mirror of
https://github.com/boykopovar/AnyPS5.git
synced 2026-11-07 13:39:55 +00:00
docs(debt): merge libkernel_sys's two Unknown function info sections
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
LeandroLP23andClaude Opus 5.5 authored and Adrià committed
1 parent
654d844524
commit
da1e21ec8c
1 file changed
+32
-34
@@ -329,6 +329,38 @@
|
||||
- [sceKernelIsModuleLoaded](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - returning `SCE_KERNEL_ERROR_EFAULT` (`0x8002000E`) for an unreadable name pointer is a host-safety fallback; firmware 13.42 disassembly reads the caller string in place without copy checks, so the console faults
|
||||
- [scePthreadCondattrGetclock](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - a null clock pointer with a valid attribute throws `std::invalid_argument`, where a payload process measured on a device faults. A null or destroyed attribute with a null output returns `SCE_KERNEL_ERROR_EINVAL` (`0x80020016`) because [FreeBSD 11.4 libthr](https://github.com/freebsd/freebsd-src/blob/d106002967/lib/libthr/thread/thr_condattr.c#L82-L90) checks the attribute first; that pair was not measured. Returning `SCE_KERNEL_ERROR_EFAULT` (`0x8002000E`) for an unwritable clock pointer is a host-safety fallback; firmware 13.42 disassembly stores the clock directly, so the console faults. Stale handles are not validated
|
||||
|
||||
- [scePthreadTimedjoin](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys, NID `HLUSF4Oi7Pc`) - the signature is not measured on a console and not present in the Orbital type database; it adopts the relative microsecond deadline form `(Pthread, void**, KernelUseconds)` of its sibling `scePthread*Timed*` functions (`scePthreadMutexTimedlock`, `scePthreadCondTimedwait`, `scePthreadRwlockTimedrdlock`) and converts the deadline relative to `CLOCK_REALTIME` before forwarding to `pthread_timedjoin_np`.
|
||||
- [scePthreadBarrier*, scePthreadBarrierattr*, scePthreadGetcpuclockid, scePthreadGetconcurrency and sceKernelMsync](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) call libkernel's `pthread_barrier*`, `pthread_getcpuclockid`, `pthread_getconcurrency` and `msync` and turn a POSIX error into `0x80020000 | errno`; that the console's `sce` forms do the same is not measured. Signatures follow the [Orbital type database](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json); `scePthreadBarrierInit` ignores its name, and `scePthreadBarrierWait` returns -1 to the serial thread, both as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/kernel/threads/barrier.cpp) (PS4). `scePthreadGetconcurrency` returns the level unchanged
|
||||
- [scePthreadAttrGetscope, scePthreadAttrSetscope, scePthreadAtfork and scePthreadSetconcurrency](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) call libkernel's `pthread_attr_getscope`, `pthread_attr_setscope`, `pthread_atfork` and `pthread_setconcurrency` and turn a POSIX error into `0x80020000 | errno`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/kernel/threads/pthread_attr.cpp#L392) exports `scePthreadAttrGetscope` as `ORBIS(posix_pthread_attr_getscope)`; shadPS4 has no export for the other three, whose names and NIDs are in the [symbol database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv) and whose signatures follow the same POSIX forms. Not measured on a console. As in libkernel, the scope is 0 (process) or 2 (system), and `scePthreadAtfork` handlers are only recorded, as no process forks
|
||||
- [scePthreadMutexInitForInternalLibc, scePthreadMutexattrInitForInternalLibc](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - not measured on a console. They call `pthread_mutex_init` and `pthread_mutexattr_init` as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/ce74386/src/core/libraries/kernel/threads/mutex.cpp#L541-L557) and [ChonkyStation4](https://github.com/liuk7071/ChonkyStation4/blob/c101a23/ChonkyStation4/OS/Libraries/Kernel/Kernel.cpp#L97-L108) (PS4) do, with shadPS4's `0x80020000 | errno` errors; a mutex without attributes checks errors. FreeBSD's malloc-internal [`_pthread_mutex_init_calloc_cb`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_mutex.c#L401-L419) disagrees, making a normal mutex that defers signals. A name argument, signal deferral and allocation are unknown; the [PS5 payload SDK](https://github.com/ps5-payload-dev/sdk/blob/a7685ce/sce_stubs/libkernel_sys.c#L4382-L4452) only lists the exports
