VSH
VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know.XrossMediaBar (XMB). This, is a user space executable (vsh.self), loaded by lv2_kernel/sys_init_osd.
from here several other functions/syscalls to other modules are made, e.g. lv2 (SELF decryption), lv1 (Secure_RTC, Storage_Manager, Gelic_Device, BD_Drive) etc.
not much is documented (yet) about this module. Please fill in where possible.
Modes
possible arguments to pass when executing vsh.self:
- --mode=gametool
- --mode=gametool2
- --arcade=true
Offsets
Function | 3.55 | 3.41 | 3.15 | Notes |
---|---|---|---|---|
- | - | - | - | - |
sub_308EE4 | check_Is_Act_Dat_for_This_Acc_ID |
Exports
Export Library | Export NID | Notes | Usage |
---|---|---|---|
sys_io | - | - | - |
sys_fs | - | - | - |
sys_fs | 0x18DD4604 | cellFsOpen2 | - |
sys_fs_ps2disc | 0x8160A811 | switches /dev_ps2disc(1) mount? | |
vsh | - | - | |
vsh | 0xF48562D | cellSsAimIsCEX | |
vsh | 0x145991B4 | cellSsAimIsArcade | |
vsh | 0x172B05CD | update_mgr_write_eprom syscall | |
vsh | 0x1B890AD2 | update_mgr_get_token_seed syscall | |
vsh | 0x1F80E287 | cellSsAimIsTool | |
vsh | 0x2C563C92 | update_mgr_read_eprom syscall | |
vsh | 0x3231E012 | vtrm_Decrypt_Master syscall | |
vsh | 0x349F1535 | update_mgr_set_token syscall | |
vsh | 0x3B4A1AC4 | AIM GetDeviceId syscall | |
vsh | 0x3F062337 | AIM GetPsCode syscall | |
vsh | 0xE44F29F4 | cellFsUtilMount syscall | |
vsh | 0xE7C34044 | retrieves vsh memory container by "id" 0=game,1=app,2=debug,3=fg, 4=bg | sys_memory_container_t vsh_E7C34044(int id) |
vsh | 0xE932A8C0 | reboot and show minimum version char can be "text whatever you like", no check etc. |
int vsh_E932A8C0(char * ) |
vsh | 0xFF4A1633 | cellFsUtilMount syscall | |
vsh | 0x7D73E7CD | inflate_init | |
vsh | 0x4DB8DD87 | inflate_end | |
vsh | 0x20215547 | inflate_buffer | |
vsh | 0x1C68CC75 | inflate | |
sdk | - | - | |
sdk | 0xB5877BBF | cellAvsetGetMonitorInformation | |
sdk | 0x5FAFE92B | cellCryptoPuSha1Hash | |
sdk | 0xB45387CD | AesCbcCfb128Decrypt | |
sdk | 0x55ACAB8A | sha1_init | |
sdk | 0x831E89EE | sha1_update | |
sdk | 0x3CABD075 | sha1_final | |
sdk | 0x4484A101 | sha1_hmac_update | |
sdk | 0x547B602C | sha1_hmac_init | |
sdk | 0x300B99F2 | sha1_hmac_final | |
sdk | 0x74A2A1FE | sha1_hmac_buffer | |
sdk | 0x68B630D5 | aes_omac_mode1 | |
paf | - | - | |
paf | 0xBB04609B | GetSparkInfo | |
paf | 0x65BE85B3 | _UnloadView | _paf_65BE85B3(char * plugin_name,0,0) |
paf | 0x350B4536 | Job_Start | |
paf | 0xFE0C1F10 | Job_Queue | |
paf | 0xA1DC401 | sets Interface from plugin | uint32_t SetInterface(unknown, uint32_t identifier, void * ptr_structure) |
paf | 0x23AFB290 | gets Interface from plugin, should allow calling its exports/funcs | uint32_t plugin->GetInterface(uint32_t return from paf_F21655F3, uint32_t identifier) |
paf | 0x3A8454FC | finds/gets Texture/Resource | Example: out: uint32_t*, return from paf_F21655F3, "tex_notification_info" |
paf | 0x3CEC3833 | sets up a plugin widget ? (page_...) | |
paf | 0x794CEACB | finds widget in a plugin | Example: plugin->FindWidget(return from paf_F21655F3, "page_autooff_guide") |
paf | 0x89B67B9C | gets msg_ text from plugin resource | Example: (w)char (return from paf_F21655F3, "msg_help_system_off_soon_by_setting") |
paf | 0xF21655F3 | finds a loaded plugin | Example: uint32_t paf::View::Find("system_plugin") |
vshcommon | - | - | |
vshcommon | 0x7F5C551B | System_plugin#1_Interface func 11 | vshcommon_7F5C551B(int * texture_dialog, int* texture_dialog_shadow, wchar * infotext1, wchar * infotext2, int) |
