PSVita FW 3.50 kernel exploit files released for World of Pool/Pool Hall Pro

In the previous article, we told you the name of a game you’d need to run qwikrazor’s latest kernel exploit for firmware 3.36 and the first one for firmware 3.50 – World of Pool (EU)/Pool Hall Pro (US). Today we present you the necessary files and also a step-by-step guide to trigger the exploit.

I hope that those who wanted to buy the game have already done it. If not, the game is still available on the PS Stores and VitaUpdateBlocker is still working as of now (Thursday, 10:15am PST). VitaUpdateBlocker always works only on the pre-latest firmware (which is now 3.36) and for a limited amount of time.
UPDATE: On Friday April 10, the game was removed from the PS Stores and VitaUpdateBlocker stopped working. Good job, Sony, it took you only 6 days.

What do you need:
– a PS Vita/PSTV you want to hack
– a second device – either hacked Vita (both 1k, 2k are good)/PSTV running eCFW (any of ARK’s, TN-V, TN-C) or hacked PSP (all except for E1000 are good) running CFW (LME, ME, PRO)
– World of Pool/Pool Hall Pro on both devices. It must be the same version of game (either EU World of Pool or US Pool Hall Pro) on both devices. On the hacked device, the game can be in ISO/CSO/PSN EBOOT format.
– exploit saves + plugin: Download the files matching your game and your firmware version below.

3.36
– Pool Hall Pro (US)
FW336_PHP_US_ARK_adhoc.zip
– World of Pool (EU)
FW336_WOP_EU_ARK_adhoc.zip
3.50
– Pool Hall Pro (US)
FW350_PHP_US_ARK_adhoc.zip
– World of Pool (EU)
FW350_WOP_EU_ARK_adhoc.zip
Source: qwikrazor87

What is useless:
– PPSSPP and other emulators
– PSP E1000 (because it doesn’t have WiFi)

How to install and trigger the exploit:
Before you start, don’t forget to make a backup of World of Pool/Pool Hall Pro (if you haven’t done it yet), and then make a backup of that backup, just to be sure.
Now, open the zip file you downloaded.

1) Transfer the save in the “PSP” folder to your hacked PSP/Vita/PSTV.

2) Transfer the save in the “Vita” folder to the Vita/PSTV you want to hack.

3) Transfer the plugin (Pool Hall Pro’s “php_adhoc_exploit.prx” or World of Pool’s “wop_adhoc_exploit.prx”) to your hacked PSP/Vita/PSTV.

4) For the step 4, there are four different ways (a-d), depending on what hacked device and (e)CFW you’re using.
a) If you are using a PSP (with memory stick, not PSP Go’s internal storage) on a CFW (LME, ME, PRO) or Vita/PSTV on TN-V then make a file called GAME.TXT in ms0:/seplugins/
place this inside it:
– for Pool Hall Pro:
ms0:/seplugins/php_adhoc_exploit.prx 1
– for World of Pool:
ms0:/seplugins/wop_adhoc_exploit.prx 1
Make sure the the plugin is at the path pointed to in GAME.TXT
b) If you are using a PSP Go and its internal storage, everything is same like in the step a), except for the string you’re placing inside GAME.TXT.
– for Pool Hall Pro:
ef0:/seplugins/php_adhoc_exploit.prx 1
– for World of Pool:
ef0:/seplugins/wop_adhoc_exploit.prx 1
c) If you are using ARK, make a file called PLUGINS.TXT inside the ARK save folder.
Place this inside it:
– for Pool Hall Pro:
game,ms0:/seplugins/php_adhoc_exploit.prx,1
– for World of Pool:
game,ms0:/seplugins/wop_adhoc_exploit.prx,1
Make sure that the plugin is at the path pointed to in PLUGINS.TXT.
d) If you are using TN-C then make a file called GAME.TXT inside TN-C save folder.
Place this inside it:
– for Pool Hall Pro:
ms0:/seplugins/php_adhoc_exploit.prx 1
– for World of Pool:
ms0:/seplugins/wop_adhoc_exploit.prx 1

5) Once you have everything done as stated above, launch the game on both devices and load the saves. Then,
– On the hacked PSP/Vita/PSTV, go to Multiplayer and “Create Game”.
– On the Vita/PSTV you want to hack, go to Multiplayer and”Join Game”.

 

 

 

 

It should take a few seconds for the exploit to work. It may also crash, then try this method from @trakons. If it still doesn’t work, make sure you have Wi-Fi enabled and flight mode disabled on the Vita/PSTV. You do NOT need to be connected to an access point for it to work. Don’t forget to transfer the plugin, place the right string into the right *.TXT, and transfer that *.TXT to the right folder.

If you do not want to use the provided menu (Pro Shell), then you can replace it with another menu by switching out EBOOT.PBP. You can find more menus here.

Here’s darkamon running the exploit on FW 3.50 while using PS Vita on FW 3.18 as a second device, the menu is ARK Recovery Menu.

https://youtu.be/p2RW_Tmxqs4

– credits to qwikrazor87
– pictures by hackinformer
– video by darkamon

It works, what now?
– On FW 3.36, you’ll be able to create a custom bubble, which means that you won’t need a second device to launch eCFW anymore. You may find this information about custom bubbles useful.
– On FW 3.50, the only publicly known method to create bubbles is patched (yes), so you’ll need a second device every time you’ll want to launch eCFW. This is why I don’t recommend updating to 3.50, it is not worth it, at least not now. Don’t get me wrong, I think this exploit very cool and complex exploit, but also very impractical and potentially annoying. Firmware 3.50 simply sucks. Firmwares 3.18 & 3.36 are currently the best for ordinary users.

If you have any questions, our guide is here for you, or you can ask us directly. Thank you, qwikrazor, for your amazing work.

Source: qwikrazor87