VSH: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
 
(249 intermediate revisions by 14 users not shown)
Line 1: Line 1:
VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know.[http://www.ps3devwiki.com/wiki/XMB XrossMediaBar (XMB)]. This, is a user space executable (vsh.self), loaded by lv2_kernel/sys_init_osd.  
VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know. [[XMB|XrossMediaBar (XMB)]]. This, is a userspace executable (vsh.self), loaded by lv2_kernel/sys_init_osd.  


from here several other functions/syscalls to other modules are made, e.g. lv2 ([http://www.ps3devwiki.com/index.php?title=Talk:SELF_File_Format_and_Decryption SELF decryption]), lv1 ([http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#0x3000_-_Secure_RTC Secure_RTC], [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#0x5000_-_Storage_Manager Storage_Manager], [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#Gelic_Device Gelic_Device], [http://www.ps3devwiki.com/index.php?title=Hypervisor_Reverse_Engineering#BD_Drive BD_Drive]) etc.
from here several other functions/syscalls to other modules are made, e.g. lv2 ([[Talk:SELF_File_Format_and_Decryption|SELF decryption]]), lv1 ([[Hypervisor_Reverse_Engineering#0x3000_-_Secure_RTC|Secure_RTC]], [[Hypervisor_Reverse_Engineering#0x5000_-_Storage_Manager|Storage_Manager]], [[Hypervisor_Reverse_Engineering#Gelic_Device|Gelic_Device]], [[Hypervisor_Reverse_Engineering#BD_Drive|BD_Drive]]) etc.


not much is documented (yet) about this module. Please fill in where possible.
not much is documented (yet) about this module. Please fill in where possible.
Line 21: Line 21:


