My Experience with Exploiting PS Vita (Gen 1) Using TN-V8 (Firmware 3.01) After Sony Releases Firmware 3.10

After missing out the TN-V exploit game last February - Persona 2 - Innocent Sin, I thought this is it. I will have to wait for the next firmware release from Sony and keep on waiting for another breed of exploit.



I'm lucky to constantly tracing any news on Wololo.net and my effort finally paid off. On March 25, Sony finally release the long awaited firmware update for PS Vita, v3.10. As predicted, this is a huge leap from the original 3.01, which implies many fixes that might make TN-V exploit no longer possible. Truth to be spoken, I am really crossing my finger when I read the following post.



Then on March 27, I immediately filled with intense joy when I read the following news. Finally a chance to bring back the homebrew (mostly retro emulators) on PSP on my PSV in their glory!



To my surprise, there is not only one game exploit, but 6! The cheapest one, NumBlast only costs $2.99! This is definitely a huge steal and I will not spare any chance to miss it. Come to think of it, I'm glad that I missed out the previous exploit (Persona 2: Innocent Sin) since it costs $9.99! Just when you started things will turn out to be worst, another opportunity arise!




Without haste, I immediately open up PS Store on my PS Vita. And then, the following message pop-up...



At that point, my joy suddenly dissipated into thin air. As most others would do, I immediately Google and found a nifty solution from a post on Wololo.net dated back on December 14, 2013 containing instruction to overcome this restriction. Not hope is all lost.



At this point I'm having doubt whether this trick might still work, since I thought Sony might have patched their system as they did with the exploited game. To recap, almost all the exploited game release on Wololo.net will be taken down from PSN one or two days after its release. And this post is almost 3 months old, well... I cannot set my hope high. Anyways, it still worth a shot.

Honoring the instruction, I disabled the Wi-Fi and enable the Airplane mode on my PS Vita. And then power it off and on again. Then, I headed to SEN Online Store (https://store.sonyentertainmentnetwork.com/) and search for NumBlast.


Good, it is still there!



After purchasing it, I quickly check my Download List and transfer the Download to my PS Vita. The game will then show up in the Download Queue.



Seeing that the NumBlast on my Download Queue is showing 'Waiting...', I then disable Airplane mode and reenabled the Wifi. Subsequently I power it off and on again. And voila, soon after few seconds I saw the spinning animation showing on the top right icon showing that it is now downloading the NumBlast game on my Download Queue directly to my PS Vita!

Having this game sitting on my PS Vita, what's next is to exploit it! Note that I do not have any prior experience to launch any exploit on PS Vita. So the overly simple instruction below is indeed very puzzling.


Casting my question aside, I immediately download the TNV Loader, TN-V Core, and OpenCMA.







As described, OpenCMA is a patch over the official CMA (Content Management Assistant) released by Sony allowing user to transfer any data (PSV/PSP/PS game, saves, application, photo, music, movies) from PC to PSV and vice versa. Sort of like a backup application. Without this patch, you won't be able to do the transfer as your PS Vita will prompt you to update the firmware since every access is validated on Sony server. This is where this patch comes into handy, it bypass the check to Sony server allowing us to use it anytime even without Internet connection.

One thing I realized is even after following their installation and patching the CMA, my PS Vita still refuses to connect to it and the prompt message asking me to update my PS Vita firmware still exist!



Apparently there are still additional steps that I must do, which is turning on the Airplane mode and restart my PS Vita. Upon next boot up, I managed to launch the Content Manager app just fine.

Having this connection setup, I browse to my Application data folder and copy the TN-V loader and TN-V Core. The readme.txt found in TN-V core (or the download site) contains very useful instructions. To make sure I don't screw things up on first try, I proceed with their instructions very carefully by paying close attention in every single step.




Copy the content of FW301-Numblast_US to PSAVEDATA folder.



Following next, I copied TN.BIN and FLASH0.TN from release_tnv8 (TN-V Core) into the NPUG80320KEXPLOIT folder which contains the H.BIN file. In addition, I also copied the PSP firmware 6.60 (renamed as 660.PBP) into the same folder. I downloaded the 660.PBP files here.



