In this tutorial we’ll create an exploit and install it on a fully stock PlayStation TV (PSTV). The exploit will allow us to play PS Vita, PSP, and PlayStation game backups, as well as homebrew software. The current Vita homebrew scene is very impressive, and many emulators for 8-bit and 16-bit consoles are available.
This exploit can be installed on any PSTV with software up to version 3.68. My system was updated to the latest firmware (3.68) and I have tested everything here and it’s working great. Note that if you have 3.65 or below, it behooves you not to update past 3.65. In addition to what I show you below, you can optionally install a package called ENSO that allows you to permanently install custom firmware versus having to execute exploit code each time you cold-power up your PSTV. There’s no real penalty for not having ENSO installed, other than it’s a little less convenient. Since my PSTV was on 3.68 I was unable to install ENSO, but if you have a PSTVwith 3.65 or lower, you can find ENSO here: https://enso.henkaku.xyz.
This article is very similar to my other article, but there are a few key differences for the PS TV since you can’t directly connect it to the PC via USB, so everything has to be done over the network via FTP.
We’ll then go in to installing Adrenaline so we can play PlayStation and PSP games, NoNpDrm so we can download Vita games, and I’ll talk about how to install PKGj, which is the newest and latest way to get backups of your Vita games directly from Sony’s PlayStation Network CDN.
PSTV Hardware/Software Prerequisites
To check the software version of your PSTV, go to Settings > System > System Information.
The latest version right now is 3.68. You can go to Settings > System Update to update if you aren’t worried about installing ENSO, or if you’re already on a version greater than 3.60 that isn’t 3.68. If you are on a version less than 3.65, you should probably stick with 3.65 or below. You can upgrade from a lesser version to 3.65 via USB. You’ll have to Google how to do that, as it’s beyond the scope of this tutorial.
Here are some additional “gotchas.”
- PSTV must be connected to the same LAN segment as your PC. This can be wired or wireless.
- The device must be linked with a PSN account – the PSN account doesn’t need to be activated and you don’t need PS+.
Preparing Packages for Install
Download h-encore and decompress the h-encore folder to your Windows desktop for easy access. You can download h-encore here: https://github.com/TheOfficialFloW/h-encore/releases.
Download and install QCMA from here: https://codestation.github.io/qcma/. Install is typical “next next next finish” Windows installer. Accept all default values.
Download the DRM-free demo of “Bitter Smile” – This is the exploitable binary we’ll use to construct our exploit.
Copy the Bitter Smile PKG file to your h-encore folder. Do yourself a favor and rename it something shorter. I renamed mine bitter.pkg.
From the Windows command prompt, cd to the following folder and run the command:
cd C:\Users\YourName\Desktop\h-encore pkg2zip -x bitter.pkg
…where YourName is your Windows username and bitter.pkg is whatever your shortened Bitter Smile to. I assume you can do this without explicit instruction.
You’ll get output that looks something like the following:
pkg2zip v1.8 [*] loading... [*] unpacking Vita APP [*] unpacking completed [*] creating sce_sys/package/head.bin [*] creating sce_sys/package/tail.bin [*] creating sce_sys/package/stat.bin [*] minimum fw version required: 2.61 [*] done!
This will output files to \h-encore\app\PCSG90096
Copy all of the files from \h-encore\app\PCSG90096 to \h-encore\app\ux0_temp_game_PCSG90096_app_PCSG90096
Copy the temp.bin file from \h-encore\app\PCSG90096\sce_sys\package to \h-encore\license\ux0_temp_game_PCSG90096_license_app_PCSG90096 and rename the file to 6488b73b912a753a492e2714e9b38bc7.rif See what I highlighted in red and note that this is NOT the same location where you just copied the game files. Also note that it has to be .rif, and not .rif.bin. You may need to enable the setting in Windows Explorer to show file extensions to properly rename the extension for this file.
