PS Vita Firmware 3.69 & 3.70 Exploit by TheFlow has been released!

What is Trinity?

“Trinity” is the third public jailbreak for the PS Vita and currently supports the latest firmwares 3.69 and 3.70. The developer named it “Trinity” due to the way the exploit functions as it consists of three stages: the MIPS Kernel Exploit, the PSP Emulator Escape and the ARM Kernel Exploit. It’s similar to vita exploit h-encore in regards to the user will be required to do the exploit again following booting up.

It’s recommended you use this exploit to downgrade to 3.60 or 3.65 and using their respective exploits for those firmwares. Modoru is still used to downgrade to lower firmwares so the article here written by Freakler is still a valid guide to doing so. The Github for the exploit can be found here and includes links to support the developer. You can also find a Bi-Weekly Questions thread on r/vitahacks incase you have any questions. It’s a great place to learn from other users mistakes as well as general troubleshooting regarding the exploit. A video of the exploit can be found below:

Requirements

Below are some simple requirements before doing the exploit:

• Your device MUST be on firmware 3.69 or 3.70.and if you’re on a lower firmware you should use h-encore instead.
• A memory card is required to install if your device is a phat OLED model and is not required for Slim/PS TV models.

Preparation

Skip to “Installation” if you have already done the preparation.

1. If you’re on firmware 3.69, you have two options:
   • Either update to firmware 3.70 (go to Settings → System Update).
   • Or set DNS to 212.47.229.76 (go to Settings → Network → Wi-Fi Settings → Your access point → Advanced Settings and set DNS Settings to Manual and Primary DNS to 212.47.229.76).
2. Register a PSN account to your device if you don’t have one registered yet. Only 3 devices can be registered per account.
3. Download and install any PSP/minis game (PS Vita or PS one Classics do not work). There are demos in most regions (if you know a title that is not listed here, please let me know):
   • EU/UK: Ape Quest
   • NA/SG: LocoRoco Midnight Carnival
   • JP: YS seven

   Unfortunately, if you can’t find a demo in your region, you must either buy any PSP/minis game, or register a new PSN account in one of the regions listed above.

4. Please make sure that your demo is a PSP/minis game. To verify, please launch the game and hold the PS button for a while. Then a quick menu should come up with the Settings option, where you can set bilinear filter, etc. If this option is not there, you’ve likely downloaded the wrong game. For help, please consider watching some youtube tutorials and see how a PSP game should look like.

Installation

1. Download and install qcma and psvimgtools (check the releases section for the binaries).
2. Start qcma and within the qcma settings set the option Use this version for updates to FW 0.00 (Always up-to-date)to spoof the System Software check.
3. Launch Content Manager on your PS Vita and connect it to your computer, where you then need to select PS Vita System -> PC, and after that you select Applications. Finally select PSP™/Other and click on the game that you want to turn into the Trinity exploit. If you see an error message about System Software, you should simply reboot your device to solve it (if this doesn’t solve, then put your device into airplane mode and reboot). If this does still not work, then alternatively set DNS to 212.47.229.76 to block updates.
4. Transfer the game over to your computer by clicking on Copy on your PS Vita. After copying, you go to the folder /Documents/PS Vita/PGAME/xxxxxxxxxxxxxxxx/YYYYZZZZZ on your computer, where xxxxxxxxxxxxxxxx is some string corresponding to your account ID and YYYYZZZZZ is the title id of the game that you’ve just copied over. You can look at the image at YYYYZZZZZ/sce_sys/icon0.png to verify that it is indeed your chosen game. Furthermore, the YYYYZZZZZfolder should contain these folders: game, license and sce_sys.
5. Before you attempt to modify the backup, you should make a copy of it. Just copy YYYYZZZZZ somewhere else, such that if you fail to follow the instructions, you can copy it back and retry.
6. Insert the xxxxxxxxxxxxxxxx string here. If the AID is valid, it will yield a key that you can now use to decrypt/re-encrypt your game.
7. Decrypt the game backup by executing the following command in your command line/terminal (make sure you’re in the right working directory. On Windows you can open the terminal in the current working directory by typing in cmd in the path bar of the file explorer. Also, if you haven’t installed psvimgtools yet, then just place them in the YYYYZZZZZ folder):

   psvimg-extract -K YOUR_KEY game/game.psvimg game_dec
   

   If done correctly, you should see an output like this:

   creating file ux0:pspemu/temp/game/PSP/GAME/YYYYZZZZZ/EBOOT.PBP (x bytes)...
   creating file ux0:pspemu/temp/game/PSP/GAME/YYYYZZZZZ/__sce_ebootpbp (x bytes)... 
   all done.
   