|
||||
- [AMM kernel write commands](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - signatures of the map, map direct, unmap, remap, multimap and protection writers and their GPU mask id forms taken from [ampr_emu's libkernel hook targets](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_libkernel_hook_targets.h), which forward to the real kernel; the measure mode (`dst` null reports the size, `outSize` null skips the report) follows ampr_emu's measure-then-record calls, not confirmed on a title. Each writer builds its record with the encoder of its `libSceAmpr` command buffer sibling, so it applies the sibling's checks and writes its bytes. The GPU mask id is ignored, as by the siblings, and a protection or mask with bits above 32 is rejected, as by `sceKernelWriteModifyMtypeProtectCommand`. A wider `type` is cut to the record's 32 bits, as by that writer; the console's handling is not measured
|
||||
- [AMM kernel write command checks](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - the map, map direct, unmap, remap, multimap and protection writers apply their libSceAmpr siblings' checks, not those of firmware 13.42's libkernel (compared under a CPU emulator, not measured on a console), so some arguments get a different return code. The console checks the range against the AMM virtual address ranges, accepts a size that wraps past the end of the address space, takes a different set of protection bits and, for maps and memory type changes, accepts only types 11 to 20. Where both accept a call, the recorded address, size, type and protection match
|
||||
- [sceKernelWriteMapCommand2, sceKernelWriteUnmapToPrtCommand, sceKernelWriteWriteAddressCommand, sceKernelWriteWriteCounterCommand, sceKernelWriteWaitOnAddressCommand, sceKernelWriteWaitOnCounterCommand and sceKernelWriteEventQueueOnCompletionCommand](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - they record this project's command layout, not the console's packed commands, so the reported sizes differ and the waits' flush bit is dropped. A PRT map with a non-zero type or protection and a recorded wait on an address that is not 8-byte aligned throw: their results are unknown. The checks follow firmware 13.42's libkernel and libkernel_sys, read from disassembly and compared under a CPU emulator, not measured on a console; without the PRT flag sceKernelWriteMapCommand2 is sceKernelWriteMapCommand. As in the firmware, the PRT range check accepts an end that wraps past the top of the address space, and only size bits 14 to 40 are recorded
|
||||
- [sceKernelWriteWaitOnAddressCommand and sceKernelWriteWaitOnCounterCommand](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - a negative compare passes the firmware's check (above 3 is refused) and is recorded as its low three bits, as in firmware 13.42, so -2 to -4 record modes 6 to 4. The command runner here (`_waitSatisfied` in `Apr.cpp`) implements modes 0 to 6, so a wait recorded with mode 7, for example from a compare of -1, is written successfully but throws when it runs
|
||||
- [sceKernelCallIndirectBuffer, sceKernelCallIndirectBuffer2, sceKernelCallIndirectBuffer3, sceKernelGiveDirectMemoryToMapper and sceKernelMapperGetParam](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - follow firmware 13.42's libkernel_sys, read from disassembly and not measured on a console. The submit calls hand their arguments to a kernel ioctl, keeping 32 bits of the dword count, so the kernel's checks are unknown: a priority above 2, a null buffer or a dword count of 2^30 or more (the AMM queue here takes a 32-bit byte count) throws. sceKernelGiveDirectMemoryToMapper requires a non-zero size and a 2 MiB aligned size and alignment. sceKernelMapperGetParam copies up to 0x38 requested bytes of a block filled at startup: its size, the four AMM range values (firmware libSceAmpr reads them from there), then two unknown values, so a request past 0x28 bytes throws. The 0x80020006 returned when its device cannot be opened is not modelled
|
||||
- [sceKernelMapperGetParam](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - returning `SCE_KERNEL_ERROR_EFAULT` (`0x8002000E`) for an unwritable output pointer or unreadable parameter struct is a host-safety fallback; firmware 13.42 disassembly accesses memory directly, so the console faults
