SceKernelModulemgr: Difference between revisions

Revision as of 05:29, 30 September 2022

SceKernelModulemgr is in charge of loading both user modules and kernel modules. SceKernelModulemgr calls SceSblAuthMgr functions for the SELF decryption process. SceKernelModulemgr loads the ELF programs into memory along with linking with NIDs and relocation of ELF in position independent executables.

Module

Version	World	Privilege
0.940-3.60	Non-secure	Kernel

The SELF can be found in os0:kd/modulemgr.skprx.

Functions of this module are also embedded in NSKBL.

Libraries

This module exports kernel and user libraries.

Known NIDs

Version	Name	World	Visibility	NID
0.940-3.61	SceModulemgrForKernel	Non-secure	Kernel	0xC445FA63
3.63-3.65	SceModulemgrForKernel	Non-secure	Kernel	0x92C9FFC2
0.940-3.65	SceModulemgrForDriver	Non-secure	Kernel	0xD4A60A52
0.940-3.65	SceModulemgr	Non-secure	User	0xEAED1616
3.57-3.65	SceBacktraceForDriver	Non-secure	Kernel	0x77CB3DD6
3.57-3.65	SceBacktrace	Non-secure	User	0xB07B6A3F

Types

// These types are defined in elfutils
typedef Elf32_Ehdr Elf32_Ehdr;
typedef Elf32_Phdr Elf32_Phdr;

typedef struct SCE_header {
	uint32_t magic;                 /* 53434500 = SCE\0 */
	uint32_t version;               /* header version 3*/
	uint16_t sdk_type;              /* */
	uint16_t header_type;           /* 1 self, 2 unknown, 3 pkg */
	uint32_t metadata_offset;       /* metadata offset */
	uint64_t header_len;            /* self header length */
	uint64_t elf_filesize;          /* ELF file length */
	uint64_t self_filesize;         /* SELF file length */
	uint64_t unknown;               /* UNKNOWN */
	uint64_t self_offset;           /* SELF offset */
	uint64_t appinfo_offset;        /* app info offset */
	uint64_t elf_offset;            /* ELF #1 offset */
	uint64_t phdr_offset;           /* program header offset */
	uint64_t shdr_offset;           /* section header offset */
	uint64_t section_info_offset;   /* section info offset */
	uint64_t sceversion_offset;     /* version offset */
	uint64_t controlinfo_offset;    /* control info offset */
	uint64_t controlinfo_size;      /* control info size */
	uint64_t padding;
} SCE_header;

typedef struct SCE_appinfo {
   uint64_t program_authority_id;  /* program authority id */
   uint32_t vendor_id;             /* vendor id */
   uint32_t self_type;             /* app type */
   uint64_t version;               /* app version */
   uint64_t padding;               /* UNKNOWN */
} SCE_appinfo;

typedef struct segment_info {
   uint64_t offset;
   uint64_t length;
   uint64_t compression; // 1 = uncompressed, 2 = compressed
   uint64_t encryption; // 1 = encrypted, 2 = plain
} segment_info;

typedef struct self_data_buffer {
   SCE_header sce_header;
   SCE_appinfo sce_appinfo;
   Elf32_Ehdr elf_hdr;
   
   //... data goes
   
} self_data_buffer;

typedef struct SceDecryptCtx { //size is 0x30
   self_data_buffer* self_header; // aligned buffer - based on (buffer_unaligned). 
                                  // points at SCE_header followed by SCE_appinfo
                                  // size is usually 0x1000
   int self_header_length;
   Elf32_Ehdr* elf_ptr; // pointer constructed with elf_offset
   Elf32_Phdr* phdr_ptr; // pointer constructed with phdr_offset

   uint8_t type; // ex: 2
   uint8_t init_completed;
   uint8_t unk_12;
   uint8_t unk_13;
   
   segment_info* section_info_ptr; // pointer constructed with section_info_offset
   void* buffer_unaligned; // SELF header data - size 0x103F - raw data read from file
   int sm_ctx; // obtained with sceSblAuthMgrOpenForKernel

   SceSblSmCommContext130* context_130;
   SceUID fd; // file descriptor of SELF file - obtained with sceIoOpenForDriver
   SceUID pid;
   uint32_t max_size;
} SceDecryptCtx;

typedef struct SceDecryptCtxGlobal { // size is 0x4C
	uint32_t unk_0;
	uint32_t unk_4;		// ex:3
	void *module_decrypt_buff_ptr1;
	int decrypt_size;	// max 0x10000

	int unk_10;		// 0 or 1 or 2
	int unk_14;		// ex:-1
	void *module_decrypt_buff_ptr2;
	int unk_1C;		// some size

	SceDecryptCtx *decrypt_ctx;
	SceUID evid;		// SceModuleMgrSelfDecryptComm event flag
	SceUID tid;		// SceModuleMgrSelfDecrypter   thread uid
	void *unk_2C;		// sceDeflateDecompressPartialForDriver out memblock

	int compressed_seg_size;
	uint32_t unk_34;	// unk_2C out size?
	uint16_t segment_number;
	uint16_t unk_3A;	// ex:0xFFFF

	SceDeflatePartialInputParam cbinfo;
} SceDecryptCtxGlobal;

typedef struct SceKernelFwInfo {
  SceSize size;
  char versionString[0x1C];
  SceUInt version;
  SceUInt unk_24;
} SceKernelFwInfo;

typedef struct SceKernelSegmentInfo {
  SceUInt size;   //!< this structure size (0x18)
  SceUInt perms;  //!< probably rwx in low bits
  void *vaddr;    //!< address in memory
  SceUInt memsz;  //!< size in memory
  SceUInt flags;  //!< meaning unknown
  SceUInt res;    //!< unused?
} SceKernelSegmentInfo;

typedef struct SceKernelModuleName {
  char s[0x1C];
} SceKernelModuleName;

typedef struct SceKernelModuleInfo { // size is 0x1B8
	SceSize size; //!< sizeof(SceKernelModuleInfo)
	SceUID modid;
	uint16_t modattr;
	uint8_t  modver[2];
	char name[0x1C];
	uint32_t unk28;
	void *start_entry;
	void *stop_entry;
	void *exit_entry;
	void *exidx_start;
	void *exidx_end;
	void *extab_start;
	void *extab_end;
	void *tls_start;
	SceSize tls_filesz;
	SceSize tls_memsz;
	char path[256];
	SceKernelSegmentInfo segments[4];
	SceUInt type;
} SceKernelModuleInfo;

typedef struct SceKernelSegmentInfo2 { // size is 0x14
  SceSize size; // Size of this structure
  SceUInt32 perm;
  void *pVA;
  SceSize memsz;
  SceUInt32 alignment;
} SceKernelSegmentInfo2;

// Structure for SceCoredump only?
typedef struct SceKernelModuleListInfo_0945 {
  SceSize size;
  SceUID modId;
  SceUInt8 sdkVer[4];
  SceUInt8 modVer[4];
  SceUInt16 type;
  SceUInt16 flags;
  void *start;
  SceUInt32 refCount;
  void *stop;
  void *exit;
  char modName[0x20];
  SceUInt32 status;
  SceUInt32 dbgFingerprint;
  int segments_num;
  union {
    struct {
      SceKernelSegmentInfo2 SegmentInfo[1];
      uint32_t addr[4];
    } seg1;
    struct {
      SceKernelSegmentInfo2 SegmentInfo[2];
      uint32_t addr[4];
    } seg2;
    struct {
      SceKernelSegmentInfo2 SegmentInfo[3];
      uint32_t addr[4];
    } seg3;
    struct {
      SceKernelSegmentInfo2 SegmentInfo[4];
      uint32_t addr[4];
    } seg4;
  };
} SceKernelModuleListInfo_0945;

typedef struct SceKernelModuleListInfo_360 {
  SceSize size;
  SceUID modId;
  SceUInt8 sdkVer[4];
  SceUInt8 modVer[4];
  SceUInt16 type;
  SceUInt16 flags;
  void *start;
  void *unk_0x18; // maybe bootstart, but user module is doesn't have module_bootstart.
  void *stop;
  void *exit;
  char modName[0x1A];
  SceUInt16 unk_0x3A; // unused
  SceUInt32 unk_0x3C; // unused
  SceUInt32 unk_0x40; // unused
  SceUInt32 status;
  SceUInt32 dbgFingerprint;
  int segments_num;
  union {
    struct {
      SceKernelSegmentInfo2 SegmentInfo[1];
      uint32_t addr[4];
    } seg1;
    struct {
      SceKernelSegmentInfo2 SegmentInfo[2];
      uint32_t addr[4];
    } seg2;
    struct {
      SceKernelSegmentInfo2 SegmentInfo[3];
      uint32_t addr[4];
    } seg3;
    struct {
      SceKernelSegmentInfo2 SegmentInfo[4];
      uint32_t addr[4];
    } seg4;
  };
} SceKernelModuleListInfo_360;

typedef struct SceKernelLibraryInfo { // size is 0x1C
    SceSize size; //!< sizeof(SceKernelLibraryInfo)
    uint16_t libver[2];
    uint32_t libnid;
    const char *libname;
    uint16_t nfunc;
    uint16_t nvar;
    uint32_t *nid_table;
    uint32_t *entry_table;
} SceKernelLibraryInfo;

typedef struct SceKernelModuleExportEntry {
    uint32_t libnid;
    const void *entry; // function ptr. or vars?
} SceKernelModuleExportEntry;

typedef struct {
    SceUID modid;
    uint32_t libnid;
} SceKernelModuleImportNID;

typedef struct SceKernelModuleImportNonlinkedInfo {
	SceSize size; // 0x124
	SceUID modid;
	uint32_t libnid;
	char libname[0x100];
	uint32_t data_0x10C;
	uint32_t data_0x110;
	uint32_t data_0x114;
	uint32_t data_0x118;
	uint32_t data_0x11C;
	uint32_t data_0x120;
} SceKernelModuleImportNonlinkedInfo;

typedef struct SceKernelModuleLibraryInfo {
  SceSize size; //!< sizeof(SceKernelModuleLibraryInfo) : 0x120
  SceUID library_id;
  uint32_t libnid;
  uint16_t libver[2];
  uint16_t entry_num_function;
  uint16_t entry_num_variable;
  uint16_t unk_0x14;
  uint16_t unk_0x16;
  char library_name[0x100]; // offset : 0x18
  uint32_t unk_0x118;
  SceUID modid2;
} SceKernelModuleLibraryInfo;

typedef struct SceSelfAppInfo {
	int vendor_id;
	int self_type;
} SceSelfAppInfo;

typedef int (* SceKernelModuleEntry)(SceSize args, void *argp);

