SceSblSsMgr: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
 
(187 intermediate revisions by 3 users not shown)
Line 1: Line 1:
== Module ==
== Module ==


=== Known NIDs ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! Name !! World !! Privilege !! NID
! Version !! World !! Privilege
|-
|-
| 1.69 || SceSblSsMgr || Non-secure || Kernel || 0xFDDD93FA
| 1.69-3.60 || Non-secure || Kernel
|-
| 3.60 || SceSblSsMgr || Non-secure || Kernel || 0x4E913538
|}
|}


Line 34: Line 31:
|}
|}


== NVS Areas ==
== TODO ==
 
* study command flags
* check if mask_enable is a SceBool and if so change type.
* check which keyrings are allowed per function, and if key_id are per keyring index.
* create enum for keyrings indexes
* check IV usage
 
== Types ==
 
=== SceKitActivationData ===
 
{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Size !! Comment !! Used by
! Offset !! Size !! Description
|-
| 0x00 || 0x4 || Magic "act\0"
|-
| 0x04 || 0x4 || Format version
|-
|-
| 0 || 0x20 || qaf nvs mgmt area || sceSblQafManagerSetFlag (sub_81001610 on 0.990)
| 0x08 || 0x4 || Issue number (increment each activation, prevent rollback)
|-
|-
| 0x2A0 || 0x20 || Qa Flag Version ||
| 0x0C || 0x4 || Start validity time unix timestamp
|-
|-
| 0x400 || 0x80 || Qaf Token || [[SceSblSsMgr#|]]
| 0x10 || 0x4 || End validity time unix timestamp
|-
|-
| 0x480 || 1 || A Qaf Token flag. ?Set to 1 by default? || [[SceSblSsMgr#|]]
| 0x14 || 0x10 || Activation key
|-
| 0x24 || 0x1C || Unused
|-
| 0x40 || 0x40 || Encrypted Token (First 0x30 bytes of SceKitActivationData then 0x10 byte CMAC)
|}
|}
<source lang="C">
typedef struct SceConsoleId {
uint16_t unk; // {0, 0}
uint16_t company_code; // {0, 1}
uint16_t product_code;
uint16_t product_sub_code;
uint8_t chassis_check;
uint8_t unknown[7];
} SceConsoleId;
typedef struct SceOpenPsId {
uint8_t open_psid[0x10];
} SceOpenPsId;
typedef struct ScePsCode {
uint16_t company_code; // {0, 1}
uint16_t product_code;
uint16_t product_sub_code;
uint16_t factory_code; // = chassis_check >> 2;
} ScePsCode;
typedef struct Sce SceVisibleId {
char visible_id[0x20];
} SceVisibleId;
typedef enum SceSblSsNvsDataType {
SCE_SBL_SS_NVS_DATA_SYSTEM_LANGUAGE  = 0, // NVS offset 0x4A4, size 4, present on FW 0.990.000-3.740.011
SCE_SBL_SS_NVS_DATA_WLAN_BT          = 1, // NVS offset 0x500, size 1, present on FW 0.990.000-3.740.011
SCE_SBL_SS_NVS_DATA_UNK_482          = 2, // NVS offset 0x482, size 1, present on FW 0.990.000-3.740.011
SCE_SBL_SS_NVS_DATA_KIBAN_ID        = 3, // NVS offset 0x4E0, size 0x20, present on FW 0.990.000-3.740.011
SCE_SBL_SS_NVS_DATA_SAFEMODE_FLAGS  = 4, // NVS offset 0x483, size 1 - not present on FW 0.931.010, present on FW 0.990.000-3.740.011
SCE_SBL_SS_NVS_DATA_USE_INT_STOR    = 5  // NVS offset 0x486, size 1 - not present on FW 0.931.010-0.990.000, present on FW 3.600.011-3.740.011
} SceSblSsNvsDataType;
typedef struct SceKitActivationDataToken { // size is 0x40 bytes
  char magic[4]; // "act\n"
  uint32_t issue_no;
  uint32_t format_version;
  uint32_t start_date;
  uint32_t end_date;
  char open_psid[0x10];
  char padding[0xC];
  char cmac[0x10];
} SceKitActivationDataToken;
// This is what embeds the tm0:activation/act.dat file
typedef struct SceKitActivationData { // size is 0x80 bytes
  char magic[4]; // "act\n"
  uint32_t issue_no;
  uint32_t format_version;
  uint32_t start_date;
  uint32_t end_date;
  char open_psid[0x10];
  char padding[0x1C];
  char encrypted_token[0x40];
} SceKitActivationData;
typedef struct SceQafToken { // size is 0x80 bytes
  char magic[4];
  SceUInt32 qaf_version;
  char qaf_name[0x18]; // "NO_FLAGS" by default
  char console_id[0x10];
  char qa_flags[0x10];
  char reserved[0x30];
  char cmac[0x10]; // AES256CMAC of SceQafToken with zeroed CMAC field
} SceQafToken;
typedef struct SceQafTokenEnc { // size is 0x80 bytes
  char magic[4];
  SceUInt32 qaf_version;
  char qaf_name[0x18]; // "NO_FLAGS" by default
  char enc_data[0x60];
} SceQafTokenEnc;
typedef struct SceQafTokenEx {
  SceQafTokenEnc token_enc[0x80];
  char sig[0x100]; // Not present on FW 0.990. Present on FW 3.60.
} SceQafTokenEx;
typedef struct ScePortabilityData { // size is 0x24
  SceSize msg_size; // max size is 0x20
  uint8_t msg[0x20];
} ScePortabilityData;
// Used by run_encdec_cmd, itself called by sceSblDmac5EncDec for example.
typedef struct dmac_op_ctx {
dmac_op_ctx_heap *ctx_heap_addr;
uint keyring_key_count; // if keyring_key_count < 0x100, keyring_key_count is used as DKey
uint unk_8;
SceUID dmac_opid; // used with sceKernelDmaOpFreeForDriver
char iv[0x28]; // iv_size can be 0, 8, 0x10 or 0x28 depending on cmd itself depending on key_length
} dmac_op_ctx;
typedef struct dmac_op_ctx_heap { // size is 0x40 on FW 0.990
uint cmd;
uint unk_4; // 0x100
uint unk_8; // 0 if unk_flag = 0, 0x3ffff else
uint dmac5_op;
char reserved[0x30];
} dmac_op_ctx_heap;
typedef struct SceSblSsCreatePassPhraseParam { // size is 0x18
  SceUInt32 reserved; // ex: 0
  SceSize size; // Size of this structure
  char accountIdText[0x10]; // Taken from registry "/CONFIG/NP/account_id" and converted to ASCII
} SceSblSsCreatePassPhraseParam;
typedef struct SceKernelGetRandomNumberParam {
    SceUInt32 dstSize; // In bytes. Must be <= 0x40.
    SceUInt32 reserved;
} SceKernelGetRandomNumberParam;
typedef struct SceSblDmac5EncDecParam { // size is 0x18-bytes
const void *src;
void *dst;
SceSize size;
const void *key;
SceSize keysize;
void *iv;
} SceSblDmac5EncDecParam;
typedef struct SceSblDmac5HashTransformContext { // size is 0x28-bytes
SceUInt32 state[8];
SceUInt64 length;
} SceSblDmac5HashTransformContext;
typedef struct SceSblDmac5HashTransformParam { // size is 0x18-bytes
const void *src; // must be aligned on 0x40-byte
void *dst;
SceSize size;
const void *key;
SceSize keysize;
SceSblDmac5HashTransformContext *ctx; // Or another context of size 0x10-bytes
} SceSblDmac5HashTransformParam;
</source>


== SceSblSsMgrForKernel ==
== SceSblSsMgrForKernel ==


=== sceSblSsMgrNvsReadDataForKernel ===
=== sceSblNvsReadDataForKernel ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xC2EC8F5A
| 0.990-3.60 || 0xC2EC8F5A
|}
|}


Previous name was sceSblSsMgrGetSysconDataForKernel
Temp name was sceSblSsMgrNvsReadDataForKernel.
 
Calls [[SceSyscon#sceSysconNvsReadDataForDriver]].
 
Trying to read at offset 0-0x3FF: error 0x8025023C (cannot read SNVS using this function, need to use SNVS protocol).


For example gets 0x20 bytes of data for [[F00D_Commands#0x4 | act_sm.self command 0x4]] call.
Trying to read at offset > 0xB5F: error 0x80250001 (out of range).


This is done by passing offset 0x520 as first argument.
Trying to read at ((offset & 7) != 0): error 0x80250001 (non aligned).


<source lang="C">int sceSblSsMgrNvsReadDataForKernel(int offset, char *buffer, int size);</source>
<source lang="C">int sceSblNvsReadDataForKernel(int offset, char *buffer, int size);</source>


=== sceSblSsMgrNvsWriteDataForKernel ===
=== sceSblNvsWriteDataForKernel ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xE29E161C
| 0.990-3.60 || 0xE29E161C
|}
|}


Previous name was sceSblSsMgrSetSysconDataForKernel
Temp name was sceSblSsMgrNvsWriteDataForKernel.
 
Calls [[SceSyscon#sceSysconNvsWriteDataForDriver|sceSysconNvsWriteDataForDriver]].


<source lang="C">int sceSblSsMgrNvsWriteDataForKernel(int offset, char *buffer, int size);</source>
<source lang="C">int sceSblNvsWriteDataForKernel(int offset, char *buffer, int size);</source>


=== return_ffffffff ===
=== sceSblPmMgrGetProductModeForKernel ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 0.990-3.60 || 0x516ecc08
| 0.990-3.60 || 0x516ECC08
|}
|}


From 0.990 to 3.60, all it does is return -1; // 0xFFFFFFFF.
Temp name was scePmMgrGetProductModeForKernel.


<source lang="C">int return_ffffffff(void);</source>
From FWs 0.990 to 3.60, it is simply a redirect to [[SceSysmem#scePmMgrGetProductModeForDriver]].
 
<source lang="C">int sceSblPmMgrGetProductModeForKernel(char* result);</source>


=== sceSblQafManagerGetQafTokenForKernel ===
=== sceSblQafManagerGetQafTokenForKernel ===
Line 95: Line 255:
! Version !! NID
! Version !! NID
|-
|-
| 0.990 || 0x281FD75A
| 0.931-0.990 || 0x281FD75A
|-
| 3.60 || not present
|}
|}
<source lang="C">int sceSblQafManagerGetQafTokenForKernel(SceQafToken *pToken);</source>


=== sceSblQafManagerSetQafTokenForKernel ===
=== sceSblQafManagerSetQafTokenForKernel ===
Line 103: Line 267:
! Version !! NID
! Version !! NID
|-
|-
| 0.990 || 0x8E9447A1
| 0.931-0.990 || 0x8E9447A1
|-
| 3.60 || not present
|}
|}


=== sceSblSsMgrClearQafTokenForKernel ===
<source lang="C">int sceSblQafManagerSetQafTokenForKernel(SceQafToken *pToken);</source>
 
=== sceSblQafManagerGetQafOnNVSForKernel ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 0.990 || 0xD45155C6
| 0.931 || not present
|-
| 0.990-1.03 || 0x228A6653
|-
| 3.60 || not present
|}
|}


<source lang="C">int sceSblSsMgrClearQafTokenForKernel(void);</source>
<source lang="C">
SceQafToken *temp_token = pToken;
sceSblNvsReadDataForKernel(0x480, flag, 1);
if (!flag) {
nvs_read(0x400, temp_token, 0x80);
ret = exec_qaf_sm(temp_token, 0);
}
return ret;
</source>
 
<source lang="C">int sceSblQafManagerGetQafOnNVSForKernel(SceQafToken *pToken)</source>
 
=== sceSblQafManagerClearQafTokenForKernel ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931-0.990 || 0xD45155C6
|-
| 3.60 || not present
|}
 
<source lang="C">int sceSblQafManagerClearQafTokenForKernel(void);</source>


<source lang="C">
<source lang="C">
   uint32_t ret;
   uint32_t ret;
   char buffer[0x80];
   char qaf_token[0x80];


   memset(&buffer, 0xFF, 0x80);
   memset(&qaf_token, 0xFF, 0x80);
   SceKernelSuspendForDriver_4DF40893(0);
   SceKernelSuspendForDriver_4DF40893(0);
   ret = sceSblSsMgrNvsWriteDataForKernel(0x400, &buffer, 0x80);
   ret = sceSblNvsWriteDataForKernel(0x400, &qaf_token, 0x80);
   if ( !ret ) // if buffer successfully written, set a flag at 0x480
   if (!ret) // if qaf_token successfully written, set a flag at 0x480
     ret = sceSblSsMgrNvsWriteDataForKernel(0x480, (char)1, 1);
     ret = sceSblNvsWriteDataForKernel(0x480, 1, 1);
   SceKernelSuspendForDriver_2BB92967(0);
   SceKernelSuspendForDriver_2BB92967(0);
   return ret;
   return ret;
</source>
</source>


=== sceSblSsMgrGetQAFlagsForKernel ===
=== sceSblQafManagerGetQAFlagsForKernel ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x83D254FF
| 0.931-3.60 || 0x83D254FF
|}
|}


<source lang="C">int sceSblSsMgrGetQAFlagsForKernel(char buffer[0x10]);</source>
<source lang="C">int sceSblQafManagerGetQAFlagsForKernel(char buffer[0x10]);</source>


=== sceSblQafManagerGetQafNameForKernel ===
=== sceSblQafManagerGetQafNameForKernel ===
Line 144: Line 338:
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xE2DD0378
| 0.931-3.60 || 0xE2DD0378
|}
|}
Uses string "qaf_workaround" under certain conditions.