Getting Your Unique System ID and Encryption Key
Launch QMCA and open the Other tab. Ensure Use this version for updates is set to FW 0.00 (Always up-to-date) (mine defaulted to this), and click OK. QMCA will continue to run in the taskbar.
Launch Content Manager on the PSTV and then run through the setup to add your PC to Content Manager. You’ll essentially be given the option of managing the PSTV through a PC or a PS3. You’ll want to ensure QMCA is running as described above before attempting to connect the PSTV to it. You’ll be shown some numbers on the PC screen and you’ll have to type those numbers in to the PSTV with the controller to verify for security reasons. Once you’re connected, you should get a notification from QMCA on your PC that the device is connected, and you should see your PC by hostname on the PSTV.
Choose the option that says Copy Content on the PSTVContent Manager screen. The PSTVwill ask Select device to connect to – Choose PC. You’ll get a system notification from QMCA that says that a device was added to the database.
On the PSTV, choose the line that says PC > PS TV System then Applications. If you left the QMCA paths at default, there will be a new folder created in: C:\Users\YourName\Documents\PS Vita\APP.
This new folder has a 16 character long name of letters/numbers and represents your Account ID. Take note of this string and save it in a safe place. This Account ID is unique to your PSN Account. You need to insert that key at this website to get an unlock key that you can use to encrypt Vita Packages: http://cma.henkaku.xyz.
Note that you have to use the key for your own PSN Account. If you try to use someone else’s unique key, you won’t be able to install the exploit (or any other software for that matter).
At this point you should have a 16-character Account ID number as well as a 64-character encryption key.
Compiling and Installing the Exploit
Open a Windows command prompt and change directory to where you unzipped h-encore. Type in the commands:
psvimg-create -n app -K YOUR_KEY app PCSG90096/app psvimg-create -n appmeta -K YOUR_KEY appmeta PCSG90096/appmeta psvimg-create -n license -K YOUR_KEY license PCSG90096/license psvimg-create -n savedata -K YOUR_KEY savedata PCSG90096/savedata
…where YOUR_KEY is your 64-character encryption key.
After all 4 command execute successfully, navigate to \h-encore\PCSG90096
That folder will contain a folder called sce_sys it should also contain the folders:
license, savedata, app, and appmeta. Each of those folders should contain the files X.psvimg and X.psvmd where X has the same name as the folder in which it resides.
Your final tree should look like this (D means Directory, F means File):
[D] h-encore\PCSG90096\ | --[D]app | | [F] app.psvimg | | [F] app.psvmd | --[D]appmeta | | [F] appmeta.psvimg | | [F] appmeta.psvmd | --[D]license | | [F] license.psvimg | | [F] license.psvmd | --[D]savedata | | [F] savedata.psvimg | | [F] savedata.psvmd | --[D]sce_sys | [F] icon0.png | [F] param.sfo
Copy the entire folder \h-encore\PCSG90096 to C:\Users\YourName\Documents\PS Vita\APP\XXXXXXXXXXXXXXXX\
Right click on the QCMA icon in the taskbar and choose Refresh Database. You’ll get a Windows message that says items have been added to the database.
Back on the PSTV, under Applications choose PS PSTV. The h-encore bubble with a size of 243MB should appear. Select h-encore with the check box and tap Copy.
You’ll get a message that says The selected items will be copied to this system. Tap OK.
If the size does not match or if you get an error C2-12858-4 then it’s because you did something wrong. Ensure your folder structure looks exactly like mine above. If that doesn’t work, go back and follow the instructions from the beginning.
I attempted this several times on my PSTV, which is weird because when I did it on my Vita it copied first try. If you get errors during copy, reboot the PSTV and try again. That ended up working for me.
When the application finishes copying, close Content Manager and scroll down to the last page on your PSTVhome screen. You’ll see the h-encore bubble. Launch it and OK past the warning about not being able to earn trophies. From here the screen should flash and you should see the option to install HENkaku and download VitaShell. Do both of those things, in that order.