|
||||
- [sceKernelWaitCommandBufferCompletion](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - signature taken from [ampr_emu's libkernel hook targets](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_libkernel_hook_targets.h), where `sceAmprAmmWaitCommandBufferCompletion` forwards to it; like that sibling it waits for an AMM submission and returns `SCE_KERNEL_ERROR_ESRCH` for an id that was never submitted, not confirmed on a title
|
||||
- [kldsym](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_kldsym`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_linker.c) in the order it checks its arguments: `EFAULT` for an unreadable lookup structure, `EINVAL` for a `version` other than the structure size (32 bytes on amd64) or a command other than `KLDSYM_LOOKUP`, `EFAULT` or `ENAMETOOLONG` for the symbol name, `ENOENT` for a file id that no file has. The linker file list is empty here, as in `kldnext` and `kldfind`, so every file id other than 0 gets `ENOENT`; modules a console preloads are not modelled. A lookup in id 0 (every file) throws, as no symbol table is modelled. Whether a title may query kernel symbols is unverified
|
||||
|
||||
#### Inventory identity evidence
|
||||
|
||||
The NID set is from the inspected `libkernel_sys` ELF function-export table (defined `STT_FUNC` entries), not the older 3.20 inventory. The module-parameter words at `0x10` and `0x14` are `0x13590001` and `0x13600007`; the earlier 13.60 label refers to SDK-formatted metadata, not independently authenticated retail firmware or an introduction date. The [reproducible static audit](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298) finds 1551 unique function NIDs with set digest `5f1668cc9c69e2950722a83151f31cf7aa94fb1552ab883e5067f43c94d63b16` and confirms all 328 proposed entries. The digest hashes sorted unique ASCII NIDs, each followed by LF. Named declarations are candidate spellings whose repository-computed NID exactly matches an observed function NID; the hashed table establishes neither plaintext spelling nor C ABI.
|
||||
|
||||
The 35 formerly literal aliases are named by the [repository-pinned aerolib table](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). There are now 161 named declarations and 160 unresolved NID aliases; every one of the 321 entries remains a throwing placeholder. `sceKernelHasTrinityMode` left the inventory for its `libkernel` implementation and `_execve` and `_execvpe` left it for their implementations in `AdditionalExports.cpp`.
|
||||
|
||||
The following eight candidate spellings are absent from that aerolib revision. Their name/NID pairs occur in the [public ps5rs identity database at commit `2304be5131221bae0dac24b9767cabffda33f747`](https://github.com/claimore22/ps5rs/blob/2304be5131221bae0dac24b9767cabffda33f747/data/nids.csv) and independently recompute to the function NIDs in the inspected table. This database supports candidate spelling only; it does not establish firmware membership, introduction version or ABI.
|
||||
|
||||
| Candidate spelling | NID |
|
||||
| --- | --- |
|
||||
| `__sys_dynlib_unload_prx` | `GQli4UAXTfQ` |
|
||||
| `mmap2` | `tGtH2GTWbyE` |
|
||||
| `pthread_setschedother_np` | `ymCrwbFD4fk` |
|
||||
| `sceKernelEnableDmemAliasing3` | `RbhD-epf6c0` |
|
||||
| `sceKernelGetResidentFmemCount2` | `zx9n-9bt7IA` |
|
||||
| `sceKernelIsCloudDevkit` | `XyW5rUlKP1w` |
|
||||
| `sceKernelKernelHeapUsage2` | `pQiLz-exzR4` |
|
||||
| `sceKernelSetAppInfoByAppId` | `fIyST5BItRg` |
|
||||
|
||||
### Functional
|
||||
- [sceKernelGetPhysPageSize](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) returns `PS5_PAGE_SIZE` (16 KiB), the guest page granularity used by libkernel's direct-memory and mapping implementation. The export has no arguments. Console behaviour is unverified
|
||||
- [revoke](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - a character device throws, because device revocation is not modelled. Other paths follow FreeBSD 11 `sys_revoke`: path errors as `stat` reports them, and `EINVAL` for anything that is not a character device. Guest paths have no `/dev`, so `/dev/null` and the like fail with `ENOENT`, not as devices
|
||||
@@ -385,37 +417,3 @@