<source lang="C">
<source lang="C">
sceSblSsMgrGetSysconDataForKernel(0x480, buf, 1);
if ( byte_81008725 & 2 ) {
sceSblSsMgrGetSysconDataForKernel(0x400, buf, 0x80);
    char workaround_string = "qaf_workaround";
memcpy(buffer, buf, 0x18);
    memcpy(buffer, workaround_string, max_len);
} else {
sceSblNvsReadDataForKernel(0x480, flag, 1);
if (flag) {
sceSblNvsReadDataForKernel(0x400, buf, 0x80);
memcpy(buffer, buf, 0x18);
}
}
</source>
</source>


Line 161: Line 360:
Cryptographic functions in this module typically have 3 variations:
Cryptographic functions in this module typically have 3 variations:
# Use <code>key</code> - meaning that the key that you provide is used directly for encryption/decryption.
# Use <code>key</code> - meaning that the key that you provide is used directly for encryption/decryption.
# Use <code>slot_id</code> - meaning that you have to use [[SceSblAuthMgr#sceSblAuthMgrSetDmac5Key|sceSblAuthMgrSetDmac5Key]] function to set the key into a specific slot.
# Use <code>keyring_id</code> - meaning that you have to use [[SceSblAuthMgr#sceSblAuthMgrSetDmac5KeyForKernel|sceSblAuthMgrSetDmac5KeyForKernel]] function to set the key into a specific keyring. In this case you select a key from cmep by <code>key_id</code>. It will be encrypted by cmep and placed into the keyring selected by <code>keyring_id</code>.
#* Note that in this case you select a key from F00D by <code>key_id</code>. It will be encrypted by F00D and placed into the slot selected by <code>slot_id</code>.
# Use <code>key_id</code> - meaning that the call to [[SceSblAuthMgr#sceSblAuthMgrSetDmac5KeyForKernel|sceSblAuthMgrSetDmac5KeyForKernel]] will happen internally. In this case the key from cmep is also selected by <code>key_id</code> and encrypted by cmep. It is then placed into one of the available keyrings. Default keyring range is 0xC-0x17.
# Use <code>key_id</code> - meaning that the call to [[SceSblAuthMgr#sceSblAuthMgrSetDmac5Key|sceSblAuthMgrSetDmac5Key]] will happen internally.
 
#* In this case the key from F00D is also selected by <code>key_id</code> and encrypted by F00D. It is then placed into one of the available slots. Default slot range is 0xC-0x17.
=== sceSblRngPseudoRandomNumberForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.990.000-3.740.011 || 0x4F9BFBE5
|}
 
Temp name was sceSblSsMgrGetRandomNumberForDriver.
 
Gets the pseudo-random number calculated within [[SceSblSsMgr|SceSblSsMgr]].
 
The base seed is (DMAC5 RNG + HMAC-SHA1) * 2. System Time is also used for one of them.
 
<source lang="C">int sceSblRngPseudoRandomNumberForDriver(void *result, SceSize size);</source>
 
=== sceSblRngGenuineRandomNumberForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.990.000-3.740.011 || 0xAC57F4F0
|}
 
Temp name was sceSblSsMgrGetRandomDataForDriver.
 
Generates random data of length 0x40 bytes by doing: sceSblDmac5RndForDriver(dest, 0x40, 1);
 
Used in [[SceKrm]], [[SceSblGcAuthMgr]].
 
<source lang="c">int sceSblRngGenuineRandomNumberForDriver(char* dest);</source>
 
=== sceSblDmac5SetKeyLocalForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x18A1BF77
|-
| 0.990.000-3.740.011 || not present
|}
 
<source lang="C">int sceSblDmac5SetKeyLocalForDriver(uint *pCtx, SceSize alignment, SceSize size, SceUInt32 flag, void *pKey);</source>
 
=== sceSblDmac5DeleteKeyLocalForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x9DC22C1A
|-
| 0.990.000-3.740.011 || not present
|}
 
<source lang="C">int sceSblDmac5DeleteKeyLocalForDriver(uint *pCtx);</source>
 
=== SceSblSsMgrForDriver_8C31A8FD ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x8C31A8FD
|-
| 0.990.000-3.740.011 || not present
|}
 
A guessed name is sceSblDmac5...Op...ForDriver.
 
Uses _sceSblDmac5AllocOp.


=== sceSblSsMgrGetRandomNumberForDriver ===
=== SceSblSsMgrForDriver_CAB891D3 ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x4F9BFBE5
| 0.931.010 || 0xCAB891D3
|-
| 0.990.000-3.740.011 || not present
|}
|}


<source lang="C">int sceSblSsMgrGetRandomNumberForDriver(char* result, int size);</source>
A guessed name is sceSblDmac5...Op...ForDriver.


=== sceSblSsMgrGetRandomDataForDriver ===
Uses _sceSblDmac5AllocOp.
 
=== sceSblDmac5AllocOpForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 0.990-3.60 || 0xAC57F4F0
| 0.931.010 || 0xE293FC8E
|-
| 0.990.000-3.740.011 || not present
|}
|}


Generates random data of length 0x40 by executing [[Dmac5|Dmac5]] command 0x04
=== sceSblDmac5FreeOpForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0xCAEF7541
|-
| 0.990.000-3.740.011 || not present
|}


used in [[SceKrm]], [[SceSblGcAuthMgr]]
=== _sceSblDmac5FreeOpForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0xEB462E80
|-
| 0.990.000-3.740.011 || not present
|}


<source lang="c">int sceSblSsMgrGetRandomDataForDriver(char* dest);</source>
=== sceSblDmac5DirectCryptForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x850F81AD
|-
| 0.990.000-3.740.011 || not present
|}
 
=== _sceSblDmac5DirectCryptForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x29BE9D99
|-
| 0.990.000-3.740.011 || not present
|}
 
This is a guessed name.
 
Uses _sceSblDmac5DirectCrypt.
 
=== SceSblSsMgrForDriver_A87E82A4 ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0xA87E82A4
|-
| 0.990.000-3.740.011 || not present
|}
 
A guessed name is sceSblDmac5...ForDriver.
 
Uses _sceSblDmac5DirectCrypt.
 
=== SceSblSsMgrForDriver_465D1526 ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x465D1526
|-
| 0.990.000-3.740.011 || not present
|}
 
A guessed name is sceSblDmac5...ForDriver.
 
Uses _sceSblDmac5DirectCrypt.


=== sceSblDmac5RndForDriver ===
=== sceSblDmac5RndForDriver ===
Line 195: Line 534:
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x4DD1B2E5
| 0.931.010-3.740.011 || 0x4DD1B2E5
|}
|}


Temp name was sceSblSsMgrGetRandomDataCropForDriver.
Temp name was sceSblSsMgrGetRandomDataCropForDriver.


Generates random data of length 0x40 by executing [[Dmac5|Dmac5]] command 0x04
Generates random data by executing [[DMAC#DMAC5|Dmac5]] command 0x4.


Data is then cropped to fit the size in outputBuffer.
Data is then cropped to fit the size in pOutputBuffer.


Used by [[SceMsif]]
Used in [[SceMsif]].


<source lang="c">int sceSblDmac5RndForDriver(char* outputBuffer, int size, int unk);</source>
<source lang="c">int sceSblDmac5RndForDriver(char* pOutputBuffer, int size, int unk);</source>


=== sceSblSsMgrAESECBEncryptForDriver ===
=== sceSblDmac5AesEcbEncForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xC517770D
| 0.990.000-3.740.011 || 0xC517770D
|}
|}


Executes [[Dmac5|Dmac5]] command 0x1
Temp name was sceSblSsMgrAESECBEncryptForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x1.


used in [[ScePfsMgr]]
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. 128 / 192 / 256
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESECBEncryptForDriver(char *src, char *dst, int size, char* key, int key_size, int mask_enable);
int sceSblDmac5AesEcbEncForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESECBDecryptForDriver ===
=== sceSblDmac5AesEcbDecForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x7C978BE7
| 0.990.000-3.740.011 || 0x7C978BE7
|}
|}


Executes [[Dmac5|Dmac5]] command 0x02
Temp name was sceSblSsMgrAESECBDecryptForDriver.


used [[ScePfsMgr]]
Executes [[DMAC#DMAC5|Dmac5]] command 0x2.
 
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESECBDecryptForDriver(char *src, char *dst, int size, char* key, int key_size, int mask_enable);
int sceSblDmac5AesEcbDecForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESECBEncryptForDriver ===
=== sceSblDmac5AesEcbEncNPForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x01BE0374
| 0.990.000-3.740.011 || 0x0F7D28AF
|}
|}


Executes [[Dmac5|Dmac5]] command 0x01
Temp name was sceSblSsMgrAESECBEncryptWithKeygenForDriver.


used in [[SceSblMgKeyMgr]]
Executes [[DMAC#DMAC5|Dmac5]] command 0x1.
 
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//slot_id - 0x1C, 0x1D, 0x1E, 0x1F
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//mask_enable = 1
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5Key. Uses keyring_id range 0x0C-0x17 internally.
int sceSblSsMgrAESECBEncryptForDriver(char *src, char *dst, int size, int slot_id, int key_size, int mask_enable);
// mask_enable: ex: 1
int sceSblDmac5AesEcbEncNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 key_id, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESECBDecryptForDriver ===
=== sceSblDmac5AesEcbDecNPForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x8B4700CB
| 0.990.000-3.740.011 || 0x197ACF6F
|}
|}


Executes [[Dmac5|Dmac5]] command 0x02
Temp name was sceSblSsMgrAESECBDecryptWithKeygenForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x2.


used by [[SceSblMgKeyMgr]]
no usages found


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//slot_id - 0x1D, ?
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//mask_enable = 1
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5KeyForDriver. Uses keyring_id range 0x0C-0x17 internally.
int sceSblSsMgrAESECBDecryptForDriver(char *src, char *dst, int size, int slot_id, int key_size, int mask_enable);
// mask_enable: ex: 1
int sceSblDmac5AesEcbDecNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 key_id, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESECBEncryptWithKeygenForDriver ===
=== sceSblDmac5AesEcbEncWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x0F7D28AF
| 0.990.000-3.740.011 || 0x01BE0374
|}
|}


Executes [[Dmac5|Dmac5]] command 0x01
Temp name was sceSblDmac5AesEcbEncWithKeyslotForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x1.


used in [[ScePfsMgr]]
Used in [[SceSblMgKeyMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// keyring_id: ex: 0x1C, 0x1D, 0x1E, 0x1F
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//key_id - 0 - used with sceSblAuthMgrSetDmac5Key. uses slot_id range 0x0C-0x17 internally
// mask_enable: ex: 1
//mask_enable = 1
int sceSblDmac5AesEcbEncWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);
int sceSblSsMgrAESECBEncryptWithKeygenForDriver(char *src, char *dst, int size, char *key, int key_size, int key_id, int mask_enable);
</source>
</source>


=== sceSblSsMgrAESECBDecryptWithKeygenForDriver ===
=== sceSblDmac5AesEcbDecWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x197ACF6F
| 0.990.000-3.740.011 || 0x8B4700CB
|}
|}


Executes [[Dmac5|Dmac5]] command 0x02
Temp name was sceSblDmac5AesEcbDecWithKeyslotForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x2.


no usages found
Used in [[SceSblMgKeyMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// keyring_id: ex: 0x1D
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//key_id - 0 - used with sceSblAuthMgrSetDmac5Key. uses slot_id range 0x0C-0x17 internally
// mask_enable: ex: 1
//mask_enable = 1
int sceSblDmac5AesEcbDecWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);
int sceSblSsMgrAESECBDecryptWithKeygenForDriver(char *src, char *dst, int size, char *key, int key_size, int key_id, int mask_enable);
</source>
</source>


=== sceSblSsMgrDES64ECBEncryptForDriver ===
=== sceSblDmac5DesEcbEncWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x37DD5CBF
| 0.990.000-3.740.011 || 0x37DD5CBF
|}
|}
Temp name was sceSblDmac5DesEcbEncWithKeyslotForDriver, sceSblSsMgrDES64ECBEncryptForDriver.


This also implements 3DES. Chosen function depends on key size.
This also implements 3DES. Chosen function depends on key size.


for 0x40 - DES
* for 64 - DES
 
* for 128 - not tested. assuming 3DES with K1 = K3.
for 0x80 - not tested. assuming 3DES with K1 = K3.
* for 192 - 3DES
 
for 0xC0 - 3DES


Executes [[Dmac5|Dmac5]] command 0x41
Executes [[DMAC#DMAC5|Dmac5]] command 0x41.


used in [[SceMsif]], [[SceSblMgKeyMgr]]
Used in [[SceSblMgKeyMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//slot_id - 0x1C, ?
// keyring_id: ex: 0x1C
//key_size - 0xC0 (size in bits) - other sizes also work
// key_length: Key length in bits. ex: 192 - other sizes also work
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrDES64ECBEncryptForDriver(char *src, char *dst, int size, int slot_id, int key_size, int mask_enable);
int sceSblDmac5DesEcbEncWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrDES64ECBDecryptForDriver ===
=== sceSblDmac5DesEcbDecWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x8EAFB18A
| 0.990.000-3.740.011 || 0x8EAFB18A
|}
|}
Temp name was sceSblDmac5DesEcbDecWithKeyslotForDriver, sceSblSsMgrDES64ECBDecryptForDriver.


This also implements 3DES. Chosen function depends on key size.
This also implements 3DES. Chosen function depends on key size.


for 0x40 - DES
* for 64 - DES
 
* for 128 - not tested. assuming 3DES with K1 = K3.
for 0x80 - not tested. assuming 3DES with K1 = K3.
* for 192 - 3DES
 
for 0xC0 - 3DES


Executes [[Dmac5|Dmac5]] command 0x42
Executes [[DMAC#DMAC5|Dmac5]] command 0x42.


used in [[SceSblMgKeyMgr]]
Used in [[SceSblMgKeyMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//slot_id - 0x1C, ?
// keyring_id: ex: 0x1C
//key_size - 0xC0 (size in bits) - other sizes also work
// key_length: Key length in bits. ex: 192, other sizes also work.
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrDES64ECBDecryptForDriver(char *src, char *dst, int size, int slot_id, int key_size, int mask_enable);
int sceSblDmac5DesEcbDecWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrDES64CBCEncryptForDriver ===
=== sceSblDmac5DesCbcEncWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x05B38698
| 0.990.000-3.740.011 || 0x05B38698
|}
|}
Temp name was sceSblDmac5DesCbcEncWithKeyslotForDriver, sceSblSsMgrDES64CBCEncryptForDriver.