=== Exports ===
=== Exports ===
[[VSH Exports]]
=== Imports ===
[[VSH Imports]]
===Memory Containers===
{| class="wikitable sortable"
{| class="wikitable sortable"
! Export Library !! Export NID !! Notes !! Usage
! Type/Id !! Name !! Size !! Usage
|-
| sys_io || - || - || -
|-
| sys_fs || - || - || -
|-
| sys_fs || 0x18DD4604 || cellFsOpen2 || -
|-
| sys_fs_ps2disc || 0x8160A811|| switches /dev_ps2disc(1) mount? ||
|-
| vsh || - || - ||
|-
| vsh || 0xF48562D || cellSsAimIsCEX ||
|-
| vsh || 0x145991B4|| cellSsAimIsArcade ||
|-
| vsh || 0x172B05CD|| update_mgr_write_eprom syscall ||
|-
| vsh || 0x1B890AD2|| update_mgr_get_token_seed syscall ||
|-
| vsh || 0x1F80E287|| cellSsAimIsTool ||
|-
| vsh || 0x2C563C92|| update_mgr_read_eprom syscall ||
|-
| vsh || 0x3231E012|| vtrm_Decrypt_Master syscall ||
|-
| vsh || 0x349F1535|| update_mgr_set_token syscall ||
|-
| vsh || 0x3B4A1AC4|| AIM GetDeviceId syscall ||
|-
| vsh || 0x3F062337|| AIM GetPsCode syscall ||
|-
| vsh || 0xE44F29F4|| cellFsUtilMount syscall ||
|-
| vsh || 0xE7C34044|| retrieves vsh memory container by "id" 0=game,1=app,2=debug,3=fg, 4=bg || sys_memory_container_t vsh_E7C34044(int id)
|-
| vsh || 0xE932A8C0|| reboot and show minimum version <br> char can be "text whatever you like", no check etc. || int vsh_E932A8C0(char * )
|-
| vsh || 0xFF4A1633|| cellFsUtilMount syscall ||
|-
| vsh || 0x7D73E7CD || inflate_init ||
|-
| vsh || 0x4DB8DD87 || inflate_end ||
|-
| vsh || 0x20215547 || inflate_buffer ||
|-
| vsh || 0x1C68CC75 || inflate ||
|-
| sdk || - || - ||
|-
| sdk || 0xB5877BBF || cellAvsetGetMonitorInformation ||
|-
| sdk || 0x5FAFE92B|| cellCryptoPuSha1Hash ||
|-
| sdk || 0xB45387CD|| AesCbcCfb128Decrypt ||
|-
| sdk || 0x55ACAB8A || sha1_init ||
|-
| sdk || 0x831E89EE || sha1_update ||
|-
| sdk || 0x3CABD075 || sha1_final ||
|-
| sdk || 0x4484A101 || sha1_hmac_update ||
|-
| sdk || 0x547B602C || sha1_hmac_init ||
|-
| sdk || 0x300B99F2 || sha1_hmac_final ||
|-
| sdk || 0x74A2A1FE || sha1_hmac_buffer ||
|-
| sdk || 0x68B630D5 || aes_omac_mode1 ||
|-
| paf || - || - ||
|-
| paf || 0xBB04609B || GetSparkInfo ||
|-
| paf || 0x65BE85B3 || _UnloadView || _paf_65BE85B3(char * plugin_name,0,0)
|-
| paf || 0x350B4536 || Job_Start ||
|-
| paf || 0xFE0C1F10 || Job_Queue ||
|-
| paf || 0xA1DC401  || sets Interface from plugin || uint32_t SetInterface(unknown, uint32_t identifier, void * ptr_structure)
|-
| paf || 0x23AFB290 || gets Interface from plugin, should allow calling its exports/funcs || uint32_t plugin->GetInterface(uint32_t return from paf_F21655F3, uint32_t identifier)
|-
| paf || 0x3A8454FC || finds/gets Texture/Resource || Example: out: uint32_t*, return from paf_F21655F3, "tex_notification_info"
|-
| paf || 0x3CEC3833 || sets up a plugin widget ? (page_...) ||
|-
| paf || 0x794CEACB || finds widget in a plugin || Example: plugin->FindWidget(return from paf_F21655F3, "page_autooff_guide")
|-
| paf || 0x89B67B9C || gets msg_ text from plugin resource || Example: (w)char (return from paf_F21655F3, "msg_help_system_off_soon_by_setting")
|-
| paf || 0xF21655F3 || finds a loaded plugin || Example: uint32_t paf::View::Find("system_plugin")
|-
| vshcommon || - || - ||
|-
| vshcommon || 0x7F5C551B || [[System_plugin#1_Interface]] func 11 || vshcommon_7F5C551B(int * texture_dialog, int* texture_dialog_shadow, wchar * infotext1, wchar * infotext2, int)
|-
| vshcommon || 0x94F43BE7 || [[System_plugin#1_Interface]] func 12 || vshcommon_94F43BE7(uint8 )
|-
| vshcommon || 0xF9E43DA2 || returns "msg_ok" wide char text ||
|-
| vshcommon || 0xCCD2C319 || returns "msg_cancel" wide char text ||
|-
| vshcommon || 0x746C5F88 || returns "msg_option" wide char text  ||
|-