/**
 * Module common macro
 */
#define SCE_KERNEL_START_SUCCESS		(0)				/**< Successful startup */
#define SCE_KERNEL_START_RESIDENT		SCE_KERNEL_START_SUCCESS	/**< Successful startup (resident) */
#define SCE_KERNEL_START_NO_RESIDENT		(1)				/**< Successful startup (not resident) */
#define SCE_KERNEL_START_FAILED			(2)				/**< Failed to start */

#define SCE_KERNEL_STOP_SUCCESS			(0)				/**< Successful stop */
#define SCE_KERNEL_STOP_FAIL			(1)				/**< Failed to stop */
#define SCE_KERNEL_STOP_CANCEL			SCE_KERNEL_STOP_FAIL		/**< Stop was cancelled */

/** Module attributes */
#define SCE_MODULE_ATTR_NONE			(0x0000)			/**< No attributes specified */

/** obsolete */
#define SCE_KERNEL_MODULE_ATTR_NONE		SCE_MODULE_ATTR_NONE

/**
 * option parameter for load module APIs
 */
typedef struct SceKernelLoadModuleOpt {
	SceSize		size;		/**< Size of structure itself */
} SceKernelLoadModuleOpt;

/**
 * option parameter for start module API
 */
typedef struct SceKernelStartModuleOpt {
	SceSize		size;		/**< size of structure itself */
	SceUInt32	flags;		/**< should be 0 */
	SceUInt32	prologue;	/**< should be 0 */
	SceUInt32	start;		/**< should be 0 */
} SceKernelStartModuleOpt;

/**
 * option parameter for stop module API
 */
typedef struct SceKernelStopModuleOpt {
	SceSize size;			/**< size of structure itself */
	SceUInt32 flags;		/**< should be 0 */
	SceUInt32 epilogue;		/**< should be 0 */
	SceUInt32 stop;			/**< should be 0 */
} SceKernelStopModuleOpt;

/**
 * option parameter for unload module APIs
 */
typedef struct SceKernelUnloadModuleOpt {
	SceSize		size;		/**< size of structure itself */
} SceKernelUnloadModuleOpt;

typedef struct SceLoadProcessParam { //Size is 0x9C
	uint32_t sysver;
	char thread_name[0x20];
	uint32_t initial_thread_priority; // ex: 0x100000EC
	SceSize initial_thread_stack_size; // ex: 0x6000
	uint32_t unk_0x2C;
        uint32_t unk_0x30;
        SceKernelThreadOptParam	thread_opt; //Size 0x14
        int unk_0x48;
        int unk_0x4C;
        int unk_0x50;
	char module_name[0x20];
	uint32_t unk_0x74; // ex: 0x790000
	void *unk_0x78; // ex: 0x81600814, data segment VA?
	SceUID stdin_guid; // result of IoOpen("tty0:")
        SceUID stdout_guid; // result of IoOpen("tty0:")
        SceUID stderr_guid; // result of IoOpen("tty1:")
        SceUID tty7_guid; // result of IoOpen("tty7:") - needs dipsw 0xB8 set
        SceUID stdin_puid; // result of scePUIDOpenByGUIDForDriver(pid, stdin_guid)
        SceUID stdout_puid; // result of scePUIDOpenByGUIDForDriver(pid, stdout_guid)
        SceUID stderr_puid; // result of scePUIDOpenByGUIDForDriver(pid, stderr_guid)
        SceUID tty7_puid; // result of scePUIDOpenByGUIDForDriver(pid, tty7_guid)
} SceLoadProcessParam;

typedef struct SceModuleLibraryInfo { // size is 0x2C
	struct SceModuleLibraryInfo *next;
	struct SceModuleLibraryInfo *data_0x04; // maybe
	SceModuleExport *pExportInfo;

	/*
	 * (syscall_idx &  0xFFF): syscall idx
	 * (syscall_idx & 0x1000): has syscall flag?
	 * (syscall_idx == 0): kernel export
	 */
	uint16_t syscall_info;
	uint16_t data_0x0E;

	/*
	 * Number of times this export was imported into another module
	 */
	SceSize number_of_imported;
	SceModuleImportedInfo *pImportedInfo;
	SceUID libid_kernel;
	SceUID libid_user;
	SceModuleCB *pModCB; // Temp structure name was SceModuleInfoInternal
	int data_0x24; // zero?
	int data_0x28; // zero?
} SceModuleLibraryInfo;

typedef struct SceKernelModuleNonlinkedInfo {
	SceUID modid;
	uint32_t libnid;
} SceKernelModuleNonlinkedInfo;

#define SCE_KERNEL_BACKTRACE_CONTEXT_CURRENT	(0x00000000)	/**< Backtrace current context */

#define SCE_KERNEL_BACKTRACE_MODE_USER		(0x00000000)	/**< User stack backtrace */
#define SCE_KERNEL_BACKTRACE_MODE_KERNEL        (0x00000001)
#define SCE_KERNEL_BACKTRACE_MODE_DONT_EXCEED	(0x00000002)	/**< Don't get stack depth */
#define SCE_KERNEL_BACKTRACE_MODE_UNK_0x00000004 (0x00000004) // should exist because 8 exists
#define SCE_KERNEL_BACKTRACE_MODE_UNK_0x00000008 (0x00000008) // exists based on FW 0.931 SceExcpmgr

/**
 * Structure that represents one stage of the call stack
 */
typedef struct	_SceKernelCallFrame {
	SceUIntVAddr	sp;		/**< stack pointer */
	SceUIntVAddr	pc;		/**< program counter */
} SceKernelCallFrame;

/**
 * Structures used for compatibility shim lists (hardcoded in SceProcessmgr)
 */
typedef struct _SceKernelFunctionShimInfo {
         SceUInt32 replaced_function_nid; /**< NID of the function that needs to be replaced */
         SceUInt32 replacing_function_nid; /**< NID of the function that will serve as a replacement - must probably come from same library as replaced function */
} SceKernelFunctionShimInfo;

typedef struct _SceKernelLibraryShimInfo {
         char* library_name; /**< Name of the library the shimmed functions come from (i.e. SceThreadmgr) */
         SceUInt32 unk_04; /**< Always 0 ? */
         SceSize function_shims_count; /**< Size of the array pointed to by next field */
         SceKernelFunctionShimInfo* function_shims;
} SceKernelLibraryShimInfo;

typedef struct _SceKernelCompatibilityShimInfo {
        char* title_id; /**< TitleID (process name) of the app this shim applies to */
        SceUInt32 unk_04; /**< Always 0 ? */
        SceSize library_shims_count; /**< Size of the array pointed to by next field */
        SceKernelLibraryShimInfo* library_shims;
} SceKernelCompatibilityShimInfo;

Notes

Error codes

0x8002D01E

Attempted to load a module with a start entry as bootfs.

Attempted to load a module that has syscall exports to usermode.

module_start no resident/failed

If module_start returns SCE_KERNEL_START_NO_RESIDENT, the module will start successfully, but it will be unloaded after the module_start call.

However, if the module_start of the module where the syscall export exists is called after boot and returns SCE_KERNEL_START_NO_RESIDENT/SCE_KERNEL_START_FAILED, then a kernel panic is triggered.

How to get module info

modid and SceUIDModuleClass are required to get module information.

Simply call sceGUIDReferObjectForDriver(sceKernelGetObjectForUidForDriver) with these parameters.

Module decrypt threads

SceKernelModulemgr_func_8100910D

This thread keeps waiting at sceKernelWaitEventFlagForDriver until a module decrypt request comes.

bits of sceKernelWaitEventFlagForDriver is 3.

Common functions

Decrypt module to membase with current ctx.

int SceKernelModulemgr_func_81009309(SceDecryptCtx *ctx, int seg_idx, void *membase, int arg4);

Called whenever a module is loaded.

flags
process image           : 0x4
normal module           : 0x1000
process module shared   : 0x8001
process module          : 0x8002
homebrew plugin         : 0x8000002
shared module           : 0x8008001
normal module ?         : 0x8008002

int SceKernelModulemgr_func_81001519(void *pInfo, const char *path, SceUID fd, void *a4, uint32_t flags);

Reads the header from the passed fd and performs some checks.

[out] ctx
[in]  pid
[in]  fd
[in]  context_130

int SceKernelModulemgr_func_81008DC9(void *ctx, SceUID pid, SceUID fd, void *context_130);

Data segment layout

Offsets are for FW 3.60.

Data section size is 0x203C0.

Offset	Size	Description
0x0000	0x30	unknown
0x0030	0x4	some flags. Related to relocation.
0x0034	0x4	SceKernelFwInfo data Initialize flag
0x0038	0x4	pointer of ModulePrivate(9).
0x003C	0x4	pointer of SceClass. The third class obtained with sceKernelSysrootGetModulePrivateForKernel. SceUIDLibStubClass
0x0040	0x4	pointer of SceClass. The second class obtained with sceKernelSysrootGetModulePrivateForKernel. SceUIDLibraryClass
0x0044	0x4	Return value of SceThreadmgrForDriver_B645C7EF.
0x0048	0x4	pointer of SceClass. The first class obtained with sceKernelSysrootGetModulePrivateForKernel. SceUIDModuleClass
0x004C	0x4	SceModuleMgr Mutex uid
0x0050	0x280 (4*0xA0)	unknown. some module data. (process max loadable module number is 0xA0)
0x02D0	0x28	SceKernelFwInfo data
0x02F8	0x4	some thread id, check sceKernelModuleUnloadMySelfForKernel
0x02FC	0x4	some kernel module uid, check sceKernelModuleUnloadMySelfForKernel
0x0300	0x4	unk, used by sceKernelLoadPreloadingModulesForKernel
0x0304	0x4	some storage ptr. used by sceKernelMountBootfsForKernel, sceKernelUmountBootfsForKernel
0x0308	0x4	pModuleEventDebugHandler
0x030C	0x4	pointer of SceModuleSharedInfo.
0x0310	0x4	cpu_addr out (sceKernelCpuLockSuspendIntrStoreLRForDriver arg1)
0x0314	0x4	shared inhibit flag
0x0318	0x4	sceKernelGetMemBlockBaseForDriver membase out
0x031C	0x4	sceKernelAllocMemBlockForDriver ret
0x0320	0xC	unk
0x032C	0x4	unk, used by SceModulemgrForKernel_F3CD647F
0x0330	0x4	unk, used by SceModulemgrForKernel_F3CD647F
0x0334	0x4	Syscall table vaddr.
0x0338	0x4	unk, related to syscall. used by sceMt19937GlobalUninitForDriver
0x033C	0x4	unk
0x0340	0x4C	SceDecryptCtxGlobal data
0x038C	0x34	unk, all zero
0x03C0	0x10000	module decrypt buff 1
0x103C0	0x10000	module decrypt buff 2