This also probably implements 3DES. Chosen function depends on key size.
This also probably implements 3DES. Chosen function depends on key size.


for 0x40 - DES
* for 0x40 - DES
 
* for 0x80 - not tested. assuming 3DES with K1 = K3.
for 0x80 - not tested. assuming 3DES with K1 = K3.
* for 0xC0 - 3DES
 
for 0xC0 - 3DES


Executes [[Dmac5|Dmac5]] command 0x49
Executes [[DMAC#DMAC5|Dmac5]] command 0x49.


no usages found
no usages found


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//slot_id - 0x1D, ?
// keyring_id: ex: 0x1D
//key_size - ? - does not matter ?
// key_length: Key length in bits. ? - does not matter ?
//iv - length is 8 for DES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 8 bytes for DES - will be updated after encryption (most likely for encrypting data in blocks?).
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrDES64CBCEncryptForDriver(char *src, char *dst, int size, int slot_id, int key_size, char* iv, int mask_enable);
int sceSblDmac5DesCbcEncWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, void *iv, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrDES64CBCDecryptForDriver ===
=== sceSblDmac5DesCbcDecWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x926BCCF0
| 0.990.000-3.740.011 || 0x926BCCF0
|}
|}
Temp name was sceSblDmac5DesCbcDecWithKeyslotForDriver, sceSblSsMgrDES64CBCDecryptForDriver.


This also probably implements 3DES. Chosen function depends on key size.
This also probably implements 3DES. Chosen function depends on key size.


for 0x40 - DES
* for 0x40 - DES
* for 0x80 - not tested. assuming 3DES with K1 = K3.
* for 0xC0 - 3DES


for 0x80 - not tested. assuming 3DES with K1 = K3.
Executes [[DMAC#DMAC5|Dmac5]] command 0x4A.


for 0xC0 - 3DES
no usages found
 
Executes [[Dmac5|Dmac5]] command 0x4A
 
no usages found  


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//slot_id - 0x1D, ?
// keyring_id: ex: 0x1D
//key_size - ? - does not matter ?
// key_length: Key length. ? - does not matter ?
//iv - length is 8 for DES
// iv: IV. IV length is 8 bytes for DES.
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrDES64CBCDecryptForDriver(char *src, char *dst, int size, int slot_id, int key_size, char* iv, int mask_enable);
int sceSblDmac5DesCbcDecWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, void *iv, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESCBCEncryptForDriver ===
=== sceSblDmac5AesCbcEncForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xE6E1AD15
| 0.990.000-3.740.011 || 0xE6E1AD15
|}
|}


Executes [[Dmac5|Dmac5]] command 0x09
Temp name was sceSblSsMgrAESCBCEncryptForDriver.


used by [[ScePfsMgr]]
Executes [[DMAC#DMAC5|Dmac5]] command 0x9.
 
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Allowed values are: 128 / 192 / 256.
//iv - length is 0x10 for AES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESCBCEncryptForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int mask_enable);
int sceSblDmac5AesCbcEncForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESCBCDecryptForDriver ===
=== sceSblDmac5AesCbcDecForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x121FA69F
| 0.990.000-3.740.011 || 0x121FA69F
|}
|}


Executes [[Dmac5|Dmac5]] command 0x0A
The official name maybe contains a typo: sceSblDmac5AEsCbcDecForDriver.


used by [[ScePfsMgr]]
Temp name was sceSblSsMgrAESCBCDecryptForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0xA.
 
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//iv - length is 0x10 for AES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESCBCDecryptForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int mask_enable);
int sceSblDmac5AesCbcDecForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESCBCEncryptWithKeygenForDriver ===
=== sceSblDmac5AesCbcEncNPForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x711C057A
| 0.990.000-3.740.011 || 0x711C057A
|}
|}


Executes [[Dmac5|Dmac5]] command 0x09
Temp name was sceSblSsMgrAESCBCEncryptWithKeygenForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x9.


used by [[ScePfsMgr]]
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//iv - length is 0x10 for AES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
//key_id - 0 - used with sceSblAuthMgrSetDmac5Key. uses slot_id range 0x0C-0x17 internally
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5KeyForDriver. Uses keyring_id range 0x0C-0x17 internally.
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESCBCEncryptWithKeygenForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int key_id, int mask_enable);
int sceSblDmac5AesCbcEncNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 key_id, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESCBCDecryptWithKeygenForDriver ===
=== sceSblDmac5AesCbcDecNPForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x1901CB5E
| 0.990.000-3.740.011 || 0x1901CB5E
|}
|}


Executes [[Dmac5|Dmac5]] command 0x0A
Temp name was sceSblSsMgrAESCBCDecryptWithKeygenForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0xA.


used by [[ScePfsMgr]]
Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//iv - length is 0x10 for AES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
//key_id - 0 - used with sceSblAuthMgrSetDmac5Key. uses slot_id range 0x0C-0x17 internally
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5KeyForDriver. Uses keyring_id range 0x0C-0x17 internally.
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESCBCDecryptWithKeygenForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int key_id, int mask_enable);
int sceSblDmac5AesCbcDecNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 key_id, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESCTREncryptForDriver ===
=== sceSblDmac5AesCtrEncForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x82B5DCEF
| 0.931.010-1.06 || not present
|-
| 1.500.151-3.740.011 || 0x82B5DCEF
|}
|}


Executes [[Dmac5|Dmac5]] command 0x21
Temp name was sceSblSsMgrAESCTREncryptForDriver.


used by [[SceNpDrm]]
Executes [[DMAC#DMAC5|Dmac5]] command 0x21.


this function can also be used for decryption since CTR is symmetric function
Used in [[SceNpDrm]].
 
This function can also be used for decryption since AES CTR is a symmetric function.


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//iv - length is 0x10 for AES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESCTREncryptForDriver (char *src, char *dst, int size, char *key, int key_size, char *iv, int mask_enable);
int sceSblDmac5AesCtrEncForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrAESCTRDecryptForDriver ===
=== sceSblDmac5AesCtrDecForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x7D46768C
| 0.931.010-1.06 || not present
|-
| 1.500.151-3.740.011 || 0x7D46768C
|}
|}


Executes [[Dmac5|Dmac5]] command 0x22
Temp name was sceSblSsMgrAESCTRDecryptForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x22.


no usages found
no usages found


this function can also be used for encryption since CTR is symmetric function
This function can also be used for encryption since AES CTR is a symmetric function.


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//key - length is 0x10 / 0x18 / 0x20
// key: Key.
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//iv - length is 0x10 for AES - will be updated after encryption (most likely for encrypting data in blocks?)
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
//mask_enable = 1
// mask_enable: ex: 1
int sceSblSsMgrAESCTRDecryptForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int mask_enable);
int sceSblDmac5AesCtrDecForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);
</source>
</source>


=== sceSblSsMgrSHA1ForDriver ===
=== sceSblDmac5Sha1ForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xEB3AF9B5
| 0.990.000-3.740.011 || 0xEB3AF9B5
|}
|}


Executes [[Dmac5|Dmac5]] command 0x03
Executes [[DMAC#DMAC5|Dmac5]] command 0x3. Used in [[ScePfsMgr]].


used by [[ScePfsMgr]]
<source lang="c">int sceSblDmac5Sha1ForDriver(const void *src, void *dst, SceSize length, SceSblDmac5HashTransformContext *ctx, SceUInt32 mask_enable, SceUInt32 extra);</source>


key_size is always 0x100 bits
=== sceSblDmac5Sha1HmacTransformForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.990.000-3.740.011 || 0x6704D985
|}


<source lang="c">
Temp name was sceSblSsMgrHMACSHA1ForDriver.
//size - size of data in src
 
//iv = 0
Executes [[DMAC#DMAC5|Dmac5]] command 0x23. Used in [[ScePfsMgr]].
//mask_enable = 1
 
//command_bit = 0 / 0x400 / 0x800 / 0xC00
Key size is always 256-bits.
int sceSblSsMgrSHA1ForDriver(char *src, char *dst, int size, char *iv, int mask_enable, int command_bit);
 
</source>
<source lang="c">int sceSblDmac5Sha1HmacTransformForDriver(const void *src, void *dst, SceSize length, const void *key, SceSblDmac5HashTransformContext *ctx, SceBool mask_enable, SceUInt32 extra);</source>


=== sceSblSsMgrHMACSHA1ForDriver ===
=== sceSblDmac5Sha1HmacNPForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x6704D985
| 0.990.000-3.740.011 || 0x92E37656
|}
|}


Executes [[Dmac5|Dmac5]] command 0x23
Temp name was sceSblSsMgrHMACSHA1WithKeygenForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x23. no usages found.
 
<source lang="c">int sceSblDmac5Sha1HmacNPForDriver(const void *src, void *dst, SceSize length, const void *key, SceSblDmac5HashTransformContext *ctx, SceUInt32 key_id, SceBool mask_enable, SceUInt32 extra);</source>
 
=== sceSblDmac5Sha256HmacForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.740.011 || 0x79F38554
|}


used by [[ScePfsMgr]]
Temp name was sceSblSsMgrHMACSHA256ForDriver.


key_size is always 0x100 bits
Executes [[DMAC#DMAC5|Dmac5]] command 0x33. no usages found.


<source lang="c">
<source lang="c">int sceSblDmac5Sha256HmacForDriver(const void *src, void *dst, SceSize length, const void *key, SceSblDmac5HashTransformContext *ctx, SceBool mask_enable, SceUInt32 extra);</source>
//size - size of data in src
//iv = 0
//mask_enable = 1
//command_bit = 0 / 0x400 / 0x800 / 0xC00
int sceSblSsMgrHMACSHA1ForDriver(char *src, char *dst, int size, char *key, char *iv, int mask_enable, int command_bit);
</source>


=== sceSblSsMgrHMACSHA1WithKeygenForDriver ===
=== sceSblDmac5AesCmacForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x92E37656
| 0.990.000-3.740.011 || 0x1B14658D
|}
|}


Executes [[Dmac5|Dmac5]] command 0x23
Temp name was sceSblSsMgrAESCMACForDriver.


no usages found
Executes [[DMAC#DMAC5|Dmac5]] command 0x3B. Used in [[ScePfsMgr]].
 
<source lang="c">int sceSblDmac5AesCmacForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize keysize, SceSblDmac5HashTransformContext *ctx, SceBool mask_enable, SceUInt32 extra);</source>
 
=== sceSblDmac5AesCmacNPForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.990.000-3.740.011 || 0x83B058F5
|}
 
Temp name was sceSblSsMgrAESCMACWithKeygenForDriver.


key_size is always 0x100 bits
Executes [[DMAC#DMAC5|Dmac5]] command 0x3B. Used in [[ScePfsMgr]].


<source lang="c">
<source lang="c">int sceSblDmac5AesCmacNPForDriver(const void *src, void *dst, SceSize length, const void *key, SceSize keysize, SceSblDmac5HashTransformContext *ctx, SceUInt32 key_id, SceBool mask_enable, SceUInt32 extra);</source>
//size - size of data in src
//key - length is always 0x20
//iv = 0
//key_id - 0 - used with sceSblAuthMgrSetDmac5Key. uses slot_id range 0x0C-0x17 internally
//mask_enable = 1
//command_bit = 0 / 0x400 / 0x800 / 0xC00
int sceSblSsMgrHMACSHA1WithKeygenForDriver(char *src, char *dst, int size, char *key, char *iv, int key_id, int mask_enable, int command_bit);
</source>


=== sceSblSsMgrHMACSHA256ForDriver ===
=== sceSblDmac5AesCmacWithDmac5KeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x79F38554
| 0.931.010-0.990.000 || not present
|-
| 0.996.090-3.740.011 || 0xEA6ACB6D
|}
|}


Executes [[Dmac5|Dmac5]] command 0x33
Temp name was sceSblDmac5AesCmacWithKeyslotForDriver.
 
Executes [[DMAC#DMAC5|Dmac5]] command 0x3B.


no usages found
no usages found


<source lang="c">
<source lang="c">
//size - size of data in src
// size: size of data in src
//iv = 0
// keyring_id: ex: 0x1D
//mask_enable = 1
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
//command_bit = 0 / 0x400 / 0x800 / 0xC00
// iv: ex: 0
int sceSblSsMgrHMACSHA256ForDriver(char *src, char *dst, int size, char *key, char *iv, int mask_enable, int command_bit);
// mask_enable: ex: 1
// flags: ex: 0 / 0x400 / 0x800 / 0xC00
int sceSblDmac5AesCmacWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, void *iv, SceUInt32 mask_enable, SceUInt32 flags);
</source>
</source>


=== sceSblSsMgrAESCMACForDriver ===
=== sceSblSsMgrExecuteDmac5HashCommandForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x1B14658D
| 0.931.010-1.06 || not present
|-
| 1.500.151-3.740.011 || 0x9641374E
|}
|}


Executes [[Dmac5|Dmac5]] command 0x3B
Executes [[DMAC#DMAC5|Dmac5]] commands related to hash functions.
 
Used in [[SceNpDrm]].


used in [[ScePfsMgr]]
<source lang="c">int sceSblSsMgrExecuteDmac5HashCommandForDriver(const void *src, void *dst, SceSize size, void *iv, SceUInt32 mask_enable, SceUInt32 command, SceUInt32 flags);</source>


<source lang="c">
=== sceSblSsEncryptWithPortabilityForDriver ===
//size - size of data in src
{| class="wikitable"
//key - length is 0x10 / 0x18 / 0x20
|-
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
! Version !! NID
//iv = 0
|-
//mask_enable = 1
| 0.931.010-3.740.011 || 0x21EC51F6
//command_bit = 0 / 0x400 / 0x800 / 0xC00
|}
int sceSblSsMgrAESCMACForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int mask_enable, int command_bit);
 
</source>
derived from <code>_vshSblSsEncryptWithPortability</code>
 
Strangely it does not communicate with [[Secure_Modules_Functions#0x1000A|encdec_w_portability_sm command 0x1000A]]. That is because anyway this SM command is not implemented in release System Software.
 
<source lang="C">SceInt32 sceSblSsEncryptWithPortabilityForDriver(SceUInt32 key_type, void *iv, ScePortabilityData *plain_msg, ScePortabilityData *enc_msg);</source>
 
=== sceSblSsDecryptWithPortabilityForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-3.740.011 || 0x934DB6B5
|}
 
derived from <code>_vshSblSsDecryptWithPortability</code>
 
For example, decrypts or derives AES key that is used in msif to decrypt static sha224 table.
 
Executes [[Secure_Modules_Functions#0x2000A_-_DecryptWithPortability|encdec_w_portability_sm command 0x2000A]].
 