| vshcommon || 0xF995E53F || returns "msg_back" wide char text ||
|-
| vshcommon || 0x26F18EDF || returns "msg_enter" wide char text ||
|-
| vshcommon || 0xE9E8DA5 || returns "msg_no" wide char text ||
|-
| vshcommon || 0xB8E256D7 || returns "msg_yes" wide char text ||
|-
| vshcommon || 0x79A562D5 || [[System_plugin#1_Interface]] func 25 circle_cross ||
|-
| vshcommon || 0x75DC9C2D || [[System_plugin#1_Interface]] func 26 cross_circle ||
|-
|-
| vshcommon || 0x60DEE5B3 || [[System_plugin#1_Interface]] func 27 triangle ||
| 0 || game || dex: 426.770.432 / cex: 223.346.688 Bytes ||
|-
|-
| vshcommon || 0xF7A67D49 || [[System_plugin#1_Interface]] func 28 rectangle ||
| 1 || app || 223.346.688 Bytes ||
Spurs (Tiff, Png, Jpg)
[[autodownload_plugin]]
[[custom_render_plugin]]
[[dlna_plugin]]
fchk (libfs_utility2)
[[game_ext_plugin]]
[[impose_plugin]]
libfs_utility_init
vshmain_util
mms
libsre libadec
libac3dec
paf_ext
qglbase
vshmain_ext
[[msgdialog_plugin]]
msmw1
msmw2
[[podl_plugin]]
[[premo_plugin]]
[[software_update_plugin]]
[[soundvisualizer_plugin]]
[[system_plugin]]
vshmain_util
[[xmb_plugin]] (XMB normal)
[[ycon_manual_plugin]]
|-
|-
| vshcommon || 0x2438F1A4 || [[System_plugin#1_Interface]] func 21 - anim_cross_circle_show_hide ||
| 2 || debug || 203.423.744 Bytes ||
|-
|-
| vshcommon || 0x9BD8429E || [[System_plugin#1_Interface]] func 22 - anim_cross_circle_show_hide ||
| 3 || fg (foreground)|| 3.145.728 Bytes ||
User Information
[[auth_plugin]]
[[avc2_text_plugin]]
[[comboplay_plugin]]
[[ps3_savedata_plugin]]
[[game_plugin]]
[[deviceconf_plugin]]
fchk (libfs_utility2)
[[friendim_plugin]]
[[friendlm_plugin]]
[[friendtrophy_plugin]]
[[game_plugin]]
[[gameupdate_plugin]]
libfs_utility_init
vshmain_util
mms
[[np_eula_plugin]]
[[np_sns_plugin]]
[[np_multisignin_plugin]]
[[npsignin_plugin]]
[[osk_plugin]]
photoUtil
photoUtil2
[[photo_network_sharing_plugin]]
[[print_plugin]]
[[profile_plugin]]
[[screenshot_plugin]]
upload_util
[[xmb_ingame]]
|-
|-
| vshcommon || 0xE011E7D0 || [[System_plugin#1_Interface]] func 23 - anim_triangle_show_hide ||
| 4 || bg (background)|| 3.145.728 Bytes ||
|-
  [[avc_plugin]]
| vshcommon || 0x73F85259 || [[System_plugin#1_Interface]] func 24 - anim_rectangle_show_hide || vshcommon_73F85259(uint8 )
  [[avc2_game_plugin]]
|-
[[audioplayer_plugin]]
| vshcommon || 0x16106ACD || returns "impose_plugin" interface 1 || uint vshcommon_16106ACD()
[[audioplayer_plugin_mini]]
|-
music playback/decode
| vshcommon || 0x8B2110D5 || reads boot_history.dat ||  
[[rec_plugin]]
|-
imejp (service type=1)
| vshcommon || 0x9A43140 || adds info to /pushlist/patch.dat ||
  ime_atok_module
|-
| vshcommon || 0x9EA67737 || vsh::ws_boot_history::Set() { uint8 type, char TitleId [0x1F] } <br> titleid to boot_history.dat (creates if not present) ||  
|-
| vshcommon || 0xCC2C67F2 || reads /pushlist/patch.dat || vshcommon_CC2C67F2(int* count,uint8_t buf[0x680])
|-
| x3 || - || - ||
|-
| x3 || 0x16FA740A || xCore_GetInterface() || uint32_t* interface xCore_GetInterface()
|-
| x3 || 0x11409ED3|| xRegistryGetDefaultInstance|| int xRegistryGetDefaultInstance (1, &handle)
|-
| x3 || 0x9C246A91 || xBDVDGetInstance ||
|-
| x3 || 0xCB1D791D|| Obtains SS Key||
|-
| x3 || 0xECACA8AD|| xRegistry SetValue|| Example: int SetValue(handle, "/setting/categoryVersion", 0,0,0)
|-
| mms_db || 0x8EC9A2A7 || xCB_Interface::GetInterface ||
|-
| vshnet || - || - ||
|-
| vshnet || 0x8478A915 || sceNpMatchingGetRoomMemberListLocal || int sceNpMatchingGetRoomMemberList ( ctx_id,  uint8_t opt[0x1C], int * size, uint8_t roomStatus[ ], int (1) )
|-
| vshnet || 0x3139980 || sceNpMatchingGetRoomMemberList || int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], req_id, int (1) )
