From PS3 Developer wiki
Jump to: navigation, search

VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know.XrossMediaBar (XMB). This, is a user space executable (vsh.self), loaded by lv2_kernel/sys_init_osd.

from here several other functions/syscalls to other modules are made, e.g. lv2 (SELF decryption), lv1 (Secure_RTC, Storage_Manager, Gelic_Device, BD_Drive) etc.

not much is documented (yet) about this module. Please fill in where possible.


[edit] Modes

possible arguments to pass when executing vsh.self:

  • --mode=gametool
  • --mode=gametool2
  • --arcade=true

[edit] Offsets

Function 3.55 3.41 3.15 Notes
- - - - -
sub_308EE4 check_Is_Act_Dat_for_This_Acc_ID

[edit] Exports

Export Library Export NID Notes Usage
sys_io - - -
sys_fs - - -
sys_fs 0x18DD4604 cellFsOpen2 -
sys_fs_ps2disc 0x8160A811 switches /dev_ps2disc(1) mount?
vsh - -
vsh 0xF48562D cellSsAimIsCEX
vsh 0x145991B4 cellSsAimIsArcade
vsh 0x172B05CD update_mgr_write_eprom syscall
vsh 0x1B890AD2 update_mgr_get_token_seed syscall
vsh 0x1F80E287 cellSsAimIsTool
vsh 0x2C563C92 update_mgr_read_eprom syscall
vsh 0x3231E012 vtrm_Decrypt_Master syscall
vsh 0x349F1535 update_mgr_set_token syscall
vsh 0x3B4A1AC4 AIM GetDeviceId syscall
vsh 0x3F062337 AIM GetPsCode syscall
vsh 0xE44F29F4 cellFsUtilMount syscall
vsh 0xE7C34044 retrieves vsh memory container by "id" 0=game,1=app,2=debug,3=fg, 4=bg sys_memory_container_t vsh_E7C34044(int id)
vsh 0xE932A8C0 reboot and show minimum version
char can be "text whatever you like", no check etc.
int vsh_E932A8C0(char * )
vsh 0xFF4A1633 cellFsUtilMount syscall
vsh 0x7D73E7CD inflate_init
vsh 0x4DB8DD87 inflate_end
vsh 0x20215547 inflate_buffer
vsh 0x1C68CC75 inflate
sdk - -
sdk 0xB5877BBF cellAvsetGetMonitorInformation
sdk 0x5FAFE92B cellCryptoPuSha1Hash
sdk 0xB45387CD AesCbcCfb128Decrypt
sdk 0x55ACAB8A sha1_init
sdk 0x831E89EE sha1_update
sdk 0x3CABD075 sha1_final
sdk 0x4484A101 sha1_hmac_update
sdk 0x547B602C sha1_hmac_init
sdk 0x300B99F2 sha1_hmac_final
sdk 0x74A2A1FE sha1_hmac_buffer
sdk 0x68B630D5 aes_omac_mode1
paf - -
paf 0xBB04609B GetSparkInfo
paf 0x65BE85B3 _UnloadView _paf_65BE85B3(char * plugin_name,0,0)
paf 0x350B4536 Job_Start
paf 0xFE0C1F10 Job_Queue
paf 0xA1DC401 sets Interface from plugin uint32_t SetInterface(unknown, uint32_t identifier, void * ptr_structure)
paf 0x23AFB290 gets Interface from plugin, should allow calling its exports/funcs uint32_t plugin->GetInterface(uint32_t return from paf_F21655F3, uint32_t identifier)
paf 0x3A8454FC finds/gets Texture/Resource Example: out: uint32_t*, return from paf_F21655F3, "tex_notification_info"
paf 0x3CEC3833 sets up a plugin widget ? (page_...)
paf 0x794CEACB finds widget in a plugin Example: plugin->FindWidget(return from paf_F21655F3, "page_autooff_guide")
paf 0x89B67B9C gets msg_ text from plugin resource Example: (w)char (return from paf_F21655F3, "msg_help_system_off_soon_by_setting")
paf 0xF21655F3 finds a loaded plugin Example: uint32_t paf::View::Find("system_plugin")
vshcommon - -
vshcommon 0x7F5C551B System_plugin#1_Interface func 11 vshcommon_7F5C551B(int * texture_dialog, int* texture_dialog_shadow, wchar * infotext1, wchar * infotext2, int)
vshcommon 0x94F43BE7 System_plugin#1_Interface func 12 vshcommon_94F43BE7(uint8 )
vshcommon 0xF9E43DA2 returns "msg_ok" wide char text
vshcommon 0xCCD2C319 returns "msg_cancel" wide char text
vshcommon 0x746C5F88 returns "msg_option" wide char text
vshcommon 0xF995E53F returns "msg_back" wide char text
vshcommon 0x26F18EDF returns "msg_enter" wide char text
vshcommon 0xE9E8DA5 returns "msg_no" wide char text
vshcommon 0xB8E256D7 returns "msg_yes" wide char text
vshcommon 0x79A562D5 System_plugin#1_Interface func 25 circle_cross
vshcommon 0x75DC9C2D System_plugin#1_Interface func 26 cross_circle
vshcommon 0x60DEE5B3 System_plugin#1_Interface func 27 triangle
vshcommon 0xF7A67D49 System_plugin#1_Interface func 28 rectangle
vshcommon 0x2438F1A4 System_plugin#1_Interface func 21 - anim_cross_circle_show_hide
vshcommon 0x9BD8429E System_plugin#1_Interface func 22 - anim_cross_circle_show_hide
