMC block 0x30+
 - if exists, write `ux0:eex/recovery/rmbr.bin` to EMMC block 3

## Base kernel plugins
To add a custom base kernel plugin put it in `ux0:eex/custom/`, add it to the `ux0:eex/custom/boot_list.txt` and "Synchronize" via the enso_ex installer. 
By default, enso_ex installer installs the following plugins:
### e2xhencfg.skprx
 - Adds support for unsigned kernel modules
 - Redirects `os0:psp2config_%model%.skprx` to `ur0:tai/boot_config.txt`
 - if in safe mode, the default redirect is skipped
 - if SQUARE is held, `ux0:eex/boot_config.txt` is used (also works in safe mode)
 - on devkits in PSTV mode, `ur0:tai/boot_config_kitv.txt` or `ux0:eex/boot_config_kitv.txt` is used

### e2xculogo.skprx
 - replaces the default PlayStation boot logo with `os0:ex/bootlogo.raw`
 - format is RGBA32 960x544
 - if no logo found, no logo will be displayed
 - disabled in safe mode

## Advanced usage
 - [Using the built-in recovery mechanism](README-recovery.md)
 - [For developers](README-dev.md)
 - Core flow: [light](enso_ex-core-diagram.png) / [dark](enso_ex-core-diagram-dark.png)

## FAQ
### How does the jailbreak work?
 - Check out [xyz's writeup](https://blog.xyz.is/2018/enso.html) and [yifanlu's writeup](https://yifan.lu/2017/07/31/henkaku-enso-bootloader-hack-for-vita/)

### How to change, remove or restore the bootlogo?
 - To change the bootlogo, put the new image in `ux0:eex/custom/bootlogo.raw` and "Synchronize" via the enso_ex installer
 - To remove the bootlogo, remove `ux0:eex/custom/bootlogo.raw` and "Synchronize" via the enso_ex installer
 - To restore stock bootlogo, remove `ux0:eex/custom/e2xculogo.skprx` and "Synchronize" via the enso_ex installer

### How to uninstall enso_ex?
 - enso_ex can be uninstalled via the provided installer.
 - As a safety measure, enso_ex is also disabled (but not removed) on system update.

### How to update enso_ex?
 - Using the "Install/reinstall" installer option will update enso_ex

## Credits
 - Team molecule for taihenkaku and enso.
 - xerpi for his work on vita-libbaremetal.
 - Henkaku wiki contributors.
 - Everyone that helped me with this project over the years.

enso_ex

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README