Finally choose Exit. Note that you’ll have to launch h-encore and re-apply HENkaku every time you reboot your system (unless you just put it to sleep). You should now be able to launch VitaShell.
Get Rid of the Trophy Warning
This next step isn’t required but it gets rid of warnings about trophies when launching the exploit, since the save code that’s been provided for the exploit isn’t linked to your personal PS account. Keep in mind that you should do this, especially the first part where you enable unsafe homebrew, since you won’t be able to install any other homebrew if you don’t enable that setting.
- Launch Settings from the PSTV Home Screen
- Choose HENkaku Settings from the Settings menu
- Click the checkbox next to Enable Unsafe Homebrew
- Launch VitaShell from the home screen
- Navigate to: ux0:user/00/savedata/
- Scroll down to highlight the folder PCSG90096 and press Triangle select Open Decrypted
- Scroll down and highlight system.dat, press Triangle, and choose Copy
- Go up one level (..), press Triangle, and then Paste. The system.dat file should have copied to the folder with all of the other “PCSE…” directories.
- Highlight the PCSG90096 folder again and press Triangle, and Delete it
- Close VitaShell and launch h-encore
- This will not launch the exploit anymore, rather it will launch Bitter Smile. When you see the title screen, close it.
- Go back in to VitaShell and again ensure you are in ux0:user/00/savedata
- A new folder for PCSG90096 has been created
- Highlight the system.dat file that we pasted before and press Triangle and choose Copy
- Highlight the PCSG90096 directory, press Triangle and choose Open Decrypted
- Once in the folder, press Triangle and choose Paste to copy the system.dat file back in
- Close VitaShell and launch h-encore again. This time it should take you to the exploit menu
Installing Adrenaline to Play PSP and PlayStation Games
Adrenaline is more than just a PSP / PlayStation emulator. It’s actually a full-fat PSP running directly on the PS Vita, complete with the full PSP BIOS, which is itself backwards compatible with original PlayStation games.
Download the Adrenaline vpk file from here: https://github.com/TheOfficialFloW/Adrenaline/releases.
On the PS TV, ensure you have the h-encore hack enabled, and launch VitaShell. In VitaShell, press Start and change the Select button setting to FTP. Press Circle to go back to the directory listing.
Navigate all the way up the file system until you’re in ux0:. This is the root of your PS Vita memory card.
Press Select to put the PS TV in to FTP mode. The PS TV will display the IP address and port of the FTP server that it’s now running. You’ll have to use an FTP client on your PC to copy files to it. I like Filezilla personally, but you can use whatever FTP client you want. Connection type will be Anonymous. There’s no username and password. Protocol will be FTP (not SFTP, etc.).
Copy the Adrenaline.vpk that you downloaded above over to the root of the PS TV memory card, which is inside the ux0: folder on the FTP server.
Back on the PS TV press Circle to close the FTP server. Scroll down to the bottom of the ux0: directory in VItaShell and you should see your Adrenaline.vpk file. Highlight it and press X to install. Press X a couple more times to confirm the install, following instructions as you go. When finished, you won’t be prompted to do anything. Note that doing this is the same way you’ll install games and homebrew that’s packaged in VPK files. Once the VPK file is done installing, you can deleting it by highlighting it in VitaShell, pressing Triangle, and then selecting Delete from the menu and pressing X to confirm.
Go back to the main menu and launch Adrenaline. You’ll be warned that the 6.61 firmware doesn’t yet exist and you’ll be asked to download it. Press X to download the PSP firmware. When the download is done you’ll be kicked back to the main Vita screen. Launch Adrenaline again. You’ll be asked to press X to install the firmware, do so.
When this finishes, you’ll be asked to press X to start Adrenaline. From here, you have the same interface as a PSP. Go through setup to access the crossbar PSP interface. Any PSP or PlayStation games you already have on or install your Vita will be playable from here.
There you have it. A full-fat PSP running on your PS TV.
NoNpDRM is required for you to play PS Vita backups.