typedef struct SceKernelModulemgr_data_t { // size is 0x203C0 on FW 3.60
	char unk_00[0x34];	 // unknown, all zero
	int is_FwInfo_init;
	void *pModulePrivate9;
	SceClass *pSceUIDLibStubClass;
	SceClass *pSceUIDLibraryClass;
	int some_thread_res;
	SceClass *pSceUIDModuleClass;
	SceUID mutex_id;
	char unk_50[0x280];	 // unknown
	SceKernelFwInfo FwInfo;
	SceUID some_threadid;
	SceUID some_kernel_module_id;
	int unk_0x0300;
	void *bootfs_info;
	int (* pModuleEventDebugHandler)(void *pInfo);
	SceModuleSharedInfo *pSharedInfo;
	int cpu_addr;
	int shared_inhibit_flag;
	void *membase;
	SceUID memuid;
	int unk_0x0320[3];
	int unk_0x032C;
	int unk_0x0330;
	void *syscall_table;
	int some_syscall_info;
	int unk_0x033C;
	SceDecryptCtxGlobal g_decrypt_ctx;
	char unk_0x038C[0x34];
	char module_decrypt_buff1[0x10000];
	char module_decrypt_buff2[0x10000];
} SceKernelModulemgr_data_t;

Loading Sequence

When loading a module the sequence creates a SceModule structure to represent it.

typedef struct SceModule { // ?size is 0x3EC?
    u8 unk0[0x64];          // 0x0
    const char *filename;   // 0x64
    u8 unk1[0xC];           // 0x68
    Elf32_Ehdr ehdr;        // 0x74
    Elf32_Phdr phdr;        // 0xA8
    void *text_addr;        // 0x108
    SceUID text_uid;        // 0x10C
    u32 text_size;          // 0x110
    void *kernel_addr;      // 0x114
    SceUID kernel_uid;      // 0x118
    u8 unk2[0x2C8];         // 0x11C
    SceUID parent_pid;      // 0x3E4
    SceSblSmCommContext130* context_130; // 0x3E8
} SceModule;

SELF Decryption

The following code can decrypt a SELF located at path.

Set self_type to 1 if decrypting a usermode module else 0 for kernel (2 for SM but maybe not allowed).

Set media_type to 0 if you're decrypting the SELF at the right location (for example decrypting sysmem.skprx located in os0:). If you have copied the SELF elsewhere, you need to set the media_type to the right value for where the real path was.

use_cdram is for modules that are too large and won't fit in contiguous regular memory.

int decrypt_self(const char *path, const char *out_prefix, int media_type, int use_cdram, int self_type) {
    char out_path[256];
    int handle;
    int ret;
    int pid;
    int fd = 0, wfd = 0;
    char *ctx130 = NULL;
    char *hdr_buf = NULL, *hdr_buf_aligned;
    char *data_buf = NULL, *data_buf_aligned;
    int phdr;

    unsigned int hdr_size;

    // set up Auth Mgr
    ret = sceSblAuthMgrOpenForKernel(&handle);
    printf("sceSblAuthMgrOpenForKernel: 0x%08X, handle: 0x%08X\n", ret, handle);
    if (ret < 0)
        return 1;

    // set up ctx130
    ctx130 = sceKernelLoadcoreKallocForKernel(0x10005, 0x130);
    printf("Ctx130: 0x%08X\n", ctx130);
    if (ctx130 == NULL)
        goto fail;
    memset(ctx130, 0, 0x130);
    if (ret < 0)
        goto fail;
    *(int *)(ctx130 + 0x4) = self_type;
    *(u64_t *)(ctx130 + 0x8) = 0x2808000000000001LL;
    *(u64_t *)(ctx130 + 0x10) = 0xF000C000000080LL;
    *(u64_t *)(ctx130 + 0x18) = 0xFFFFFFFF00000000LL;
    *(u64_t *)(ctx130 + 0x30) = 0xC300003800980LL;
    *(u64_t *)(ctx130 + 0x38) = 0x8009800000LL;
    *(u64_t *)(ctx130 + 0x48) = 0xFFFFFFFF00000000LL;

    if (media_type)
        *(int *)(ctx130 + 0x128) = media_type;
    else {
        ret = sceIoGetMediaTypeForDriver(0x10005, path, 1, ctx130 + 0x128);
        printf("sceIoGetMediaTypeForDriver: 0x%08X\n", ret);
        if (ret < 0)
            goto fail;
    }

    // read header
    fd = sceIoOpenForDriver(path, 1, 0);
    printf("sceIoOpenForDriver: 0x%08X\n", fd);
    if (fd < 0)
        goto fail;
    hdr_buf = sceKernelLoadcoreKallocForKernel(0x10005, 0x1000+63);
    hdr_buf_aligned = (char *)(((int)hdr_buf + 63) & 0xFFFFFFC0);
    printf("Header buffer: 0x%08X, aligned: 0x%08X\n", hdr_buf, hdr_buf_aligned);
    if (hdr_buf == NULL)
        goto fail;
    ret = sceIoReadForDriver(fd, hdr_buf_aligned, 0x1000);
    printf("Header read: 0x%08X\n", ret);
    hdr_size = *(unsigned int *)(hdr_buf_aligned + 0x10);
    if (hdr_size > 0x1000) {
        printf("Header too large: 0x%08X\n", hdr_size);
        goto fail;
    }
    ret = sceIoLseekForDriver(fd, 0LL, 0);
    printf("Header rewind: 0x%08X\n", ret);

    // set up SBL decryption for this SELF
    ret = sceSblAuthMgrAuthHeaderForKernel(handle, hdr_buf_aligned, hdr_size, ctx130);
    printf("sceSblAuthMgrAuthHeaderForKernel: 0x%08X\n", ret);
    if (ret < 0)
        goto fail;

    // set up read buffer
    data_buf = sceKernelLoadcoreKallocForKernel(0x10005, 0x10000+63);
    data_buf_aligned = (char *)(((int)data_buf + 63) & 0xFFFFFFC0);
    printf("Data buffer: 0x%08X, aligned: 0x%08X\n", data_buf, data_buf_aligned);
    if (data_buf == NULL)
        goto fail;

    // get sections
    int elf_offset = *(int*)(hdr_buf_aligned + 0x40);
    int num_segs = *(short*)(hdr_buf_aligned + elf_offset + 0x2C);
    printf("Number of segments to read: 0x%04X\n", num_segs);
    int info_offset = *(int*)(hdr_buf_aligned + 0x58);
    struct seg_info *segs = (struct seg_info *)(hdr_buf_aligned + info_offset);
    int phdr_offset = *(int*)(hdr_buf_aligned + 0x48);
    struct e_phdr *phdrs = (struct e_phdr *)(hdr_buf_aligned + phdr_offset);

    // decrypt sections
    int total, to_read, num_read, off;
    int aligned_size;
    int blkid = 0;
    void *pgr_buf;
    for (int i = 0; i < num_segs; ++i) {
        sprintf(out_path, "%s.seg%u", out_prefix, i);
        sceIoCloseForDriver(wfd);
        wfd = sceIoOpenForDriver(out_path, 0x602, 6);
        printf("sceIoOpenForDriver(%s): 0x%08X\n", out_path, wfd);
        if (wfd < 0)
            break;

        if (blkid)
            sceKernelFreeMemBlockForKernel(blkid);
        aligned_size = (phdrs[i].p_filesz + 4095) & 0xFFFFF000;
        if (use_cdram)
            blkid = sceKernelAllocMemBlockForKernel("self_decrypt_buffer", 0x40404006, 0x4000000, NULL);
        else
            blkid = sceKernelAllocMemBlockForKernel("self_decrypt_buffer", 0x1020D006, aligned_size, NULL);
        printf("sceKernelAllocMemBlockForKernel: 0x%08X, size: 0x%08X\n", blkid, aligned_size);
        ret = sceKernelGetMemBlockBaseForKernel(blkid, &pgr_buf);
        printf("sceKernelGetMemBlockBaseForKernel: 0x%08X, base: 0x%08X\n", ret, pgr_buf);
        if (ret < 0)
            break;

        // setup buffer for output
        ret = sceSblAuthMgrSetupAuthSegmentForKernel(handle, i, (u32_t)segs[i].length, pgr_buf, phdrs[i].p_filesz);
        printf("sceSblAuthMgrSetupAuthSegmentForKernel: 0x%08X\n", ret);
        if (ret < 0)
            break;

        ret = sceIoLseekForDriver(fd, segs[i].offset, 0);
        printf("sceIoLseekForDriver(0x%08X): 0x%08X\n", (u32_t)segs[i].offset, ret);
        if (ret < 0)
            break;
        total = (u32_t)segs[i].length;
        to_read = total > 0x10000 ? 0x10000 : total;
        off = 0;
        while (total > 0 && (num_read = sceIoReadForDriver(fd, data_buf_aligned + off, to_read)) > 0) {
            off += num_read;
            total -= num_read;
            if (num_read < to_read) {
                to_read -= num_read;
                continue;
            }

            ret = sceSblAuthMgrAuthSegmentForKernel(handle, data_buf_aligned, off); // decrypt buffer
            printf("sceSblAuthMgrAuthSegmentForKernel: 0x%08X\n", ret);
            if (ret < 0)
                printf("!!! ERROR !!!\n");
            ret = sceSblAuthMgrLoadSegmentInternalForKernel(handle, data_buf_aligned, off); // copy buffer to output
            printf("sceSblAuthMgrLoadSegmentInternalForKernel: 0x%08X\n", ret);
            if (ret < 0)
                printf("!!! ERROR !!!\n");

            off = 0;
            to_read = total > 0x10000 ? 0x10000 : total;
        }

        // write buffer
        off = 0;
        while ((off += sceIoWriteForDriver(wfd, pgr_buf + off, phdrs[i].p_filesz - off)) < phdrs[i].p_filesz);
    }
    if (blkid)
        sceKernelFreeMemBlockForKernel(blkid);
    sceIoCloseForDriver(wfd);

fail:
    sceSblAuthMgrCloseForKernel(handle);
    if (fd)
        sceIoCloseForDriver(fd);
    if (ctx130)
        sceKernelLoadcoreKfreeForKernel(ctx130);
    if (hdr_buf)
        sceKernelLoadcoreKfreeForKernel(hdr_buf);
    if (data_buf)
        sceKernelLoadcoreKfreeForKernel(data_buf);
    return 1;
}

Module decryption and signature checks ("HENkaku patches" on FW 1.60)

See also SELF_Loading to see how these SceSblAuthMgr functions are used to decrypt SELFs.