vshcommon 0xE011E7D0 System_plugin#1_Interface func 23 - anim_triangle_show_hide
vshcommon 0x73F85259 System_plugin#1_Interface func 24 - anim_rectangle_show_hide vshcommon_73F85259(uint8 )
vshcommon 0x16106ACD returns "impose_plugin" interface 1 uint vshcommon_16106ACD()
vshcommon 0x8B2110D5 reads boot_history.dat
vshcommon 0x9A43140 adds info to /pushlist/patch.dat
vshcommon 0x9EA67737 vsh::ws_boot_history::Set() { uint8 type, char TitleId [0x1F] }
titleid to boot_history.dat (creates if not present)
vshcommon 0xCC2C67F2 reads /pushlist/patch.dat vshcommon_CC2C67F2(int* count,uint8_t buf[0x680])
x3 - -
x3 0x16FA740A xCore_GetInterface() uint32_t* interface xCore_GetInterface()
x3 0x11409ED3 xRegistryGetDefaultInstance int xRegistryGetDefaultInstance (1, &handle)
x3 0x9C246A91 xBDVDGetInstance
x3 0xCB1D791D Obtains SS Key
x3 0xECACA8AD xRegistry SetValue Example: int SetValue(handle, "/setting/categoryVersion", 0,0,0)
mms_db 0x8EC9A2A7 xCB_Interface::GetInterface
vshnet - -
vshnet 0x89801F5D sceNpC7yTusDestroyTransaction
vshnet 0xE806058 sceNpC7yTusCreateTransaction
vshnet 0xE2201D8B sceNpC7yTusEnd
vshnet 0xF9884100 sceNpC7yTusInit
vshnet 0x122AF93C sceNPC7yLookupTssImageResult
vshnet 0x9012A265 sceNpC7yLookupTssImageRequest?
vshnet 0xEEF8AC4B sceNpC7yLookupAvatarImageResult?
vshnet 0x11823D97 sceNpC7yLookupAvatarImageRequest?
vshnet 0xF4F94F46 sceNpC7yLookupUserProfileResult?
vshnet 0x3F680668 sceNpC7yLookupUserProfileRequest?
vshnet 0x9EA2D869 sceNpC7yLookupNpIdResult?
vshnet 0xF7A88701 sceNpC7yLookupNpIdRequest?
vshnet 0xEC969F67 sceNpC7yLookupDestroyTransaction?
vshnet 0x8BD9F160 sceNpCc7yLookupCreateTransaction?
vshnet 0xB45F6C17 sceNpC7yLookupAbort? int sceNpC7yLookupAbort( transid)
vshnet 0x66EA9546 sceNpC7yLookupInit?
vshnet 0xF02E64BF sceNpC7yLookupEnd?
vshnet 0xD79D5840 sceNpC7yScoreGetGameDataResult?
vshnet 0xF5FBFB50 sceNpC7yScoreGetGameDataRequest?
vshnet 0xF67C877 sceNpC7yScoreRecordGameDataRequest?
vshnet 0x250E633D sceNpC7yScoreRecordScoreResult? int sceNpC7yScoreRecordScoreResult( int transid, int * RankNumber )
vshnet 0x42332FFA sceNpC7yScoreGetBoardInfoResult? int sceNpC7yScoreGetBoardInfoResult (int transid, uint8_t ScoreBoardInfo [ ])
vshnet 0xFC015E62 sceNpC7yScoreGetBoardInfoRequest? int sceNpC7yScoreGetBoardInfoRequest( int transid, uint8_t SelfNpId [ ], uint8_t TitleId [0xC], int ScoreBoardId )
vshnet 0xCC014646 sceNpC7yScoreDestroyTransaction? int sceNpC7yScoreDestroyTransaction (int transid )
vshnet 0x372E972A sceNpC7yScoreFreeTransactionResource? int sceNpC7yScoreFreeTransactionResource ( int transid )
vshnet 0xDF1FF79F sceNpC7yScoreCreateTransaction? int sceNpC7yScoreCreateTransaction(uint8_t psHandle[0x14], uint8_t ScorePassphrase [0x80] )
vshnet 0x3F59F7B6 sceNpC7yScoreAbort? int sceNpC7yScoreAbort ( int transid)
vshnet 0x71DF362C sceNpC7yScoreEnd? int sceNpC7yScoreEnd()
vshnet 0x56779FBD sceNpC7yScoreInit? / SceNpRankingVshInit? int sceNpC7yScoreInit(void * callback, uint8_t np_debug_flag)
vshnet 0xCF725EB1 sceNpInstallerRegetSigninTicket int sceNpInstallerRegetSigninTicket (0)
vshnet 0x7084A801 sceNpCommerceSetDataFlagFinish int sceNpCommerceSetDataFlagFinish ( int req_id )
vshnet 0x572A4D1D sceNpSommerceSetDataFlagStart int sceNpSommerceSetDataFlagStart ( ctx_id, licensee_id, dataflagContainer, dataflag_num, * req_id )
vshnet 0xFF500259 sceNpCommerceGetDataFlagFinish int sceNpCommerceGetDataFlagFinish ( int req_id )
vshnet 0x15910AE7 sceNpCommerceGetDataFlagState int sceNpCommerceGetDataFlagState ( int req_id, dataflagContainer, dataflag_num )
vshnet 0x13D56523 sceNpCommerceGetDataFlagAbort int sceNpCommerceGetDataFlagAbort ( int req_id )
vshnet 0x854FE623 sceNpCommerceGetDataFlagStart int sceNpCommerceGetDataFlagStart ( ctx_id, licensee_id, dataflag [0x10] , dataflag_num, * req_id )
vshnet 0xE2A0CB65 sceNpCommerceGetProductCategoryResult int sceNpCommerceGetProductCategoryResult ( int req_id, uint8_t result_buf_size [0x10] )
vshnet 0xE84BBCAF sceNpCommerceGetProductCategoryFinish int sceNpCommerceGetProductCategoryFinish ( int req_id )
vshnet 0xD297EF28 sceNpCommerceGetProductCategoryAbort int sceNpCommerceGetProductCategoryAbort ( int req_id )
