AnyPS5/docs/dev/debt/libScePad.md

libScePad technical debt

Unknown function info

• libScePad profile and device-setting exports - profile getters, tuning, saved settings, USB state, shared output and virtual-device setting arguments are recovered. Hunt and Leonardo reset each consume only a handle; physical VR USB status consumes only an output pointer. Remote settings output is 64 bytes and license-controller information is 1224 bytes. Kernel ioctl payload fields remain incomplete.

• libScePad report and tracking exports - read, extended-read, tracker, UI, VR-controller and report argument registers are recovered. Feature reports use a byte report ID and 64-bit byte count, capped at 64. VR trigger effects consume a 56-byte record; the dual-controller call uses two handles and a mask with records at offsets 8 and 64. Remaining payload field layouts use incomplete declarations, including extended samples and kernel-owned extension reports.

• scePadUnknown_n3kSX62fgNo (libScePad, NID n3kSX62fgNo) - the name is unknown, and the 0 returned after scePadInit is inferred, not measured. In the OS 10.01 system module the function takes no arguments, returns 0x80920005 before scePadInit, and otherwise sends a per-process value of 1 to ShellCore over Mbus, returning 0x809200ff if that call fails and 0 if it succeeds, with or without an open handle. The #3177 probe measured 0x809200ff in a process that is not a game; a game process is assumed to get 0. The ShellCore setting it changes is unknown and not modelled

• scePadSetAngularVelocityDeadbandState (libScePad) - with the deadband on, each angular velocity axis whose magnitude is below 0.017453292 rad/s (1 degree per second) reads as 0, before the orientation is integrated; it starts off. Threshold, per-axis test and default follow duaLib, which reimplements the PC libScePad.dll; the console's threshold is not measured, and the deadband is kept per library rather than per handle since one pad handle exists

• scePadOpen and scePadOpenExt (libScePad) - special ports (type 2) return DEVICE_NOT_CONNECTED (0x80920007) because the host has no special controller, and scePadGetHandle has no handle for them; whether the console opens a handle and reports the device as disconnected later is unknown. scePadOpenExt handles only special ports. PPSA01317 passes a 16-byte param that names the device by vendor and product id (b7 0e 04 0e ... for 0x0eb7:0x0e04) and skips the user on any negative result. Other port types throw

• scePadVrControllerReadState - the 104-byte output layout is recovered, including buttons, stick, triggers, touch fields, motion, connection state and timestamp. Touch-value semantics and kernel report production remain incomplete; the export still throws.

• scePadVrControllerReadCombinedState - the two handle arguments and 128-byte output are recovered; output field semantics remain incomplete.

• scePadSetVibrationMode (libScePad) - modes 1 to 3 and 5 are accepted and stored. On a PS5 (firmware 13.60) the call returns 0x80920005 before scePadInit, then rejects a mode of 0 or below with INVALID_ARG before it checks the handle, and returns INVALID_HANDLE for a bad handle with any higher mode; whether an open handle accepts modes above 3 was not measured, since the payload could not open a pad; 5 is accepted because PPSA25286 passes it on its open handle at start-up; the meanings of modes 3 and 5 are unknown (PPSA21480 calls it with 3 right after scePadOpen and aborts on failure; SharpProspero names only 1 and 2). The stored mode has no other effect

• scePadIsRemoteController (libScePad) - the name hashes to NID fCWdlnmB1Ks; the signature (int handle, bool* remote) comes from PPSA16064, which zeroes a byte, passes its address after scePadGetControllerInformation and ignores the result. The error codes follow the other pad calls. Controllers are local devices, so the answer is always false

• scePadSetAngularVelocityBiasCorrectionState (libScePad) - inferred signature (int handle, bool enabled) follows scePadSetTiltCorrectionState and scePadSetAngularVelocityDeadbandState; an invalid handle returns PAD_ERROR_INVALID_HANDLE, disabling is a no-op, and enabling throws because bias correction is not modelled

• scePadGetAccessibilityControllerState (libScePad) - the value a console reports for a DualSense is not measured; the emulated pad, which is not an Access controller, reports 0. The name hashes to NID zBsgF0q8DIM. In the OS 10.01 system module the (int handle, uint32_t* state) function returns 0x80920005 before scePadInit, then INVALID_ARG for a NULL state and INVALID_HANDLE for a bad handle, and otherwise asks the pad driver for a per-device value of the device behind the handle: 0 when no device is behind it, 1 when the driver has no answer, else the driver's value. What the values mean is unknown

• libScePad internal data and device control - kernel-owned version, telemetry, Lotus-button and update payload fields remain unresolved. Lotus-button parameter units and the three blinking byte meanings are unknown. Port information occupies 152 bytes; history records occupy 72 bytes; Leonardo unique data occupies 24 bytes. Their complete field semantics remain unresolved.

• libScePad profile writes and virtual devices - profile writes take a handle, profile ID, profile pointer and a 32-bit result pointer; the profile payload direction and fields remain unresolved. Virtual-device creation takes an input record and an output ID pointer, whose width is not exposed by the wrapper. Component information copies 16 bytes; field meanings remain unknown. Virtual trigger state contains two 32-bit states and three control bytes, but the control semantics remain incomplete.

Functional

• Touchpad resolution (libScePad) - the library reports a DualSense to every title, so the controller information reports its touchpad, 1920 by 1080 at 44.86 pixels per cm, and the host controller's fingers and the keyboard touch contacts are placed in that range. duaLib reports these values for a DualSense and 1920 by 943 at 44 for a DualShock 4, and the Linux kernel's hid-playstation holds 1920 by 1080 against 1920 by 942 for the DualShock 4. A DualShock 4 on the host reports through the DualSense range too, so its last touchpad rows are never reached. The console's values are not measured