<source lang="C">int sceSblSsDecryptWithPortabilityForDriver(SceUInt32 key_type, void *iv, ScePortabilityData *enc_msg, ScePortabilityData *plain_msg);</source>


=== sceSblSsMgrAESCMACWithKeygenForDriver ===
=== sceSblSsGetNvsDataForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x83B058F5
| 0.931.010-3.740.011 || 0xFDD6D5DE
|}
|}


Executes [[Dmac5|Dmac5]] command 0x3B
derived from <code>_vshSblSsGetNvsData</code>


used in [[ScePfsMgr]]
Calls [[SceSyscon#sceSysconNvsReadDataForDriver|sceSysconNvsReadDataForDriver]].


<source lang="c">
<source lang="C">
//size - size of data in src
// type - 0-5
//key - length is 0x10 / 0x18 / 0x20
// pData - destination buffer
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// size - 2, 4, 8, 0x10, 0x20
//iv = 0
int sceSblSsGetNvsDataForDriver(SceSblSsNvsDataType type, void *pData, SceSize size);
//key_id - 0 - used with sceSblAuthMgrSetDmac5Key. uses slot_id range 0x0C-0x17 internally
//mask_enable = 1
//command_bit = 0 / 0x400 / 0x800 / 0xC00
int sceSblSsMgrAESCMACWithKeygenForDriver(char *src, char *dst, int size, char *key, int key_size, char *iv, int key_id, int mask_enable, int command_bit);
</source>
</source>


=== sceSblSsMgrAESCMACForDriver ===
=== sceSblSsSetNvsDataForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xEA6ACB6D
| 0.931.010-3.740.011 || 0x249ADB07
|}
|}


Executes [[Dmac5|Dmac5]] command 0x3B
derived from <code>_vshSblSsSetNvsData</code>


no usages found
Calls [[SceSyscon#sceSysconNvsWriteDataForDriver|sceSysconNvsWriteDataForDriver]].


<source lang="c">
<source lang="C">
//size - size of data in src
// type - 0-5
//slot_id - 0x1D, ?
// pData - source buffer
//key_size - 0x80 / 0xC0 / 0x100 (size in bits)
// size - 2, 4, 8, 0x10, 0x20
//iv = 0
int sceSblSsSetNvsDataForDriver(SceSblSsNvsDataType type, void *pData, SceSize size);
//mask_enable = 1
//command_bit = 0 / 0x400 / 0x800 / 0xC00
int sceSblSsMgrAESCMACForDriver(char *src, char *dst, int size, int slot_id, int key_size, char *iv, int mask_enable, int command_bit);
</source>
</source>


=== sceSblSsMgrExecuteDmac5HashCommandForDriver ===
=== sceSblAimgrGetVisibleIdForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x9641374E
| 0.990.000-3.740.011 || 0x04843835
|}
|}


Executes [[Dmac5|Dmac5]] commands related to hashe functions
Temp name was sceSblSsMgrGetVisibleIdForDriver, sceSblSsMgrGetFuseIdForDriver.
 
Derived from <code>_vshSblAimgrGetVisibleId</code>.


used by [[SceNpDrm]]
Obtains the console's Visible ID by executing [[Secure_Modules_Functions#0x3_-_GetVisibleId|aimgr_sm command 0x3]].


<source lang="c">
<source lang="C">int sceSblAimgrGetVisibleIdForDriver(SceVisibleId *pVisibleId);</source>
int sceSblSsMgrExecuteDmac5HashCommandForDriver(char *src, char *dst, int size, char *iv, int mask_enable, int command, int command_bit);
</source>


=== sceSblAimgrGetConsoleIdForDriver ===
=== sceSblAimgrGetConsoleIdForDriver ===
Line 752: Line 1,162:
! Version !! NID
! Version !! NID
|-
|-
| 0.990-3.60 || 0xFC6CDD68
| 0.990.000-3.740.011 || 0xFC6CDD68
|}
|}


Temp name was sceSblSsMgrGetConsoleIdForDriver.
Temp name was sceSblSsMgrGetConsoleIdForDriver.


This function obtains ConsoleId by executing aimgr_sm.self [[F00D_Commands#0x1|F00D command 0x1]]  
Obtains Console ID by executing [[Secure_Modules_Functions#0x1_-_GetConsoleId|aimgr_sm command 0x1]].


<source lang="c">
<source lang="c">int sceSblAimgrGetConsoleIdForDriver(SceConsoleId *pConsoleId);</source>
// console_id is of size 0x10
int sceSblAimgrGetConsoleIdForDriver(void* console_id);
</source>


=== sceSblAimgrGetOpenPsIdForDriver ===
=== sceSblAimgrGetOpenPsIdForDriver ===
Line 769: Line 1,176:
! Version !! NID
! Version !! NID
|-
|-
| 0.990-3.60 || 0xA5B5D269
| 0.990.000-3.740.011 || 0xA5B5D269
|}
|}


Line 776: Line 1,183:
This function returns information from a static buffer that is initialized on module_start.
This function returns information from a static buffer that is initialized on module_start.


Read OpenPsId from sysroot_buffer+0x70 using [[SceSysmem#sceSysrootGetSysrootBufferForKernel|sceSysrootGetSysrootBufferForKernel]].
OpenPsId comes from kbl_param->openpsid using [[SceSysmem#sceKernelSysrootGetKblParamForKernel]].
 
<source lang="C">int sceSblAimgrGetOpenPsIdForDriver(SceOpenPsId *pOpenPsId);</source>
 
=== sceSblAimgrGetPscodeForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.990.000-3.740.011 || 0xE0DC2587
|}
 
Temp name was sceSblSsMgrGetPscodeForDriver.
 
Derived from <code>_vshSblAimgrGetPscode</code>.
 
This function returns information from a static buffer that is initialized on module_start.
 
PsCode comes from kbl_param->pscode using [[SceSysmem#sceKernelSysrootGetKblParamForKernel]].
 
<source lang="C">int sceSblAimgrGetPscodeForDriver(ScePsCode *pPsCode);</source>
 
=== sceSblAimgrGetPscode2ForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.990.000-3.740.011 || 0x9A9676D0
|}
 
Temp name was sceSblSsMgrGetPscode2ForDriver.
 
Derived from <code>_vshSblAimgrGetPscode2</code>
 
Obtains the console's Ps Code by executing [[Secure_Modules_Functions#0x4_-_GetPsCode|aimgr_sm command 0x4]].
 
<source lang="C">int sceSblAimgrGetPscode2ForDriver(ScePsCode *pPsCode);</source>
 
=== sceSblSsCreatePassPhraseForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.740.011 || 0xB8B298FD
|}
 
derived from <code>_vshSblSsCreatePassPhrase</code>
 
Obtains the PassPhrase by executing [[Secure_Modules_Functions#0x5_-_CreatePassPhrase|aimgr_sm command 0x5]].
 
<source lang="C">int sceSblSsCreatePassPhraseForDriver(SceSblSsCreatePassPhraseParam *pParam, void *pPassPhrase);</source>
 
=== sceSblSsInfraAllocatePARangeVectorForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-3.740.011 || 0xE0B13BA7
|}
 
Used by [[SceSblUpdateMgr]].
 
<source lang="C">int sceSblSsInfraAllocatePARangeVectorForDriver(void *buf, SceSize size, SceUID blockid, SceKernelPAVector *pPAV);</source>
 
=== sceSblSsInfraFreePARangeVectorForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-3.740.011 || 0xC38D0CEA
|}


<source lang="C">
Used by [[SceSblUpdateMgr]].
typedef struct OpenPsId {
char open_psid[0x10];
} OpenPsId;


int sceSblAimgrGetOpenPsIdForDriver(OpenPsId *open_psid);
<source lang="C">int sceSblSsInfraFreePARangeVectorForDriver(SceUID blockid, SceKernelPAVector *pPAV);</source>
</source>


=== sceSblSsMgrEncryptWithPortabilityForDriver ===
=== sceSblSsMemsetForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x21ec51f6
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.740.011 || 0xCD98CC92
|}
|}


derived from <code>_vshSblSsEncryptWithPortability</code>
Used by [[SceSblPostSsMgr]].


strangely enough '''does not use''' communication with F00D through [[F00D_Commands#0x1000A|command 0x1000A]] from encdec_w_portability_sm.self
<source lang="C">void sceSblSsMemsetForDriver(char* dest, char value, SceSize size);</source>


<source lang="C">
=== sceSblRtcMgrSetCpRtc_1ForDriver ===
struct size_data_pair
{| class="wikitable"
{
|-
  int size;
! Version !! NID
  char data[0x20];
|-
};
| 0.931.010 || 0x2B259A82
|-
| 0.990.000-3.740.011 || not present
|}


int sceSblSsMgrEncryptWithPortabilityForDriver(int key_id, char *iv, size_data_pair *src, size_data_pair *dst);
=== sceSblRtcMgrSetCpRtc_2ForDriver ===
</source>
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-0.940 || 0xD8F6F110
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


=== sceSblSsMgrDecryptWithPortabilityForDriver ===
=== sceSblRtcMgrGetCpRtcPhysicalForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x934db6b5
| 0.931.010-0.940 || 0xC96622EC
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


derived from <code>_vshSblSsDecryptWithPortability</code>
=== sceSblRtcMgrGetCpRtcLogicalForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-0.940 || 0xAF56206D
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


Decrypts or derives AES key that is used in msif to decrypt static sha224 table.
=== sceSblLicMgrActivateDevkitForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || 0x37682AB1
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


Communication with F00D is done with [[F00D_Commands#0x2000A|command 0x2000A]] from encdec_w_portability_sm.self.
=== sceSblLicGetActivationKeyForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || not present
|-
| 0.940 || 0xED4878A4
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


<source lang="C">
=== sceSblLicMgrGetExpireDateForDriver ===
typedef struct ScePortabilityInputData // size of structure is 0x24
{| class="wikitable"
{
|-
  uint32_t enc_size; // max size is 0x20
! Version !! NID
  uint8_t enc_msg[0x20];
|-
} ScePortabilityInputData;
| 0.931.010-0.940 || 0xE840CD4E
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


typedef struct ScePortabilityOutputData // size of structure is 0x24
=== sceSblLicMgrGetLicenseStatusForDriver ===
{
{| class="wikitable"
  uint32_t plain_size; // max size is 0x20
|-
  uint8_t plain_msg[0x20];
! Version !! NID
} ScePortabilityOutputData;
|-
| 0.931.010-0.940 || 0x65CBED16
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


int sceSblSsMgrDecryptWithPortabilityForDriver(int key_type, char *iv, ScePortabilityInputData* enc, ScePortabilityOutputData* plain);
=== sceSblPmMgrGetProductModeFromNVSForDriver ===
</source>
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-0.940 || 0x196C7FB2
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


=== sceSblAimgrGetVisibleIdForDriver ===
=== sceSblPmMgrSetProductModeForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 0.990-3.60 || 0x04843835
| 0.931.010-0.940 || 0x33B706E1
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


Temp name was sceSblSsMgrGetVisibleIdForDriver.
=== sceSblPmMgrAuthEtoIForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010-0.940 || 0xB241EA2B
|-
| 0.990.000-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


In old firmwares this function was named <code>sceSblSsMgrGetFuseIdForDriver</code>.
=== sceSblSsCrepoInitializeForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0x80879AFB
|-
| 3.100.081-3.740.011 || not present
|}


Derived from <code>_vshSblAimgrGetVisibleId</code>.
Initializes Crash Report key ring. Returns 0 on success.


Executes F00D aimgr_sm.self [[F00D_Commands#0x3|command 0x3]].
Calls the _sceSblSsCrepoGetKeyRing subroutine to initialize the Crepo key ring. The Crepo key ring is then cached in memory from the result of decrypt with portability.


<source lang="C">
<source lang="C">
typedef struct VisibleId {
typedef struct SceCrepoKeyRing { // size is 0xC0
char visible_id[0x20];
    char magic[0x20]; // "CFK1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
} VisibleId;
    SceUInt8 unk_0x20[0x60];
    SceUInt8 unk_0x80[0x10];
    SceUInt8 unk_0x90[0x10];
    SceUInt8 unk_0xA0[0x10];
    SceUInt8 unk_0xB0[0x10];
} SceCrepoKeyRing;
</source>


int sceSblAimgrGetVisibleIdForDriver(VisibleId* visible_id);
<source lang="C">int sceSblSsCrepoInitializeForDriver(void);</source>
</source>


=== sceSblSsMgrGetNvsDataForDriver ===
=== sceSblSsCrepoGetKeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xfdd6d5de
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0x2D794404
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


derived from <code>_vshSblSsGetNvsData</code>
This is a guessed name.


uses syscon function to get the data
Uses Crepo Key Ring.


<source lang="C">
<source lang="C">
//index - max index is 5
// idx: must be in range 0-3
//input - max size is 0x20
// size: must be 0x20
int sceSblSsMgrGetNvsDataForDriver(int index, char *output, int size);
// pKey: pointer to a buffer of size 0x20 bytes
int sceSblSsCrepoGetKeyForDriver(SceUInt32 idx, SceSize size, void *pKey);
</source>
</source>


=== sceSblSsMgrSetNvsDataForDriver ===
=== sceSblSsCrepoGetKeyInfoByIdxForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x249adb07
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0x52BC448C
|-
| 3.100.081-3.740.011 || not present
|}
|}


derived from <code>_vshSblSsSetNvsData</code>
This is a guessed name.
 
Gets 0x10 bytes of data from the cached Crepo Key Ring.


uses syscon function to set the data
{| class="wikitable"
|-
! Index !! Offset !! Value
|-
| 0 || 0 || "CFK1\0\0\0\0\0\0\0\0\0\0\0\0" Crepo Key Ring header
|-
| 1 || 0x80 || To document with the result of decrypt with portability.
|-
| 2 || 0x90 || To document with the result of decrypt with portability.
|-
| 3 || 0xA0 || To document with the result of decrypt with portability.
|-
| 4 || 0xB0 || To document with the result of decrypt with portability.
|}


<source lang="C">
<source lang="C">
//index - max index is 5
// idx: must be in range 0-4
//input - max size is 0x20
// size: must be 0x10
int sceSblSsMgrSetNvsDataForDriver(int index, char *input, int size);
// pKey: pointer to a buffer of size 0x10 bytes
int sceSblSsCrepoGetKeyInfoByIdxForDriver(SceUInt32 idx, SceSize size, void *pInfo);
</source>
</source>


=== sceSblSsMgrGetPscodeForDriver ===
=== sceSblSsCrepoStopForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xE0DC2587
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0x2B3EF6DF
|-
| 3.100.081-3.740.011 || not present
|}
|}


derived from <code>_vshSblAimgrGetPscode</code>
This is a guessed name.


