starred/AnyPS5
1
0 Fork 0
mirror of https://github.com/boykopovar/AnyPS5.git synced 2026-10-23 00:53:02 -05:00
Code Issues Packages Projects Releases 3 Wiki Activity
Files
ea086b23745cb167780f5aed0a3b9600a4e8dd0a
AnyPS5/docs/dev/debt/libSceHmd2.md
T

40 KiB
Raw Blame History

libSceHmd2 technical debt

Silent stubs

  • libSceHmd2 has no PS VR2 runtime: sceHmd2Initialize returns libSceHmd's UNSUPPORTED_FEATURE (0x81110016) for any param, so the other calls answer as before initialization and sceHmd2Open returns NotInitialized (0x8a720002). These results are restored from the behaviour before #7323 and are not measured on hardware: firmware 13.20's libSceHmd2, with the /dev/hmd2_cmd state measured on a retail PS5 with no headset connected (connected flag 0, status 2, user -1), initializes, returns a handle from sceHmd2Open and reports NotDetected, which the code past the initialization check models but no title reaches. PPSA01317 passes a pointer to 16 zeroed bytes, only tests the result for non-zero and then skips its VR set-up; with initialization succeeding it stopped on sceHmd2ReprojectionQueryBufferSizeAlign (#6350). That export, sceHmd2ReprojectionQueryDisplayBufferSizeAlign and sceHmd2ReprojectionQuerySeeThroughBufferSizeAlign stay unimplemented and throw pending console measurements of their sizes and alignments. The other reprojection and gaze exports throw, and libSceVrTracker2 never initializes

Unknown function info

Functional

  • sceHmd2Initialize (libSceHmd2) - the firmware also fails with 0x8a72001f when sceKernelGetAppInfo fails and with 0x8a72000a for some applications, depending on app info fields at 0x2c, 0x4b and 0x4d whose meaning is unknown, and then calls sceMbusInit; none of this is modelled

  • sceHmd2ReprojectionQueryDisplayBufferSizeAlign, sceHmd2ReprojectionQuerySeeThroughBufferSizeAlign, sceHmd2ReprojectionGetMirroringDisplayBufferSizeAlign and sceHmd2ReprojectionGetMirroringWorkMemorySizeAlign (libSceHmd2) - each returns a {uint64 size, uint64 alignment} pair in RAX:RDX; the values were measured on a retail PS5 (firmware 13.60) with no PS VR2 headset from a homebrew payload that loaded libSceHmd2.sprx without initializing it, and stayed the same for every argument tried; sceHmd2ReprojectionQueryBufferSizeAlign measured there returns 0x100828 and 0x100 for every argument, including the 2, 0xAF and 1 that PPSA05666 passes. They are assumed not to depend on initialization or on a connected headset, and their parameters are unknown