vshcommon | 0x94F43BE7 | System_plugin#1_Interface func 12 | vshcommon_94F43BE7(uint8 ) |
vshcommon | 0xF9E43DA2 | returns "msg_ok" wide char text | |
vshcommon | 0xCCD2C319 | returns "msg_cancel" wide char text | |
vshcommon | 0x746C5F88 | returns "msg_option" wide char text | |
vshcommon | 0xF995E53F | returns "msg_back" wide char text | |
vshcommon | 0x26F18EDF | returns "msg_enter" wide char text | |
vshcommon | 0xE9E8DA5 | returns "msg_no" wide char text | |
vshcommon | 0xB8E256D7 | returns "msg_yes" wide char text | |
vshcommon | 0x79A562D5 | System_plugin#1_Interface func 25 circle_cross | |
vshcommon | 0x75DC9C2D | System_plugin#1_Interface func 26 cross_circle | |
vshcommon | 0x60DEE5B3 | System_plugin#1_Interface func 27 triangle | |
vshcommon | 0xF7A67D49 | System_plugin#1_Interface func 28 rectangle | |
vshcommon | 0x2438F1A4 | System_plugin#1_Interface func 21 - anim_cross_circle_show_hide | |
vshcommon | 0x9BD8429E | System_plugin#1_Interface func 22 - anim_cross_circle_show_hide | |
vshcommon | 0xE011E7D0 | System_plugin#1_Interface func 23 - anim_triangle_show_hide | |
vshcommon | 0x73F85259 | System_plugin#1_Interface func 24 - anim_rectangle_show_hide | vshcommon_73F85259(uint8 ) |
vshcommon | 0x16106ACD | returns "impose_plugin" interface 1 | uint vshcommon_16106ACD() |
vshcommon | 0x8B2110D5 | reads boot_history.dat | |
vshcommon | 0x9A43140 | adds info to /pushlist/patch.dat | |
vshcommon | 0x9EA67737 | vsh::ws_boot_history::Set() { uint8 type, char TitleId [0x1F] } titleid to boot_history.dat (creates if not present) |
|
vshcommon | 0xCC2C67F2 | reads /pushlist/patch.dat | vshcommon_CC2C67F2(int* count,uint8_t buf[0x680]) |
x3 | - | - | |
x3 | 0x16FA740A | xCore_GetInterface() | uint32_t* interface xCore_GetInterface() |
x3 | 0x11409ED3 | xRegistryGetDefaultInstance | int xRegistryGetDefaultInstance (1, &handle) |
x3 | 0x9C246A91 | xBDVDGetInstance | |
x3 | 0xCB1D791D | Obtains SS Key | |
x3 | 0xECACA8AD | xRegistry SetValue | Example: int SetValue(handle, "/setting/categoryVersion", 0,0,0) |
mms_db | 0x8EC9A2A7 | xCB_Interface::GetInterface | |
vshnet | - | - | |
vshnet | 0xEF85527 | sceNpSignalingAddExtendedHandler | int sceNpSignalingAddExtendedHandler (ctx_id, 1) |
vshnet | 0xFC663F7F | sceNpSignalingGetPeerNetInfoResult | int sceNpSignalingGetPeerNetInfoResult ( ctx_id, req_id, uint8_t netinfo[0x1C], 1) |
vshnet | 0x2B2E098F | sceNpSignalingGetLocalNetInfo | int sceNpSignalingGetLocalNetInfo ( ctx_id, uint8_t netinfo[0x1C], 1) |
vshnet | 0xE5CBDF3D | sceNpSignalingGetConnectionInfo | int sceNpSignalingGetConnectionInfo ( ctx_id, conn_id, code, * rtt/bandwith/addr/port/packet_loss, 1 ) |
vshnet | 0x995D1D2F | sceNpSignalingGetConnectionStatus | int sceNpSignalingGetConnectionStatus ( ctx_id, conn_id, int * conn_status,int * peer_addr,uint16_t * peer_port, 1 ) |
vshnet | 0x158032C9 | sceNpSignalingDestroyCtx | int sceNpSignalingDestroyCtx ( ctx_id, 1) |
vshnet | 0x8478A915 | sceNpMatchingGetRoomMemberListLocal | int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], int * size, uint8_t roomStatus[ ], int (1) ) |
vshnet | 0x3139980 | sceNpMatchingGetRoomMemberList | int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], req_id, int (1) ) |
vshnet | 0x24B26C3F | sceNpMatchingLeaveRoom | int sceNpMatchingLeaveRoom ( ctx_id, uint8_t opt[0x1C], req_id, int (1) ) |
vshnet | 0x14211FB9 | sceNpMatchingDestroyCtx | int sceNpMatchingDestroyCtx ( ctx_id, 1 ) |
vshnet | 0x4C9F0992 | sceNpManagerGetPsHandle | int sceNpManagerGetPsHandle ( int (0), uint8_t psHandle[0x14] |