This function returns information from a static buffer that is initialized on module_start.
Clears Crash Report key ring. Always return 0.
 
<source lang="C">int sceSblSsCrepoStopForDriver(void);</source>


Read PsCode from sysroot_buffer+0xA0 using [[SceSysmem#sceSysrootGetSysrootBufferForKernel|sceSysrootGetSysrootBufferForKernel]].
=== sceSblSsDebugDecryptKeystoneForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0x9084AEDB
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


<source lang="C">
=== sceSblSsDebugEncryptKeystoneForDriver ===
typedef struct PsCode {
{| class="wikitable"
char magic[2]; // {0, 1}
|-
char target_id[2];
! Version !! NID
char model_revision[2];
|-
uint16_t chassis; // chassis = ConsoleId.chassis_check >> 2;
| 0.931.010 || not present
} PsCode;
|-
| 0.990.000-3.010.031 || 0xDFB5E945
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
 
=== sceSblSsEncryptSealedkeyForDriver ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0xB36051C4
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


int sceSblSsMgrGetPscodeForDriver(PsCode *pscode);
=== sceSblSsDecryptSealedkeyForDriver ===
</source>
{| class="wikitable"
|-
! Version !! NID
|-
| 0.931.010 || not present
|-
| 0.990.000-3.010.031 || 0xEC0D967A
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}


=== sceSblSsMgrGetPscode2ForDriver ===
=== sceSblSsCloudDataGetEncDecCryptHandleForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0x9a9676d0
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.010.031 || 0xB7C1A72B
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


Executes F00D aimgr_sm.self [[F00D_Commands#0x4_2|command 0x4]].
This is a guessed name.


derived from <code>_vshSblAimgrGetPscode2</code>
Gets the entire Cloud Data Key Ring.
 
Used in [[SceAppMgr#sceAppMgrCloudDataCreateHeaderForDriver]].


<source lang="C">
<source lang="C">
typedef struct PsCode {
typedef struct SceCloudDataKeyRing { // size is 0x2A0
char magic[2]; // {0, 1}
    char magic[8]; // "CloudBU\0"
char target_id[2];
    SceUInt32 unk_8; // ex: 0 or 1
char model_revision[2];
    SceUInt8 unk_0xC[0x294];
uint16_t chassis; // chassis = ConsoleId.chassis_check >> 2;
} SceCloudDataKeyRing;
} PsCode;


int sceSblSsMgrGetPscode2ForDriver(uint64_t* result);
typedef struct SceCloudDataSignCryptHandle { // size is 0x2A0
    SceCloudDataKeyRing keyring;
} SceCloudDataSignCryptHandle;
 
int sceSblSsCloudDataGetEncDecCryptHandleForDriver(SceCloudDataSignCryptHandle *pHandle);
</source>
</source>


=== sceSblSsMgrCreatePassPhraseForDriver ===
=== sceSblSsCloudDataGetSignCryptHandleForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xb8b298fd
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.010.031 || 0x7970D8B4
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


executes F00D aimgr_sm.self [[F00D_Commands#0x5_2|command 0x5]]
This is a guessed name.


derived from <code>_vshSblSsCreatePassPhrase</code>
Used in [[SceAppMgr#sceAppMgrCloudDataVerifyHeaderForDriver]] and [[SceAppMgr#sceAppMgrLocalBackupVerifyOfflineHeader]].


<source lang="C">
<source lang="C">
//input is of size 0x18
typedef struct SceCloudDataSignCryptHandleBlock { // size is 0x104
int sceSblSsMgrCreatePassPhraseForDriver(char *input, char *output);
    SceUInt8 data[0x100];
    SceSize size; // ex: 4 for exponent, 0x100 for modulus. Normal range is 0-0x100.
} SceCloudDataSignCryptHandleBlock;
 
typedef struct SceCloudDataSignCryptHandle { // size is 0x208
    SceCloudDataSignCryptHandleBlock rsa_modulus;
    SceCloudDataSignCryptHandleBlock rsa_exponent;
} SceCloudDataSignCryptHandle;
 
// mode: must be 1
// idx: must be 1
int sceSblSsCloudDataGetSignCryptHandleForDriver(SceUInt32 mode, SceUInt32 idx, SceCloudDataSignCryptHandle *pHandle);
</source>
</source>


=== unk_e0b13ba7 ===
=== sceSblSsCloudDataStopForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xe0b13ba7
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.010.031 || 0x51ACBC5F
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


Used by SceSblUpdateMgr - does some initialization
This is a guessed name.
 
Clears Cloud Data Key Ring.
 
<source lang="C">int sceSblSsCloudDataStopForDriver(void);</source>


=== unk_c38d0cea ===
=== sceSblSsGenerateAppKeyForDriver ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xc38d0cea
| 0.931.010-1.81 || not present
|-
| 2.000.081-3.010.031 || 0x9610A871
|-
| 3.100.081-3.740.011 || not present. Moved to [[SceSblPostSsMgr]].
|}
|}


Used by SceSblUpdateMgr - does some cleanup
This name was derived from [[SceVshBridge#_vshSblSsGenerateAppKey]].
 
<source lang="C">int sceSblSsGenerateAppKeyForDriver(void *in, void *out);</source>
 
== SceSblSsMgr ==


=== sceSblSsMgrMemsetForDriver ===
This library exists on FW 1.69 but does not exist on FW 3.60.
 
=== sceSblSsInfraAllocatePARangeVector ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 3.60 || 0xcd98cc92
| 0.931-1.69 || 0x8C2822A9
|}
|}


Used by SceSblPostSsMgr
<source lang="C">int sceSblSsInfraAllocatePARangeVector(void *buf, SceSize size, SceUID blockid, SceKernelPAVector *pPAV);</source>


<source lang="C">void sceSblSsMgrMemsetForDriver(char* dest, char value, int size);</source>
=== sceSblSsInfraFreePARangeVector ===
 
{| class="wikitable"
== SceSblSsMgr ==
|-
! Version !! NID
|-
| 0.931-1.69 || 0xFAD42134
|}


This library exists on 1.69 but doesn't exist on 3.60.
<source lang="C">int sceSblSsInfraFreePARangeVector(SceUID blockid, SceKernelPAVector *pPAV);</source>


== SceSblQafMgr ==
== SceSblQafMgr ==
<source lang="C">
typedef struct SceQafToken
{
  char data[0x180];
};
</source>


=== sceSblQafMgrGetQafToken ===
=== sceSblQafMgrGetQafToken ===
Line 1,013: Line 1,672:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xB6BAE81D
| 1.69-3.60 || 0xB6BAE81D
|-
| 3.60 || 0xB6BAE81D
|}
|}


On 3.60 returns 0x80010058.
On 3.60 returns 0x80010058 (SCE_ERROR_ERRNO_ENOSYS).


<source lang="C">int sceSblQafMgrGetQafToken(SceQafToken *qaf_token);</source>
<source lang="C">int sceSblQafMgrGetQafToken(SceQafToken *qaf_token);</source>
Line 1,037: Line 1,694:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0x56A16392
| 1.69-3.60 || 0x56A16392
|-
| 3.60 || 0x56A16392
|}
|}


On 3.60 returns 0x80010058.
On 3.60 returns 0x80010058 (SCE_ERROR_ERRNO_ENOSYS).


<source lang="C">int sceSblQafManagerSetQafTokenForUser(SceQafToken qaf_token);</source>
<source lang="C">int sceSblQafManagerSetQafTokenForUser(SceQafToken qaf_token);</source>
Line 1,061: Line 1,716:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xD542583F
| 0.940-3.60 || 0xD542583F
|-
| 3.60 || 0xD542583F
|}
|}


On 3.60 returns 0x80010058.
On 3.60 returns 0x80010058 (SCE_ERROR_ERRNO_ENOSYS).


<source lang="C">int sceSblQafManagerDeleteQafTokenForUser(void);</source>
<source lang="C">int sceSblQafManagerDeleteQafTokenForUser(void);</source>
Line 1,079: Line 1,732:


<source lang="C">
<source lang="C">
   int v0; // r5
   int ret;
   int v1; // r6
   int ret2;
   int v2; // r5
   int ret3;
   signed int result; // r0
   signed int result;
   char v4; // [sp+7h] [bp-199h]
   char flag;
   char buffer[128]; // [sp+8h] [bp-198h]
   char data[0x80];
   char v6; // [sp+88h] [bp-118h]
   char sig[0x100];
  int v7; // [sp+18Ch] [bp-14h]


  v7 = MEMORY[0];
   memset(data, (char)0xFF, 0x180);
   memset(buffer, 0xFF, 0x180u);
   SceKernelSuspendForDriver_4DF40893_0(0);
   SceKernelSuspendForDriver_4DF40893_0(0);
   v0 = sceSblSsMgrSetSysconDataForKernel(0x400, buffer, 0x80);
   ret = sceSblNvsWriteDataForKernel(0x400, data, 0x80);
   if ( v0 )
   if ( ret ) {
  {
     SceKernelSuspendForDriver_4DF40893(0);
     SceKernelSuspendForDriver_4DF40893(0);
     result = v0;
     result = ret;
   }
   } else {
  else
     ret2 = sceSblNvsWriteDataForKernel(0x5A0, sig, 0x100);
  {
     if ( ret2 ) {
     v1 = sceSblSsMgrSetSysconDataForKernel(0x5A0, &v6, 0x100);
     if ( v1 )
    {
       SceKernelSuspendForDriver_4DF40893(0);
       SceKernelSuspendForDriver_4DF40893(0);
       result = v1;
       result = ret2;
     }
     } else {
    else
       flag = 1;
    {
       ret3 = sceSblNvsWriteDataForKernel(0x480, &flag, 1);
       v4 = 1;
       v2 = sceSblSsMgrSetSysconDataForKernel(0x480, &v4, 1);
       SceKernelSuspendForDriver_4DF40893(0);
       SceKernelSuspendForDriver_4DF40893(0);
       result = v2;
       result = ret3;
     }
     }
   }
   }
Line 1,123: Line 1,768:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0x0F7EA8C2
| 0.940-3.60 || 0x0F7EA8C2
|-
| 3.60 || 0x0F7EA8C2
|}
|}


Line 1,142: Line 1,785:
<source lang="C">
<source lang="C">
memset(buf, 0, 0x180);
memset(buf, 0, 0x180);
sceSblSsMgrGetSysconDataForKernel(0x480, buf, 1);
sceSblNvsReadDataForKernel(0x480, buf, 1);
sceSblSsMgrGetSysconDataForKernel(0x400, buf, 0x80);
sceSblNvsReadDataForKernel(0x400, buf, 0x80);
memcpy(buffer, buf, 0x18);
memcpy(buffer, buf, 0x18);
sceSblSsMgrGetSysconDataForKernel(0x5A0, buf, 0x100);
sceSblNvsReadDataForKernel(0x5A0, buf, 0x100);
// if all functions returned success
// if all functions returned success
sceSblQafManagerGetQafNameForKernel(buf2, len);
sceSblQafManagerGetQafNameForKernel(buf2, len);
Line 1,161: Line 1,804:
|}
|}


return sysroot_buffer->qa_flags[0xF] & 1;
return pKblParam->qa_flags[0xF] & 1;


<source lang="C">int sceSblQafMgrIsAllowMinimumDebugMenuDisplay(void);</source>
<source lang="C">int sceSblQafMgrIsAllowMinimumDebugMenuDisplay(void);</source>
Line 1,170: Line 1,813:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xC456212D
| 1.69-3.60 || 0xC456212D
|-
| 3.60 || 0xC456212D
|}
|}


return (sysroot_buffer->qa_flags[6] >> 1) & 1;
return (pKblParam->qa_flags[6] >> 1) & 1;


<source lang="C">int sceSblQafMgrIsAllowLimitedDebugMenuDisplay(void);</source>
<source lang="C">int sceSblQafMgrIsAllowLimitedDebugMenuDisplay(void);</source>
Line 1,184: Line 1,825:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0x66843305
| 1.69-3.60 || 0x66843305
|-
| 3.60 || 0x66843305
|}
|}


return (sysroot_buffer->qa_flags[0xC] >> 1) & 1;
return (pKblParam->qa_flags[0xC] >> 1) & 1;


<source lang="C">int sceSblQafMgrIsAllowAllDebugMenuDisplay(void);</source>
<source lang="C">int sceSblQafMgrIsAllowAllDebugMenuDisplay(void);</source>
Line 1,198: Line 1,837:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0x11D30766
| 0.940-3.60 || 0x11D30766
|-
| 3.60 || 0x11D30766
|}
|}


return sysroot_buffer->qa_flags[0xD] & 1;
return pKblParam->qa_flags[0xD] & 1;


<source lang="C">int sceSblQafManagerIsAllowKernelDebugForUser(void);</source>
<source lang="C">int sceSblQafManagerIsAllowKernelDebugForUser(void);</source>
Line 1,212: Line 1,849:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0x63F29BA0
| 1.69-3.60 || 0x63F29BA0
|-
| 3.60 || 0x63F29BA0
|}
|}


return (sysroot_buffer->qa_flags[0xF] >> 1) & 1;
return (pKblParam->qa_flags[0xF] >> 1) & 1;


<source lang="C">int sceSblQafMgrIsAllowForceUpdate(void);</source>
<source lang="C">int sceSblQafMgrIsAllowForceUpdate(void);</source>
Line 1,226: Line 1,861:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xA9EBCBAC
| 1.69-3.60 || 0xA9EBCBAC
|-
| 3.60 || 0xA9EBCBAC
|}
|}


<source lang="C">
<source lang="C">
if (sysroot_buffer->qa_flags[0xF] << 31)
if (pKblParam->qa_flags[0xF] << 31)
   return 1;
   return 1;
else
else
Line 1,248: Line 1,881:
|}
|}


return (sysroot_buffer->qa_flags[6] >> 1) & 1;
return (pKblParam->qa_flags[6] >> 1) & 1;


<source lang="C">int sceSblQafMgrIsAllowNpFullTest(void);</source>
<source lang="C">int sceSblQafMgrIsAllowNpFullTest(void);</source>
Line 1,257: Line 1,890:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xB5621615
| 1.69-3.60 || 0xB5621615
|-
| 3.60 || 0xB5621615
|}
|}


return sysroot_buffer->qa_flags[0xF] & 1;
return pKblParam->qa_flags[0xF] & 1;


<source lang="C">int sceSblQafMgrIsAllowNonQAPup(void);</source>
<source lang="C">int sceSblQafMgrIsAllowNonQAPup(void);</source>
Line 1,271: Line 1,902:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xD22A8731
| 1.69-3.60 || 0xD22A8731
|-
| 3.60 || 0xD22A8731
|}
|}


return (sysroot_buffer->qa_flags[6] >> 1) & 1;
return (pKblParam->qa_flags[6] >> 1) & 1;


<source lang="C">int sceSblQafMgrIsAllowScreenShotAlways(void);</source>
<source lang="C">int sceSblQafMgrIsAllowScreenShotAlways(void);</source>
Line 1,285: Line 1,914:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0xF45AA706
| 0.940-3.60 || 0xF45AA706
|-
| 3.60 || 0xF45AA706
|}
|}


return (sysroot_buffer->qa_flags[0xD] >> 1) & 1;
return (pKblParam->qa_flags[0xD] >> 1) & 1;


<source lang="C">int sceSblQafMgrIsAllowRemoteSysmoduleLoad(void);</source>
<source lang="C">int sceSblQafMgrIsAllowRemoteSysmoduleLoad(void);</source>
Line 1,296: Line 1,923:
== SceSblRng ==
== SceSblRng ==


=== sceSblSsMgrGetRandomData ===
=== sceSblRngGenuineRandomNumber ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 0.990 || 0xD1189305
| 0.940-0.990 || 0xD1189305
|-
| 3.60 || not present
|}
|}


Calls sceSblSsMgrGetRandomDataForDriver.
Temp name was sceSblSsMgrGetRandomData.
 