  • Hmd2BeforeInitializeZero (libSceHmd2) - before sceHmd2Initialize the console answers 0 to these 45 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: vDgpdS2N9Rw (sceHmd2InternalRegisterVibrationCallback), Ri35gKTZpvE (sceHmd2InternalUnregisterVibrationCallback), 9oyW8puiKeI, 1HZNE6jhBnQ (sceHmd2InternalPowerEventInitialize), cdwAKBZLXjs, Yub1MF58jfY, JYXAuQFnPyw (sceHmd2InternalDfuOpen), VuPKqCu3wzw (sceHmd2InternalDfuClose), GSThagVyW5U (sceHmd2InternalCrashReportOpen), J4qE5N937MY (sceHmd2InternalCrashReportClose), 9KnNj-dyASg, Qta2bkstbFk, 5ZcObnDRBXE, AvPNn0qx4WQ, jp0apqNGgi8 (sceHmd2SetIpdOffset), -kZT7X7OMg0 (sceHmd2InternalRelocalizerOpen), 1ewLtng-SVk (sceHmd2InternalRelocalizerClose), B0b8DeIUGes (sceHmd2InternalTrackingOpen), HclLg4Oj5yw (sceHmd2InternalTrackingClose), VbEvrQXsZyY (sceHmd2InternalLedDetectorOpen), bB6MKZi5UCQ (sceHmd2InternalLedDetectorClose), OXQ1EDf02XU (sceHmd2InternalImageOpen), IAxfMTvFm0M (sceHmd2InternalImageClose), qTJtAtaLeno (sceHmd2InternalGenDataOpen), j7Q16UX6l34 (sceHmd2InternalGenDataClose), pmmNM06rLqU, zdQfyDK9Ods (sceHmd2InternalSlamTraceOpen), aPRwp9GnljM (sceHmd2InternalSlamTraceClose), MjY1gBSaed0 (sceHmd2InternalGazeOpen), evAMjJYHqW4 (sceHmd2InternalGazeClose), r93FLEZ3BBk (sceHmd2InternalGazeStart), IdYURdEdNFo (sceHmd2InternalGazeStop), CVcL2Cu2AEI (sceHmd2GazeActivateGazeTracking), NmKIfVxr2s0, KeDLkkp62Gg, +aadu6-ra+A, FgnTiwwGSzk, PWAUwOTHbbo (sceHmd2InternalCreateSharedMemory), WzaEApHnsP8 (sceHmd2InternalIsGameVr2d), dXzQI8QVY7Y (sceHmd2InternalIsMiniAppVr2d), cCvFKGqRh1k (sceHmd2InternalIsCommonDlgVr2d), uj4-2VEAFPU (sceHmd2InternalIsCommonDlgMiniAppVr2d), sIaGStI-iLM (sceHmd2InternalMapSharedMemory), JzwpZOemDO8, IsC4R4bZFVU. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeNotInitialized (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720002 to these 9 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: sXaPEPY-fLA (sceHmd2InternalOpen), 3F5inHhKzXg (sceHmd2InternalGetDeviceInformation), sJAiB-6p55U, E8hDydLjsSs, xEQkSb2WJ7Y, aaP4dnR4q-0, lEU0TeUoGwI, cFVyjHBpUUU, zROtb46jTj4. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeError0004 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720004 to these 15 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: kAMsjYHBbNQ (sceHmd2InternalSetVolume), 5m73zmLpsQ0 (sceHmd2InternalResetViewPosition), EPeH4xuQ2XQ (sceHmd2InternalGetStatus), TJ8lyRsjFY4 (sceHmd2InternalClearTrackerFts), -XQVcLnyX68 (sceHmd2InternalSetSlamCommand), giQwQoHhYYA (sceHmd2InternalDfuStart), zNc9IkgawMI, -tnG5UJPvAc (sceHmd2GazeStartUserCalibration), FPhFmG+jXuQ (sceHmd2GazeStopUserCalibration), CKlkvNngofQ, yL1CZaciFWE (sceHmd2GazeSetUserCalibrationPoint), qlzgyG3s0RY, kTIDrDLzMv0, 9Gee0ef8a+U, ecZVjQdwmBI (sceHmd2GazeSetEnabledEye). Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeParameterNull (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 to these 16 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: MNtiJTDOPAU, RRy9WmqZfgU (sceHmd2InternalDecryptData), uobR4m9lgwc (sceHmd2InternalGetMirroringMode), -XPk5KWBYdo (sceHmd2InternalRelocalizerSetResultData), J44idh9izZM, Ps0wAvYaa1E, kLnMR8oQ1MY, kMz4rbBxvjo, DIU1sFRRaiE (sceHmd2GazeGetCalibrationData), ZQvU4vDzZGQ (sceHmd2GazeSetUserCalibrationData), TJpyGGP9YEY, Dih+Odk+RC0, oaqdSJw+HVY, m35gtHuanXU, CTM7QPLJF9Q (sceHmd2InternalGetFlipInfo), +rExHeC9lP0 (sceHmd2GazeObjectSelectionInitialize). Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeParameterInvalid (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720009 to these 9 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: bBh5bCp9coo (sceHmd2InternalSetPositionResetIcon), G3PNDE2VjfY (sceHmd2InternalSetPowerOff), nScCT0OPU0o, 6Q0Ng7OTN9o, -fJKh4SnFR0 (sceHmd2InternalSetBudgetMode), jUA2s-l0npY (sceHmd2InternalSetForceIcon), +9XhyAIJVj4, eBGK-o6E4RQ (sceHmd2InternalBindDeviceWithUserId), MTuFeL9184E. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeReprojectionNotInitialized (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a72000b to these 10 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: d3SEIYTP6wc, EVECbTvBezo, ciusPdJKjSU, DIwqTkcZiJo (sceHmd2ReprojectionSetUserEventStart), 64ERZWVFBTE (sceHmd2ReprojectionSetUserEventEnd), z0+0gXUJWs8 (sceHmd2ReprojectionClearUserEventStart), rjAd4nCY4DM (sceHmd2ReprojectionClearUserEventEnd), Acyg4vTdGm0 (sceHmd2ReprojectionGetCurrentOutput), aGOWaEeg04I, 9up+EPhw1No. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeError002C (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a72002c to these 1 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: V1kLQmP-17U (sceHmd2GazeObjectSelectionTerminate). Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeError1002 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a721002 to these 5 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: 2LVD1EC5SYE, Bf87AL6zWxU, XKt7w1MODFY, Y5s22M-qUDA, JJKY-BtQJLg. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeError1003 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a721003 to these 1 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: 9kj9vw8UShQ. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeMinusOne (libSceHmd2) - before sceHmd2Initialize the console answers -1 to these 12 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: EAkv8Mqt33E (sceHmd2InternalRelocalizerStart), Rv7bkmKvmz0 (sceHmd2InternalRelocalizerStop), 1oPZizn0SNA (sceHmd2InternalTrackingStart), TwCpE-nNrlo (sceHmd2InternalTrackingStop), jkqAeQfdtxw (sceHmd2InternalLedDetectorStart), +l0RQph81Z8 (sceHmd2InternalLedDetectorStop), qsmAtGw1Ncc (sceHmd2InternalImageStart), uKhwYoMsIsA (sceHmd2InternalImageStop), WNdaigr94dI (sceHmd2InternalGenDataStart), P6S5ZVWf-H0 (sceHmd2InternalGenDataStop), sun6NWE1sdg (sceHmd2InternalSlamTraceStart), --TFsJYXo04 (sceHmd2InternalSlamTraceStop). Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeValue0400 (libSceHmd2) - before sceHmd2Initialize the console answers 0x400 to these 1 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: BWqcwjCozzI. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2BeforeInitializeValue20000 (libSceHmd2) - before sceHmd2Initialize the console answers 0x20000 to these 1 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: PRz7TdBGUI0. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • libSceHmd2 pre-initialization sweep (libSceHmd2) - the names in the entries above are the aerolib names of the NIDs where one exists; the error names Error0004, Error002C, Error1002 and Error1003 are placeholders for codes whose meaning is unknown, and ReprojectionNotInitialized is ours because every export answering 0x8a72000b is a reprojection one. Exports that answered differently to null and to zeroed arguments, wrote output, returned a pointer-like value, answered 0x8a72000a (which sceHmd2Initialize also returns for some applications) or crashed the probe are left as they were

