starred/AnyPS5
1
0 Fork 0
mirror of https://github.com/boykopovar/AnyPS5.git synced 2026-10-22 08:33:12 -05:00
Code Issues Packages Projects Releases 3 Wiki Activity
Files
797fb303c5cad840bc148ed7a9c8df366175b8a4
AnyPS5/docs/dev/debt/libSceSystemService.md
T

31 KiB
Raw Blame History

libSceSystemService technical debt

Silent stubs

  • libSceSystemService - sceSystemServicePowerTick, sceSystemServiceReportAbnormalTermination, sceSystemServiceDisableMusicPlayer, sceSystemServiceReenableMusicPlayer, sceSystemServiceDisableMediaPlay and sceSystemServiceReenableMediaPlay return success and do nothing: the host has no auto power-off timer to reset, no system crash reporter to notify, no system music player to pause or resume and no system media playback to disable. PPSA01521 calls sceSystemServiceDisableMediaPlay during start-up, and its wrappers for both pass no arguments
  • sceSystemServiceLaunchWebBrowser (libSceSystemService) - AnyPS5 launches no web browser, so the call fails and nothing is shown. RommPS PPSA76677 then tells the player to scan its QR code instead
  • sceSystemServiceShowControllerSettings (libSceSystemService) - returns success without showing the controller settings: AnyPS5 has no system UI to open. Cat Quest III (PPSA15065) imports it
  • sceSystemServiceShowDisplaySafeAreaSettings (libSceSystemService) - returns success without showing the display safe area settings dialog: AnyPS5 has no system UI to open. PPSA03332 imports it, and the no-argument signature is assumed: Orbital has sceSystemServiceShowControllerSettings but not this call
  • sceSystemServiceOpenChallengeActivity (libSceSystemService) - returns success without opening the challenge activity: AnyPS5 has no system UI to open. Cat Quest III (PPSA15065) imports it
  • sceSystemServiceOpenTournamentOccurrence (libSceSystemService) - returns success without opening the tournament occurrence: AnyPS5 has no system UI to open

Unknown function info

Functional

  • sceSystemServiceLoadExec (libSceSystemService) - besides "exit", it starts the title's own /app0/eboot.bin or another executable under /app0 that the relinker converted with --executable, which is looked up beside the running one (/app0/picker/picker.bin as picker.picker.bin with the running executable's extension). The main executable is the one APS5_EBOOT names, which the first call sets to its own path. After the guest shutdown the old process ends without running guest exit handlers or host destructors; as during exit, a guest thread that calls a library the shutdown has stopped waits for the end instead of unwinding. "exit" ends the process after the host shutdown without running the title's atexit and __cxa_atexit handlers, since the console's shell closes the title instead; a line the title writes just before through its own thread, such as a forwarded standard error line, may not be printed. VLC for PS5 (PPSA85300) relaunches itself with no arguments; RetroArch (PPSA99169) starts its frontend picker with {"", NULL}, and the picker starts eboot.bin with {"--ps5-mode=retroarch", NULL} or /app0/es-de/es-de.bin (picker.cpp), so the list holds only arguments. A list with a first entry becomes the whole guest argv, with no program name in front (LoadExec.cpp): a PS5 RetroArch console transcript records a restart with one argument entering with argc=1, argv[0]="--ps5-relaunch=1", and a launch from the home screen with argc=1, argv[0]="" (relaunch_ps5.cpp). For such a list Linux replaces the process with fexecve, and macOS with posix_spawn and POSIX_SPAWN_SETEXEC: the PID and the standard streams stay, the other descriptors are closed and the working directory becomes the executable's. Windows starts a suspended process that inherits only the standard streams and a handle of the old process, and its entry stub waits for the old process to end before it loads the title's libraries, so a shell or script that started the title sees it end. A null list or one without a first entry keeps the earlier launch: the new executable gets only its own path as its command line (CreateProcessW on Windows, execv on Linux and macOS), so its argv[0] is the host path, and the old process ends without waiting for it. What the console passes for such a list is not known, nor are its argument limits and error codes. Paths outside /app0 and unconverted executables throw

  • Running application ID (libSceSystemService) - sceSystemServiceGetAppIdOfRunningBigApp reports 1 as the running title's app ID. The value is AnyPS5's own: the console's shell assigns app IDs and their values are not known here, so other calls that take an app ID must use the same one. sceSystemServiceKillApp with that ID and the arguments -1, 0 and 0, which SwanStationPS5 passes to close itself and ps5-payload-dev's hbldr passes to close the running game, ends the title as its own exit(0) would: the guest's shutdown and atexit handlers run and the process exits with status 0. On the console the call returns and the shell then ends the title, and whether those handlers run there is unknown; here there is no shell, so the call does not return. Another app ID or other arguments throw.