vshnet 0x3E20181D sceNpCommerceGetProductCategoryStart int sceNpCommerceGetProductCategoryStart ( int ctx_id, int category_id, int lang_code, int * req_id )
vshnet 0x2A4C99A6 sceNpCommerceDestroyCtx int sceNpCommerceDestroyCtx (ctx_id)
vshnet 0x98340E57 sceNpCommerceCreateCtx int sceNpCommerceCreateCtx ( int version, uint8_t npId[0x24], void * callback, int * arg,int * ctx_id, int (1) )
vshnet 0x594266BE sceNpBasicGetInitialPresence
vshnet 0xEF85527 sceNpSignalingAddExtendedHandler int sceNpSignalingAddExtendedHandler (ctx_id, 1)
vshnet 0xFC663F7F sceNpSignalingGetPeerNetInfoResult int sceNpSignalingGetPeerNetInfoResult ( ctx_id, req_id, uint8_t netinfo[0x1C], 1)
vshnet 0x2B2E098F sceNpSignalingGetLocalNetInfo int sceNpSignalingGetLocalNetInfo ( ctx_id, uint8_t netinfo[0x1C], 1)
vshnet 0xE5CBDF3D sceNpSignalingGetConnectionInfo int sceNpSignalingGetConnectionInfo ( ctx_id, conn_id, code, * rtt/bandwith/addr/port/packet_loss, 1 )
vshnet 0x995D1D2F sceNpSignalingGetConnectionStatus int sceNpSignalingGetConnectionStatus ( ctx_id, conn_id, int * conn_status,int * peer_addr,uint16_t * peer_port, 1 )
vshnet 0x158032C9 sceNpSignalingDestroyCtx int sceNpSignalingDestroyCtx ( ctx_id, 1)
vshnet 0x8478A915 sceNpMatchingGetRoomMemberListLocal int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], int * size, uint8_t roomStatus[ ], int (1) )
vshnet 0x3139980 sceNpMatchingGetRoomMemberList int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], req_id, int (1) )
vshnet 0x24B26C3F sceNpMatchingLeaveRoom int sceNpMatchingLeaveRoom ( ctx_id, uint8_t opt[0x1C], req_id, int (1) )
vshnet 0x14211FB9 sceNpMatchingDestroyCtx int sceNpMatchingDestroyCtx ( ctx_id, 1 )
vshnet 0x4C9F0992 sceNpManagerGetPsHandle int sceNpManagerGetPsHandle ( int (0), uint8_t psHandle[0x14]
vshnet 0x4E276F38 sceNpManagerGetSubjectRegion int sceNpManagerGetSubjectRegion ( int (0), uint8_t subjectRegion[4]
vshnet 0x58AB86D8 sceNpManagerGetSubjectStatus int sceNpManagerGetSubjectStatus ( int (0), uint8_t subjectStatus[4]
vshnet 0x7A9421D8 sceNpManagerGetStatusDuration int sceNpManagerGetStatusDuration ( int (0), uint64_t * statusDuration
vshnet 0x4216DF9F sceNpManagerRegisterCallbackExt int sceNpManagerRegisterCallbackExt ( void * callback, void * arg)
vshnet 0x572FFDFB sceNpManagerGetSubHandle int sceNpManagerGetSubHandle (int (0), uint8_t subHandle[0x34])
vshnet 0x2C393B42 sceNpManagerUnregisterCallbackExt int sceNpManagerUnregisterCallbackExt ()
vshnet 0x4DD12D0C sceNpManagerGetUserIconURL int sceNpManagerGetUserIconURL ( int (0), uint8_t icon[0x80] )
vshnet 0x99666F31 sceNpManagerGetEnvnamae int sceNpManagerGetEnvnamae ( uint8_t envname[0x0F] )
vshnet 0x319E53BD sceNpManagerLoadCachedInfo int sceNpManagerLoadCachedInfo ( int userId, uint8_t cachedInfo[0xF8] )
vshnet 0x9EF14F7C sceNpManagerIsPlus int attr_is_plus sceNpManagerIsPlus ( int (0) )
vshnet 0xC3417866 sceNpManagerGetTicketParam
vshnet 0x788759C6 sceNpManagerGetSigninTicket sceNpManagerGetSigninTicket ( int (0), uint8_t signinTicketData[], int * signinTicketSize
vshnet 0x1FA25660 sceNpManagerSubSignout int sceNpManagerSubSignout (int (0), uint8_t npId [0x24]
vshnet 0xB79B2FE0 sceNpManagerGetNetworkTime int sceNpManagerGetNetworkTime (int (0), uint8_t casualClock[8])
vshnet 0xFACC5962 sceNpManagerGetMyLanguages int sceNpManagerGetMyLanguages (int (0), uint8_t myLang[0x10]
vshnet 0xFC7303C5 sceNpManagerGetNpId int sceNpManagerGetNpId ( int (0), uint8_t npId[0x24]
vshnet 0x1D555F5F sceNpUpdateClockStart
vshnet 0x50EE5602 gets updatelist txt and compares version
vshnet 0x731E546F prints Firmware version ("%02d.%02d) int vshnet_731E546F(out: const char*)
vshnet 0xEBEA23A1 sceNetHttpXmlConsoleInfoBitOpe int sceNetHttpXmlConsoleInfoBitOpe(0x190, xml?,1,1)
vshmain - -
vshmain 0x624D3AE returns game process id
vshmain 0xF32CEC81 loadRegistryNetautoDlFlag int loadRegistryNetautoDlFlag ( void )
vshmain 0xB84B751A saveRegistryNetautoDlFlag saveRegistryNetautoDlFlag ( uint8 )
vshmain 0xAE35CF2D Executes Action based on Input (More Info: XMB Plugin XMM0 Interface 23)