Calls [[#sceSblRngGenuineRandomNumberForDriver]].


=== ?_sceKernelGetRandomNumber_OLD? ===
=== sceSblRngGenuineRandomNumber2 ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 0.990 || 0xD8BC42B8
| 0.940-0.990 || 0xBA5242FE
|-
| 3.60 || not present
|}
 
=== sceSblRngPseudoRandomNumber ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.940-0.990 || 0xD8BC42B8
|-
| 3.60 || not present
|}
 
Calls [[#sceSblRngPseudoRandomNumberForDriver]].
 
=== sceSblRngPseudoRandomNumber2 ===
{| class="wikitable"
|-
! Version !! NID
|-
| 0.940-0.990 || 0xD84424230
|-
| 3.60 || not present
|}
|}


Line 1,318: Line 1,973:
|-
|-
! Version !! NID
! Version !! NID
|-
| 0.940-0.990 || not present
|-
|-
| 1.69-3.60 || 0xC37E818C
| 1.69-3.60 || 0xC37E818C
|}
|}


<source lang="C">int _sceKernelGetRandomNumber(int *out, int a2, char a3[8]);</source>
Calls [[#sceSblRngPseudoRandomNumberForDriver]].
 
<source lang="C">
// length: length in bytes of the random number to generate. The actual length written to pDst is in pParam. Must be <= 0x40.
int _sceKernelGetRandomNumber(void *pDst, SceSize length, SceKernelGetRandomNumberParam *pParam);</source>


== SceSblDmac5Mgr ==
== SceSblDmac5Mgr ==


=== sceSblDmac5HashTransform ===
=== sceSblDmac5EncDec ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 1.69-3.60 || 0x09EBC6EF
| 0.931 || not present
|-
| 0.990-3.60 || 0xD0B1F759
|}
|}


This function can execute the following dmac5 commands:
<source lang="C">int sceSblDmac5EncDec(SceSblDmac5EncDecParam *pParam, SceUInt32 command);</source>
* 0x3B: CMAC-AES (length 0x10)
* 0x03: SHA1 (length 0x14)
* 0x23: HMAC-SHA1 (length 0x14)
* 0x13: SHA256 (length 0x20)
* 0x33: HMAC-SHA256 (length 0x20)


<source lang="C">
=== sceSblDmac5EncDecNP ===
typedef struct hash_trans_opt_t //size 0x18
{| class="wikitable"
{
|-
  char* src;
! Version !! NID
  char* dst;
|-
  uint32_t size;
| 0.931 || not present
  uint32_t unk_C; // = 0
|-
 
| 0.940-0.990 || 0x30702CC7
  uint32_t unk_10; // = 0
|-
  char* iv;
| 3.60 || not present
}hash_trans_opt_t;
|}
 
// flags:
// 0x000
// 0x400
// 0x800
// 0xC00


int sceSblDmac5HashTransform(hash_trans_opt_t* ctx, int command, int flags);
<source lang="C">int sceSblDmac5EncDecNP(void *args, SceUInt32 key_id, SceUInt32 command);</source>
</source>


=== sceSblDmac5EncDecKeyGen ===
=== sceSblDmac5EncDecKeyGen ===
Line 1,370: Line 2,021:
|}
|}


This function is also called <code>sceSblDmac5AesCbcDecKeyGen</code> or <code>sceSblDmac5AesCbcEncKeyGen</code> in <code>SceGameDataPlugin</code>
official:
 
AesCbcEncrypt command to <code>sceSblDmac5AesCbcEncKeyGen</code> in [[SceGameDataPlugin]].
 
AesCbcDecrypt command to <code>sceSblDmac5AesCbcDecKeyGen</code> in [[SceGameDataPlugin]].
 
 
theory:


<source lang="C">
AesCtrEncrypt command to <code>sceSblDmac5AesCtrEncKeyGen</code>.
typedef struct keygen_ctx //size is 0x18
{
  char *src;
  char *dst;
  int size;
  char* key;
 
  uint32_t key_size;  // (int bits)
  char* out; //hash ?
}keygen_ctx;


//command - 0xA (dmac5 command AES-192-CBC decrypt)
<source lang="C">int sceSblDmac5EncDecKeyGen(SceSblDmac5EncDecParam *pParam, SceUInt32 key_id, SceUInt32 command);</source>
//command - 0x9 (dmac5 command AES-192-CBC encrypt)
int sceSblDmac5EncDecKeyGen(keygen_ctx* ctx, int key_id, int command);
</source>


=== sceSblDmac5EncDec ===
=== sceSblDmac5HashTransform ===
{| class="wikitable"
{| class="wikitable"
|-
|-
! Version !! NID
! Version !! NID
|-
|-
| 1.69-3.60 || 0xD0B1F759
| 1.69-3.60 || 0x09EBC6EF
|}
|}


<source lang="C">int sceSblDmac5EncDec(void *args, int command);</source>
Support to Sha1/Sha224/Sha256 only.
 
<source lang="C">int sceSblDmac5HashTransform(SceSblDmac5HashTransformParam *pParam, SceUInt32 command, SceUInt32 extra);</source>


=== sceSblDmac5HmacKeyGen ===
=== sceSblDmac5HmacKeyGen ===
Line 1,407: Line 2,054:
|}
|}


This function called <code>sceSblDmac5HmacKeyGen</code> in SceSysLibTrace but is also called <code>sceSblDmac5Sha256HmacKeyGen</code> in <code>SceGameDataPlugin</code>
This function is named <code>sceSblDmac5HmacKeyGen</code> in [[SceSysLibTrace]].
 
HmacSha256 command to <code>sceSblDmac5Sha256HmacKeyGen</code> in [[SceGameDataPlugin]] (official name).
 
Theory:
 
HmacSha1 command to <code>sceSblDmac5Sha1HmacKeyGen</code>.
 
HmacSha224 command to <code>sceSblDmac5Sha224HmacKeyGen</code>.


<source lang="C">
<source lang="C">int sceSblDmac5HmacKeyGen(SceSblDmac5HashTransformParam *pParam, SceUInt32 key_id, SceUInt32 command, SceUInt32 extra);</source>
// data is of size 0x18 (24 - 192 bits ?)
// unk1 - 0x20001
// command - 0x33 (dmac5 HMAC-SHA256 command)
// flags - 0x400, 0x800, 0xC00
int sceSblDmac5HmacKeyGen(char* data, int unk1, int command, int flags);
</source>


== SceSblAimgr ==
== SceSblAimgr ==
Line 1,424: Line 2,073:
! Version !! NID
! Version !! NID
|-
|-
| 1.69 || 0x6E283E2E
| 1.69-3.60 || 0x6E283E2E
|-
| 3.60 || 0x6E283E2E
|}
|}


<source lang="C">int _sceKernelGetOpenPsId(char open_psid[0x10]);</source>
<source lang="C">int _sceKernelGetOpenPsId(SceOpenPsId *pOpenPsId);</source>
 


[[Category:ARM]]
[[Category:Kernel]]
[[Category:Modules]]
[[Category:Modules]]
[[Category:Kernel]]
[[Category:Library]]

Latest revision as of 18:07, 19 May 2024

Module

Version World Privilege
1.69-3.60 Non-secure Kernel

Libraries

Known NIDs

Version Name World Visibility NID
1.69-3.60 SceSblSsMgrForKernel Non-secure Kernel 0x74580D9F
1.69-3.60 SceSblSsMgrForDriver Non-secure Kernel 0x61E9428D
1.69 SceSblSsMgr Non-secure Kernel 0xEC86E4B0
1.69-3.60 SceSblQafMgr Non-secure User 0x756B7E89
1.69-3.60 SceSblRng Non-secure User 0x1843F124
1.69-3.60 SceSblDmac5Mgr Non-secure User 0x437366A2
1.69-3.60 SceSblAimgr Non-secure User 0xD473F968

TODO

  • study command flags
  • check if mask_enable is a SceBool and if so change type.
  • check which keyrings are allowed per function, and if key_id are per keyring index.
  • create enum for keyrings indexes
  • check IV usage

Types

SceKitActivationData

Offset Size Description
0x00 0x4 Magic "act\0"
0x04 0x4 Format version
0x08 0x4 Issue number (increment each activation, prevent rollback)
0x0C 0x4 Start validity time unix timestamp
0x10 0x4 End validity time unix timestamp
0x14 0x10 Activation key
0x24 0x1C Unused
0x40 0x40 Encrypted Token (First 0x30 bytes of SceKitActivationData then 0x10 byte CMAC) 
typedef struct SceConsoleId {
	uint16_t unk; // {0, 0}
	uint16_t company_code; // {0, 1}
	uint16_t product_code;
	uint16_t product_sub_code;
	uint8_t chassis_check;
	uint8_t unknown[7];
} SceConsoleId;

typedef struct SceOpenPsId {
	uint8_t open_psid[0x10];
} SceOpenPsId;

typedef struct ScePsCode {
	uint16_t company_code; // {0, 1}
	uint16_t product_code;
	uint16_t product_sub_code;
	uint16_t factory_code; // = chassis_check >> 2;
} ScePsCode;

typedef struct Sce SceVisibleId {
	char visible_id[0x20];
} SceVisibleId;

typedef enum SceSblSsNvsDataType {
	SCE_SBL_SS_NVS_DATA_SYSTEM_LANGUAGE  = 0, // NVS offset 0x4A4, size 4, present on FW 0.990.000-3.740.011
	SCE_SBL_SS_NVS_DATA_WLAN_BT          = 1, // NVS offset 0x500, size 1, present on FW 0.990.000-3.740.011
	SCE_SBL_SS_NVS_DATA_UNK_482          = 2, // NVS offset 0x482, size 1, present on FW 0.990.000-3.740.011
	SCE_SBL_SS_NVS_DATA_KIBAN_ID         = 3, // NVS offset 0x4E0, size 0x20, present on FW 0.990.000-3.740.011
	SCE_SBL_SS_NVS_DATA_SAFEMODE_FLAGS   = 4, // NVS offset 0x483, size 1 - not present on FW 0.931.010, present on FW 0.990.000-3.740.011
	SCE_SBL_SS_NVS_DATA_USE_INT_STOR     = 5  // NVS offset 0x486, size 1 - not present on FW 0.931.010-0.990.000, present on FW 3.600.011-3.740.011
} SceSblSsNvsDataType;

typedef struct SceKitActivationDataToken { // size is 0x40 bytes
  char magic[4]; // "act\n"
  uint32_t issue_no;
  uint32_t format_version;
  uint32_t start_date;
  uint32_t end_date;
  char open_psid[0x10];
  char padding[0xC];
  char cmac[0x10];
} SceKitActivationDataToken;

// This is what embeds the tm0:activation/act.dat file
typedef struct SceKitActivationData { // size is 0x80 bytes
  char magic[4]; // "act\n"
  uint32_t issue_no;
  uint32_t format_version;
  uint32_t start_date;
  uint32_t end_date;
  char open_psid[0x10];
  char padding[0x1C];
  char encrypted_token[0x40];
} SceKitActivationData;

typedef struct SceQafToken { // size is 0x80 bytes
  char magic[4];
  SceUInt32 qaf_version;
  char qaf_name[0x18]; // "NO_FLAGS" by default
  char console_id[0x10];
  char qa_flags[0x10];
  char reserved[0x30];
  char cmac[0x10]; // AES256CMAC of SceQafToken with zeroed CMAC field
} SceQafToken;

typedef struct SceQafTokenEnc { // size is 0x80 bytes
  char magic[4];
  SceUInt32 qaf_version;
  char qaf_name[0x18]; // "NO_FLAGS" by default
  char enc_data[0x60];
} SceQafTokenEnc;

typedef struct SceQafTokenEx {
  SceQafTokenEnc token_enc[0x80];
  char sig[0x100]; // Not present on FW 0.990. Present on FW 3.60.
} SceQafTokenEx;

typedef struct ScePortabilityData { // size is 0x24
   SceSize msg_size; // max size is 0x20
   uint8_t msg[0x20];
} ScePortabilityData;

// Used by run_encdec_cmd, itself called by sceSblDmac5EncDec for example.
typedef struct dmac_op_ctx {
	dmac_op_ctx_heap *ctx_heap_addr;
	uint keyring_key_count; // if keyring_key_count < 0x100, keyring_key_count is used as DKey
	uint unk_8;
	SceUID dmac_opid; // used with sceKernelDmaOpFreeForDriver
	char iv[0x28]; // iv_size can be 0, 8, 0x10 or 0x28 depending on cmd itself depending on key_length
} dmac_op_ctx;

typedef struct dmac_op_ctx_heap { // size is 0x40 on FW 0.990
	uint cmd;
	uint unk_4; // 0x100
	uint unk_8; // 0 if unk_flag = 0, 0x3ffff else
	uint dmac5_op;
	char reserved[0x30];
} dmac_op_ctx_heap;

typedef struct SceSblSsCreatePassPhraseParam { // size is 0x18
  SceUInt32 reserved; // ex: 0
  SceSize size; // Size of this structure
  char accountIdText[0x10]; // Taken from registry "/CONFIG/NP/account_id" and converted to ASCII
} SceSblSsCreatePassPhraseParam;

typedef struct SceKernelGetRandomNumberParam {
    SceUInt32 dstSize; // In bytes. Must be <= 0x40.
    SceUInt32 reserved;
} SceKernelGetRandomNumberParam;

typedef struct SceSblDmac5EncDecParam { // size is 0x18-bytes
	const void *src;
	void *dst;
	SceSize size;
	const void *key;
	SceSize keysize;
	void *iv;
} SceSblDmac5EncDecParam;

typedef struct SceSblDmac5HashTransformContext { // size is 0x28-bytes
	SceUInt32 state[8];
	SceUInt64 length;
} SceSblDmac5HashTransformContext;

typedef struct SceSblDmac5HashTransformParam { // size is 0x18-bytes
	const void *src; // must be aligned on 0x40-byte
	void *dst;
	SceSize size;
	const void *key;
	SceSize keysize;
	SceSblDmac5HashTransformContext *ctx; // Or another context of size 0x10-bytes
} SceSblDmac5HashTransformParam;

SceSblSsMgrForKernel

sceSblNvsReadDataForKernel

Version NID
0.990-3.60 0xC2EC8F5A

Temp name was sceSblSsMgrNvsReadDataForKernel.

