Resolved Export.cpp and GuestVrTracker2.cpp keeping main's header layout; the new sceHmd2Internal exports are declared in the libSceHmd2 header and the test uses the library headers.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceVrTracker2Initialize follows the order read from firmware 13.60
libSceVrTracker2.sprx (disassembly, not measured on a console). It
rejects with 0x8A740006, in order: a null record or a size other than
72; a mode other than 0, 1000 or 1001; a null work memory; a size below
the mode's 32 MiB, 7 MiB or 3 MiB; an alignment below 0x10000; a
non-zero reserved byte at 0x3a..0x47; a thread priority outside
256..767; an affinity mask outside bits 0..12 in mode 0 or outside
0xEA00 in modes 1000 and 1001. It then moves the module state from 0 to
1 and returns 0x8A740002 if it was not 0.
From there every failure undoes what the call opened and resets the
state to 0. Mode 0 clears the first 32 MiB of work memory first. The
application attribute checks on the sceKernelGetAppInfo2 record
(0x8A74001E, 0x8A740020) are skipped: the host has none, and a zeroed
record passes them. The signed option at 0x39 accepts -1 and 0,
and 1 only for titles compiled with SDK 7.00 or later. Modes 0 and 1000
then call libSceHmd2 TrackingOpen, TrackingStart, LedDetectorOpen and
LedDetectorStart and return the first non-zero result unchanged.
Without a headset main's libSceHmd2 answers 0 and -1 (its measured
pre-initialization answers), so Initialize returns -1 and every other
export keeps answering 0x8A740001.
Modes 1000 and 1001 need the application category, which the host does
not have, and a fully successful Hmd2 sequence would need the tracker
runtime; both throw. The eight tracking and LED-detector exports become
named functions in libSceHmd2 so that libSceVrTracker2 can import them
by name; their answers are unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceHmd2GazeGetResult and sceHmd2GazeGetResultForFoveatedRendering threw.
In the PS5 12.00 module both check for null arguments (0x8a720008) and
the sizes of the parameter (0x10) and result (0x38 or 0x18; 0x8a720009),
then, for a handle that is not the open headset, fill the result with an
invalid record and return 0x8a720003. libSceHmd2 never opens a headset
here, so that is the answer; an open handle still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
The hmd2s and hmd2n sweeps left 19 libSceHmd2 exports that either write
into their arguments or take a slot number rather than a pointer first.
A third probe called the writers with zero-filled and with 0xAA-filled
buffers, dumping every byte that changed, and the slot exports with a
first argument of 0, 1, 2, 3, 4, 5, 8, 16, 255 and -1. Before
sceHmd2Initialize, six writers put fixed bytes in their output (a 2 and
a zero byte; 0x2000 and 0x100 as 64-bit sizes; four floats; six or
twelve floats of 0 and 0.5 followed by 0x8a720003), and twelve exports
accept a slot of 0 to 1, 2 or 3 and answer 0x8a720009 above it, with
0, -1, 0x8a721002, 0x8a721003, 0x8a72002c or 0x8a72100f for a valid
slot. They are bound here, by NID, to 14 handlers with the measured
checks, returning their value while the library is not initialized and
throwing if sceHmd2Initialize ever succeeds.
The one export whose answer depends on the contents of an in-out
structure stays unimplemented and is described in the debt file.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The hmd2s sweep left 81 libSceHmd2 exports that answer 0x8a720008 to
all-null arguments but something else to zeroed buffers. A second probe
called each of them six times before sceHmd2Initialize, every argument
pointing at a zeroed 16 KiB buffer except one, to find which arguments
are the checked pointers. 62 exports answer 0x8a720008 exactly when one
of a fixed set of arguments is null and their all-present code otherwise:
48 check the first argument, 10 the second, 6 the first two, 2 the first
and third, 2 all six. They are bound here, by NID, to 18 handlers with
that many pointer parameters, each returning ParameterNull for a null
checked pointer and otherwise the measured code (0x8a720004 for 20 of
them, 0 for 11, 0x8a721002 for 10, -1 for 5, 0x8a720009 for 7,
0x8a72002c for 3, and 0x8a720003, 0x8a721003, 0x8a721010 and 0x800d0203
for the rest) while the library is not initialized, throwing if
sceHmd2Initialize ever succeeds.
Left out: 7 exports that write output and 12 whose first argument is a
handle or slot number rather than a pointer. The debt entries list every
NID with its aerolib name where one exists.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A sweep of the 281 libSceHmd2 exports on a PS5 (firmware 13.60), each
called from a payload before sceHmd2Initialize once with every argument
null and once with every argument pointing at a zeroed 16 KiB buffer,
found 127 that answer the same code both ways and write nothing. 125 of
them are bound here, by NID, to one handler per answer: 45 return 0, 16
return 0x8a720008, 15 return 0x8a720004, 12 return -1, 10 reprojection
exports return 0x8a72000b, 9 return 0x8a720002, 9 return 0x8a720009, 5
return 0x8a721002 and one each returns 0x8a72002c, 0x8a721003, 0x400 and
0x20000. Each handler returns its measured value while the library is not
initialized and throws if sceHmd2Initialize ever succeeds, because the
initialized behaviour is not measured; since b378541e79 it fails with
UnsupportedFeature here, so these are the answers titles get.
Left out: the export that returns a pointer-like value, the one answering
0x8a72000a (which sceHmd2Initialize also returns for some applications),
the exports that answer differently to null and to zeroed arguments or
write output, the 16 that crashed the probe, and the exports that main,
its aerolib name where one exists.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Since #7323 sceHmd2Initialize succeeds and sceHmd2Open returns a handle,
so PPSA01317 runs its PS VR2 set-up and aborts on
sceHmd2ReprojectionQueryBufferSizeAlign, which is not implemented
(reported in #6350). AnyPS5 has no PS VR2 or PC VR support, so
initialization returns libSceHmd's UNSUPPORTED_FEATURE (0x81110016)
again, as before #7323, and titles skip their VR set-up. sceHmd2Open
then returns NotInitialized. The reprojection size queries stay
unimplemented.
Refs #6350
PPSA09030's Media/Plugins/psvr2.prx imports sceHmd2ReprojectionGetStatus
from libSceHmd2 and sceVrTracker2GetCoordinateSystem and
sceVrTracker2GetPlayAreaBoundaryGeometry from libSceVrTracker2, so the
title does not start with the plugin loaded (discussion #4680). Declare
the three as throwing exports, like the earlier PS VR2 imports of
PPSA29866. The names resolve from the NIDs 8GkaY2B7opM, Y-3JCiU9bbU
and SCph4ZbkqzU with tools/nid_names.py; no reference gives their
signatures.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA29866 (Tomba! 2) fails to load without these imports that no library exports. Their signatures are unknown, so they are declared without parameters and throw until they are implemented. Adds a TechnicalDebt entry.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
PPSA07411 (Resident Evil 4) fails to load without these imports. Their signatures are unknown, so they are declared without parameters and throw until they are implemented. Adds a TechnicalDebt entry.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Propagation: Paradise Hotel (PPSA15878) does not load on main: its
executable imports 15 PS VR2 functions that no library exports, the
first reported being sceVrTracker2GetPlayAreaOrientedBoundingBox
(snYs7Nf-RKk). Declare the nine libSceHmd2 reprojection and gaze
exports, three libSceVrTracker2 exports and three scePadVrController
trigger effect exports, without parameters, as throwing stubs. Names
come from the aerolib NID list.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