First thing you’ll need to do is launch VitaShell on the PS TV, press Start to ensure that Select is set to FTP mode. Press Circle to exit the menu and press Select to enter FTP mode. Connect back to your PS TV as we did above with the FTP client on your desktop.
Download the latest NoNpDRM .skprx file from here: https://github.com/TheOfficialFloW/NoNpDrm/releases
Instead of copying it to ux0: on the PS TV, we’re going to copy this to ur0:. ur0: is the PS TV’s internal storage space, and we want this plug-in to run regardless if there’s a memory card in the PS TV or not. Using your FTP client, copy nonpdrm.skprx from wherever you downloaded it on your PC to the ur0:/tai/ directory. You should notice some other .skprx files there as well.
Next, we’ll have to modify the ur0:tai\config.txt files in order to reference the .skprx plugin we just installed. Start by copying ur0:tai\config.txt from the PS TV, via FTP, to your Windows PC.
Next, if you don’t already have it, you’ll have to download Notepad++. You’ll use this to edit the file – for two reasons. First, Windows Notepad doesn’t respect UNIX-like carriage returns so if you edited it with Windows Notepad you’d break it, and second, the file is marked as a system file so Notepad won’t allow you to edit it anyway. If you try to save it, you’ll get an Access Denied message.
I saved a backup of my original config.txt just in case – I renamed the copy config.txt.bak. Next, open config.txt in Notepad++. You’ll need to add the statement ur0:tai/nonpdrm.skprx directly under *KERNEL in that file, like this:
Ignore everything else in the file. Save it, and then use your FTP client to copy it to ur0:tai/config.txt and over-write the existing config.txt file with your new one. If done right, your new file should show in VitaShell as 566 bytes in size. Since the PS TV checks memory cards for the file before it checks its internal storage, we’ll need to make a copy of your modified config file on the card too. Using FTP, copy your modified file to ux0:tai/config.txt as well, overwriting the file in that location. There should be no .skprx files in ux0:tai/ directory or referenced in either config.txt.
Reboot the PS TV by holding down the PS button button on the controller for 5 seconds until you’re prompted to Power Off. Wait 15 seconds or so and power the device back on. Your install should be complete. Don’t forget to run the exploit again by installing HENkaku from h-encore upon boot-up.
Download the latest version of PKGj from here: https://github.com/blastrock/pkgj/releases.
There’s a PKGj config.txt file floating around that has links in it to servers that unscrupulously host full versions of PS Vita, PSP, and PlayStation games, which can be downloaded via PKGj right on your PS TV. Unfortunately this configuration is illegal in many countries, including my own, so I can not link to or tell you how to obtain this file. If you were to obtain it though, you could:
- Create a pkgi folder on your Windows PC and put the config.txt file in it.
- Launch VitaShell on the Vita, press Start to ensure Select is set to FTP mode, press Circle to exit the menu, and press Select to enter FTP mode
- Connect PS TV via FTP and drag the pkgi folder and the pkgj.vpk to the root of ux0:
- Back on the PS TV press Select to disconnect FTP, scroll down to the pkgj.vpk file and press X to install
- Follow the install prompts and let the install finish
- Close VitaShell and go back to the home screen
- Launch PKGj from its icon. Once it’s open, press Triangle to get a menu, and then scroll down and select Refresh with X
You can could install games from the list. If you install a PSP/Playstation game, it will show up under the Adrenaline emulator
Vita games show up on the PS TV home screen.
If you did not want to use PKGj, you could also search for games that are already packaged as VPK files and install them just as we have installed other VPK packages elsewhere in this tutorial.
Getting Rid of the Featured Page
The “Featured” page is probably the most annoying thing about the PS TV. After I wrote this guide I found a way to get rid of it once and for all. I documented that process on this page. Spend a few minutes with the Featured page and you’ll be dying to get rid of it.