|-
| vshnet || 0x24B26C3F || sceNpMatchingLeaveRoom || int sceNpMatchingLeaveRoom ( ctx_id,  uint8_t opt[0x1C], req_id, int (1) )
|-
| vshnet || 0x14211FB9 || sceNpMatchingDestroyCtx || int sceNpMatchingDestroyCtx ( ctx_id, 1 )
|-
| vshnet || 0x4C9F0992 || sceNpManagerGetPsHandle || int sceNpManagerGetPsHandle ( int (0), uint8_t psHandle[0x14]
|-
| vshnet || 0x4E276F38 || sceNpManagerGetSubjectRegion || int sceNpManagerGetSubjectRegion ( int (0), uint8_t subjectRegion[4]
|-
| vshnet || 0x58AB86D8 || sceNpManagerGetSubjectStatus || int sceNpManagerGetSubjectStatus ( int (0), uint8_t subjectStatus[4]
|-
| vshnet || 0x7A9421D8 || sceNpManagerGetStatusDuration || int sceNpManagerGetStatusDuration ( int (0), uint64_t * statusDuration
|-
| vshnet || 0x4216DF9F || sceNpManagerRegisterCallbackExt || int sceNpManagerRegisterCallbackExt ( void * callback, void * arg)
|-
| vshnet || 0x572FFDFB || sceNpManagerGetSubHandle || int sceNpManagerGetSubHandle (int (0), uint8_t subHandle[0x34])
|-
| vshnet || 0x2C393B42 || sceNpManagerUnregisterCallbackExt || int sceNpManagerUnregisterCallbackExt ()
|-
| vshnet || 0x4DD12D0C || sceNpManagerGetUserIconURL || int sceNpManagerGetUserIconURL ( int (0), uint8_t icon[0x80] )
|-
| vshnet || 0x99666F31 || sceNpManagerGetEnvnamae || int sceNpManagerGetEnvnamae ( uint8_t envname[0x0F] )
|-
| vshnet || 0x319E53BD || sceNpManagerLoadCachedInfo || int sceNpManagerLoadCachedInfo ( int userId, uint8_t cachedInfo[0xF8] )
|-
| vshnet || 0x9EF14F7C || sceNpManagerIsPlus || int attr_is_plus sceNpManagerIsPlus ( int (0) )
|-
| vshnet || 0xC3417866 || sceNpManagerGetTicketParam ||
|-
| vshnet || 0x788759C6 || sceNpManagerGetSigninTicket || sceNpManagerGetSigninTicket ( int (0), uint8_t signinTicketData[], int * signinTicketSize
|-
| vshnet || 0x1FA25660 || sceNpManagerSubSignout || int sceNpManagerSubSignout (int (0), uint8_t npId [0x24]
|-
| vshnet || 0xB79B2FE0 || sceNpManagerGetNetworkTime || int sceNpManagerGetNetworkTime (int (0), uint8_t casualClock[8])
|-
| vshnet || 0xFACC5962 || sceNpManagerGetMyLanguages || int sceNpManagerGetMyLanguages (int (0), uint8_t myLang[0x10]
|-
| vshnet || 0xFC7303C5 || sceNpManagerGetNpId || int sceNpManagerGetNpId ( int (0), uint8_t npId[0x24]
|-
| vshnet || 0x1D555F5F || sceNpUpdateClockStart||
|-
| vshnet || 0x50EE5602 || gets updatelist txt and compares version ||
|-
| vshnet || 0x731E546F || prints Firmware version ("%02d.%02d) || int vshnet_731E546F(out: const char*)
|-
| vshnet || 0xEBEA23A1 || sceNetHttpXmlConsoleInfoBitOpe || int sceNetHttpXmlConsoleInfoBitOpe(0x190, xml?,1,1)
|-
| vshmain || - || - ||
|-
| vshmain || 0xF32CEC81 || loadRegistryNetautoDlFlag || int loadRegistryNetautoDlFlag ( void )
|-
| vshmain || 0xB84B751A || saveRegistryNetautoDlFlag || saveRegistryNetautoDlFlag ( uint8 )
|-
| vshmain || 0xAE35CF2D || Executes Action based on Input [[Xmb_plugin#Function_23|(More Info: XMB Plugin XMM0 Interface 23)]]
Example:
"http://www.psdevwiki.com",0
  "copy:device",1
"regcam:reg?",1
|| int vshmain_AE35CF2D(char *, int value)
|-
| vshmain || 0xD609A2F6 || shows up XMB Login? ||
|-
| vshmain || 0xF3F75BE || sysutil::BeginService ||
|-
| vshmain || 0x505FA917 || cxmlutil::GetFile ||
|-
| vshmain || 0x7606AF6F || VersionFile::Get ||
|-
| vshmain || 0x981D7E9F || Gets ScreenShot Flag || int vshmain_981D7E9F()
|-
| vshtask || - || - ||
|-
| vshtask || 0xA02D46E7 || Displays a notification in XMB || int vshtask_A02D46E7(0 /*ignored*/<!--//or icon? (refered by his number from 0 to 12 availables, or by his name)?//-->, "your text" )
|-
| cellHttp || 0x8FC281F7 || cellHttpCookieFlush||
|-
| cellHttp || 0xDCDF003A || cellHttpAuthCacheFlush ||
|-
|-
|}
|}


