VSH
Jump to navigation
Jump to search
VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know.XrossMediaBar (XMB). This, is a user space executable (vsh.self), loaded by lv2_kernel/sys_init_osd.
from here several other functions/syscalls to other modules are made, e.g. lv2 (SELF decryption), lv1 (Secure_RTC, Storage_Manager, Gelic_Device, BD_Drive) etc.
not much is documented (yet) about this module. Please fill in where possible.
Modes
possible arguments to pass when executing vsh.self:
- --mode=gametool
- --mode=gametool2
- --arcade=true
Offsets
| Function | 3.55 | 3.41 | 3.15 | Notes |
|---|---|---|---|---|
| - | - | - | - | - |
| sub_308EE4 | check_Is_Act_Dat_for_This_Acc_ID |
Exports
| Export Library | Export NID | Notes | Usage |
|---|---|---|---|
| sys_io | - | - | - |
| sys_fs | - | - | - |
| sys_fs | 0x18DD4604 | cellFsOpen2 | - |
| sys_fs_ps2disc | 0x8160A811 | switches /dev_ps2disc(1) mount? | |
| vsh | - | - | |
| vsh | 0xF48562D | cellSsAimIsCEX | |
| vsh | 0x145991B4 | cellSsAimIsArcade | |
| vsh | 0x172B05CD | update_mgr_write_eprom syscall | |
| vsh | 0x1B890AD2 | update_mgr_get_token_seed syscall | |
| vsh | 0x1F80E287 | cellSsAimIsTool | |
| vsh | 0x2C563C92 | update_mgr_read_eprom syscall | |
| vsh | 0x3231E012 | vtrm_Decrypt_Master syscall | |
| vsh | 0x349F1535 | update_mgr_set_token syscall | |
| vsh | 0x3B4A1AC4 | AIM GetDeviceId syscall | |
| vsh | 0x3F062337 | AIM GetPsCode syscall | |
| vsh | 0xE44F29F4 | cellFsUtilMount syscall | |
| vsh | 0xE7C34044 | retrieves vsh memory container by "id" 0=game,1=app,2=debug,3=fg, 4=bg | sys_memory_container_t vsh_E7C34044(int id) |
| vsh | 0xE932A8C0 | reboot and show minimum version char can be "text whatever you like", no check etc. |
int vsh_E932A8C0(char * ) |
| vsh | 0xFF4A1633 | cellFsUtilMount syscall | |
| vsh | 0x7D73E7CD | inflate_init | |
| vsh | 0x4DB8DD87 | inflate_end | |
| vsh | 0x20215547 | inflate_buffer | |
| vsh | 0x1C68CC75 | inflate | |
| sdk | - | - | |
| sdk | 0xB5877BBF | cellAvsetGetMonitorInformation | |
| sdk | 0x5FAFE92B | cellCryptoPuSha1Hash | |
| sdk | 0xB45387CD | AesCbcCfb128Decrypt | |
| sdk | 0x55ACAB8A | sha1_init | |
| sdk | 0x831E89EE | sha1_update | |
| sdk | 0x3CABD075 | sha1_final | |
| sdk | 0x4484A101 | sha1_hmac_update | |
| sdk | 0x547B602C | sha1_hmac_init | |
| sdk | 0x300B99F2 | sha1_hmac_final | |
| sdk | 0x74A2A1FE | sha1_hmac_buffer | |
| sdk | 0x68B630D5 | aes_omac_mode1 | |
| paf | - | - | |
| paf | 0xBB04609B | GetSparkInfo | |
| paf | 0x65BE85B3 | _UnloadView | _paf_65BE85B3(char * plugin_name,0,0) |
| paf | 0x350B4536 | Job_Start | |
| paf | 0xFE0C1F10 | Job_Queue | |
| paf | 0xA1DC401 | sets Interface from plugin | uint32_t SetInterface(unknown, uint32_t identifier, void * ptr_structure) |
| paf | 0x23AFB290 | gets Interface from plugin, should allow calling its exports/funcs | uint32_t plugin->GetInterface(uint32_t return from paf_F21655F3, uint32_t identifier) |
| paf | 0x3A8454FC | finds/gets Texture/Resource | Example: out: uint32_t*, return from paf_F21655F3, "tex_notification_info" |
| paf | 0x3CEC3833 | sets up a plugin widget ? (page_...) | |