The code below will patch signature checks and bypass module decryption and allow homebrews to run. The idea is to hook SceSblAuthMgr* calls that are imported to SceKernelModulemgr. The offsets are from FW 1.60, you will probably need to modify functions defines (set to addresses of functions) and INSTALL_HOOK second arguments (set to addresses of imports in SceKernelModulemgr). For old FWs like 1.60, as there is no kASLR, you can set hardcoded addresses, else take HENkaku code. As a bonus there is also patch_npdrm functions that patches SceNpDrm to bypass some DRM checks and allow unsigned packages to be installed, which you also need to modify addresses. See SceNpDrm#Package_integrity_checks.

// hardcoded addresses for FW 1.60
#define G_OUR_EBOOT *(unsigned*)(0x01E60000 - 0x14)
#define G_BUF *(unsigned*)(0x01E60000 - 0xC)
#define G_WRITTEN *(unsigned*)(0x01E60000 - 0x10)

#define Func(addr) ((unsigned(*)())(addr))

// Hardcoded addresses for FW 1.60
#define sceSblAuthMgrAuthHeaderForKernel Func(0x4BC6C9)
#define sceSblAuthMgrSetupAuthSegmentForKernel Func(0x4BC851)
#define sceSblAuthMgrAuthSegmentForKernel Func(0x4BC909)
#define sceSblAuthMgrLoadSegmentInternalForKernel Func(0x4BCA89)


// setup file decryption
unsigned sceSblAuthMgrAuthHeaderForKernel_patched(unsigned a1, unsigned a2, unsigned a3, unsigned a4) {
    unsigned res = sceSblAuthMgrAuthHeaderForKernel(a1, a2, a3, a4);

    if (res == 0x800f0624 || res == 0x800f0616 || res == 0x800f0024) {
        G_OUR_EBOOT = 1;

        // patch somebuf so our module actually runs
        unsigned *somebuf = (unsigned*)a4;
        somebuf[42] = 0x40;

        return 0;
    } else {
        G_OUR_EBOOT = 0;
    }
    return res;
}

// setup output buffer
unsigned sceSblAuthMgrSetupAuthSegmentForKernel_patched(unsigned a1, unsigned a2, unsigned a3, unsigned a4, unsigned a5) {
    G_BUF = a4;
    G_WRITTEN = 0;
    if (G_OUR_EBOOT == 1) {
        return 0;
    }
    return sceSblAuthMgrSetupAuthSegmentForKernel(a1, a2, a3, a4, a5);
}

// decrypt
unsigned sceSblAuthMgrAuthSegmentForKernel_patched(unsigned a1, unsigned a2, unsigned a3) {
    if (G_OUR_EBOOT == 1) {
        return 0;
    }
    return sceSblAuthMgrAuthSegmentForKernel(a1, a2, a3);
}

// copy to output - not present on 3.60
unsigned sceSblAuthMgrLoadSegmentInternalForKernel_patched(unsigned a1, unsigned a2, unsigned a3) {
    if (G_OUR_EBOOT == 1) {
        memcpy((void*)(G_BUF + G_WRITTEN), (void*)a2, a3);
        G_WRITTEN += a3;
        return 0;
    }
    return sceSblAuthMgrLoadSegmentInternalForKernel(a1, a2, a3);
}

#define INSTALL_HOOK(func, addr) \
    { unsigned *target; \
    target = (unsigned*)addr; \
    *target++ = 0xE59FF000; /* ldr pc, [pc, #0] */ \
    *target++; /* doesn't matter */ \
    *target = (unsigned)func; \
    }

// hardcoded addresses for FW 1.60
void hook_install(void) {
    INSTALL_HOOK(sceSblAuthMgrLoadSegmentInternalForKernel_patched, 0x5BA9CC);
    INSTALL_HOOK(sceSblAuthMgrSetupAuthSegmentForKernel_patched, 0x5BA9DC);
    INSTALL_HOOK(sceSblAuthMgrAuthSegmentForKernel_patched, 0x5BAA0C);
    INSTALL_HOOK(sceSblAuthMgrAuthHeaderForKernel_patched, 0x5BAA1C);
}

unsigned get_module_base(const char *name) {
    int * modlist[MOD_LIST_SIZE];
    int modlist_records;
    int res;
    SceKernelModuleInfo modinfo;

    memset(modlist, 0, sizeof(modlist));
    modlist_records = MOD_LIST_SIZE;
    sceKernelGetModuleListForKernel(0x10005, 0x7FFFFFFF, 1, modlist, &modlist_records);

    for(int j = 0; j < modlist_records; j++) {
        memset(&modinfo, 0, sizeof(modinfo));
        res = sceKernelGetModuleInfoForKernel(modlist[j], &modinfo);
        if (strcmp(modinfo.name, name) == 0)
            return (unsigned)modinfo.module_top;
    }
    return 0;
}

// Hardcoded addresses for FW 1.60
void patch_npdrm(unsigned base) {
    unsigned *patch;
    // check where check_func[0] is called
    patch = (unsigned*)(base + 0x310);
    *patch = 0x47702001;
    // check where check_func[1] is called
    patch = (unsigned*)(base + 0xaa4);
    *patch = 0x47702001;

    // always return 1 in install_allowed
    patch = (unsigned*)(base + 0x2d64);
    *patch = 0x47702001;
    // patch error code 0x80870003
    patch = (unsigned*)(base + 0x4856);
    *patch = 0x2500;
    // second same error code
    patch = (unsigned*)(base + 0x35fe);
    *patch = 0x2600;
}

// Call this function from a thread
int hook(void) {
    fprintf("Hook start\n");

    unsigned prev_dacr;
    __asm__ volatile("mrc p15, 0, %0, c3, c0, 0" : "=r" (prev_dacr));
    __asm__ volatile("mcr p15, 0, %0, c3, c0, 0" : : "r" (-1));

    unsigned base_npdrm = get_module_base("SceNpDrm");
    fprintf("SceNpDrm base: 0x%08x\n", base_npdrm);
    patch_npdrm(base_npdrm);

    hook_install();

    __asm__ volatile("MCR    p15, 0, %0, c7, c5, 0" : : "r" (0)); // flush icache
    __asm__ volatile("mcr p15, 0, %0, c3, c0, 0" : : "r" (prev_dacr));

    sceKernelDelayThread(4*1000*1000);

    return 0;
}

SceModulemgrForKernel

sceKernelSetupForModulemgrForKernel

Version	NID
3.60	0x3382952B

void sceKernelSetupForModulemgrForKernel(void);

sceKernelFinalizeKblForKernel

Version	NID
0.990-3.60	0xFDD7F646
3.65	0xB911516F

Unloads ScePsp2BootConfig.

void *pKblParam = sceKernelGetKblParamForDriver();
kbl_modid = *(SceUID *)(sceKernelSysrootGetLibraryDBForKernel(pKblParam) + 0x38);
sceKernelStopUnloadModuleForDriver(kbl_modid);
unk = *(int *)(sceKernelSysrootGetLibraryDBForKernel(pKblParam) + 0x34);
// then does other things with other sysroot functions

// 0.990
void sceKernelFinalizeKblForKernel(void);

// 3.60
int sceKernelFinalizeKblForKernel(void);

sceKernelRegisterSyscallForKernel

Version	NID
3.60	0xB427025E
3.65-3.68	0x2E4A10A0

void sceKernelRegisterSyscallForKernel(SceSize num, void *function);

sceKernelLoadPtLoadSegForFwloaderForKernel

Version	NID
0.990-3.60	0x448810D5
3.65	0xA07063EA

Temp name was sceKernelDecryptSelfByPathForKernel.

int sceKernelLoadPtLoadSegForFwloaderForKernel(const char *path, int e_phnum, void *buffer, uint32_t bufsize, int zero_unk, uint32_t *bytes_read);

This is an easy way of decrypting SELFs but you are limited to the kinds of SELFs you can load in the current context (for example, you can't load user modules from kernel context). It is also susceptible to limitations of where the SELF can be loaded from. For example, you are not allowed to load SELFs found in os0: from ux0: because Secure Kernel checks the Media Type.

