// the find
TheOfficialFloW/h-encore
Fully chained kernel exploit for the PS Vita on firmwares 3.65-3.68
h-encore is a kernel exploit chain for the PS Vita targeting firmwares 3.65–3.68, using a vulnerable DRM-free demo (bitter smile) as the entry point. It delivers a full userland-to-kernel privilege escalation via ROP chains, enabling homebrew, plugins, and clock speed overrides. Aimed at PS Vita owners who want to run unsigned code and don't mind a manual, multi-step setup.
The exploit chain is well-documented — the linked write-up explains each stage (user UAF, kernel ROP) with enough detail to learn from, not just copy-paste. The multi-stage architecture (stage1/stage2/payload/plugin) is cleanly separated, making it readable for anyone studying ARM/MIPS exploit development. ROP gadgets are defined in assembly includes rather than hardcoded offsets scattered through C, which makes the chain maintainable. The 80% success rate is honestly stated rather than hidden, and the FAQ addresses the failure modes directly.
Installation is genuinely painful — 12 steps involving four separate tools, manual encryption with per-account keys, and file paths you have to get exactly right or hit opaque error codes. The exploit requires a relaunch on every reboot unless you use enso/permanent hack, which is a meaningful daily friction cost. Last commit was 2021 and it caps out at firmware 3.68, so anything newer is permanently out of scope — this is a finished artifact, not an active project. The bootstrap UI (font.c, pspdebug.h) is minimal to the point of being barely usable; no effort went into making it approachable for non-technical users.