AnyPS5/docs/dev/debt/libSceSysmodule.md

libSceSysmodule technical debt

Silent stubs

• sceSysmoduleIsLoaded, sceSysmoduleLoadModule, sceSysmoduleUnloadModule (libSceSysmodule) accept the 141 ids sceSysmoduleIsLoaded did not reject in a payload process on a PS5 (firmware 13.60) and return 0x805A1000 for every other id, as the console does; that includes 51 ids the module table names from older firmware, such as 0x0001 (libSceAudioOut) and 0x0080 (libSceJson). Load and unload are counted as measured. The 21 accepted ids the table does not name (0x0111, 0x0117, 0x011c to 0x011f, 0x0121 to 0x0124, 0x0129, 0x012c to 0x012e, 0x0133, 0x0134, 0x0136 and 0x013a to 0x013d) are logged and return 0 without loading anything, so sceSysmoduleIsLoaded reports them as loaded; which module each loads is not known. Loading id 0x00ff ended the payload process. One title (PPSA04354) calls sceSysmoduleIsLoaded with id 0x96 at twelve sites and loads it only when the result is 0x805a1001; any other result lets it continue.
• sceSysmoduleIsLoadedInternal, sceSysmoduleLoadModuleInternal, sceSysmoduleUnloadModuleInternal, sceSysmoduleLoadModuleInternalWithArg, sceSysmoduleUnloadModuleInternalWithArg (libSceSysmodule) - an internal id missing from the module table throws, except 0x8000ffff and 0x80ffff00, and 0x00ffffff for sceSysmoduleIsLoadedInternal, which return 0x805A1000 as sceSysmoduleIsLoadedInternal, sceSysmoduleLoadModuleInternal and sceSysmoduleUnloadModuleInternal did for them in a payload process on a PS5 (firmware 12.70). Which other internal ids the console rejects, and what the WithArg variants return for a missing id, is not measured; sceSysmoduleIsLoadedInternal(0x800000c4), also missing from the table, returned 0x805A1001 there and throws here.

Unknown function info

• kModuleTable (libSceSysmodule) - module id 0x00000132 is named libSceProprietaryVoiceChatHelperPrx, the name of the built module, because sceSysmoduleGetModuleHandleInternal opens libs/<table name>.prx. The name the console's table uses for this id is not verified
• kModuleTable (libSceSysmodule) - module IDs registered from decrypted PS5 firmware 1.00–3.20 sysmodule lookup tables:
  • User-space IDs (0x00000005, 0x0000010a, 0x0000010e, 0x0000011b, 0x00000125, 0x00000126, 0x00000127, 0x00000128, 0x0000012a, 0x0000012b, 0x00000130) and internal IDs (0x8000007b, 0x8000007e, 0x8000007f, 0x80000080, 0x80000082, 0x80000083, 0x80000084, 0x80000085, 0x80000086, 0x80000087, 0x80000088, 0x80000089, 0x8000008e, 0x80000090, 0x80000091, 0x80000092, 0x80000093, 0x80000095, 0x80000097, 0x80000099, 0x8000009b, 0x8000009c, 0x8000009e, 0x8000009f, 0x800000a0, 0x800000a1, 0x800000a2, 0x800000a3, 0x800000a4, 0x800000a6, 0x800000a7, 0x800000a8, 0x800000a9, 0x800000ad, 0x800000ae, 0x800000af, 0x800000b0, 0x800000b2, 0x800000b3, 0x800000b4, 0x800000b5, 0x800000b6, 0x800000b7, 0x800000b9, 0x800000ba, 0x800000bb, 0x800000bc, 0x800000bd, 0x800000be, 0x800000bf, 0x800000c3); whether all mapped PRX modules exist as separate runtime files or are embedded in system daemons on retail consoles is unverified
  • Dual IDs for libSceNgs2 (0x0000000b user / 0x80000090 internal) and libSceHdrScopes (0x00000109 user / 0x800000bd internal) reflect distinct public and internal sysmodule identifiers defined in PS5 firmware SDKs
• sceSysmoduleIsCalledFromSysModule, sceSysmoduleIsCameraPreloaded, sceSysmoduleLoadModuleByNameInternal, sceSysmoduleMapLibcForLibkernel, sceSysmodulePreloadModuleForLibkernel and sceSysmoduleUnloadModuleByNameInternal (libSceSysmodule) - names and NIDs are present in the PS5 3.20 export inventory. sceSysmoduleLoadModuleByNameInternal takes (uint8_t* fname, uint64_t a1, uint64_t a2, uint64_t a3, uint64_t a4, uint64_t a5) from SharpProspero's Sysmodule bindings, not measured on a console. The other exports had no credible prototypes and are declared without parameters solely to resolve known imports; they make no ABI claim.

Functional

• sceSysmoduleGetModuleInfoForUnwind (libSceSysmodule) - on Windows the region and file name of an address inside a loaded image are cached after the first lookup, because VirtualQuery on a large image section is slow. An entry is used only while the loader still reports the same image for the address (same base, time stamp and size). A page protection change inside the image after the first lookup, which would split or merge the region VirtualQuery reports, is not noticed. Addresses outside loaded images are queried every time