vshnet | 0x4E276F38 | sceNpManagerGetSubjectRegion | int sceNpManagerGetSubjectRegion ( int (0), uint8_t subjectRegion[4] |
vshnet | 0x58AB86D8 | sceNpManagerGetSubjectStatus | int sceNpManagerGetSubjectStatus ( int (0), uint8_t subjectStatus[4] |
vshnet | 0x7A9421D8 | sceNpManagerGetStatusDuration | int sceNpManagerGetStatusDuration ( int (0), uint64_t * statusDuration |
vshnet | 0x4216DF9F | sceNpManagerRegisterCallbackExt | int sceNpManagerRegisterCallbackExt ( void * callback, void * arg) |
vshnet | 0x572FFDFB | sceNpManagerGetSubHandle | int sceNpManagerGetSubHandle (int (0), uint8_t subHandle[0x34]) |
vshnet | 0x2C393B42 | sceNpManagerUnregisterCallbackExt | int sceNpManagerUnregisterCallbackExt () |
vshnet | 0x4DD12D0C | sceNpManagerGetUserIconURL | int sceNpManagerGetUserIconURL ( int (0), uint8_t icon[0x80] ) |
vshnet | 0x99666F31 | sceNpManagerGetEnvnamae | int sceNpManagerGetEnvnamae ( uint8_t envname[0x0F] ) |
vshnet | 0x319E53BD | sceNpManagerLoadCachedInfo | int sceNpManagerLoadCachedInfo ( int userId, uint8_t cachedInfo[0xF8] ) |
vshnet | 0x9EF14F7C | sceNpManagerIsPlus | int attr_is_plus sceNpManagerIsPlus ( int (0) ) |
vshnet | 0xC3417866 | sceNpManagerGetTicketParam | |
vshnet | 0x788759C6 | sceNpManagerGetSigninTicket | sceNpManagerGetSigninTicket ( int (0), uint8_t signinTicketData[], int * signinTicketSize |
vshnet | 0x1FA25660 | sceNpManagerSubSignout | int sceNpManagerSubSignout (int (0), uint8_t npId [0x24] |
vshnet | 0xB79B2FE0 | sceNpManagerGetNetworkTime | int sceNpManagerGetNetworkTime (int (0), uint8_t casualClock[8]) |
vshnet | 0xFACC5962 | sceNpManagerGetMyLanguages | int sceNpManagerGetMyLanguages (int (0), uint8_t myLang[0x10] |
vshnet | 0xFC7303C5 | sceNpManagerGetNpId | int sceNpManagerGetNpId ( int (0), uint8_t npId[0x24] |
vshnet | 0x1D555F5F | sceNpUpdateClockStart | |
vshnet | 0x50EE5602 | gets updatelist txt and compares version | |
vshnet | 0x731E546F | prints Firmware version ("%02d.%02d) | int vshnet_731E546F(out: const char*) |
vshnet | 0xEBEA23A1 | sceNetHttpXmlConsoleInfoBitOpe | int sceNetHttpXmlConsoleInfoBitOpe(0x190, xml?,1,1) |
vshmain | - | - | |
vshmain | 0xF32CEC81 | loadRegistryNetautoDlFlag | int loadRegistryNetautoDlFlag ( void ) |
vshmain | 0xB84B751A | saveRegistryNetautoDlFlag | saveRegistryNetautoDlFlag ( uint8 ) |
vshmain | 0xAE35CF2D | Executes Action based on Input (More Info: XMB Plugin XMM0 Interface 23)
Example: "http://www.psdevwiki.com",0 "copy:device",1 "regcam:reg?",1 |
int vshmain_AE35CF2D(char *, int value) |
vshmain | 0xD609A2F6 | shows up XMB Login? | |
vshmain | 0xF3F75BE | sysutil::BeginService | |
vshmain | 0x505FA917 | cxmlutil::GetFile | |
vshmain | 0x7606AF6F | VersionFile::Get | |
vshmain | 0x981D7E9F | Gets ScreenShot Flag | int vshmain_981D7E9F() |
vshtask | - | - | |
vshtask | 0xA02D46E7 | Displays a notification in XMB | int vshtask_A02D46E7(0 /*ignored*/, "your text" ) |
cellHttp | 0x8FC281F7 | cellHttpCookieFlush | |
cellHttp | 0xDCDF003A | cellHttpAuthCacheFlush |
To help documenting offsets+exports, you can use this dumper tool for vsh (actually,no need to dump anymore).
Memory Containers
id name 0 game 1 app 2 debug 3 fg (foreground?) 4 bg (background?)
Display Buffers
VSH uses 2 of 8 available display buffers. Information about them can be aquired by vsh plugins using this code snippet: [[1]]
In FW 4.46 DEX the buffer info looks like this (for 1920x1080):
GCMBUFINFO 0 offset: 0xdc80000 pitch: 0x2000 width: 0x780 height: 0x438 GCMBUFINFO 1 offset: 0xe500000 pitch: 0x2000 width: 0x780 height: 0x438