  • Hmd2CheckFirstThenError0004 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0x8a720004 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 20 exports: 9WeZr4kYfzk (sceHmd2InternalGetFwVersion), N+5h1hCOFAg (sceHmd2InternalGetRequiredPUPVersion), w2vEs2y5ZmE (sceHmd2InternalGetOpticalParam), L5gat1pe0y0 (sceHmd2InternalSetCameraSeeThroughParam), 4GnLHR9NJ1w, AHk7nGSzef0 (sceHmd2InternalGetTrackerFtsData), ncjX9d3mc0M, l63QYAUuogc (sceHmd2InternalGetSlamCommand), mrcBySCdXSo (sceHmd2InternalDfuGetStatus), ieBra+td8sU (sceHmd2InternalDfuGetUpdateStatus), s+rzBnewgGs (sceHmd2InternalDfuCheckAfterPvt), Nfcm0GBdzZI (sceHmd2InternalRelocalizerGetVersion), Tc9rasWfrm4 (sceHmd2InternalSetHomeCalibration), ckTbKTX4KZg, D7576PUbUjk (sceHmd2InternalGazeReadStatus), tTJ04SrBT8U, sDP7hZ-P6OI (sceHmd2GazeGetDeviceStatus), J+eVNbN9ndY (sceHmd2GazeGetUserCalibrationStatus), kozvHBNyxf0, 638Tmg5y6U4. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenZero (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 8 exports: 8ETtFtp5zqY (sceHmd2InternalGetVrMode), CWPkBm3EXQA, R62liQQIAaA (sceHmd2InternalGetFakeLensSeparationDistance), -bcWLHsdzo0, JngJzgNbu8U (sceHmd2SetFieldOfView), xNBSz8xrGdk, yUVPfN-jRIU, BKPR3RZ5aO4. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenError1002 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0x8a721002 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 8 exports: IG4y+drWAWw (sceHmd2InternalRelocalizerReadData), rhYUml9vppE (sceHmd2InternalRelocalizerReadDataAsync), 6574xHS+jZk (sceHmd2InternalRelocalizerReadData2), mXzaY6xVoxg (sceHmd2InternalTrackingReadData), 6af-HIZQQn4 (sceHmd2InternalTrackingReadData2), 6qWtdTHQsTk, pUm8t8xWhFg, A0XKI-WjxK8 (sceHmd2InternalImageReadData). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenMinusOne (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and -1 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 5 exports: A9s2j8OioPQ, YIgtmrL+HLY, Ng8zEkGxDNs, EtslTnqO1xU (sceHmd2InternalImageStart2), hfrnRTryKQQ (sceHmd2InternalImageSetConfig). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstTwoThenParameterInvalid (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 and argument 1 is null and 0x8a720009 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 3 exports: PPX68fNToFM, LxPIfjHaY4c (sceHmd2GazeObjectSelectionQueryMemory), w8gBTTdg+po (sceHmd2GazeObjectSelectionGetSelectedObject). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckSecondThenError002C (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 1 is null and 0x8a72002c when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 3 exports: tWJPX2ycRMM, 5UMB9PJA70o, xQs62qCk1EI. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenParameterInvalid (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0x8a720009 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 2 exports: MMc+bSlqkzk (sceHmd2InternalSetVirtualDisplaySize), NpZHgvSYgEA. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckAllSixThenZero (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 and argument 1 and argument 2 and argument 3 and argument 4 and argument 5 is null and 0 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 2 exports: z-serf9vsb0 (sceHmd2InternalPushVr2dData), IRMUFu+uG5s. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckSecondThenParameterInvalid (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 1 is null and 0x8a720009 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 2 exports: 72U64E+0z6U, LCQzi5ILGrY (sceHmd2GazeGetCalibrationDataMaxSize). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenError800d0203 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0x800d0203 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: Im0qL0j9Ubg. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenError1003 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0x8a721003 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: ng6eI8uA0h4 (sceHmd2InternalImageGetMemoryLayout). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstThenError1010 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 is null and 0x8a721010 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: mPPGgjyJrCI. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstTwoThenError1002 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 and argument 1 is null and 0x8a721002 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: ZupCJmV5BDI (sceHmd2InternalImageGetFrameData). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstTwoThenError1003 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 and argument 1 is null and 0x8a721003 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: mAQZwOX1IHU (sceHmd2InternalImageGetAverageLuminance). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstAndThirdThenZero (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 and argument 2 is null and 0 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: oacDkQkinLo. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckFirstAndThirdThenError1003 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 0 and argument 2 is null and 0x8a721003 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: zn7PHGzzEyI. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckSecondThenInvalidHandle (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 1 is null and 0x8a720003 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: wEHILc7TP04 (sceHmd2GazeInsertRawDataWithHandle). Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • Hmd2CheckSecondThenError1002 (libSceHmd2) - before sceHmd2Initialize the console answers 0x8a720008 when argument 1 is null and 0x8a721002 when every argument points at a zeroed 16 KiB buffer, writing nothing, for these 1 exports: W-ZIlUXcrNA. Each argument was nulled on its own with the others present (probe hmd2n, payload process, firmware 13.60); what the present arguments mean, and the behaviour after initialization, are not measured, so the handler throws once sceHmd2Initialize has succeeded