And that's it. I then launch Content Manager and navigate:
 > Copy Content > PC to PS Vita System > Applications > Saved Data > PSP/Other

I start to transfer the saves by ticking both the saves data titled NUMBLAST and then the Copy button.



While launching the NUMBLAST app, I'm still having my finger crossed hoping that nothing will go wrong.



The screen will flashes white and green briefly before showing the familiar TN-V Recovery Console very similar with the ones on PSP. The ship has finally sailed! Now then let us install the 6.60 CFW (Custom Firmware) by going to Advanced -> Install 6.60 files.




What a nostalgic XMB (Cross Media Bar) returning on my PS Vita! For a little while I actually thought this is my PSP since I'm also using the exact green background back then on my PSP-2000.




Now that I have it running smoothly, the next milestone is to install my favorite homebrew!

I hope you are also excited about this exploit just as I did!

8 comments

I tried exactly this and got An error occurred (C1-2858-3). What to do here

Reply

Hi there. Did you copied both TN.BIN and FLASH0.TN from release_tnv8 (TN-V Core) into the NPUG80320KEXPLOIT folder which contains the H.BIN file? I initially got that same error when I left out the FLASH0.TN.

Reply

thnx bro. very nice,detailed step by step tut. i use EU version but couldnt get it to work . for some reason i always got just a black screen and after MINUTES i got the (C1-2858-3) error. i own also KoP and i am not a new on this area. i use tn-v for 2 months already without any problems...
however. i redownloaded tn-v8 files again for numblast but this time i chosed the US version...did the same as with the EU version and copied all 4 folders(us versions have different folder numbers)to my vita via cma and started the game while holding r-trigger down.
now i get the white,green flash and recovery menu showed up. i installed 6.60 files and started psp xmb. i was surprised to see my (already per KoP installed) games like virtual tennis and chess. ^^
idk why it acted all like this but finally ima happy i got this to work too. i am also unsure it has something to do with mentonied folders and versions or it was just because. but somehow i think ur article helped me too. so : THANK you ! :)

Reply

Hi Kevin, I'm glad that my tutorial somewhat prove to be useful to your aid. So far I've tested homebrew emulators such as gpSP, snes9xTYL, MasterBoy and they all work wonderfully. Unfortunately I couldn't load DosBox for some exception error. Stay tuned as I am currently seeking a workaround for it. I had already gotten Win95 to load on my x86 machine running DosBox.

Reply

I am having a hard time installing the homebrews!! Ive followed the TN-V Read Me about installing .ZIPS but to no avail. Ive made sure that the extension were on and that everything was capitalized. After compressing the INSTALL.ZIP/PSP/GAME/FILER/EBOOT.PBP or any other hombrew/emulator and placing it in the kexploit folder and making sure that i chose the right file compared to its file size, it still doesnt show up under memory stick. It shows on the save data utility menu on the VSH but not under the memory stick!! The only thing that shows up on the memory stick is the game save for numblast and if i play that it just triggers the reboot of the VSH. Any help is appreciated.

Reply

Hi Frank. By right it will show up on your Memory Stick if you had the correct file structure and having the INSTALL.ZIP name capitalized. Double check that the file structure of your zipped file is indeed PSP\GAME\FILER\. One suspicion that I had is the INSTALL.ZIP file could be named as INSTALL.ZIP.ZIP instead. This could happen if you just simply rename it without turning on the 'Show known file extension' on the Control Panel. I could send you the INSTALL.ZIP file containing FILER if you are still having trouble by email.

Reply

I had a problem, when I try to install the 6.60 files a error message appears: "pspPSARInt failed (0xFFFFFED3)
What can I do or what I'm doing wrong???

Reply

Hi there. Are you sure that you had the 660.PBP all capitalized? That is the only cause that I can think of. Or perhaps redownload the .PBP file?

Reply

Post a Comment

If you found this article or post helpful to you, feel free to enter your comments below ;)