| paf | 0x794CEACB | finds widget in a plugin | Example: plugin->FindWidget(return from paf_F21655F3, "page_autooff_guide") |
| paf | 0x89B67B9C | gets msg_ text from plugin resource | Example: (w)char (return from paf_F21655F3, "msg_help_system_off_soon_by_setting") |
| paf | 0xF21655F3 | finds a loaded plugin | Example: uint32_t paf::View::Find("system_plugin") |
| vshcommon | - | - | |
| vshcommon | 0x7F5C551B | System_plugin#1_Interface func 11 | vshcommon_7F5C551B(int * texture_dialog, int* texture_dialog_shadow, wchar * infotext1, wchar * infotext2, int) |
| vshcommon | 0x94F43BE7 | System_plugin#1_Interface func 12 | vshcommon_94F43BE7(uint8 ) |
| vshcommon | 0xF9E43DA2 | returns "msg_ok" wide char text | |
| vshcommon | 0xCCD2C319 | returns "msg_cancel" wide char text | |
| vshcommon | 0x746C5F88 | returns "msg_option" wide char text | |
| vshcommon | 0xF995E53F | returns "msg_back" wide char text | |
| vshcommon | 0x26F18EDF | returns "msg_enter" wide char text | |
| vshcommon | 0xE9E8DA5 | returns "msg_no" wide char text | |
| vshcommon | 0xB8E256D7 | returns "msg_yes" wide char text | |
| vshcommon | 0x79A562D5 | System_plugin#1_Interface func 25 circle_cross | |
| vshcommon | 0x75DC9C2D | System_plugin#1_Interface func 26 cross_circle | |
| vshcommon | 0x60DEE5B3 | System_plugin#1_Interface func 27 triangle | |
| vshcommon | 0xF7A67D49 | System_plugin#1_Interface func 28 rectangle | |
| vshcommon | 0x2438F1A4 | System_plugin#1_Interface func 21 - anim_cross_circle_show_hide | |
| vshcommon | 0x9BD8429E | System_plugin#1_Interface func 22 - anim_cross_circle_show_hide | |
| vshcommon | 0xE011E7D0 | System_plugin#1_Interface func 23 - anim_triangle_show_hide | |
| vshcommon | 0x73F85259 | System_plugin#1_Interface func 24 - anim_rectangle_show_hide | vshcommon_73F85259(uint8 ) |
| vshcommon | 0x16106ACD | returns "impose_plugin" interface 1 | uint vshcommon_16106ACD() |
| vshcommon | 0x8B2110D5 | reads boot_history.dat | |
| vshcommon | 0x9A43140 | adds info to /pushlist/patch.dat | |
| vshcommon | 0x9EA67737 | vsh::ws_boot_history::Set() { uint8 type, char TitleId [0x1F] } titleid to boot_history.dat (creates if not present) |
|
| vshcommon | 0xCC2C67F2 | reads /pushlist/patch.dat | vshcommon_CC2C67F2(int* count,uint8_t buf[0x680]) |
| x3 | - | - | |
| x3 | 0x16FA740A | xCore_GetInterface() | uint32_t* interface xCore_GetInterface() |
| x3 | 0x11409ED3 | xRegistryGetDefaultInstance | int xRegistryGetDefaultInstance (1, &handle) |
| x3 | 0x9C246A91 | xBDVDGetInstance | |
| x3 | 0xCB1D791D | Obtains SS Key | |
| x3 | 0xECACA8AD | xRegistry SetValue | Example: int SetValue(handle, "/setting/categoryVersion", 0,0,0) |
| mms_db | 0x8EC9A2A7 | xCB_Interface::GetInterface | |
| vshnet | - | - | |
| vshnet | 0xCF725EB1 | sceNpInstallerRegetSigninTicket | int sceNpInstallerRegetSigninTicket (0) |
| vshnet | 0x7084A801 | sceNpCommerceSetDataFlagFinish | int sceNpCommerceSetDataFlagFinish ( int req_id ) |
| vshnet | 0x572A4D1D | sceNpSommerceSetDataFlagStart | int sceNpSommerceSetDataFlagStart ( ctx_id, licensee_id, dataflagContainer, dataflag_num, * req_id ) |
| vshnet | 0xFF500259 | sceNpCommerceGetDataFlagFinish | int sceNpCommerceGetDataFlagFinish ( int req_id ) |