To help documenting offsets+exports, you can use [http://www.ps3devwiki.com/index.php?title=Dev_Tools#vsh_dumper this dumper tool for vsh] (actually,no need to dump anymore).
===Loaded Views===
These Views and prx files are loaded by default and are accessable without further loading, all others need to be loaded.
 
====Regular XMB====
 
[[system_plugin]]
[[xmb_plugin]]
[[explore_plugin]]
[[category_setting_plugin]]
[[impose_plugin]]


===Memory Containers===
====InGame XMB====
 
[[system_plugin]]
[[xmb_plugin]]
[[explore_plugin]]
[[game_plugin]]
[[impose_plugin]]
 
====InGame====
 
[[game_plugin]]
[[impose_plugin]]
 
===VSH Service Communication (CXML Header Magic)===
 
APNT - [[ap_plugin|Access Point Utility]]
ATHD - [[auth_plugin|(Password) Authentication Dialog]]
AVC2 - [[avc2_game_plugin|Audio-Voice/Video Chat Utility 2]]
AVCH - [[avc_plugin|Audio-Voice/Video Chat Utility]]
BGDL - Background Download Service
CHAT - [[avc2_game_plugin|System Chat]]
CMND -
COMB - [[comboplay_plugin|Combo Playing(Cross Controller)]]
DGAM - [[game_plugin|Disc Game-Mode Utility]]
DPSN - Decrypt PSN Video Service
DTCP - DTCP IP Service
EULA - End User License Agreement
GAME - [[game_plugin|Game Utility]]
GDAT - [[game_plugin|Game Data Utility]]
GDTL - [[game_plugin|(uses DGAM)]]
GEXE - [[game_plugin|Game Execution Utility]]
GPS1 - [[game_plugin|Game PS1 Rumble]]
GUPD - Game Upate Check
IMEJ - Input Method Engine Japanese
MSGD - [[msgdialog_plugin|Message Dialog Utility]]
MUDE - Music Decode
MUSC - Music Playback
NMT2 - NP Matching 2 Utility
NPBA - NP Basic Utility
NPC2 - NP (Ingame) Commerce 2 Utility
NPCM - NP Commerce Utility
NPCU - NP Custom Menu
NPDR - NP DRM Utility
NPFL - NP Friendlist Utility
NPIN - NP Install (Commerce)
NPLU - NP LookUp
NPMG - NP Manager Utility
NPMT - NP Matching Utility
NPRA - NP Score/Ranking Utility
NPSN - NP Signaling Utility
NPTR - NP Trophy
NPUS - NP User Storage
NSNS - NP Social Networking Services (Facebook Api)
NTCL - netcl Utility
OSKD - [[osk|On Screen Keyboard Utility]]
PARA - System Parameters Utility
PESM - PKI End to end Secure Module
PHDE - Photo Decode
PHE2 - Photo Export (Utility 2)
PHEX - Photo Export
PHIM - Photo Import
PNSU - Photo Network Sharing
PRIN - Printer Utility
RECO - [[rec_plugin|Recording Utility]]
RMTP - [[premo_game_plugin|Remote Play]]
RTCA - [[rtcalarm|RTC Alarm]]
SAVE - Save Data Utility (surf autosave)
SRCH - [[cell_search_service|Search]]
SSHT - ScreenShot
STDT - Storage Data Copy Utility
SUBD - [[premo_game_plugin|SubDisplay Utility]]
SYSC - [[deviceconf_plugin|System (Device/Pad) Configuration]]
USRI - User Information Utility
VDPL - Video Player
VDUP - [[upload_util|Video Upload]]
WBRW - [[webbrowser_plugin|WebBrowser Utility]]
 
===Notification Window Textures===
<div style="float:right">[[File:Notification_window_textures.jpg|800px|thumb|left|Notification Window Textures (inside dev_flash/vsh/resource/system_plugin.rco)]]</div>
 
All the icons are 100x100 pixels size
* tex_notification_caution
* tex_notification_friend
* tex_notification_headset
* tex_notification_info
* tex_notification_keypad
* tex_notification_mediaserver
* tex_notification_music
* tex_notification_psbutton_insensitive
* tex_notification_settings
* tex_notification_trophy_bronze
* tex_notification_trophy_gold
* tex_notification_trophy_platinum
* tex_notification_trophy_silver
 