Calls SceSyscon#sceSysconNvsReadDataForDriver.

Trying to read at offset 0-0x3FF: error 0x8025023C (cannot read SNVS using this function, need to use SNVS protocol).

Trying to read at offset > 0xB5F: error 0x80250001 (out of range).

Trying to read at ((offset & 7) != 0): error 0x80250001 (non aligned). 

int sceSblNvsReadDataForKernel(int offset, char *buffer, int size);

sceSblNvsWriteDataForKernel

Version NID
0.990-3.60 0xE29E161C

Temp name was sceSblSsMgrNvsWriteDataForKernel.

Calls sceSysconNvsWriteDataForDriver. 

int sceSblNvsWriteDataForKernel(int offset, char *buffer, int size);

sceSblPmMgrGetProductModeForKernel

Version NID
0.990-3.60 0x516ECC08

Temp name was scePmMgrGetProductModeForKernel.

From FWs 0.990 to 3.60, it is simply a redirect to SceSysmem#scePmMgrGetProductModeForDriver. 

int sceSblPmMgrGetProductModeForKernel(char* result);

sceSblQafManagerGetQafTokenForKernel

Version NID
0.931-0.990 0x281FD75A
3.60 not present 
int sceSblQafManagerGetQafTokenForKernel(SceQafToken *pToken);

sceSblQafManagerSetQafTokenForKernel

Version NID
0.931-0.990 0x8E9447A1
3.60 not present 
int sceSblQafManagerSetQafTokenForKernel(SceQafToken *pToken);

sceSblQafManagerGetQafOnNVSForKernel

Version NID
0.931 not present
0.990-1.03 0x228A6653
3.60 not present 
SceQafToken *temp_token = pToken;
sceSblNvsReadDataForKernel(0x480, flag, 1);
	if (!flag) {
		nvs_read(0x400, temp_token, 0x80);
		ret = exec_qaf_sm(temp_token, 0);
	}
return ret;
int sceSblQafManagerGetQafOnNVSForKernel(SceQafToken *pToken)

sceSblQafManagerClearQafTokenForKernel

Version NID
0.931-0.990 0xD45155C6
3.60 not present 
int sceSblQafManagerClearQafTokenForKernel(void);
  uint32_t ret;
  char qaf_token[0x80];

  memset(&qaf_token, 0xFF, 0x80);
  SceKernelSuspendForDriver_4DF40893(0);
  ret = sceSblNvsWriteDataForKernel(0x400, &qaf_token, 0x80);
  if (!ret) // if qaf_token successfully written, set a flag at 0x480
    ret = sceSblNvsWriteDataForKernel(0x480, 1, 1);
  SceKernelSuspendForDriver_2BB92967(0);
  return ret;

sceSblQafManagerGetQAFlagsForKernel

Version NID
0.931-3.60 0x83D254FF 
int sceSblQafManagerGetQAFlagsForKernel(char buffer[0x10]);

sceSblQafManagerGetQafNameForKernel

Version NID
0.931-3.60 0xE2DD0378 
if ( byte_81008725 & 2 ) {
    char workaround_string = "qaf_workaround";
    memcpy(buffer, workaround_string, max_len);
} else {
	sceSblNvsReadDataForKernel(0x480, flag, 1);
	if (flag) {
		sceSblNvsReadDataForKernel(0x400, buf, 0x80);
		memcpy(buffer, buf, 0x18);
	}
}
int sceSblQafManagerGetQafNameForKernel(char *buffer, unsigned int max_len);

SceSblSsMgrForDriver

Cryptographic functions in this module typically have 3 variations:

  1. Use key - meaning that the key that you provide is used directly for encryption/decryption.
  2. Use keyring_id - meaning that you have to use sceSblAuthMgrSetDmac5KeyForKernel function to set the key into a specific keyring. In this case you select a key from cmep by key_id. It will be encrypted by cmep and placed into the keyring selected by keyring_id.
  3. Use key_id - meaning that the call to sceSblAuthMgrSetDmac5KeyForKernel will happen internally. In this case the key from cmep is also selected by key_id and encrypted by cmep. It is then placed into one of the available keyrings. Default keyring range is 0xC-0x17.

sceSblRngPseudoRandomNumberForDriver

Version NID
0.990.000-3.740.011 0x4F9BFBE5

Temp name was sceSblSsMgrGetRandomNumberForDriver.

Gets the pseudo-random number calculated within SceSblSsMgr.

The base seed is (DMAC5 RNG + HMAC-SHA1) * 2. System Time is also used for one of them. 

int sceSblRngPseudoRandomNumberForDriver(void *result, SceSize size);

sceSblRngGenuineRandomNumberForDriver

Version NID
0.990.000-3.740.011 0xAC57F4F0

Temp name was sceSblSsMgrGetRandomDataForDriver.

Generates random data of length 0x40 bytes by doing: sceSblDmac5RndForDriver(dest, 0x40, 1);

Used in SceKrm, SceSblGcAuthMgr. 

int sceSblRngGenuineRandomNumberForDriver(char* dest);

sceSblDmac5SetKeyLocalForDriver

Version NID
0.931.010 0x18A1BF77
0.990.000-3.740.011 not present 
int sceSblDmac5SetKeyLocalForDriver(uint *pCtx, SceSize alignment, SceSize size, SceUInt32 flag, void *pKey);

sceSblDmac5DeleteKeyLocalForDriver

Version NID
0.931.010 0x9DC22C1A
0.990.000-3.740.011 not present 
int sceSblDmac5DeleteKeyLocalForDriver(uint *pCtx);

SceSblSsMgrForDriver_8C31A8FD

Version NID
0.931.010 0x8C31A8FD
0.990.000-3.740.011 not present

A guessed name is sceSblDmac5...Op...ForDriver.

Uses _sceSblDmac5AllocOp.

SceSblSsMgrForDriver_CAB891D3

Version NID
0.931.010 0xCAB891D3
0.990.000-3.740.011 not present

A guessed name is sceSblDmac5...Op...ForDriver.

Uses _sceSblDmac5AllocOp.

sceSblDmac5AllocOpForDriver

Version NID
0.931.010 0xE293FC8E
0.990.000-3.740.011 not present

sceSblDmac5FreeOpForDriver

Version NID
0.931.010 0xCAEF7541
0.990.000-3.740.011 not present

_sceSblDmac5FreeOpForDriver

Version NID
0.931.010 0xEB462E80
0.990.000-3.740.011 not present

sceSblDmac5DirectCryptForDriver

Version NID
0.931.010 0x850F81AD
0.990.000-3.740.011 not present

_sceSblDmac5DirectCryptForDriver

Version NID
0.931.010 0x29BE9D99
0.990.000-3.740.011 not present

This is a guessed name.

Uses _sceSblDmac5DirectCrypt.

SceSblSsMgrForDriver_A87E82A4

Version NID
0.931.010 0xA87E82A4
0.990.000-3.740.011 not present

A guessed name is sceSblDmac5...ForDriver.

Uses _sceSblDmac5DirectCrypt.

SceSblSsMgrForDriver_465D1526

Version NID
0.931.010 0x465D1526
0.990.000-3.740.011 not present

A guessed name is sceSblDmac5...ForDriver.

Uses _sceSblDmac5DirectCrypt.

sceSblDmac5RndForDriver

Version NID
0.931.010-3.740.011 0x4DD1B2E5

Temp name was sceSblSsMgrGetRandomDataCropForDriver.

Generates random data by executing Dmac5 command 0x4.

Data is then cropped to fit the size in pOutputBuffer.

Used in SceMsif. 

int sceSblDmac5RndForDriver(char* pOutputBuffer, int size, int unk);

sceSblDmac5AesEcbEncForDriver

Version NID
0.990.000-3.740.011 0xC517770D

Temp name was sceSblSsMgrAESECBEncryptForDriver.

Executes Dmac5 command 0x1.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. 128 / 192 / 256
// mask_enable: ex: 1
int sceSblDmac5AesEcbEncForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 mask_enable);

sceSblDmac5AesEcbDecForDriver

Version NID
0.990.000-3.740.011 0x7C978BE7

Temp name was sceSblSsMgrAESECBDecryptForDriver.

Executes Dmac5 command 0x2.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// mask_enable: ex: 1
int sceSblDmac5AesEcbDecForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 mask_enable);

sceSblDmac5AesEcbEncNPForDriver

Version NID
0.990.000-3.740.011 0x0F7D28AF

Temp name was sceSblSsMgrAESECBEncryptWithKeygenForDriver.

Executes Dmac5 command 0x1.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5Key. Uses keyring_id range 0x0C-0x17 internally.
// mask_enable: ex: 1
int sceSblDmac5AesEcbEncNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 key_id, SceUInt32 mask_enable);

sceSblDmac5AesEcbDecNPForDriver

Version NID
0.990.000-3.740.011 0x197ACF6F

Temp name was sceSblSsMgrAESECBDecryptWithKeygenForDriver.

Executes Dmac5 command 0x2.

no usages found 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5KeyForDriver. Uses keyring_id range 0x0C-0x17 internally.
// mask_enable: ex: 1
int sceSblDmac5AesEcbDecNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, SceUInt32 key_id, SceUInt32 mask_enable);

sceSblDmac5AesEcbEncWithDmac5KeyForDriver

Version NID
0.990.000-3.740.011 0x01BE0374

Temp name was sceSblDmac5AesEcbEncWithKeyslotForDriver.

Executes Dmac5 command 0x1.

Used in SceSblMgKeyMgr. 

// size: size of data in src
// keyring_id: ex: 0x1C, 0x1D, 0x1E, 0x1F
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// mask_enable: ex: 1
int sceSblDmac5AesEcbEncWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);

sceSblDmac5AesEcbDecWithDmac5KeyForDriver

Version NID
0.990.000-3.740.011 0x8B4700CB

Temp name was sceSblDmac5AesEcbDecWithKeyslotForDriver.

Executes Dmac5 command 0x2.

Used in SceSblMgKeyMgr. 

// size: size of data in src
// keyring_id: ex: 0x1D
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// mask_enable: ex: 1
int sceSblDmac5AesEcbDecWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);

sceSblDmac5DesEcbEncWithDmac5KeyForDriver

Version NID
0.990.000-3.740.011 0x37DD5CBF

Temp name was sceSblDmac5DesEcbEncWithKeyslotForDriver, sceSblSsMgrDES64ECBEncryptForDriver.

This also implements 3DES. Chosen function depends on key size.

  • for 64 - DES
  • for 128 - not tested. assuming 3DES with K1 = K3.
  • for 192 - 3DES

Executes Dmac5 command 0x41.

Used in SceSblMgKeyMgr. 

// size: size of data in src
// keyring_id: ex: 0x1C
// key_length: Key length in bits. ex: 192 - other sizes also work
// mask_enable: ex: 1
int sceSblDmac5DesEcbEncWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);

sceSblDmac5DesEcbDecWithDmac5KeyForDriver

Version NID
0.990.000-3.740.011 0x8EAFB18A

Temp name was sceSblDmac5DesEcbDecWithKeyslotForDriver, sceSblSsMgrDES64ECBDecryptForDriver.

This also implements 3DES. Chosen function depends on key size.

  • for 64 - DES
  • for 128 - not tested. assuming 3DES with K1 = K3.
  • for 192 - 3DES

Executes Dmac5 command 0x42.

Used in SceSblMgKeyMgr. 

// size: size of data in src
// keyring_id: ex: 0x1C
// key_length: Key length in bits. ex: 192, other sizes also work.
// mask_enable: ex: 1
int sceSblDmac5DesEcbDecWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, SceUInt32 mask_enable);

sceSblDmac5DesCbcEncWithDmac5KeyForDriver

Version NID
0.990.000-3.740.011 0x05B38698

Temp name was sceSblDmac5DesCbcEncWithKeyslotForDriver, sceSblSsMgrDES64CBCEncryptForDriver.

This also probably implements 3DES. Chosen function depends on key size.

  • for 0x40 - DES
  • for 0x80 - not tested. assuming 3DES with K1 = K3.
  • for 0xC0 - 3DES

Executes Dmac5 command 0x49.

no usages found 

// size: size of data in src
// keyring_id: ex: 0x1D
// key_length: Key length in bits. ? - does not matter ?
// iv: IV. IV length is 8 bytes for DES - will be updated after encryption (most likely for encrypting data in blocks?).
// mask_enable: ex: 1
int sceSblDmac5DesCbcEncWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, void *iv, SceUInt32 mask_enable);

sceSblDmac5DesCbcDecWithDmac5KeyForDriver

Version NID
0.990.000-3.740.011 0x926BCCF0

Temp name was sceSblDmac5DesCbcDecWithKeyslotForDriver, sceSblSsMgrDES64CBCDecryptForDriver.

