AnyPS5/docs/dev/debt/libSceSystemService.md

libSceSystemService technical debt

Silent stubs

• libSceSystemService - sceSystemServicePowerTick, sceSystemServiceReportAbnormalTermination, sceSystemServiceDisableMusicPlayer, sceSystemServiceReenableMusicPlayer, sceSystemServiceDisableMediaPlay and sceSystemServiceReenableMediaPlay return success and do nothing: the host has no auto power-off timer to reset, no system crash reporter to notify, no system music player to pause or resume and no system media playback to disable. PPSA01521 calls sceSystemServiceDisableMediaPlay during start-up, and its wrappers for both pass no arguments
• sceSystemServiceLaunchWebBrowser (libSceSystemService) - AnyPS5 launches no web browser, so the call fails and nothing is shown. RommPS PPSA76677 then tells the player to scan its QR code instead
• sceSystemServiceShowControllerSettings (libSceSystemService) - returns success without showing the controller settings: AnyPS5 has no system UI to open. Cat Quest III (PPSA15065) imports it
• sceSystemServiceOpenChallengeActivity (libSceSystemService) - returns success without opening the challenge activity: AnyPS5 has no system UI to open. Cat Quest III (PPSA15065) imports it
• sceSystemServiceOpenTournamentOccurrence (libSceSystemService) - returns success without opening the tournament occurrence: AnyPS5 has no system UI to open

Unknown function info

• sceSystemServiceAddLocalProcessForPsmKit, sceSystemServiceKillLocalProcessForPsmKit (libSceSystemService) - AnyPS5 runs one process and starts or stops no other, so both throw without reading their arguments. The parameters follow Forever Launcher's own firmware 5.50 probes (ps5/probes/localproc in bizkut/ps5-forever): a path, a null-terminated argv and a 0x90-byte parameter block in, a handle out; the kill takes that handle. Their results on the console are unknown. Forever Launcher (PPSA99030) imports both and stops at load without them.

• sceSystemServiceLaunchApp (libSceSystemService) - AnyPS5 runs one title and cannot start another, so every call throws without reading its arguments. The (title ID, null-terminated argv, launch parameters) signature follows SharpProspero, whose AppLauncher Prospero Explorer (PPSA99109) and Prospero Multi Tools (PPSA99110) import it through and which passes a 0x20-byte launch context or null; the console's argument checks and errors are unknown

• sceSystemServiceLaunchWebBrowser (libSceSystemService) - the console's error for an unavailable web browser is unknown; it returns the kernel's EOPNOTSUPP (0x8002002D) for any arguments. The (uri, param) signature follows RommPS, which passes a URL and a null param and only tests the result for zero; the param layout and the console's argument checks are unknown

• sceSystemServiceParamGetString (libSceSystemService) - the system name (parameter 6) is the fixed PS5, not the console's name; other parameters and buffers of 1 to 64 bytes throw. PPSA26344 at 0xA87935 passes parameter 6 with a 65-byte buffer

• sceSystemServiceParamGetInt (libSceSystemService) - console language numbers 0 to 29 follow the PS4 SDK enum in OpenOrbis (21 Arabic). 30 (Ukrainian) is not in it and follows PPSA99505 (Jelly5) and PPSA99002 (ProsperoLight), whose numbers agree with the enum. Not confirmed on a console, and neither title starts on main yet. Parameter 400 returns the same number as parameter 1: PPSA01325 asks for 400 first, asks for 1 when that fails, and uses either answer as an index into the same 31 languages; in the PS5 10.01 and 12.60 libSceSystemService modules parameter 400 reads the same registry value as parameter 1, without parameter 1's mapping of newer language numbers by SDK version, and returns 0x80a10003 when an imported check that is not identified returns 1; the 4.03 module has no parameter 400. Neither the mapping nor that error is modelled, and the parameter's name is not known. Without ANYPS5_LANGUAGE the language is English (United States); the date format, time format and enter button stay fixed