| vshnet | 0x15910AE7 | sceNpCommerceGetDataFlagState | int sceNpCommerceGetDataFlagState ( int req_id, dataflagContainer, dataflag_num ) |
| vshnet | 0x13D56523 | sceNpCommerceGetDataFlagAbort | int sceNpCommerceGetDataFlagAbort ( int req_id ) |
| vshnet | 0x854FE623 | sceNpCommerceGetDataFlagStart | int sceNpCommerceGetDataFlagStart ( ctx_id, licensee_id, dataflag [0x10] , dataflag_num, * req_id ) |
| vshnet | 0xE2A0CB65 | sceNpCommerceGetProductCategoryResult | int sceNpCommerceGetProductCategoryResult ( int req_id, uint8_t result_buf_size [0x10] ) |
| vshnet | 0xE84BBCAF | sceNpCommerceGetProductCategoryFinish | int sceNpCommerceGetProductCategoryFinish ( int req_id ) |
| vshnet | 0xD297EF28 | sceNpCommerceGetProductCategoryAbort | int sceNpCommerceGetProductCategoryAbort ( int req_id ) |
| vshnet | 0x3E20181D | sceNpCommerceGetProductCategoryStart | int sceNpCommerceGetProductCategoryStart ( int ctx_id, int category_id, int lang_code, int * req_id ) |
| vshnet | 0x2A4C99A6 | sceNpCommerceDestroyCtx | int sceNpCommerceDestroyCtx (ctx_id) |
| vshnet | 0x98340E57 | sceNpCommerceCreateCtx | int sceNpCommerceCreateCtx ( int version, uint8_t npId[0x24], void * callback, int * arg,int * ctx_id, int (1) ) |
| vshnet | 0x594266BE | sceNpBasicGetInitialPresence | |
| vshnet | 0xEF85527 | sceNpSignalingAddExtendedHandler | int sceNpSignalingAddExtendedHandler (ctx_id, 1) |
| vshnet | 0xFC663F7F | sceNpSignalingGetPeerNetInfoResult | int sceNpSignalingGetPeerNetInfoResult ( ctx_id, req_id, uint8_t netinfo[0x1C], 1) |
| vshnet | 0x2B2E098F | sceNpSignalingGetLocalNetInfo | int sceNpSignalingGetLocalNetInfo ( ctx_id, uint8_t netinfo[0x1C], 1) |
| vshnet | 0xE5CBDF3D | sceNpSignalingGetConnectionInfo | int sceNpSignalingGetConnectionInfo ( ctx_id, conn_id, code, * rtt/bandwith/addr/port/packet_loss, 1 ) |
| vshnet | 0x995D1D2F | sceNpSignalingGetConnectionStatus | int sceNpSignalingGetConnectionStatus ( ctx_id, conn_id, int * conn_status,int * peer_addr,uint16_t * peer_port, 1 ) |
| vshnet | 0x158032C9 | sceNpSignalingDestroyCtx | int sceNpSignalingDestroyCtx ( ctx_id, 1) |
| vshnet | 0x8478A915 | sceNpMatchingGetRoomMemberListLocal | int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], int * size, uint8_t roomStatus[ ], int (1) ) |
| vshnet | 0x3139980 | sceNpMatchingGetRoomMemberList | int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], req_id, int (1) ) |
| vshnet | 0x24B26C3F | sceNpMatchingLeaveRoom | int sceNpMatchingLeaveRoom ( ctx_id, uint8_t opt[0x1C], req_id, int (1) ) |
| vshnet | 0x14211FB9 | sceNpMatchingDestroyCtx | int sceNpMatchingDestroyCtx ( ctx_id, 1 ) |
| vshnet | 0x4C9F0992 | sceNpManagerGetPsHandle | int sceNpManagerGetPsHandle ( int (0), uint8_t psHandle[0x14] |
| vshnet | 0x4E276F38 | sceNpManagerGetSubjectRegion | int sceNpManagerGetSubjectRegion ( int (0), uint8_t subjectRegion[4] |
| vshnet | 0x58AB86D8 | sceNpManagerGetSubjectStatus | int sceNpManagerGetSubjectStatus ( int (0), uint8_t subjectStatus[4] |
| vshnet | 0x7A9421D8 | sceNpManagerGetStatusDuration | int sceNpManagerGetStatusDuration ( int (0), uint64_t * statusDuration |