On FW 3.60, statically compiled SELF gives an error.

sceLoadcoreIoMountBootimageFSForKernel

Version	NID
3.60	0x01360661
3.65	0x185FF1BC

Temp name was sceKernelMountBootfsForKernel.

int sceLoadcoreIoMountBootimageFSForKernel(const char *bootImagePath);

sceLoadcoreIoUmountBootimageFSForKernel

Version	NID
3.60	0x9C838A6B
3.65	0xBD61AD4D

Temp name was sceKernelUmountBootfsForKernel.

int sceLoadcoreIoUmountBootimageFSForKernel(void);

sceKernelLoadModuleForPidForKernel

Version	NID
3.60	0xFA21D8CB

/**
 * @brief Load module
 *
 * moduleFileName Loads the module specified by moduleFileName.
 * If the load is successful, the module identifier is returned as the return value.
 *
 * @param[in]	moduleFileName	file name
 * @param[in]	flags		flags
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID sceKernelLoadModuleForPidForKernel(SceUID pid, const char *moduleFileName, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt);

sceKernelStartModuleForPidForKernel

Version	NID
3.60	0x6DF745D5

// flags must be 0
// pOpt can be null

/**
 * @brief start module for process
 *
 * Starts the module specified by uid. When calling the start entry function,
 * the value specified by the args and argp arguments is passed as an argument.
 *
 * If the start process is successful, the library declared with AUTO_EXPORT will be registered.
 * Public processing is performed and the return value of the start entry function is stored in the area indicated by pRes.
 * If the start process fails, library registration and publishing will not be performed.
 *
 * SCE_KERNEL_START_NO_RESIDENT is returned as the return value of the start entry function
 * only if the module is automatically unloaded after executing the start entry function.
 * If SCE_KERNEL_START_FAILED is returned, the start process will fail.
 * At this time, the module is not unloaded. Modules that failed to start
 * It can be restarted with sceKernelStartModuleForPidForKernel().
 *
 * @param[in]	pid	process id
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of start entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int sceKernelStartModuleForPidForKernel(SceUID pid, SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelStartModuleOpt *pOpt, int *pRes);

sceKernelStopModuleForPidForKernel

Version	NID
3.60	0x7BB4CE54

/**
 * @brief Stop module
 *
 * Stops the module specified by uid. When calling the stop entry function,
 * the values specified by the args and argp arguments are passed as arguments.
 *
 * If the stop process is successful, the library released from the module is deleted,
 * and the return value of the stop entry function is stored in the area indicated by pRes.
 * If stop processing fails, library deletion processing is not performed.
 *
 * Only when SCE_KERNEL_STOP_SUCCESS is returned as the return value of the
 * stop entry function, module stop processing succeeds.
 * If any other value is returned, module stop processing will fail.
 * The module that failed to stop can be restarted with sceKernelStopModuleForPidForKernel().
 *
 * @param[in]	pid	process id
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int sceKernelStopModuleForPidForKernel(SceUID pid, SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelStopModuleOpt *pOpt, int *pRes);

sceKernelUnloadModuleForPidForKernel

Version	NID
3.60	0x5972E2CC

/**
 * @brief Unload module
 *
 * Unloads the module specified by uid.
 *
 * @param[in]	pid     process id
 * @param[in]	uid     module id
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter
 *
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
int sceKernelUnloadModuleForPidForKernel(SceUID pid, SceUID uid, SceUInt32 flags, const SceKernelUnloadModuleOpt *pOpt);

sceKernelModuleUnloadMySelfForKernel

Version	NID
3.60	0x2A69385E
3.65	0x2F82EEBC

int sceKernelModuleUnloadMySelfForKernel(void);

sceKernelLoadPreloadingModulesForKernel

Temp name was sceKernelLoadProcessModulesForKernel, sceKernelLoadStartDefaultSharedModulesForPidForKernel.

Version	NID
0.931-3.60	0x3AD26B43
3.65	0xE3C1AAA1

Loads the preloading modules for a process. This includes, for instance, SceLibKernel.

If dipsw 210 is set, it checks if the preloading module flag and 0x8 are set, OR the flag 0x20 of sceKernelLoadModule. If that is the case, the module is loaded into DevKit Additional Memory (DRAM).

param[in] flags - process modules flags.
                  1:inhibit shared and load libgxm_dbg_es4.suprx Instead of libgxm_es4.suprx
                  2:not use default lib

int sceKernelLoadPreloadingModulesForKernel(SceUID pid, SceLoadProcessParam *pParam, int flags);

sceKernelLoadProcessImageForKernel

Version	NID
0.931-3.60	0xAC4EABDB
3.65	0xA85A44D7

/**
 * @brief load process image
 *
 * @param[in]    pid       - target pid
 * @param[in]    path      - path
 * @param[in]    flags     - generally 0 - 0x10000 added if flag 0x40000000 is passed to sceKernelCreateProcess, 0x4000 added if an option is passed to sceKernelCreateProcess via the Opt argument
 * @param[out]   auth_info
 * @param[out]   param
 * @param[in]    shim_info - compatibility shim information, only used for one game (PCSG00063/PCSB000144) in 3.65
 *
 * @return modid, < 0 on error.
 */
SceUID sceKernelLoadProcessImageForKernel(SceUID pid, const char *path, uint flags, SceSelfAuthInfo *auth_info, SceLoadProcessParam *param, SceKernelCompatibilityShimInfo* shim_info);

sceKernelUnloadProcessModulesForKernel

Temp name was sceKernelStopUnloadPreloadingModulesForKernel.

Version	NID
0.990-3.60	0x0E33258E
3.65	0xE71530D7

int sceKernelUnloadProcessModulesForKernel(SceUID pid);

sceKernelStartPreloadingModulesForKernel

Version	NID
0.931-3.60	0x432DCC7A
3.65	0x998C7AE9

Temp name was sceKernelStartProcessModulesForKernel.

int sceKernelStartPreloadingModulesForKernel(SceUID pid);

sceKernelGetModuleCBForKernel

Version	NID
0.990-3.60	0xFE303863

This is a guessed name. Temp name was sceKernelGetModuleInternalForKernel, sceKernelGetModuleCBForDebuggerForKernel, sceKernelGetProcessEntryPointForKernel.

This function returns a pointer to the "ModuleCB" (module control block) for specified module UID.

0.990:

void **sceKernelGetModuleCBForKernel(SceUID modid);

3.60:

int sceKernelGetModuleCBForKernel(SceUID modid, void **ppModCB);

sceKernelGetModuleIdByPidForKernel

Version	NID
3.60	0x20A27FA9
3.65	0x679F5144

Temp name was sceKernelGetProcessMainModule.

/**
 * @brief Get the main module for a given process.
 * @param pid The process to query.
 * @return the UID of the module else < 0 for an error.
 */
SceUID sceKernelGetModuleIdByPidForKernel(SceUID pid);

sceKernelGetProcessLibStubIdListForKernel

Version	NID
3.60	0x1D341231

int sceKernelGetProcessLibStubIdListForKernel(SceUID pid, SceUID *libstub_ids, SceSize *num);

sceKernelGetProcessLibraryIdListForKernel

Version	NID
3.60	0x1FDEAE16

Temp name was sceKernelGetModuleUidListForKernel, sceKernelGetModuleExportLibraryListForKernel.

int sceKernelGetProcessLibraryIdListForKernel(SceUID pid, SceUID *library_ids, SceSize *num);

sceKernelGetModuleImportListForKernel

Version	NID
3.60	0x2DD3B511

int sceKernelGetModuleImportListForKernel(SceUID pid, SceUID modid, SceUID *library_ids, SceSize *num);

sceKernelGetModuleExportListForKernel

Version	NID
3.60	0x619925F1

Temp name was sceKernelGetModuleLibraryIdListForKernel.

int sceKernelGetModuleExportListForKernel(SceUID pid, SceUID modid, SceUID *library_ids, SceSize *num);

sceKernelGetModuleListForKernel

Version	NID
1.60-3.60	0x97CF7B4E
3.65	0xB72C75A4

int sceKernelGetModuleListForKernel(SceUID pid, int flags1, int flags2, SceUID *modids, SceSize *num);

sceKernelGetModuleList2ForKernel

Version	NID
3.60	0x410E1D2E

int sceKernelGetModuleList2ForKernel(SceUID pid, SceKernelModuleListInfo *infolists, SceSize *num);

sceKernelGetModuleListByImportForKernel

Version	NID
3.60	0x3B93CF88

Temp name was sceKernelGetModuleUidForKernel.

int sceKernelGetModuleListByImportForKernel(SceUID pid, SceUID library_id, SceUID *modids, SceSize *num, SceSize cpy_skip_num);

sceKernelGetModuleKernelExportListForKernel

Version	NID
3.60	0x8D1AA624

int sceKernelGetModuleKernelExportListForKernel(SceModuleLibraryInfo **ppList, SceSize *num);

sceKernelGetModuleLibExportListForKernel

Version	NID
3.60	0xD4BF409C

int sceKernelGetModuleLibExportListForKernel(SceUID pid, SceUID library_id, SceKernelModuleExportEntry *list, SceSize *num, SceSize cpy_skip_num);

SceModulemgrForKernel_FB251B7A

Version	NID
3.60	0xFB251B7A

maybe sceKernelGetModuleLibImportListForKernel

// a3 size is 8 * num
int SceModulemgrForKernel_FB251B7A(SceUID pid, SceUID stubid, void *a3, SceSize *num, SceSize cpy_skip_num);

sceKernelGetModuleAppInfoForKernel

Version	NID
3.60	0xF95D09C2

int sceKernelGetModuleAppInfoForKernel(const char *path, uint64_t *pAuthid, SceSelfAppInfo *pInfo);

sceKernelGetModuleIsSharedByAddrForKernel

Version	NID
3.60	0x99890202

int sceKernelGetModuleIsSharedByAddrForKernel(SceUID pid, const void *module_addr);

sceKernelGetModulePathForKernel

Version	NID
3.60	0x779A1025

Temp name was sceKernelGetProcessMainModulePathForKernel.

int sceKernelGetModulePathForKernel(SceUID modid, char *path, SceSize pathlen);

sceKernelGetModuleFingerprintForKernel

Version	NID
3.60	0xEEA92F1F

Temp name was sceKernelGetModuleNIDForKernel.

int sceKernelGetModuleFingerprintForKernel(SceUID modid, uint32_t *pFingerprint);

sceKernelGetLibraryDBFlagsForKernel

Version	NID
3.60	0x7A1E882D
3.65	0x1C82E9F7

Temp name was sceKernelGetModuleInhibitState.

int sceKernelGetLibraryDBFlagsForKernel(SceUID pid, int *pFlags);

sceKernelGetModuleCBByAddrForKernel

Version	NID
0.990-3.60	0x2C2618D9

Temp name was sceKernelGetModuleInternalByAddrForKernel, sceKernelGetProcessEntryPointByAddrForKernel.