Other Helpful Apps/Plugins
DSMotion – Although I haven’t tried it with my PSTV yet, the above instructions should work on a PSTV. DSMotion is a custom plugin (.skprx file, just like NoDpDrm above) which allows Vita games that are played in the PSTV to take advantage of the gyros in a PS3 or PS4 controller that have been paired with the PSTV. Why Sony didn’t do this from the factory is beyond me, but a lot of Vita games require motion controls and are thus incompatible with the PSTV for only that reason. DSMotion fixes those incompatibilities by replacing the controller driver. If you’re hacking a PSTV, this is a must. You can download the latest version here: https://github.com/OperationNT414C/DSMotion.
FakeCamera – This is another must for PSTV hackers. Since the PSTV doesn’t include a camera, any games that use the camera API for the Vita will crash on the PSTV. For this reason, Sony blacklisted the games as incompatible with the PSTV, and they will refuse to launch. In a hacked PSTV they will launch, but will crash when they access the camera API. FakeCamera fakes a camera API so this won’t happen. You can download the latest version here: https://github.com/OperationNT414C/FakeCamera.
AntiBlacklist – In the description for FakeCamera I mentioned how Sony blacklisted some games on the PSTV. AntiBlacklist removes the block when playing those games on the PSTV. AntiBlacklist installs as a VPK file and not a .skprx plugin, but installation is easily accomplished with VitaShell. Along with DSMotion and FakeCamera, AntiBlacklist should allow you to play pretty much any Vita game out there on your hacked PSTV. Download the latest version here: http://vitadb.rinnegatamante.it/#/info/11.
USB Flash Drives – Again, this pertains mostly to hacked PSTVs, but just a note about USB drives. With a hacked PSTV, you can avoid buying expensive PS Vita memory cards and instead use a USB flash drive in the USB port on the PSTV. Obviously you’ll want the biggest drive you can afford so you can pack as much goodness as possible on to it, but be warned – a lot of people have had issues when using USB 3.0 flash drives. USB 2.0 flash drives, even though 3.0 is supposed to be transparently backwards compatible, are much more stable. Just a word of warning.
VitaTweaks – These tweaks are for both PSTV and Vita. TheFlow is the talented individual that brought us h-encore, Adrenaline, NoNpDrm, and VitaShell. You read that right, one guy. He also has created a few plug-in tweaks all of which are on a single GitHub page. NoLockScreen disables the lock screen during initial power on so you can get to your Vita dash faster. Download Enabler allows you to download any content from the built-in web browser. NoTrophyMsg disables the trophy hint message when you launch an application whose save data is linked to a different account. Custom Warning allows you to replace the health and safety warning on system power-on with your own custom text. You can get all of these plug-ins here: https://github.com/TheOfficialFloW/VitaTweaks.
AutoPlugin – AutoPlugin is an installable VPK application that makes it easy to download and install multiple Vita plug-ins including almost all of the plug-ins mentioned above automatically. I chose not to include this in the installation instructions for NoNpDrm because I wanted you (as well as myself) to understand where the plug-ins go, why, and how they work. Still, this app is continuously updated and will make plug-in installation much easier going forward. https://github.com/theheroGAC/Autoplugin.
We’ve done a lot here. I’ve shown you how to get a PS TV to the point where we can run unsigned code on it by installing h-encore and VitaShell. I’ve shown you how to Adrenaline on your PS TV for playing classic PSP and PlayStation games, as well as how to download and install PKGj for installing PS Vita/PSP/PlayStation software via unscrupulous means – if you should so choose. We also learned that basically any file that comes in a VPK package can be installed via these same means – an easy drag and drop from a USB connected PC to move the files over to the Vita, and a one-button install from within VitaShell to get the VPK file installed.
Up to this point you should be fairly comfortable installing VPKs, using FTP to transfer files to and from the PS TV, and running homebrew apps. From here, you’re ready to do anything that’s worth doing on the PS TV.
If you enjoyed this tutorial and would like to see more, please feel free to share this article on social media, comment below letting me know what else you’d like to see, and follow me on Twitter @JROlmstead.