  • sceLncUtilKillApp, sceLncUtilKillAppWithReason (libSceSystemService) - the running title's app ID ends the title as sceSystemServiceKillApp does, which SharpProspero describes as a wrapper of sceLncUtilKillApp; the signatures follow its launcher utility bindings. Another app ID throws, and so does a reason other than 0, whose meaning and effect on the console are not documented

  • LoadExec descriptors (libSceSystemService) - on Linux, a call with an argument list replaces the process with fexecve, which first closes every descriptor above 2, and on macOS with posix_spawn, which closes them through POSIX_SPAWN_CLOEXEC_DEFAULT; a call without one uses execv, and the guest's descriptors stay open across it. On both paths descriptor 2 first gets back the host standard error a guest redirect kept, so the runtime's output does not follow the title's redirect (RetroArch's trace file, VLC's log) into the next executable. Which descriptors the console passes to the new process is not known

  • AppMessaging receive buffers: the supplied module confirms the eight messaging argument lists, 64-bit event masks, byte-sized clear flag and 8192-byte send limit. Receive writes an 8216-byte message whose field meanings still require the sender/service handler. The protected bodies remain unchanged.

  • LncUtil process and status payloads: local-process creation transmits a 72-byte parameter block; application-status entries occupy 64 bytes and shell-UI reboot entries 1336 bytes. Their fields remain unresolved. Title-ID output occupies 16 bytes; category, category type and launched-user outputs are 32-bit scalars. The argument lists are recovered through the indirect dispatch targets rather than the decompiler's apparent zero-argument wrappers.

  • LncUtil event and diagnostic payloads: local-process status entries are 36 bytes, coredump state 12 bytes and video-finalization state eight bytes; their field meanings remain unresolved. Daemon and shell-UI events are distinct output structures. GetDbgExecutablePath writes up to a 1024-byte protocol output and forwards a 64-bit selector whose meaning is unresolved. Boolean outputs and the two direct boolean budget/mode queries are confirmed.

  • LncUtil launch and lifecycle payloads: the 40-byte launch parameter fields and meanings of several 64-bit focus/resume/suspend/exception values remain unresolved. Launch and load-exec use null-terminated argument vectors; asynchronous launch/kill write a 32-bit request ID. The argument positions and transported widths are confirmed, but the service operations remain protected stubs.

  • ShellCoreUtil application data: GetAppLaunchTypeInfo writes eight bytes whose fields are unresolved. Application-data and launched-parameter keys are null-terminated strings, with 32-bit capacities/outputs. Format/fsck paths and mini-app return values are strings. File-formatting and service implementations remain protected stubs.

  • ShellCoreUtil queries: launched-parameter strings have signed 32-bit capacities; checker strings use machine-sized capacities and one or two string keys. Cloud status and device-index outputs are 32-bit scalars; the timeout variant consumes one byte. Partition-size output and the direct temporary-content free-size return are 64-bit. Device-index field meanings and the service-side checker protocol remain unresolved.

  • ShellCoreUtil storage and HID queries: partition free sizes and required application-content size are 64-bit outputs; fsck takes a path and a 32-bit progress output. HID string queries transport a 64-bit capacity and 32-bit selector, while output-vector lengths sign-extend the capacity's low 32 bits. The selector meaning and IDU mode byte values remain unresolved. Streaming status and the compositor-profiler return are boolean; the compositor-profiler and current GPU-load queries consume no caller arguments.

  • ShellCoreUtil account and privacy payloads: Pbtc user information occupies 800 bytes; privacy-event data occupies eight bytes after two string keys, each limited to 32 characters. The five account-information outputs occupy 8, 104, 136, 1024 and 1032 bytes; their fields remain unresolved. Category-default list output has a byte capacity and unresolved element format. Remote-play/share-play/social-screen outputs are boolean; application display-state queries take a 32-bit application ID. Only the support-site query signature is restored; no endpoint content is included.

  • ShellCoreUtil telemetry and user queries: telemetry-token output is 4112 bytes, including an eight-byte service result at offset 4104; its meaning remains unresolved. UMM status is an eight-byte output with unresolved fields. UI status is a 64-bit event mask; VM statistics and workaround-file strings use machine-sized capacities. HideBlocksFromUser transports a 64-bit value and a 32-bit value whose exact semantics remain unresolved. Eye-distance adjustment writes one byte.

  • ShellCoreUtil launch and status arguments: LaunchByUri reads an eight-byte parameter containing two 32-bit fields and swaps their order in its message; field meanings remain unresolved. Navigation consumes one 32-bit value, not the phantom vector/register arguments shown by decompilation. Workaround checks and mount requests take strings. Logout-state queries transmit two 32-bit values and return a byte output; selector meanings remain unresolved.

  • ShellCoreUtil notifications: IDU notifications use a signed 64-bit identifier, optional text and a 32-bit type. Error-log submission consumes four strings and two 32-bit values in the restored order; their semantic names remain unresolved. PSM events carry a 32-bit event ID and a string. IME notification consumes a 32-bit value and one byte; service meanings remain unresolved.

  • ShellCoreUtil state setters: UI updates take a 64-bit status and mask; app data takes two strings. Display-state setters mask their low bits, so source enum names and declared widths cannot be inferred from those masks alone. Streaming/impose/profiler setters test all 32 bits. User-focus reads take an application ID and return its user ID; writes apply a user ID to the current application. Device-index field meanings remain unresolved.

  • ShellCoreUtil dialog parameters: the 24-byte error-dialog parameter contains a message pointer at offset zero, a null-terminated vector of string arguments at offset eight and a byte flag at offset 16. Field offsets and size are asserted; the flag meaning remains unresolved. Start/stop streaming-game and unmount requests take strings. Talk-key events transport a 64-bit value and two 32-bit values whose meanings remain unresolved. Bus-transfer testing writes one byte after a string input.

Reference in new issue View Git Blame Copy Permalink