The other texture used by notification window is the frame of the notification window itself (called "tex_notification" with a size of 64x64 pixels), this frame is scalated in width automatically by XMB (to make the frame fit the width of the text that is displayed inside the window), and is posible to reskin the frame using a [[PlayStation 3 Theme (P3T)|Theme]]


id name
*Any texture from any plugin can be used actually. i.e.: tex_common_dialog. Would it be possible to create our own textures?
0 game
**Sure, there is no security check over .RCO's (resource containers), what is not clear is if is posible to load a texture with a custom name from a .RCO with a custom name (e.g: tex_myicon from a file named: myresources.rco)... Initially .SPRX needs to be "indexed" by VSH to be available, and .RCO's are dependant of .SPRX... but in case of the resources is posible all are available --[[User:Sandungas|Sandungas]] ([[User talk:Sandungas|talk]]) 19:22, 20 May 2014 (EDT)
1 app
2 debug
3 fg (foreground?)
4 bg (background?)


===Display Buffers===
===Display Buffers===
Line 279: Line 224:
{{Keyboard|content=<syntaxhighlight lang="bash">
{{Keyboard|content=<syntaxhighlight lang="bash">
GCMBUFINFO 0
GCMBUFINFO 0
offset: 0xdc80000
address: 0xdc80000
pitch: 0x2000
pitch: 0x2000
width: 0x780
width: 0x780
Line 285: Line 230:


GCMBUFINFO 1
GCMBUFINFO 1
offset: 0xe500000
address: 0xe500000
pitch: 0x2000
pitch: 0x2000
width: 0x780
width: 0x780
height: 0x438
height: 0x438
</syntaxhighlight>}}
</syntaxhighlight>}}
===Settings===
VSH contains an array of structs which describes the [[xRegistry.sys]]. (More Information about its access [[Talk:VSH]] )
struct Setting_s
{
  int32_t index;
  const char* name;
  int32_t unk0;
  int8_t unk1;
  union
  {
      int32_t integer;
      const char* string;
  }default;
  int32_t type;
  int32_t unk2;
};
The first element of this array describes the password setting. Use this script to label all of the settings. [http://pastebin.com/ZiZ6S43t link]
.long 1                # index
.long aSettingParen_4  # name # "/setting/parental/passwordNumber"
.long 1                # unk0
.byte 1                # unk1
.byte 0, 0, 0
.long a0000_1          # default # "0000"
.long 4                # type
.long 0x28              # unk2
===Events===
Global Event Queue Id's:
Polling Service
0x8006020000000030
0x8006020000000010
0x8006020000000002
0x8006020000000000
CMND Service (Connect)
0x8006010000000100
0x8006010000000101
0x8006010000000102
0x8006010000000103
SceNpTusVsh
0x0800604000000902
===Title IDs===
Clears a Memory Container in relation of this game and a camera (disables video chat etc.?)
BLUS20001 Ridge Racer 7
BCAS20001 Ridge Racer 7
BLJS10001 Ridge Racer 7
BCES00009 Ridge Racer 7
BCKS10001 Ridge Racer 7
Circumvents an AudioOut Setting that made the game freeze/black screen
BLUS30264 Afro Samurai
BLES00516 Afro Samurai
NPUB90215 Afro Samurai (Demo)
BLJM60130 Street Fighter IV
BLUS30265 Street Fighter IV
BLES00481 Street Fighter IV
BCJB95006 Torne
NPIA00005 PlayStation Home
NPIA00009
NPIA00010 PlayStation Home
NPIA00011
NPEA00013 PlayStation Home
WebBrowser finalize executed without mutex/lock syncs
NPJB00001 Tekken 5: Dark Resurrection
NPUB30009 Tekken 5: Dark Resurrection
NPJB00023 Crystal Defenders
NPUB30092 Crystal Defenders






{{Development}}<noinclude>[[Category:Main]]</noinclude>
{{Development}}<noinclude>[[Category:Main]]</noinclude>

Latest revision as of 00:20, 1 July 2020

VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know. XrossMediaBar (XMB). This, is a userspace executable (vsh.self), loaded by lv2_kernel/sys_init_osd.

from here several other functions/syscalls to other modules are made, e.g. lv2 (SELF decryption), lv1 (Secure_RTC, Storage_Manager, Gelic_Device, BD_Drive) etc.

not much is documented (yet) about this module. Please fill in where possible.