|
||||
- [sceKernelSettimeofday](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - forwards to `settimeofday` and returns its result, or `0x80020000` plus `errno` for a failure, as shadPS4's [`sceKernelSettimeofday`](https://github.com/shadps4-emu/shadPS4/blob/7ea677e56d75bf3d90ace2b0a5144a665d1f38b6/src/core/libraries/kernel/time.cpp#L565-L571) maps its call through `ErrnoToSceKernelError`; that branch passes the call's return value, and shadPS4's own `settimeofday` never fails, so the errno form the other sce wrappers here use is taken. Nothing is measured on the console, and a valid time inherits `settimeofday`'s refusal to set the host clock
|
||||
- [adjtime](../../../core/libs/prx/libkernel_sys/AdditionalExports.cpp) (libkernel_sys) assumes a jailed caller under the model agreed on [#11216](https://github.com/boykopovar/AnyPS5/pull/11216); console privileges and clock slewing are unverified. FreeBSD 11.4 [`sys_adjtime`/`kern_adjtime`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_ntptime.c#L961-L1010) reads `delta` before checking `PRIV_ADJTIME`, which [`prison_priv_check`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_jail.c#L3060-L3385) denies. Every readable non-null delta returns `EPERM` without writing `oldDelta`; bad input returns `EFAULT` first. A null delta reports zero pending adjustment through checked copyout. Privileged unjailed callers and nonzero pending corrections are not modelled; the host clock is never adjusted.
|
||||
- [_dup2](../../../core/libs/prx/libkernel_sys/AdditionalExports.cpp) (libkernel_sys) follows FreeBSD 11.4's [_dup2](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/libc/sys/dup.2) and POSIX.1-2008 dup2: it forwards to libkernel's dup2, returning the target descriptor or setting errno and returning -1 on failure. It inherits libkernel dup2's limits (duplicating kqueue/ksem descriptors, or moving guest sockets onto standard descriptors, throws) and console behaviour is unverified.
|
||||
|
||||
### Unknown function info
|
||||
|
||||
- [scePthreadTimedjoin](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys, NID `HLUSF4Oi7Pc`) - the signature is not measured on a console and not present in the Orbital type database; it adopts the relative microsecond deadline form `(Pthread, void**, KernelUseconds)` of its sibling `scePthread*Timed*` functions (`scePthreadMutexTimedlock`, `scePthreadCondTimedwait`, `scePthreadRwlockTimedrdlock`) and converts the deadline relative to `CLOCK_REALTIME` before forwarding to `pthread_timedjoin_np`.
|
||||
- [scePthreadBarrier*, scePthreadBarrierattr*, scePthreadGetcpuclockid, scePthreadGetconcurrency and sceKernelMsync](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) call libkernel's `pthread_barrier*`, `pthread_getcpuclockid`, `pthread_getconcurrency` and `msync` and turn a POSIX error into `0x80020000 | errno`; that the console's `sce` forms do the same is not measured. Signatures follow the [Orbital type database](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json); `scePthreadBarrierInit` ignores its name, and `scePthreadBarrierWait` returns -1 to the serial thread, both as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/kernel/threads/barrier.cpp) (PS4). `scePthreadGetconcurrency` returns the level unchanged
|
||||
- [scePthreadAttrGetscope, scePthreadAttrSetscope, scePthreadAtfork and scePthreadSetconcurrency](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) call libkernel's `pthread_attr_getscope`, `pthread_attr_setscope`, `pthread_atfork` and `pthread_setconcurrency` and turn a POSIX error into `0x80020000 | errno`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/kernel/threads/pthread_attr.cpp#L392) exports `scePthreadAttrGetscope` as `ORBIS(posix_pthread_attr_getscope)`; shadPS4 has no export for the other three, whose names and NIDs are in the [symbol database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv) and whose signatures follow the same POSIX forms. Not measured on a console. As in libkernel, the scope is 0 (process) or 2 (system), and `scePthreadAtfork` handlers are only recorded, as no process forks
|
||||
