Kernel

The Vita has a purely modular kernel. All components of the kernel are skprx files found in the os0: partition and are listed in Modules.

UID

Class

Version	Name	Size (bytes)
3.60-3.73	SceUIDModuleClass	0xF8
3.60	SceUIDThreadClass	0x200

GUID

Global UID.

0 0 00 0000 0000 0001 0000 0000 0000 000 1

Error bit. should be 0.

PUID bit. should be 0.

Sub UID. 14-bits wide. Has no effect directly for core uid. Somewhat random values are used for security (With increase method).

Core UID. 15-bits wide. Value to identify the object.

UID bit. should be 1.

The Core UID is 15-bits so in theory the system can create to 0x8000 (32768) objects

Example : 0x10005, 0x10007, 0x10547, 0x2DF84A9

PUID

Process UID.

0 1 00 0000 0000 0001 0000 0000 0000 000 1

Error bit. should be 0.

PUID bit. should be 1.

Unknown. maybe sub UID. 14-bits wide.

Unknown. maybe core UID. 15-bits wide.

UID bit. should be 1.

Example : 0x400010001

Security

KASLR

Since version 1.80 or so, the kernel implements kernel address space layout randomization to discourage ROP attacks.

Canaries

Since version 1.80 or so, the kernel makes use of stack canaries to detect stack buffer overflows and halts the system when an overflow is detected.

Memory Domains

Memory domains is a feature in ARM MMU that provides an easy way of showing and hiding groups of addresses as well as their permissions. When a syscall is made, the handler disables all access to memory domains for user memory so kernel code cannot directly access user memory. This means if a user pointer is passed in and the kernel forgets to check it and dereferences it directly, it will abort. In order to access user memory, special functions are used that temporarily enables all domains and the access is implemented with the ARM unprivileged access instructions LDRT and STRT to make sure the access functions cannot read or write in kernel memory space. As long as the domain disable code in the syscall hander is secure and the user memory access functions are secure, there is no need for additional checks implemented per function. Additionally all non-code pages are marked as "execute never" (XN) in both kernel and userland.

Syscall Randomization

The numbers assigned to syscalls change on each boot but the delta between the same functions exported by the same module will stay consistent.

NID Poisoning

Since version 2.10, SceKernelModulemgr replace the NIDs entries in the module import tables with junk data. That means that you can no longer map syscall numbers to NIDs.

Usermode stack pivoting protection

Since unknown version (seen on 3.18) the kernel will terminate an application if it notices that its stack pointer register is not pointing into the stack memory.

User&kernel heap overflow protection

dlmalloc, used for heap allocations, is compiled with -DFOOTERS=1 to enable more heap overflow checks. Additionally, a custom SceNetPs malloc implementation also does some heap overflow checks on its own.

List of kernel modules

For a list of all kernel modules, check out Modules.