Modes[edit | edit source]

possible arguments to pass when executing vsh.self:

  • --mode=gametool
  • --mode=gametool2
  • --arcade=true

Offsets[edit | edit source]

Function 3.55 3.41 3.15 Notes
- - - - -
sub_308EE4 check_Is_Act_Dat_for_This_Acc_ID

Exports[edit | edit source]

VSH Exports

Imports[edit | edit source]

VSH Imports

Memory Containers[edit | edit source]

Type/Id Name Size Usage
0 game dex: 426.770.432 / cex: 223.346.688 Bytes
1 app 223.346.688 Bytes
Spurs (Tiff, Png, Jpg)
autodownload_plugin
custom_render_plugin
dlna_plugin
fchk (libfs_utility2)
game_ext_plugin 
impose_plugin
libfs_utility_init 
vshmain_util 
mms
libsre libadec
libac3dec
paf_ext
qglbase
vshmain_ext
msgdialog_plugin
msmw1
msmw2
podl_plugin
premo_plugin
software_update_plugin
soundvisualizer_plugin
system_plugin
vshmain_util
xmb_plugin (XMB normal)
ycon_manual_plugin
2 debug 203.423.744 Bytes
3 fg (foreground) 3.145.728 Bytes
User Information
auth_plugin
avc2_text_plugin
comboplay_plugin
ps3_savedata_plugin
game_plugin
deviceconf_plugin
fchk (libfs_utility2)
friendim_plugin
friendlm_plugin 
friendtrophy_plugin
game_plugin
gameupdate_plugin
libfs_utility_init
vshmain_util 
mms
np_eula_plugin
np_sns_plugin
np_multisignin_plugin
npsignin_plugin
osk_plugin
photoUtil
photoUtil2
photo_network_sharing_plugin
print_plugin
profile_plugin
screenshot_plugin
upload_util
xmb_ingame
4 bg (background) 3.145.728 Bytes
avc_plugin
avc2_game_plugin
audioplayer_plugin
audioplayer_plugin_mini
music playback/decode
rec_plugin
imejp (service type=1)
ime_atok_module

Loaded Views[edit | edit source]

These Views and prx files are loaded by default and are accessable without further loading, all others need to be loaded.

Regular XMB[edit | edit source]

system_plugin
xmb_plugin
explore_plugin
category_setting_plugin
impose_plugin

InGame XMB[edit | edit source]

system_plugin
xmb_plugin
explore_plugin
game_plugin
impose_plugin

InGame[edit | edit source]

game_plugin
impose_plugin

VSH Service Communication (CXML Header Magic)[edit | edit source]

APNT - Access Point Utility
ATHD - (Password) Authentication Dialog
AVC2 - Audio-Voice/Video Chat Utility 2
AVCH - Audio-Voice/Video Chat Utility
BGDL - Background Download Service
CHAT - System Chat
CMND - 
COMB - Combo Playing(Cross Controller)
DGAM - Disc Game-Mode Utility
DPSN - Decrypt PSN Video Service
DTCP - DTCP IP Service
EULA - End User License Agreement
GAME - Game Utility
GDAT - Game Data Utility
GDTL - (uses DGAM)
GEXE - Game Execution Utility
GPS1 - Game PS1 Rumble
GUPD - Game Upate Check
IMEJ - Input Method Engine Japanese
MSGD - Message Dialog Utility
MUDE - Music Decode
MUSC - Music Playback
NMT2 - NP Matching 2 Utility
NPBA - NP Basic Utility
NPC2 - NP (Ingame) Commerce 2 Utility
NPCM - NP Commerce Utility
NPCU - NP Custom Menu
NPDR - NP DRM Utility
NPFL - NP Friendlist Utility
NPIN - NP Install (Commerce)
NPLU - NP LookUp
NPMG - NP Manager Utility
NPMT - NP Matching Utility
NPRA - NP Score/Ranking Utility
NPSN - NP Signaling Utility
NPTR - NP Trophy
NPUS - NP User Storage
NSNS - NP Social Networking Services (Facebook Api)
NTCL - netcl Utility
OSKD - On Screen Keyboard Utility
PARA - System Parameters Utility
PESM - PKI End to end Secure Module
PHDE - Photo Decode
PHE2 - Photo Export (Utility 2)
PHEX - Photo Export
PHIM - Photo Import
PNSU - Photo Network Sharing
PRIN - Printer Utility
RECO - Recording Utility
RMTP - Remote Play
RTCA - RTC Alarm
SAVE - Save Data Utility (surf autosave) 
SRCH - Search
SSHT - ScreenShot
STDT - Storage Data Copy Utility
SUBD - SubDisplay Utility
SYSC - System (Device/Pad) Configuration
USRI - User Information Utility
VDPL - Video Player
VDUP - Video Upload
WBRW - WebBrowser Utility