int vshmain_AE35CF2D(char *, int value)
vshmain 0xD609A2F6 shows up XMB Login?
vshmain 0xF3F75BE sysutil::BeginService
vshmain 0x505FA917 cxmlutil::GetFile
vshmain 0x7606AF6F VersionFile::Get
vshmain 0x981D7E9F Gets ScreenShot Flag int vshmain_981D7E9F()
vshtask - -
vshtask 0xA02D46E7 Displays a notification in XMB int vshtask_A02D46E7(0 /*ignored*/, "your text" )
cellHttp 0x8FC281F7 cellHttpCookieFlush
cellHttp 0xDCDF003A cellHttpAuthCacheFlush

To help documenting offsets+exports, you can use this dumper tool for vsh (actually,no need to dump anymore).

[edit] Memory Containers

id name
0 game
1 app
2 debug
3 fg (foreground, in-game-XMB menu)
4 bg (background, in-game-XMB menu)

[edit] Display Buffers

VSH uses 2 of 8 available display buffers. Information about them can be aquired by vsh plugins using this code snippet: [[1]]
In FW 4.46 DEX the buffer info looks like this (for 1920x1080):

Type This
address: 0xdc80000
pitch: 0x2000
width: 0x780
height: 0x438
address: 0xe500000
pitch: 0x2000
width: 0x780
height: 0x438