| vshnet | 0x4216DF9F | sceNpManagerRegisterCallbackExt | int sceNpManagerRegisterCallbackExt ( void * callback, void * arg) |
| vshnet | 0x572FFDFB | sceNpManagerGetSubHandle | int sceNpManagerGetSubHandle (int (0), uint8_t subHandle[0x34]) |
| vshnet | 0x2C393B42 | sceNpManagerUnregisterCallbackExt | int sceNpManagerUnregisterCallbackExt () |
| vshnet | 0x4DD12D0C | sceNpManagerGetUserIconURL | int sceNpManagerGetUserIconURL ( int (0), uint8_t icon[0x80] ) |
| vshnet | 0x99666F31 | sceNpManagerGetEnvnamae | int sceNpManagerGetEnvnamae ( uint8_t envname[0x0F] ) |
| vshnet | 0x319E53BD | sceNpManagerLoadCachedInfo | int sceNpManagerLoadCachedInfo ( int userId, uint8_t cachedInfo[0xF8] ) |
| vshnet | 0x9EF14F7C | sceNpManagerIsPlus | int attr_is_plus sceNpManagerIsPlus ( int (0) ) |
| vshnet | 0xC3417866 | sceNpManagerGetTicketParam | |
| vshnet | 0x788759C6 | sceNpManagerGetSigninTicket | sceNpManagerGetSigninTicket ( int (0), uint8_t signinTicketData[], int * signinTicketSize |
| vshnet | 0x1FA25660 | sceNpManagerSubSignout | int sceNpManagerSubSignout (int (0), uint8_t npId [0x24] |
| vshnet | 0xB79B2FE0 | sceNpManagerGetNetworkTime | int sceNpManagerGetNetworkTime (int (0), uint8_t casualClock[8]) |
| vshnet | 0xFACC5962 | sceNpManagerGetMyLanguages | int sceNpManagerGetMyLanguages (int (0), uint8_t myLang[0x10] |
| vshnet | 0xFC7303C5 | sceNpManagerGetNpId | int sceNpManagerGetNpId ( int (0), uint8_t npId[0x24] |
| vshnet | 0x1D555F5F | sceNpUpdateClockStart | |
| vshnet | 0x50EE5602 | gets updatelist txt and compares version | |
| vshnet | 0x731E546F | prints Firmware version ("%02d.%02d) | int vshnet_731E546F(out: const char*) |
| vshnet | 0xEBEA23A1 | sceNetHttpXmlConsoleInfoBitOpe | int sceNetHttpXmlConsoleInfoBitOpe(0x190, xml?,1,1) |
| vshmain | - | - | |
| vshmain | 0xF32CEC81 | loadRegistryNetautoDlFlag | int loadRegistryNetautoDlFlag ( void ) |
| vshmain | 0xB84B751A | saveRegistryNetautoDlFlag | saveRegistryNetautoDlFlag ( uint8 ) |
| vshmain | 0xAE35CF2D | Executes Action based on Input (More Info: XMB Plugin XMM0 Interface 23)
Example: "http://www.psdevwiki.com",0 "copy:device",1 "regcam:reg?",1 |
int vshmain_AE35CF2D(char *, int value) |
| vshmain | 0xD609A2F6 | shows up XMB Login? | |
| vshmain | 0xF3F75BE | sysutil::BeginService | |
| vshmain | 0x505FA917 | cxmlutil::GetFile | |
| vshmain | 0x7606AF6F | VersionFile::Get | |
| vshmain | 0x981D7E9F | Gets ScreenShot Flag | int vshmain_981D7E9F() |
| vshtask | - | - | |
| vshtask | 0xA02D46E7 | Displays a notification in XMB | int vshtask_A02D46E7(0 /*ignored*/, "your text" ) |
| cellHttp | 0x8FC281F7 | cellHttpCookieFlush | |
| cellHttp | 0xDCDF003A | cellHttpAuthCacheFlush |
To help documenting offsets+exports, you can use this dumper tool for vsh (actually,no need to dump anymore).
Memory Containers
id name 0 game 1 app 2 debug 3 fg (foreground?) 4 bg (background?)
Display Buffers
VSH uses 2 of 8 available display buffers. Information about them can be aquired by vsh plugins using this code snippet: [[1]]
In FW 4.46 DEX the buffer info looks like this (for 1920x1080):
GCMBUFINFO 0 offset: 0xdc80000 pitch: 0x2000 width: 0x780 height: 0x438 GCMBUFINFO 1 offset: 0xe500000 pitch: 0x2000 width: 0x780 height: 0x438