  • libSceHmd2 null-argument sweep (libSceHmd2) - Error1010 and Error800d0203 are placeholder names. Left as they were: the exports that write output (omimgG5itSs, FBUEhH9tQ1A, 6PeHcAaKYg8, yur+xPdWPAg, RnieDDp5ge4, jM3NEJA11yw, b0H-n-tUk0U) and those whose answer with a single null argument is neither 0x8a720008 nor their all-present answer, which take a handle or slot number rather than a pointer first (MXhloJ6Iw3w, 19wrIIiqFgM, Z389vAm47Ys, cDcrvEG8j8k, tuqJO6O6cb4, fd4fu1cziaI, UxMg7iL4nRs, K1GELwlaaGc, RFn39VCHjGY, FRoSjceDv10, wiv8+7ogrq0, wQ44gBwBw44)

  • Hmd2WriteStateTwo (libSceHmd2) - before sceHmd2Initialize the console writes the five bytes 02 00 00 00 00 at the start of its first argument and returns 0; a null first argument returns 0x8a720008: omimgG5itSs. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2WriteSize0x2000Align0x100 (libSceHmd2) - before sceHmd2Initialize the console writes the 64-bit values 0x2000 through its first argument and 0x100 through its second and returns 0; a null first or second argument returns 0x8a720008: 6PeHcAaKYg8. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2WriteFourConstants (libSceHmd2) - before sceHmd2Initialize the console writes the 16 bytes e1 f0 74 3c d8 f0 74 3c 1f f1 74 3c d8 f0 74 3c (four floats near 0.01495) at the start of its first argument and returns 0; a null first argument returns 0x8a720008: yur+xPdWPAg. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2WriteSixHalvesThenInvalidHandle (libSceHmd2) - before sceHmd2Initialize the console writes the 24 bytes 00 00 00 00 00 00 00 3f 00 00 00 3f 00 00 00 00 00 00 00 3f 00 00 00 3f (floats 0, 0.5, 0.5, 0, 0.5, 0.5) at the start of its second argument and returns 0x8a720003 for every first argument tried (0, a pointer); a null second argument returns 0x8a720008: RnieDDp5ge4, jM3NEJA11yw. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2WriteTwelveHalvesThenInvalidHandle (libSceHmd2) - before sceHmd2Initialize the console writes the 48 bytes 00 00 00 00 00 00 00 3f 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 00 00 00 3f 00 00 00 00 00 00 00 00 00 00 00 00 (floats 0, 0.5, 0.5, 0, 0, 0, 0, 0.5, 0.5, 0, 0, 0) at the start of its second argument and returns 0x8a720003 for every first argument tried; a null second argument returns 0x8a720008: b0H-n-tUk0U. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo3CheckSecondThirdThenZero (libSceHmd2) - before sceHmd2Initialize the console returns 0 for a first argument of 0 to 3 and 0x8a720009 for 4, 5, 8, 16, 255 and -1; a null second or third argument returns 0x8a720008 even with an invalid first argument. Its fourth to sixth arguments answered 0x8a720009 when null with an invalid first argument, which does not separate them from the first-argument check, so they are not looked at: MXhloJ6Iw3w. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo1ThenError1002 (libSceHmd2) - before sceHmd2Initialize the console returns 0x8a721002 for a first argument of 0 or 1 and 0x8a720009 for 2 to 5, 8, 16, 255 and -1; its other arguments were only nulled with an invalid first argument, which answered 0x8a720009 either way, so they are not looked at: 19wrIIiqFgM. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo1CheckSecondThenError1002 (libSceHmd2) - before sceHmd2Initialize the console returns 0x8a721002 for a first argument of 0 or 1 and 0x8a720009 for 2 to 5, 8, 16, 255 and -1; a null second argument returns 0x8a720008 even with an invalid first argument: Z389vAm47Ys. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo1ThenMinusOne (libSceHmd2) - before sceHmd2Initialize the console returns -1 for a first argument of 0 or 1 and 0x8a720009 for 2 to 5, 8, 16, 255 and -1; the other arguments are not looked at, for the reason given above: cDcrvEG8j8k, tuqJO6O6cb4 (sceHmd2InternalLedDetectorSetIrCameraConfigBySlot), fd4fu1cziaI (sceHmd2InternalLedDetectorSetPriorityConfigBySlot). Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo2ThenMinusOne (libSceHmd2) - before sceHmd2Initialize the console returns -1 for a first argument of 0 to 2 and 0x8a720009 for 3 to 5, 8, 16, 255 and -1; the other arguments are not looked at: UxMg7iL4nRs, K1GELwlaaGc (sceHmd2InternalImageSetConfigBySlot). Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo2ThenError1002 (libSceHmd2) - before sceHmd2Initialize the console returns 0x8a721002 for a first argument of 0 to 2 and 0x8a720009 for 3 to 5, 8, 16, 255 and -1; the other arguments are not looked at: RFn39VCHjGY. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo2ThenError1003 (libSceHmd2) - before sceHmd2Initialize the console returns 0x8a721003 for a first argument of 0 to 2 and 0x8a720009 for 3 to 5, 8, 16, 255 and -1; the other arguments are not looked at: FRoSjceDv10. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2SlotUpTo2CheckSecondThenError002C (libSceHmd2) - before sceHmd2Initialize the console returns 0x8a72002c for a first argument of 0 to 2 and 0x8a720009 for 3 to 5, 8, 16, 255 and -1; a null second argument returns 0x8a720008 even with an invalid first argument: wQ44gBwBw44. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • Hmd2IndexZeroCheckSecondThenZero (libSceHmd2) - before sceHmd2Initialize the console returns 0 for a first argument of 0 and 0x8a72100f for 1 to 5, 8, 16, 255 and -1; a null second argument returns 0x8a720008 even with a nonzero first argument. Its third to sixth arguments answered 0x8a72100f when null with a nonzero first argument, which does not separate them from the first-argument check, so they are not looked at: wiv8+7ogrq0. Measured from a payload process on firmware 13.60 (probes hmd2n and hmd2x); the meaning of the arguments and the behaviour after initialization are not measured, and the handler throws once sceHmd2Initialize has succeeded