8. Download Trinity and copy the PBOOT.PBP file to game_dec/ux0_pspemu_temp_game_PSP_GAME_YYYYZZZZZ/PBOOT.PBP (the files EBOOT.PBP, __sce_ebootpbp and VITA_PATH.txt should exist in this folder). If PBOOT.PBP does already exist there, just overwrite it.
9. Now re-encrypt the backup similar to above by typing this in your command line/terminal:

   psvimg-create -n game -K YOUR_KEY game_dec game
   

   If done correctly, you should see an output like this:

   adding files for ux0:pspemu/temp/game/PSP/GAME/YYYYZZZZZ
   packing file ux0:pspemu/temp/game/PSP/GAME/YYYYZZZZZ/EBOOT.PBP (x bytes)...
   packing file ux0:pspemu/temp/game/PSP/GAME/YYYYZZZZZ/PBOOT.PBP (x bytes)...
   packing file ux0:pspemu/temp/game/PSP/GAME/YYYYZZZZZ/__sce_ebootpbp (x bytes)...
   created game/game.psvimg (size: x, content size: x)
   created game/game.psvmd
   

10. Remove the game_dec folder (and PSVimg tools if copied here) and select Refresh database in qcma settings.
11. Now you need to copy back the modified backup to your PS Vita: Launch Content Manager on your PS Vita and connect it to your computer (if it’s already open, just go back to the first menu), where you then need to select PC -> PS Vita System, and after that you select Applications. Finally select PSP™/Other and click on the modified game. Perform the copy operation and exit Content Manager.
12. In the livearea, the game should now have a different icon and should now be called Trinity (eventually you have to rebuild the database in recovery mode to make the bubble change its look). If not, please re-read the instructions more carefully and begin from fresh.
13. Turn on Wi-Fi, then reboot your device and straightly launch Trinity. Do not do anything else, otherwise the exploit will be less reliable. It is very important that you do not have any running downloads in background.
14. Enjoy the exploitation process and wait until it launches the Construct. If the exploit fails, simply rerun Trinity.
15. Within the Construct, select Download VitaShell, then Install HENkaku and finally Exit.
16. Congratulations, your device is now able to run homebrews. It is highly suggested that you downgrade your device to either firmware 3.60 or 3.65/3.67/3.68 using modoru. On 3.60, you can use HENkaku and on 3.65/3.67/3.68 you can use h-encore. If you don’t downgrade your device now, you may lose the ability to launch Trinity later and therefore not be able to hack your device anymore.

FAQ

Exploit

• “I get the error [TURN ON WI-FI TO USE THIS EXPLOIT].” – Just hold the PS button and turn on Wi-Fi in the quickmenu.
• “I get the error [EXPLOIT FAILED: 0x800200CB].” – This can sometimes happen. Just rerun the exploit
• “My device freezes/panics.” – Be sure you do not have any downloads running in background. Also make sure that you do not launch anything else before Trinity. A fresh reboot is always recommended.
• “Trinity crashes in the second run.” – It is not recommended that you launch Trinity multiple times. Always reboot your device before launching Trinity.

HENkaku Settings

• “I don’t see all folders in VitaShell.” – Launch the Settings application and select HENkaku Settings, then select Enable unsafe homebrews. This will grant you full permission in VitaShell.
• “I can’t find the HENkaku Settings.” – Launch the exploit and reset taiHEN config.txt and reinstall HENkaku.

enso/permanent hack

• “Can I install enso on 3.69 or 3.70?” – Not on these firmwares, but you can downgrade to firmware 3.60/3.65 using modoru and then install enso.

Final Thoughts

Keep in mind it’s advised to downgrade as soon as possible. The developer, TheFlow, claims this will be his last exploit for the PS Vita so it’s possible we may not see anymore by them in the future. I for one am thankful for his contributions towards the community and wish them the best in their future en devours. I’m sure everyone in the community appreciates all of their hard work.