Used by sceKernelPrintBacktraceForDriver.

int sceKernelGetModuleCBByAddrForKernel(SceUID pid, const void *pModAddr, SceModuleCB **ppModCB);

sceKernelGetModuleIdByAddrForKernel

Version	NID
0.990-3.60	0x0053BA4A
3.65	0x0C668636

SceUID sceKernelGetModuleIdByAddrForKernel(SceUID pid, const void *module_addr);

sceKernelGetModuleEntryPointForKernel

Version	NID
3.60	0x66606301
3.65	0x7B302C5D

SceKernelModuleEntry sceKernelGetModuleEntryPointForKernel(SceUID modid);

sceKernelGetModuleEntryPointForUserForKernel

Version	NID
3.60	0x78DBC027

int sceKernelGetModuleEntryPointForUserForKernel(SceUID pid, SceUID UserUid, SceKernelModuleEntry *start, SceKernelModuleEntry *stop);

sceKernelGetModuleInfoForKernel

Version	NID
3.60	0xD269F915
3.65	0xDAA90093

int sceKernelGetModuleInfoForKernel(SceUID pid, SceUID modid, SceKernelModuleInfo *info);

sceKernelGetModuleInfoMinByAddrForKernel

Version	NID
3.60	0x8309E043

int sceKernelGetModuleInfoMinByAddrForKernel(SceUID pid, const void *pModuleAddr, SceUInt32 *puiDbgFingerprint, void **pProgramTextAddr, SceKernelModuleName *pModuleName);

sceKernelGetModuleLibraryInfoForKernel

Version	NID
3.60	0x6A655255

int sceKernelGetModuleLibraryInfoForKernel(SceUID pid, SceUID library_id, SceKernelModuleLibraryInfo *info);

SceModulemgrForKernel_B73BE671

Version	NID
3.60	0xB73BE671

maybe sceKernelGetModuleLibStubInfoForKernel

// a3 size is 0x128
int SceModulemgrForKernel_B73BE671(SceUID pid, SceUID stubid, void *a3);

sceKernelGetModuleImportNonlinkedInfoByNIDForKernel

Version	NID
3.60	0x952535A3

int sceKernelGetModuleImportNonlinkedInfoByNIDForKernel(SceUID pid, SceUID modid, uint32_t libnid, SceKernelModuleImportNonlinkedInfo *info);

sceKernelGetModuleNonlinkedListForKernel

Version	NID
3.60	0xFF2264BB

int sceKernelGetModuleNonlinkedListForKernel(SceUID pid, SceUID modid, SceKernelModuleNonlinkedInfo *pList, SceSize *num);

sceKernelGetModuleNonlinkedImportInfoForKernel

Version	NID
3.60	0x1BDE2ED2

int sceKernelGetModuleNonlinkedImportInfoForKernel(SceUID pid, SceKernelModuleImportNID *a2, SceSize *num);

sceKernelRegisterDebugCBForKernel

Version	NID
3.60	0x60E176C8

used by SceDeci4pDtracep

int sceKernelRegisterDebugCBForKernel(const void *pHandler);

sceKernelUnregisterDebugCBForKernel

Version	NID
3.60	0x9D20C9BB

Temp name was sceKernelRegisterDebugCBCheckForKernel.

int sceKernelUnregisterDebugCBForKernel(const void *pHandler);

SceModulemgrForKernel_29CB2771

Version	NID
3.60	0x29CB2771

Related to process switch?

int SceModulemgrForKernel_29CB2771(SceUID pid);

SceModulemgrForKernel_4865C72C

Version	NID
3.60	0x4865C72C

Related to non-linked?

int SceModulemgrForKernel_4865C72C(SceUID pid, const char *libname);

SceModulemgrForKernel_F3CD647F

Version	NID
3.60	0xF3CD647F

Set two param. Maybe related to syscall.

Used by SceSysLibTrace.

void SceModulemgrForKernel_F3CD647F(void *a1, const void *func);

sceKernelLibraryDBGetSyslibtraceCBForKernel

Version	NID
0.990	0x3AE7F62F
3.60	not present

sceKernelLibraryDBSetSyslibtraceCBForKernel

Version	NID
0.990	0x7E68D6EC

SceModulemgrForKernel_06D9392A

Version	NID
0.990	0x06D9392A
3.60	not present

SceModulemgrForKernel_06D9392A(int modid, void *addr, int *out);

sceModulemgrLockLibDBForKernel

Version	NID
0.990	0x37C2A1A5

sceModulemgrUnlockLibDBForKernel

Version	NID
0.990	0x0751F162

SceModulemgrForKernel_04ADDA3E

Version	NID
0.990	0x04ADDA3E

sceKernelGetProcessEntryPointForKernel

Version	NID
0.990	0xC72CA412
3.60	not present

sceKernelLoadcoreKallocForKernel

Version	NID
0.990	0xB4A1DE31

void *sceKernelLoadcoreKallocForKernel(SceSize len);

sceKernelLoadcoreKfreeForKernel

Version	NID
0.990-1.60	0xF4B2D8B8

Calls sceKernelFreeHeapMemoryForDriver.

sceKernelCallModuleSuspendEntryForKernel

Version	NID
0.990	0x829E1C94

sceKernelLibraryDBGetLibEntHeadForKernel

Version	NID
0.990	0x1100A1B8

SceModulemgrForKernel_19A65337

Version	NID
0.990	0x19A65337

SceModulemgrForDriver

sceKernelGetModuleInfoByAddrForDriver

Version	NID
0.990-3.60	0x1D9E0F7E

note : kernel only.

int sceKernelGetModuleInfoByAddrForDriver(const void *module_addr, SceKernelModuleInfo *info);

sceKernelRegisterLibaryForDriver

Version	NID
0.990-3.60	0x861638AD

note : kernel only.

int sceKernelRegisterLibaryForDriver(const void *module_addr);

sceKernelReleaseLibaryForDriver

Version	NID
0.990-3.60	0x0975B104

note : kernel only.

int sceKernelReleaseLibaryForDriver(const void *module_addr);

sceKernelGetModuleInfoForDriver

Version	NID
0.990-1.69	0x36585DAF
3.60	moved to SceModulemgrForKernel

sceKernelSearchModuleByNameForDriver

Version	NID
0.940-3.60	0xBBE1771C

// Returns (<0) if error or module is not loaded
SceUID sceKernelSearchModuleByNameForDriver(const char *module_name);

sceKernelGetSystemSwVersionForDriver

Version	NID
0.940-3.60	0x5182E212

int sceKernelGetSystemSwVersionForDriver(SceKernelFwInfo *data);

sceKernelSetSystemSwVersionForDriver

Version	NID
0.990-1.69	0x912AEB73
3.60	non existent. Integrated with sceKernelGetSystemSwVersionForDriver

sceKernelLoadStartModuleForDriver

Version	NID
1.69-3.60	0x189BFBBB

/**
 * @brief PRX Load and start PRX
 *
 * moduleFileName After loading the PRX specified by the moduleFileName argument, start processing
 * is performed.
 *
 * During start processing, module_start () is called by a thread
 * that is initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument block specified by the args and argp arguments are
 * copied to the thread stack and then passed to module_start().
 *
 * If loading and start processing is successful, the return value
 * of the start entry function is stored in the area indicated by pRes.
 *
 * If SCE_KERNEL_START_NO_RESIDENT is returned as the return value of module_start()
 * the module is not resident in memory and is automatically unloaded after module_start() is executed.
 * If SCE_KERNEL_START_FAILED is returned,
 * the PRX has failed to load. A PRX is resident (loaded) only if it
 * returns a value other than SCE_KERNEL_START_NO_RESIDENT
 * or SCE_KERNEL_START_FAILED, including SCE_KERNEL_START_RESIDENT.
 *
 * @param[in]	moduleFileName	file name
 * @param[in]	args		argument block size
 * @param[in]	argp		argument block address
 * @param[in]	flags		flags, should be 0
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @param[out]	pRes		result of start entry
 *
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID sceKernelLoadStartModuleForDriver(const char *moduleFileName, SceSize args, const void *argp, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt, int *pRes);

sceKernelLoadStartModuleForPidForDriver

Version	NID
3.60	0x9D953C22

/**
 * @brief PRX Load and start PRX
 *
 * moduleFileName After loading the PRX specified by the moduleFileName argument, start processing
 * is performed.
 *
 * During start processing, module_start () is called by a thread
 * that is initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument block specified by the args and argp arguments are
 * copied to the thread stack and then passed to module_start().
 *
 * If loading and start processing is successful, the return value
 * of the start entry function is stored in the area indicated by pRes.
 *
 * If SCE_KERNEL_START_NO_RESIDENT is returned as the return value of module_start()
 * the module is not resident in memory and is automatically unloaded after module_start() is executed.
 * If SCE_KERNEL_START_FAILED is returned,
 * the PRX has failed to load. A PRX is resident (loaded) only if it
 * returns a value other than SCE_KERNEL_START_NO_RESIDENT
 * or SCE_KERNEL_START_FAILED, including SCE_KERNEL_START_RESIDENT.
 *
 * @param[in]	pid		process id
 * @param[in]	moduleFileName	file name
 * @param[in]	args		argument block size
 * @param[in]	argp		argument block address
 * @param[in]	flags		flags, should be 0
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @param[out]	pRes		result of start entry
 *
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID sceKernelLoadStartModuleForPidForDriver(SceUID pid, const char *moduleFileName, SceSize args, const void *argp, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt, int *pRes);

sceKernelLoadStartSharedModuleForPidForDriver

Version	NID
3.60	0xE2ADEF8D

/**
 * @brief PRX Load and start PRX
 *
 * moduleFileName After loading the PRX specified by the moduleFileName argument, start processing
 * is performed.
 *
 * During start processing, module_start () is called by a thread
 * that is initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument block specified by the args and argp arguments are
 * copied to the thread stack and then passed to module_start().
 *
 * If loading and start processing is successful, the return value
 * of the start entry function is stored in the area indicated by pRes.
 *
 * If SCE_KERNEL_START_NO_RESIDENT is returned as the return value of module_start()
 * the module is not resident in memory and is automatically unloaded after module_start() is executed.
 * If SCE_KERNEL_START_FAILED is returned,
 * the PRX has failed to load. A PRX is resident (loaded) only if it
 * returns a value other than SCE_KERNEL_START_NO_RESIDENT
 * or SCE_KERNEL_START_FAILED, including SCE_KERNEL_START_RESIDENT.
 *
 * @param[in]	pid		process id
 * @param[in]	moduleFileName	file name
 * @param[in]	args		argument block size
 * @param[in]	argp		argument block address
 * @param[in]	flags		flags, should be 0
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @param[out]	pRes		result of start entry
 *
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID sceKernelLoadStartSharedModuleForPidForDriver(SceUID pid, const char *moduleFileName, SceSize args, const void *argp, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt, int *pRes);

sceKernelLoadModuleWithoutStartForDriver / sceKernelLoadModuleForDriver

Version	NID
1.69-3.60	0x86D8D634

/**
 * @brief Load module
 *
 * moduleFileName Loads the module specified by moduleFileName.
 * If the load is successful, the module identifier is returned as the return value.
 *
 * @param[in]	moduleFileName	file name
 * @param[in]	flags		flags
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID sceKernelLoadModuleForDriver(const char *moduleFileName, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt);