• sceSystemServiceParamGetInt (libSceSystemService) - the time zone (parameter 4) and summer time (parameter 5) follow the host's local time zone at the moment of the call. Titles compute the local time as UTC plus the time zone in minutes plus 60 minutes when summer time is 1 (Apollo, GoldHEN's frame logger, and SharpProspero calls them the offset from UTC in minutes and whether summer time is in effect), so the time zone is the host's current offset east of UTC less the summer time shift while summer time is in effect: 60 minutes on Linux, and on Windows the C runtime's own summer time bias (_get_dstbias), which is also what shifted its local time. For a host zone whose summer time is not one hour, Linux keeps the sum right and the standard offset wrong, and Windows the opposite; how the console reports such a zone is unknown. libkernel's sceKernelConvertUtcToLocaltime, sceKernelConvertLocaltimeToUtc and sceKernelGettimezone still use UTC

• libSceSystemService firmware 3.20 pending exports - 477 symbol names are present in the PS5 3.20 libSceSystemService export list. Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through NotImplemented_nid_no_patch.

Functional

• sceSystemServiceLoadExec (libSceSystemService) - besides "exit", it starts the title's own /app0/eboot.bin or another executable under /app0 that the relinker converted with --executable, which is looked up beside the running one (/app0/picker/picker.bin as picker.picker.bin with the running executable's extension). The main executable is the one APS5_EBOOT names, which the first call sets to its own path. After the guest shutdown the old process ends without running guest exit handlers or host destructors; as during exit, a guest thread that calls a library the shutdown has stopped waits for the end instead of unwinding. "exit" ends the process after the host shutdown without running the title's atexit and __cxa_atexit handlers, since the console's shell closes the title instead; a line the title writes just before through its own thread, such as a forwarded standard error line, may not be printed. VLC for PS5 (PPSA85300) relaunches itself with no arguments; RetroArch (PPSA99169) starts its frontend picker with {"", NULL}, and the picker starts eboot.bin with {"--ps5-mode=retroarch", NULL} or /app0/es-de/es-de.bin (picker.cpp), so the list holds only arguments. A list with a first entry becomes the whole guest argv, with no program name in front (LoadExec.cpp): a PS5 RetroArch console transcript records a restart with one argument entering with argc=1, argv[0]="--ps5-relaunch=1", and a launch from the home screen with argc=1, argv[0]="" (relaunch_ps5.cpp). For such a list Linux replaces the process with fexecve, and macOS with posix_spawn and POSIX_SPAWN_SETEXEC: the PID and the standard streams stay, the other descriptors are closed and the working directory becomes the executable's. Windows starts a suspended process that inherits only the standard streams and a handle of the old process, and its entry stub waits for the old process to end before it loads the title's libraries, so a shell or script that started the title sees it end. A null list or one without a first entry keeps the earlier launch: the new executable gets only its own path as its command line (CreateProcessW on Windows, execv on Linux and macOS), so its argv[0] is the host path, and the old process ends without waiting for it. What the console passes for such a list is not known, nor are its argument limits and error codes. Paths outside /app0 and unconverted executables throw
• Running application ID (libSceSystemService) - sceSystemServiceGetAppIdOfRunningBigApp reports 1 as the running title's app ID. The value is AnyPS5's own: the console's shell assigns app IDs and their values are not known here, so other calls that take an app ID must use the same one. sceSystemServiceKillApp with that ID and the arguments -1, 0 and 0, which SwanStationPS5 passes to close itself and ps5-payload-dev's hbldr passes to close the running game, ends the title as its own exit(0) would: the guest's shutdown and atexit handlers run and the process exits with status 0. On the console the call returns and the shell then ends the title, and whether those handlers run there is unknown; here there is no shell, so the call does not return. Another app ID or other arguments throw.
• LoadExec descriptors (libSceSystemService) - on Linux, a call with an argument list replaces the process with fexecve, which first closes every descriptor above 2, and on macOS with posix_spawn, which closes them through POSIX_SPAWN_CLOEXEC_DEFAULT; a call without one uses execv, and the guest's descriptors stay open across it. On both paths descriptor 2 first gets back the host standard error a guest redirect kept, so the runtime's output does not follow the title's redirect (RetroArch's trace file, VLC's log) into the next executable. Which descriptors the console passes to the new process is not known