Files
AnyPS5/docs/dev/debt/libSceNpUtility.md
T
Dean ce06a2aa8c Merge pull request #14939 from edubox/feat/nputility-service-checker2
feat(libSceNpUtility): implement the service checker 2 requests
2026-11-06 14:25:16 +13:00

18 KiB

libSceNpUtility technical debt

  • sceNpLookupCreateTitleCtxA, sceNpWordFilterCreateTitleCtxA (libSceNpUtility) - not measured on a console: both take only a user id and create a context in the same table and under the same 32-context limit as their NpId forms, as shadPS4 and ghostldr do; fpPS4 has the same lookup prototype. The user id is not checked (as in shadPS4 and sceNpTusCreateNpTitleCtxA); ghostldr refuses user id -1 with INVALID_ARGUMENT

Unknown function info

  • libSceNpUtility additional exports - these name/NID pairs are present in the inspected export inventory. Parameter lists, return types and behavior are unverified. Parameterless int declarations are import-resolution placeholders, not verified ABI prototypes; every entry throws through NotImplemented_nid_no_patch. No runtime functionality is implemented.

The inventory label is not authenticated retail-firmware provenance. The inspected image contains raw module-parameter words 0x13590001 at +0x10 and 0x13600007 at +0x14. Using the published static ELF membership procedure, its 102 unique function NIDs have sorted-LF SHA-256 79cc4b0f5b859cc3d8edecd19bd3e981166f7186ddd9479aec3b53b076d8f212; all 4 entries below are present. This digest identifies the function-NID set, not the whole binary or its ABI. An independent review on this PR corroborated these identities using a separately reported 13.42 reference; that does not establish matching binaries, prototypes or behavior.

Name NID
sceNpAdvppBandwidthDownloadBegin LP93vo6vwFg
sceNpAdvppBandwidthDownloadEnd KZKxJC+I9YE
sceNpBandwidthTestInitStartDownloadInternal EyZWS3ESnko
sceNpBandwidthTestInitStartUploadInternal mSlIpH6-UAY

Functional

  • sceNpServiceChecker2IntAbortRequest, sceNpServiceChecker2IntCreateRequest, sceNpServiceChecker2IntDestroyRequest, sceNpServiceChecker2IntFinalize, sceNpServiceChecker2IntGetServiceAvailability, sceNpServiceChecker2IntGetServiceAvailabilityA, sceNpServiceChecker2IntInitialize and sceNpServiceChecker2IntIsSetServiceType - signatures and errors from the wrappers at 0x14670, 0x146e0, 0x14710, 0x14780, 0x147a0, 0x14840, 0x148e0 and 0x148f0 in the 11.00 system module libSceNpUtility.sprx (SHA-256 1c90050abb737d3290539f46928fb536faca8773e335523479f06f4ae33f0c60): Initialize/Finalize hold one host state, CreateRequest writes request ids from 1, Destroy/Abort remove them, and the two availability calls return SIGNED_OUT without writing because no network is available; IsSetServiceType reads bit 0..9 of a 32-bit mask. The wrapper immediates establish 0x8055B301, 0x8055B302, 0x8055B304 and 0x8055B305; DestroyRequest ignores an unknown id and returns 0, while AbortRequest and the two availability calls return 0x8055B304 for it. The host refuses a new request while 0x1000 requests are live, returning 0x80550706 without changing the output or the existing requests; destroyed requests do not count, and ids keep increasing and skip live ones. That cap is a host safety limit, not the console's unmeasured request limit. The console's availability payload, its exact offline error and any request limit are unmeasured.

  • sceNpBandwidthTestInitStart, sceNpBandwidthTestShutdownWithDetailedInfo (libSceNpUtility) - offline answers, not measured on a PS5: InitStart returns SCE_NP_ERROR_SIGNED_OUT as sceNpBandwidthTestInitStartDownload and InitStartUpload do, so no test is ever started, and ShutdownWithDetailedInfo returns SCE_NP_ERROR_INVALID_ARGUMENT and writes nothing, as sceNpBandwidthTestShutdown does. Neither reads an argument, so their parameterless declarations stand; their prototypes are still unknown

  • NpLookup and NpWordFilter (libSceNpUtility) - offline only, not measured on a PS5: the argument checks and their order, the limit of 32 title contexts and 32 requests, the word filter id bases 0x01000001 and 0x02000001, the 0x400-byte comment limit and single-use requests (INVALID_TYPE) follow shadPS4's lookup and word filter calls. sceNpLookupNpId, sceNpWordFilterCensorComment and sceNpWordFilterSanitizeComment then finish with SCE_NP_ERROR_SIGNED_OUT and write no NpId or comment; shadPS4's word filter accepts every comment as a stand-in for the server, so its result is not used

  • NpLookup and NpWordFilter waits and timeouts (libSceNpUtility) - IDs here carry no service: on the console, measured on firmware 13.42's module in an emulator (#10640), each ID holds its service in its high bits (Lookup requests 0x2xxxxxxx and title contexts 0x4xxxxxxx, word filter 0x02xxxxxx and 0x04xxxxxx), and SetTimeout, AbortRequest, PollAsync and WaitAsync find the object by those bits whichever service's call is made; here each call finds only its own service's IDs, which keep the ranges above. The timeouts are checked as measured and then have no effect, since no request reaches a server; the console stores them. A wait on a request deleted meanwhile returns INVALID_ID, unmeasured. The measured checks are followed: a null result first (0x80550704), a synchronous request (0x80550307 for Lookup, INVALID_ID for the word filter), the timeout bounds and the 0x18-byte async parameter

Additional unidentified exports

  • Two additional callable exports are present in both the 3.20 and later 13.60-labelled inventories. Their names, parameter lists, return types and behavior are unverified; parameterless int declarations are placeholders, not verified ABI contracts. Both entries throw through NotImplemented_nid_no_patch. The later inventory label does not authenticate a retail firmware version.
Name NID
Unknown 3BZG8C8D62Q
Unknown VVM+zY9FiEU