sceKernelStartModuleForDriver

Version	NID
1.69-3.60	0x0675B682

// flags must be 0
// pOpt can be null

/**
 * @brief start module
 *
 * Starts the module specified by uid. When calling the start entry function,
 * the value specified by the args and argp arguments is passed as an argument.
 *
 * If the start process is successful, the library declared with AUTO_EXPORT will be registered.
 * Public processing is performed and the return value of the start entry function is stored in the area indicated by pRes.
 * If the start process fails, library registration and publishing will not be performed.
 *
 * SCE_KERNEL_START_NO_RESIDENT is returned as the return value of the start entry function
 * only if the module is automatically unloaded after executing the start entry function.
 * If SCE_KERNEL_START_FAILED is returned, the start process will fail.
 * At this time, the module is not unloaded. Modules that failed to start
 * It can be restarted with sceKernelStartModuleForDriver().
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of start entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int sceKernelStartModuleForDriver(SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelStartModuleOpt *pOpt, int *pRes);

sceKernelStopUnloadModuleForDriver

Version	NID
1.69-3.60	0x03B30B7E

// flags must be 0
// opt can be null

/**
 * @brief Stop and unload PRX
 *
 * After stopping the PRX specified by the uid argument, unloading is performed.
 *
 * During stop processing, module_stop() is called by a thread that is
 * initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument blocks specified by the args and argp
 * arguments are copied onto the thread stack and then passed to module_stop().
 *
 * If the stop process is successful, the library released from PRX
 * is deleted and then unloaded, and the return value of
 * the stop entry function is stored in the area indicated by pRes.
 *
 * PRX stop and unload processing has failed only if SCE_KERNEL_STOP_CANCEL
 * is returned as the return value of module_stop().
 * If any other value is returned, stop and unload processing has succeeded.
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int sceKernelStopUnloadModuleForDriver(SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelUnloadModuleOpt *pOpt, int *pRes);

sceKernelStopUnloadModuleForPidForDriver

Version	NID
3.60	0x49A3EDC7

/**
 * @brief Stop and unload PRX
 *
 * After stopping the PRX specified by the uid argument, unloading is performed.
 *
 * During stop processing, module_stop() is called by a thread that is
 * initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument blocks specified by the args and argp
 * arguments are copied onto the thread stack and then passed to module_stop().
 *
 * If the stop process is successful, the library released from PRX
 * is deleted and then unloaded, and the return value of
 * the stop entry function is stored in the area indicated by pRes.
 *
 * PRX stop and unload processing has failed only if SCE_KERNEL_STOP_CANCEL
 * is returned as the return value of module_stop().
 * If any other value is returned, stop and unload processing has succeeded.
 *
 * @param[in]	pid	process id
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int sceKernelStopUnloadModuleForPidForDriver(SceUID pid, SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelUnloadModuleOpt *pOpt, int *pRes);

sceKernelStopUnloadSharedModuleForPidForDriver

Version	NID
3.60	0x02D3D0C1

int sceKernelStopUnloadSharedModuleForPidForDriver(SceUID pid, SceUID modid, SceSize args, void *argp, int flags, SceKernelULMOption *option, int *status);

sceKernelStopModuleForDriver

Version	NID
1.69-3.60	0x100DAEB9

/**
 * @brief Stop module
 *
 * Stops the module specified by uid. When calling the stop entry function,
 * the values specified by the args and argp arguments are passed as arguments.
 *
 * If the stop process is successful, the library released from the module is deleted,
 * and the return value of the stop entry function is stored in the area indicated by pRes.
 * If stop processing fails, library deletion processing is not performed.
 *
 * Only when SCE_KERNEL_STOP_SUCCESS is returned as the return value of the
 * stop entry function, module stop processing succeeds.
 * If any other value is returned, module stop processing will fail.
 * The module that failed to stop can be restarted with sceKernelStopModuleForDriver().
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int sceKernelStopModuleForDriver(SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelStopModuleOpt *pOpt, int *pRes);

sceKernelUnloadModuleForDriver

Version	NID
1.69-3.60	0x728E72A6

In 1.69 existed in SceModulemgrForKernel

/**
 * @brief Unload module
 *
 * Unloads the module specified by uid.
 *
 * @param[in]	uid     module id
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter
 *
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
int sceKernelUnloadModuleForDriver(SceUID uid, SceUInt32 flags, const SceKernelUnloadModuleOpt *pOpt);

load_with_logs

Version	NID
0.990	0x57EE2372

SceModulemgr

__sceKernelLoadModuleWithoutStart

Version	NID
0.990-1.69	0xA4E6DA4D
3.60	non existent

/**
 * @brief Load module
 *
 * moduleFileName Loads the module specified by moduleFileName.
 * If the load is successful, the module identifier is returned as the return value.
 *
 * @param[in]	moduleFileName	file name
 * @param[in]	flags		flags
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID __sceKernelLoadModuleWithoutStart(const char *moduleFileName, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt);

_sceKernelLoadModule

Version	NID
1.69	non existent
3.60	0xB4C5EF9E

/**
 * @brief Load module
 *
 * moduleFileName Loads the module specified by moduleFileName.
 * If the load is successful, the module identifier is returned as the return value.
 *
 * @param[in]	moduleFileName	file name
 * @param[in]	flags		flags
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */
SceUID _sceKernelLoadModule(const char *moduleFileName, SceUInt32 flags, const SceKernelLoadModuleOpt *pOpt);

_sceKernelLoadStartModule

Version	NID
1.69	non existent
3.60	0x60647592

/**
 * @brief PRX Load and start PRX
 *
 * moduleFileName After loading the PRX specified by the moduleFileName argument, start processing
 * is performed.
 *
 * During start processing, module_start () is called by a thread
 * that is initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument block specified by the args and argp arguments are
 * copied to the thread stack and then passed to module_start().
 *
 * If loading and start processing is successful, the return value
 * of the start entry function is stored in the area indicated by pRes.
 *
 * If SCE_KERNEL_START_NO_RESIDENT is returned as the return value of module_start()
 * the module is not resident in memory and is automatically unloaded after module_start() is executed.
 * If SCE_KERNEL_START_FAILED is returned,
 * the PRX has failed to load. A PRX is resident (loaded) only if it
 * returns a value other than SCE_KERNEL_START_NO_RESIDENT
 * or SCE_KERNEL_START_FAILED, including SCE_KERNEL_START_RESIDENT.
 *
 * @param[in]	moduleFileName	file name
 * @param[in]	args		argument block size
 * @param[in]	argp		argument block address
 * @param[in]	flags		flags, should be 0
 * @param[in]	pOpt		option parameter, should be SCE_NULL
 * @param[out]	pRes		result of start entry
 *
 * @retval	(>0)		module uid
 * @retval	(<0)		Error code
 */

typedef struct SceKernelModuleLoadStartParam {
	SceUInt32 flags;
	int *status;
	const SceKernelLoadModuleOpt *option;
	int a4; // not used
} SceKernelModuleLoadStartParam;

SceUID _sceKernelLoadStartModule(const char *moduleFileName, SceSize args, const void *argp, const SceKernelModuleLoadStartParam *pParam);

__sceKernelStartModule

Version	NID
0.990-1.69	0x1FD99C9F
3.60	non existent

/**
 * @brief start module
 *
 * Starts the module specified by uid. When calling the start entry function,
 * the value specified by the args and argp arguments is passed as an argument.
 *
 * If the start process is successful, the library declared with AUTO_EXPORT will be registered.
 * Public processing is performed and the return value of the start entry function is stored in the area indicated by pRes.
 * If the start process fails, library registration and publishing will not be performed.
 *
 * SCE_KERNEL_START_NO_RESIDENT is returned as the return value of the start entry function
 * only if the module is automatically unloaded after executing the start entry function.
 * If SCE_KERNEL_START_FAILED is returned, the start process will fail.
 * At this time, the module is not unloaded. Modules that failed to start
 * It can be restarted with __sceKernelStartModule().
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of start entry
 * @retval		SCE_OK	success
 * @retval		(<0)	Error code
 */
int __sceKernelStartModule(SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelStartModuleOpt *pOpt, int *pRes);

_sceKernelStartModule

Version	NID
1.69	non existent
3.60	0x72CD301F

/**
 * @brief start module
 *
 * Starts the module specified by uid. When calling the start entry function,
 * the value specified by the args and argp arguments is passed as an argument.
 *
 * If the start process is successful, the library declared with AUTO_EXPORT will be registered.
 * Public processing is performed and the return value of the start entry function is stored in the area indicated by pRes.
 * If the start process fails, library registration and publishing will not be performed.
 *
 * SCE_KERNEL_START_NO_RESIDENT is returned as the return value of the start entry function
 * only if the module is automatically unloaded after executing the start entry function.
 * If SCE_KERNEL_START_FAILED is returned, the start process will fail.
 * At this time, the module is not unloaded. Modules that failed to start
 * It can be restarted with _sceKernelStartModule().
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of start entry
 * @retval		SCE_OK	success
 * @retval		(<0)	Error code
 */

typedef struct SceKernelModuleStartParam {
	SceUInt32 flags;
	int *status;
	const SceKernelStartModuleOpt *pOpt;
	int a4; // not used
} SceKernelModuleStartParam;

int _sceKernelStartModule(SceUID uid, SceSize args, const void *argp, const SceKernelModuleStartParam *pParam);

__sceKernelStopModule

Version	NID
0.990-1.69	0xBA49EA5C
3.60	non existent

/**
 * @brief Stop module
 *
 * Stops the module specified by uid. When calling the stop entry function,
 * the values specified by the args and argp arguments are passed as arguments.
 *
 * If the stop process is successful, the library released from the module is deleted,
 * and the return value of the stop entry function is stored in the area indicated by pRes.
 * If stop processing fails, library deletion processing is not performed.
 *
 * Only when SCE_KERNEL_STOP_SUCCESS is returned as the return value of the
 * stop entry function, module stop processing succeeds.
 * If any other value is returned, module stop processing will fail.
 * The module that failed to stop can be restarted with __sceKernelStopModule().
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */
int __sceKernelStopModule(SceUID uid, SceSize args, const void *argp, SceUInt32 flags, const SceKernelStopModuleOpt *pOpt, int *pRes);