- [scePthreadMutexInitForInternalLibc, scePthreadMutexattrInitForInternalLibc](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - not measured on a console. They call `pthread_mutex_init` and `pthread_mutexattr_init` as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/ce74386/src/core/libraries/kernel/threads/mutex.cpp#L541-L557) and [ChonkyStation4](https://github.com/liuk7071/ChonkyStation4/blob/c101a23/ChonkyStation4/OS/Libraries/Kernel/Kernel.cpp#L97-L108) (PS4) do, with shadPS4's `0x80020000 | errno` errors; a mutex without attributes checks errors. FreeBSD's malloc-internal [`_pthread_mutex_init_calloc_cb`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_mutex.c#L401-L419) disagrees, making a normal mutex that defers signals. A name argument, signal deferral and allocation are unknown; the [PS5 payload SDK](https://github.com/ps5-payload-dev/sdk/blob/a7685ce/sce_stubs/libkernel_sys.c#L4382-L4452) only lists the exports
|
||||
- [AMM kernel write commands](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - signatures of the map, map direct, unmap, remap, multimap and protection writers and their GPU mask id forms taken from [ampr_emu's libkernel hook targets](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_libkernel_hook_targets.h), which forward to the real kernel; the measure mode (`dst` null reports the size, `outSize` null skips the report) follows ampr_emu's measure-then-record calls, not confirmed on a title. Each writer builds its record with the encoder of its `libSceAmpr` command buffer sibling, so it applies the sibling's checks and writes its bytes. The GPU mask id is ignored, as by the siblings, and a protection or mask with bits above 32 is rejected, as by `sceKernelWriteModifyMtypeProtectCommand`. A wider `type` is cut to the record's 32 bits, as by that writer; the console's handling is not measured
|
||||
- [AMM kernel write command checks](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - the map, map direct, unmap, remap, multimap and protection writers apply their libSceAmpr siblings' checks, not those of firmware 13.42's libkernel (compared under a CPU emulator, not measured on a console), so some arguments get a different return code. The console checks the range against the AMM virtual address ranges, accepts a size that wraps past the end of the address space, takes a different set of protection bits and, for maps and memory type changes, accepts only types 11 to 20. Where both accept a call, the recorded address, size, type and protection match
|
||||
- [sceKernelWriteMapCommand2, sceKernelWriteUnmapToPrtCommand, sceKernelWriteWriteAddressCommand, sceKernelWriteWriteCounterCommand, sceKernelWriteWaitOnAddressCommand, sceKernelWriteWaitOnCounterCommand and sceKernelWriteEventQueueOnCompletionCommand](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - they record this project's command layout, not the console's packed commands, so the reported sizes differ and the waits' flush bit is dropped. A PRT map with a non-zero type or protection and a recorded wait on an address that is not 8-byte aligned throw: their results are unknown. The checks follow firmware 13.42's libkernel and libkernel_sys, read from disassembly and compared under a CPU emulator, not measured on a console; without the PRT flag sceKernelWriteMapCommand2 is sceKernelWriteMapCommand. As in the firmware, the PRT range check accepts an end that wraps past the top of the address space, and only size bits 14 to 40 are recorded
|
||||
- [sceKernelWriteWaitOnAddressCommand and sceKernelWriteWaitOnCounterCommand](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - a negative compare passes the firmware's check (above 3 is refused) and is recorded as its low three bits, as in firmware 13.42, so -2 to -4 record modes 6 to 4. The command runner here (`_waitSatisfied` in `Apr.cpp`) implements modes 0 to 6, so a wait recorded with mode 7, for example from a compare of -1, is written successfully but throws when it runs
|
||||
- [sceKernelCallIndirectBuffer, sceKernelCallIndirectBuffer2, sceKernelCallIndirectBuffer3, sceKernelGiveDirectMemoryToMapper and sceKernelMapperGetParam](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - follow firmware 13.42's libkernel_sys, read from disassembly and not measured on a console. The submit calls hand their arguments to a kernel ioctl, keeping 32 bits of the dword count, so the kernel's checks are unknown: a priority above 2, a null buffer or a dword count of 2^30 or more (the AMM queue here takes a 32-bit byte count) throws. sceKernelGiveDirectMemoryToMapper requires a non-zero size and a 2 MiB aligned size and alignment. sceKernelMapperGetParam copies up to 0x38 requested bytes of a block filled at startup: its size, the four AMM range values (firmware libSceAmpr reads them from there), then two unknown values, so a request past 0x28 bytes throws. The 0x80020006 returned when its device cannot be opened is not modelled