Notification Window Textures[edit | edit source]

Notification Window Textures (inside dev_flash/vsh/resource/system_plugin.rco)

All the icons are 100x100 pixels size

  • tex_notification_caution
  • tex_notification_friend
  • tex_notification_headset
  • tex_notification_info
  • tex_notification_keypad
  • tex_notification_mediaserver
  • tex_notification_music
  • tex_notification_psbutton_insensitive
  • tex_notification_settings
  • tex_notification_trophy_bronze
  • tex_notification_trophy_gold
  • tex_notification_trophy_platinum
  • tex_notification_trophy_silver

The other texture used by notification window is the frame of the notification window itself (called "tex_notification" with a size of 64x64 pixels), this frame is scalated in width automatically by XMB (to make the frame fit the width of the text that is displayed inside the window), and is posible to reskin the frame using a Theme

  • Any texture from any plugin can be used actually. i.e.: tex_common_dialog. Would it be possible to create our own textures?
    • Sure, there is no security check over .RCO's (resource containers), what is not clear is if is posible to load a texture with a custom name from a .RCO with a custom name (e.g: tex_myicon from a file named: myresources.rco)... Initially .SPRX needs to be "indexed" by VSH to be available, and .RCO's are dependant of .SPRX... but in case of the resources is posible all are available --Sandungas (talk) 19:22, 20 May 2014 (EDT)

Display Buffers[edit | edit source]

VSH uses 2 of 8 available display buffers. Information about them can be aquired by vsh plugins using this code snippet: [[1]]
In FW 4.46 DEX the buffer info looks like this (for 1920x1080):

Type This
GCMBUFINFO 0
address: 0xdc80000
pitch: 0x2000
width: 0x780
height: 0x438

GCMBUFINFO 1
address: 0xe500000
pitch: 0x2000
width: 0x780
height: 0x438

Settings[edit | edit source]

VSH contains an array of structs which describes the xRegistry.sys. (More Information about its access Talk:VSH )

struct Setting_s
{
  int32_t index;
  const char* name;
  int32_t unk0;
  int8_t unk1;
  union
  {
     int32_t integer;
     const char* string;
  }default;
  int32_t type;
  int32_t unk2;
};

The first element of this array describes the password setting. Use this script to label all of the settings. link

.long 1                 # index
.long aSettingParen_4   # name # "/setting/parental/passwordNumber"
.long 1                 # unk0
.byte 1                 # unk1
.byte 0, 0, 0
.long a0000_1           # default # "0000"
.long 4                 # type
.long 0x28              # unk2

Events[edit | edit source]

Global Event Queue Id's:

Polling Service
0x8006020000000030
0x8006020000000010
0x8006020000000002
0x8006020000000000
CMND Service (Connect)
0x8006010000000100
0x8006010000000101
0x8006010000000102
0x8006010000000103
SceNpTusVsh
0x0800604000000902 

Title IDs[edit | edit source]

Clears a Memory Container in relation of this game and a camera (disables video chat etc.?)
BLUS20001 Ridge Racer 7
BCAS20001 Ridge Racer 7
BLJS10001 Ridge Racer 7
BCES00009 Ridge Racer 7
BCKS10001 Ridge Racer 7
Circumvents an AudioOut Setting that made the game freeze/black screen
BLUS30264 Afro Samurai 
BLES00516 Afro Samurai
NPUB90215 Afro Samurai (Demo)
BLJM60130 Street Fighter IV
BLUS30265 Street Fighter IV
BLES00481 Street Fighter IV
BCJB95006 Torne
NPIA00005 PlayStation Home
NPIA00009 
NPIA00010 PlayStation Home
NPIA00011
NPEA00013 PlayStation Home
WebBrowser finalize executed without mutex/lock syncs
NPJB00001 Tekken 5: Dark Resurrection
NPUB30009 Tekken 5: Dark Resurrection
NPJB00023 Crystal Defenders 
NPUB30092 Crystal Defenders