_sceKernelStopModule

Version	NID
1.69	non existent
3.60	0x086867A8

/**
 * @brief Stop module
 *
 * Stops the module specified by uid. When calling the stop entry function,
 * the values specified by the args and argp arguments are passed as arguments.
 *
 * If the stop process is successful, the library released from the module is deleted,
 * and the return value of the stop entry function is stored in the area indicated by pRes.
 * If stop processing fails, library deletion processing is not performed.
 *
 * Only when SCE_KERNEL_STOP_SUCCESS is returned as the return value of the
 * stop entry function, module stop processing succeeds.
 * If any other value is returned, module stop processing will fail.
 * The module that failed to stop can be restarted with _sceKernelStopModule().
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval		SCE_OK	success
 * @retval		(<0)	Error code
 */

typedef struct SceKernelModuleStopParam {
	SceUInt32 flags;
	int *status;
	const SceKernelStopModuleOpt *pOpt;
	int a4; // not used
} SceKernelModuleStopParam;

int _sceKernelStopModule(SceUID uid, SceSize args, const void *argp, const SceKernelModuleStopParam *pParam);

_sceKernelStopUnloadModule

Version	NID
1.69	non existent
3.60	0x86EAEA0A

/**
 * @brief Stop and unload PRX
 *
 * After stopping the PRX specified by the uid argument, unloading is performed.
 *
 * During stop processing, module_stop() is called by a thread that is
 * initialized with SCE_KERNEL_DEFAULT_PRIORITY_USER as the priority
 * and SCE_KERNEL_STACK_SIZE_DEFAULT_USER_MAIN as the stack size.
 * When it is done, the argument blocks specified by the args and argp
 * arguments are copied onto the thread stack and then passed to module_stop().
 *
 * If the stop process is successful, the library released from PRX
 * is deleted and then unloaded, and the return value of
 * the stop entry function is stored in the area indicated by pRes.
 *
 * PRX stop and unload processing has failed only if SCE_KERNEL_STOP_CANCEL
 * is returned as the return value of module_stop().
 * If any other value is returned, stop and unload processing has succeeded.
 *
 * @param[in]	uid	module id
 * @param[in]	args	argument block size
 * @param[in]	argp	argument block address
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter, should be SCE_NULL
 * @param[out]	pRes	result of stop entry
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
 */

typedef struct SceKernelModuleStopUnloadParam {
	SceUInt32 flags;
	int *status;
	const SceKernelUnloadModuleOpt *pOpt;
	int a4; // not used
} SceKernelModuleStopUnloadParam;

int _sceKernelStopUnloadModule(SceUID uid, SceSize args, const void *argp, const SceKernelModuleStopUnloadParam *pParam);

__sceKernelUnloadModuleWithoutStop

Version	NID
0.990-1.69	0xE439E26B
3.60	non existent

/**
 * @brief Unload module
 *
 * Unloads the module specified by uid.
 *
 * @param[in]	uid     module id
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter
 *
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
int __sceKernelUnloadModuleWithoutStop(SceUID uid, SceUInt32 flags, const SceKernelUnloadModuleOpt *pOpt);

_sceKernelUnloadModule

Version	NID
1.69	non existent
3.60	0x8E4A7716

/**
 * @brief Unload module
 *
 * Unloads the module specified by uid.
 *
 * @param[in]	uid     module id
 * @param[in]	flags	flags, should be 0
 * @param[in]	pOpt	option parameter
 *
 * @retval	SCE_OK	success
 * @retval	(<0)	Error code
int _sceKernelUnloadModule(SceUID uid, SceUInt32 flags, const SceKernelUnloadModuleOpt *pOpt);

__sceKernelOpenModule

Version	NID
0.990-1.69	0x9C2A9A49
3.60	non existent

_sceKernelOpenModule

Version	NID
1.69	non existent
3.60	0x9D674F45

typedef struct SceKernelModuleLoadStartParam {
	SceUInt32 flags;
	int *status;
	const SceKernelLoadModuleOpt *option;
	int a4; // not used
} SceKernelModuleLoadStartParam;

SceUID _sceKernelOpenModule(const char *moduleFileName, SceSize args, const void *argp, const SceKernelModuleLoadStartParam *pParam);

__sceKernelCloseModule

Version	NID
0.990-1.69	0x5303C52F
3.60	non existent

_sceKernelCloseModule

Version	NID
1.69	non existent
3.60	0x849E78BE


typedef struct SceKernelModuleStopUnloadParam {
	SceUInt32 flags;
	int *status;
	const SceKernelUnloadModuleOpt *pOpt;
	int a4; // not used
} SceKernelModuleStopUnloadParam;

SceUID _sceKernelCloseModule(SceUID uid, SceSize args, const void *argp, const SceKernelModuleStopUnloadParam *pParam);

sceKernelKttyWrite

Version	NID
0.940-1.69	0x4D76CF9E
3.60	non existent

sceKernelPutc

Version	NID
0.931-1.69	0x9D2FE122
3.60	non existent

int sceKernelPutc(char c);

sceKernelGetSystemSwVersion

Version	NID
0.940-3.60	0x5182E212

int sceKernelGetSystemSwVersion(SceKernelFwInfo *data);

sceKernelSetSystemSwVersion

Version	NID
0.990-1.69	0x912AEB73
3.60	non existent

sceKernelGetAllowedSdkVersionOnSystem

Version	NID
1.69-3.60	0x4397FC4E

int sceKernelGetAllowedSdkVersionOnSystem(void);

sceKernelGetModuleList

Version	NID
1.69-3.60	0x2EF2581F

int sceKernelGetModuleList(int flags, SceUID *modids, SceSize *num);

sceKernelGetModuleIdByAddr

Version	NID
1.69-3.60	0xF5798C7C

SceUID sceKernelGetModuleIdByAddr(const void *module_addr);

sceKernelGetModuleInfo

Version	NID
1.69-3.60	0x36585DAF

int sceKernelGetModuleInfo(SceUID modid, SceKernelModuleInfo *info);

sceKernelGetLibraryInfoByNID

Version	NID
0.990	not present
1.69-3.60	0xEAEB1312

int sceKernelGetLibraryInfoByNID(SceUID modid, SceUInt32 libnid, SceKernelLibraryInfo *pInfo);

sceKernelIsCalledFromSysModule

Version	NID
1.69	non existent
3.60	0x85E6D2BB

int sceKernelIsCalledFromSysModule(const void *module_addr);

sceKernelInhibitLoadingModule

Version	NID
1.69	non existent
3.60	0x6CED1F63

Added somewhere between 3.30 an 3.60 to prevent loading Sysmodules from webbrowser (see Vitasploit 2.00-3.36 and h-encore 3.65-3.68 writeup).

int sceKernelInhibitLoadingModule(uint16_t flag);

SceBacktraceForDriver

sceKernelBacktraceForDriver

Version	NID
0.990-3.60	0x166B9C8C

int sceKernelBacktraceForDriver(SceUID threadId, SceKernelCallFrame *pCallFrameBuffer, SceSize numBytesBuffer, SceUInt32 *pNumReturn, SceInt32 mode);

sceKernelPrintBacktraceForDriver

Version	NID
0.990	0xC5608386
3.60	0x7C878F90

int sceKernelPrintBacktraceForDriver(SceUID processId, const SceKernelCallFrame *pCallFrame, SceUInt32 numFrames);

sceKernelBacktraceInternalForDriver

Version	NID
0.990	0xCECD5584
3.60	0x888E99B8

It does not have devmode/QAF check. It allows kernel trace.

int sceKernelBacktraceInternalForDriver(SceUID threadId, SceKernelCallFrame *pCallFrameBuffer, SceSize numBytesBuffer, SceUInt32 *pNumReturn, SceInt32 mode);

SceBacktrace

_sceKernelBacktrace

Version	NID
3.60	0xBF371A98

Calls sceKernelBacktraceForDriver.


typedef struct SceBacktraceArgs {
	SceUInt32 *pNumReturn; /**< number of frames gathered. */
	SceInt32   mode;       /**< KERNEL or USER mode. / DONT_EXCEED */
} SceBacktraceArgs;

/**
 * Get backtrace
 * - When called with pCallFrameBuffer=NULL, numBytesBuffer=0,
 *   only the depth of the call stack can be obtained as a return value.
 *
 * @param	threadId		Thread ID, or SCE_KERNEL_BACKTRACE_CONTEXT_xxx
 * @param	pCallFrameBuffer	Buffer to get call frame
 * @param	numBytesBuffer		Buffer size (byte)
 * @param	pNumReturn		Pointer that receives the acquired number of frames
 * @param	mode			Action mode
 * @retval	(0)			Call stack depth, or SCE_OK
 * @retval	(<0)			Error code
 * @note	Callable only with TOOL
 */
SceInt32 _sceKernelBacktrace(
	SceUID              threadId,         /**< Thread ID, SCE_KERNEL_BACKTRACE_* can be used. */
	SceKernelCallFrame *pCallFrameBuffer, /**< buffer for frames */
	SceSize             numBytesBuffer,   /**< buffer size */
	SceBacktraceArgs   *pArgs
);

_sceKernelPrintBacktrace

Version	NID
0.990	0x21F00CF2

Calls sceKernelPrintBacktraceForDriver.

/**
 * Display backtrace
 * @param	processId	Process ID to which the frame belongs
 * @param	pCallFrame	Stack frame data
 * @param	numFrames	Maximum step
 * @retval	(0)		Success
 * @retval	(<0)		Error code
 */
SceInt32 _sceKernelPrintBacktrace(
	SceUID				processId,
	const SceKernelCallFrame	*pCallFrame,
	SceUInt32			numFrames
);

@@ Line 1,311: / Line 1,311: @@
 <source lang="C">int sceKernelGetModuleCBForKernel(SceUID modid, void **ppModCB);</source>
-=== sceKernelGetProcessMainModuleForKernel ===
+=== sceKernelGetModuleIdByPidForKernel ===
 {| class="wikitable"
 |-
@@ Line 1,320: / Line 1,320: @@
 | 3.65 || 0x679F5144
 |}
+Temp name was sceKernelGetProcessMainModule.
 <source lang ="C">
@@ Line 1,327: / Line 1,329: @@
   * @return the UID of the module else < 0 for an error.
   */
-SceUID sceKernelGetProcessMainModuleForKernel(SceUID pid);
+SceUID sceKernelGetModuleIdByPidForKernel(SceUID pid);
 </source>