|
||||
- [sceKernelMapperGetParam](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - returning `SCE_KERNEL_ERROR_EFAULT` (`0x8002000E`) for an unwritable output pointer or unreadable parameter struct is a host-safety fallback; firmware 13.42 disassembly accesses memory directly, so the console faults
|
||||
- [sceKernelWaitCommandBufferCompletion](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - signature taken from [ampr_emu's libkernel hook targets](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_libkernel_hook_targets.h), where `sceAmprAmmWaitCommandBufferCompletion` forwards to it; like that sibling it waits for an AMM submission and returns `SCE_KERNEL_ERROR_ESRCH` for an id that was never submitted, not confirmed on a title
|
||||
- [kldsym](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_kldsym`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_linker.c) in the order it checks its arguments: `EFAULT` for an unreadable lookup structure, `EINVAL` for a `version` other than the structure size (32 bytes on amd64) or a command other than `KLDSYM_LOOKUP`, `EFAULT` or `ENAMETOOLONG` for the symbol name, `ENOENT` for a file id that no file has. The linker file list is empty here, as in `kldnext` and `kldfind`, so every file id other than 0 gets `ENOENT`; modules a console preloads are not modelled. A lookup in id 0 (every file) throws, as no symbol table is modelled. Whether a title may query kernel symbols is unverified
|
||||
|
||||
#### Inventory identity evidence
|
||||
|
||||
The NID set is from the inspected `libkernel_sys` ELF function-export table (defined `STT_FUNC` entries), not the older 3.20 inventory. The module-parameter words at `0x10` and `0x14` are `0x13590001` and `0x13600007`; the earlier 13.60 label refers to SDK-formatted metadata, not independently authenticated retail firmware or an introduction date. The [reproducible static audit](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298) finds 1551 unique function NIDs with set digest `5f1668cc9c69e2950722a83151f31cf7aa94fb1552ab883e5067f43c94d63b16` and confirms all 328 proposed entries. The digest hashes sorted unique ASCII NIDs, each followed by LF. Named declarations are candidate spellings whose repository-computed NID exactly matches an observed function NID; the hashed table establishes neither plaintext spelling nor C ABI.
|
||||
|
||||
The 35 formerly literal aliases are named by the [repository-pinned aerolib table](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). There are now 161 named declarations and 160 unresolved NID aliases; every one of the 321 entries remains a throwing placeholder. `sceKernelHasTrinityMode` left the inventory for its `libkernel` implementation and `_execve` and `_execvpe` left it for their implementations in `AdditionalExports.cpp`.
|
||||
|
||||
The following eight candidate spellings are absent from that aerolib revision. Their name/NID pairs occur in the [public ps5rs identity database at commit `2304be5131221bae0dac24b9767cabffda33f747`](https://github.com/claimore22/ps5rs/blob/2304be5131221bae0dac24b9767cabffda33f747/data/nids.csv) and independently recompute to the function NIDs in the inspected table. This database supports candidate spelling only; it does not establish firmware membership, introduction version or ABI.
|
||||
|
||||
| Candidate spelling | NID |
|
||||
| --- | --- |
|
||||
| `__sys_dynlib_unload_prx` | `GQli4UAXTfQ` |
|
||||
| `mmap2` | `tGtH2GTWbyE` |
|
||||
| `pthread_setschedother_np` | `ymCrwbFD4fk` |
|
||||
| `sceKernelEnableDmemAliasing3` | `RbhD-epf6c0` |
|
||||
| `sceKernelGetResidentFmemCount2` | `zx9n-9bt7IA` |
|
||||
| `sceKernelIsCloudDevkit` | `XyW5rUlKP1w` |
|
||||
| `sceKernelKernelHeapUsage2` | `pQiLz-exzR4` |
|
||||
| `sceKernelSetAppInfoByAppId` | `fIyST5BItRg` |
|
||||
Reference in new issue
Block a user