  • FBUEhH9tQ1A (libSceHmd2) - left unimplemented: before initialization it writes the 32-bit value 9 through its second argument and returns 0 when its first argument points at zeroed memory, but returns 0x8a720001 without writing when that memory holds 0xAA bytes, and its fourth to sixth arguments answer 0x8a720001 when null, so the first argument is an in-out structure whose fields are not known

  • libSceHmd2 gaze exports - gaze argument registers and input/output directions are recovered. Result queries take a 16-byte parameter and a 56-byte or 24-byte output. Object selection uses a 120-byte parameter and 56-byte result whose fields remain incomplete. Its initialization and memory-query structures are recovered, including the 32-bit object count and memory size, memory pointer and 64-bit alignment. Calibration data descriptors contain a pointer and signed 32-bit size; calibration status contains two 32-bit selectors and three floats. The underlying calibration blob formats remain incomplete. Raw gaze input is mutable. CalibrationPoint is three floats passed by value in two SIMD registers; SetIpdOffset takes a byte and a float.

  • libSceHmd2 reprojection exports - frame identifiers and predicted display times are 64-bit. Event setters accept a kernel event queue and 32-bit event ID, consumed by sceKernelTriggerUserEvent. Mirroring uses two memory pointers and a separate 32-byte mode/reserved option. Status and current-output queries write 104 and 32 bytes; those field layouts and the reprojection initialization fields remain incomplete. Positional-reprojection mode is a byte with values 0 through 5, not a boolean.

Reference in new issue View Git Blame Copy Permalink