This also probably implements 3DES. Chosen function depends on key size.

  • for 0x40 - DES
  • for 0x80 - not tested. assuming 3DES with K1 = K3.
  • for 0xC0 - 3DES

Executes Dmac5 command 0x4A.

no usages found 

// size: size of data in src
// keyring_id: ex: 0x1D
// key_length: Key length. ? - does not matter ?
// iv: IV. IV length is 8 bytes for DES.
// mask_enable: ex: 1
int sceSblDmac5DesCbcDecWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, void *iv, SceUInt32 mask_enable);

sceSblDmac5AesCbcEncForDriver

Version NID
0.990.000-3.740.011 0xE6E1AD15

Temp name was sceSblSsMgrAESCBCEncryptForDriver.

Executes Dmac5 command 0x9.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Allowed values are: 128 / 192 / 256.
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
// mask_enable: ex: 1
int sceSblDmac5AesCbcEncForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);

sceSblDmac5AesCbcDecForDriver

Version NID
0.990.000-3.740.011 0x121FA69F

The official name maybe contains a typo: sceSblDmac5AEsCbcDecForDriver.

Temp name was sceSblSsMgrAESCBCDecryptForDriver.

Executes Dmac5 command 0xA.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
// mask_enable: ex: 1
int sceSblDmac5AesCbcDecForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);

sceSblDmac5AesCbcEncNPForDriver

Version NID
0.990.000-3.740.011 0x711C057A

Temp name was sceSblSsMgrAESCBCEncryptWithKeygenForDriver.

Executes Dmac5 command 0x9.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5KeyForDriver. Uses keyring_id range 0x0C-0x17 internally.
// mask_enable: ex: 1
int sceSblDmac5AesCbcEncNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 key_id, SceUInt32 mask_enable);

sceSblDmac5AesCbcDecNPForDriver

Version NID
0.990.000-3.740.011 0x1901CB5E

Temp name was sceSblSsMgrAESCBCDecryptWithKeygenForDriver.

Executes Dmac5 command 0xA.

Used in ScePfsMgr. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
// key_id: ex: 0. Used with sceSblAuthMgrSetDmac5KeyForDriver. Uses keyring_id range 0x0C-0x17 internally.
// mask_enable: ex: 1
int sceSblDmac5AesCbcDecNPForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 key_id, SceUInt32 mask_enable);

sceSblDmac5AesCtrEncForDriver

Version NID
0.931.010-1.06 not present
1.500.151-3.740.011 0x82B5DCEF

Temp name was sceSblSsMgrAESCTREncryptForDriver.

Executes Dmac5 command 0x21.

Used in SceNpDrm.

This function can also be used for decryption since AES CTR is a symmetric function. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
// mask_enable: ex: 1
int sceSblDmac5AesCtrEncForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);

sceSblDmac5AesCtrDecForDriver

Version NID
0.931.010-1.06 not present
1.500.151-3.740.011 0x7D46768C

Temp name was sceSblSsMgrAESCTRDecryptForDriver.

Executes Dmac5 command 0x22.

no usages found

This function can also be used for encryption since AES CTR is a symmetric function. 

// size: size of data in src
// key: Key.
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// iv: IV. IV length is 0x10 bytes for AES. It will be updated after encryption (most likely for encrypting data in blocks?).
// mask_enable: ex: 1
int sceSblDmac5AesCtrDecForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize key_length, void *iv, SceUInt32 mask_enable);

sceSblDmac5Sha1ForDriver

Version NID
0.990.000-3.740.011 0xEB3AF9B5

Executes Dmac5 command 0x3. Used in ScePfsMgr. 

int sceSblDmac5Sha1ForDriver(const void *src, void *dst, SceSize length, SceSblDmac5HashTransformContext *ctx, SceUInt32 mask_enable, SceUInt32 extra);

sceSblDmac5Sha1HmacTransformForDriver

Version NID
0.990.000-3.740.011 0x6704D985

Temp name was sceSblSsMgrHMACSHA1ForDriver.

Executes Dmac5 command 0x23. Used in ScePfsMgr.

Key size is always 256-bits. 

int sceSblDmac5Sha1HmacTransformForDriver(const void *src, void *dst, SceSize length, const void *key, SceSblDmac5HashTransformContext *ctx, SceBool mask_enable, SceUInt32 extra);

sceSblDmac5Sha1HmacNPForDriver

Version NID
0.990.000-3.740.011 0x92E37656

Temp name was sceSblSsMgrHMACSHA1WithKeygenForDriver.

Executes Dmac5 command 0x23. no usages found. 

int sceSblDmac5Sha1HmacNPForDriver(const void *src, void *dst, SceSize length, const void *key, SceSblDmac5HashTransformContext *ctx, SceUInt32 key_id, SceBool mask_enable, SceUInt32 extra);

sceSblDmac5Sha256HmacForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.740.011 0x79F38554

Temp name was sceSblSsMgrHMACSHA256ForDriver.

Executes Dmac5 command 0x33. no usages found. 

int sceSblDmac5Sha256HmacForDriver(const void *src, void *dst, SceSize length, const void *key, SceSblDmac5HashTransformContext *ctx, SceBool mask_enable, SceUInt32 extra);

sceSblDmac5AesCmacForDriver

Version NID
0.990.000-3.740.011 0x1B14658D

Temp name was sceSblSsMgrAESCMACForDriver.

Executes Dmac5 command 0x3B. Used in ScePfsMgr. 

int sceSblDmac5AesCmacForDriver(const void *src, void *dst, SceSize size, const void *key, SceSize keysize, SceSblDmac5HashTransformContext *ctx, SceBool mask_enable, SceUInt32 extra);

sceSblDmac5AesCmacNPForDriver

Version NID
0.990.000-3.740.011 0x83B058F5

Temp name was sceSblSsMgrAESCMACWithKeygenForDriver.

Executes Dmac5 command 0x3B. Used in ScePfsMgr. 

int sceSblDmac5AesCmacNPForDriver(const void *src, void *dst, SceSize length, const void *key, SceSize keysize, SceSblDmac5HashTransformContext *ctx, SceUInt32 key_id, SceBool mask_enable, SceUInt32 extra);

sceSblDmac5AesCmacWithDmac5KeyForDriver

Version NID
0.931.010-0.990.000 not present
0.996.090-3.740.011 0xEA6ACB6D

Temp name was sceSblDmac5AesCmacWithKeyslotForDriver.

Executes Dmac5 command 0x3B.

no usages found 

// size: size of data in src
// keyring_id: ex: 0x1D
// key_length: Key length in bits. Accepted values: 128 / 192 / 256.
// iv: ex: 0
// mask_enable: ex: 1
// flags: ex: 0 / 0x400 / 0x800 / 0xC00
int sceSblDmac5AesCmacWithDmac5KeyForDriver(const void *src, void *dst, SceSize size, SceUInt32 keyring_id, SceSize key_length, void *iv, SceUInt32 mask_enable, SceUInt32 flags);

sceSblSsMgrExecuteDmac5HashCommandForDriver

Version NID
0.931.010-1.06 not present
1.500.151-3.740.011 0x9641374E

Executes Dmac5 commands related to hash functions.

Used in SceNpDrm. 

int sceSblSsMgrExecuteDmac5HashCommandForDriver(const void *src, void *dst, SceSize size, void *iv, SceUInt32 mask_enable, SceUInt32 command, SceUInt32 flags);

sceSblSsEncryptWithPortabilityForDriver

Version NID
0.931.010-3.740.011 0x21EC51F6

derived from _vshSblSsEncryptWithPortability

Strangely it does not communicate with encdec_w_portability_sm command 0x1000A. That is because anyway this SM command is not implemented in release System Software. 

SceInt32 sceSblSsEncryptWithPortabilityForDriver(SceUInt32 key_type, void *iv, ScePortabilityData *plain_msg, ScePortabilityData *enc_msg);

sceSblSsDecryptWithPortabilityForDriver

Version NID
0.931.010-3.740.011 0x934DB6B5

derived from _vshSblSsDecryptWithPortability

For example, decrypts or derives AES key that is used in msif to decrypt static sha224 table.

Executes encdec_w_portability_sm command 0x2000A. 

int sceSblSsDecryptWithPortabilityForDriver(SceUInt32 key_type, void *iv, ScePortabilityData *enc_msg, ScePortabilityData *plain_msg);

sceSblSsGetNvsDataForDriver

Version NID
0.931.010-3.740.011 0xFDD6D5DE

derived from _vshSblSsGetNvsData

Calls sceSysconNvsReadDataForDriver. 

// type - 0-5
// pData - destination buffer
// size - 2, 4, 8, 0x10, 0x20
int sceSblSsGetNvsDataForDriver(SceSblSsNvsDataType type, void *pData, SceSize size);

sceSblSsSetNvsDataForDriver

Version NID
0.931.010-3.740.011 0x249ADB07

derived from _vshSblSsSetNvsData

Calls sceSysconNvsWriteDataForDriver. 

// type - 0-5
// pData - source buffer
// size - 2, 4, 8, 0x10, 0x20
int sceSblSsSetNvsDataForDriver(SceSblSsNvsDataType type, void *pData, SceSize size);

sceSblAimgrGetVisibleIdForDriver

Version NID
0.990.000-3.740.011 0x04843835

Temp name was sceSblSsMgrGetVisibleIdForDriver, sceSblSsMgrGetFuseIdForDriver.

Derived from _vshSblAimgrGetVisibleId.

Obtains the console's Visible ID by executing aimgr_sm command 0x3. 

int sceSblAimgrGetVisibleIdForDriver(SceVisibleId *pVisibleId);

sceSblAimgrGetConsoleIdForDriver

Version NID
0.990.000-3.740.011 0xFC6CDD68

Temp name was sceSblSsMgrGetConsoleIdForDriver.

Obtains Console ID by executing aimgr_sm command 0x1. 

int sceSblAimgrGetConsoleIdForDriver(SceConsoleId *pConsoleId);

sceSblAimgrGetOpenPsIdForDriver

Version NID
0.990.000-3.740.011 0xA5B5D269

Temp name was sceSblSsMgrGetOpenPsIdForDriver.

This function returns information from a static buffer that is initialized on module_start.

OpenPsId comes from kbl_param->openpsid using SceSysmem#sceKernelSysrootGetKblParamForKernel. 

int sceSblAimgrGetOpenPsIdForDriver(SceOpenPsId *pOpenPsId);

sceSblAimgrGetPscodeForDriver

Version NID
0.990.000-3.740.011 0xE0DC2587

Temp name was sceSblSsMgrGetPscodeForDriver.

Derived from _vshSblAimgrGetPscode.

This function returns information from a static buffer that is initialized on module_start.

PsCode comes from kbl_param->pscode using SceSysmem#sceKernelSysrootGetKblParamForKernel. 

int sceSblAimgrGetPscodeForDriver(ScePsCode *pPsCode);

sceSblAimgrGetPscode2ForDriver

Version NID
0.990.000-3.740.011 0x9A9676D0

Temp name was sceSblSsMgrGetPscode2ForDriver.

Derived from _vshSblAimgrGetPscode2

Obtains the console's Ps Code by executing aimgr_sm command 0x4. 

int sceSblAimgrGetPscode2ForDriver(ScePsCode *pPsCode);

sceSblSsCreatePassPhraseForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.740.011 0xB8B298FD

derived from _vshSblSsCreatePassPhrase

Obtains the PassPhrase by executing aimgr_sm command 0x5. 

int sceSblSsCreatePassPhraseForDriver(SceSblSsCreatePassPhraseParam *pParam, void *pPassPhrase);

sceSblSsInfraAllocatePARangeVectorForDriver

Version NID
0.931.010-3.740.011 0xE0B13BA7

Used by SceSblUpdateMgr. 

int sceSblSsInfraAllocatePARangeVectorForDriver(void *buf, SceSize size, SceUID blockid, SceKernelPAVector *pPAV);

sceSblSsInfraFreePARangeVectorForDriver

Version NID
0.931.010-3.740.011 0xC38D0CEA

Used by SceSblUpdateMgr. 

int sceSblSsInfraFreePARangeVectorForDriver(SceUID blockid, SceKernelPAVector *pPAV);

sceSblSsMemsetForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.740.011 0xCD98CC92

Used by SceSblPostSsMgr. 

void sceSblSsMemsetForDriver(char* dest, char value, SceSize size);

sceSblRtcMgrSetCpRtc_1ForDriver

Version NID
0.931.010 0x2B259A82
0.990.000-3.740.011 not present

sceSblRtcMgrSetCpRtc_2ForDriver

Version NID
0.931.010-0.940 0xD8F6F110
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblRtcMgrGetCpRtcPhysicalForDriver

Version NID
0.931.010-0.940 0xC96622EC
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblRtcMgrGetCpRtcLogicalForDriver

Version NID
0.931.010-0.940 0xAF56206D
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblLicMgrActivateDevkitForDriver

Version NID
0.931.010 0x37682AB1
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblLicGetActivationKeyForDriver

Version NID
0.931.010 not present
0.940 0xED4878A4
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblLicMgrGetExpireDateForDriver

Version NID
0.931.010-0.940 0xE840CD4E
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblLicMgrGetLicenseStatusForDriver

Version NID
0.931.010-0.940 0x65CBED16
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblPmMgrGetProductModeFromNVSForDriver

Version NID
0.931.010-0.940 0x196C7FB2
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblPmMgrSetProductModeForDriver

Version NID
0.931.010-0.940 0x33B706E1
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblPmMgrAuthEtoIForDriver

Version NID
0.931.010-0.940 0xB241EA2B
0.990.000-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblSsCrepoInitializeForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0x80879AFB
3.100.081-3.740.011 not present

Initializes Crash Report key ring. Returns 0 on success.

Calls the _sceSblSsCrepoGetKeyRing subroutine to initialize the Crepo key ring. The Crepo key ring is then cached in memory from the result of decrypt with portability. 

typedef struct SceCrepoKeyRing { // size is 0xC0
    char magic[0x20]; // "CFK1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
    SceUInt8 unk_0x20[0x60];
    SceUInt8 unk_0x80[0x10];
    SceUInt8 unk_0x90[0x10];
    SceUInt8 unk_0xA0[0x10];
    SceUInt8 unk_0xB0[0x10];
} SceCrepoKeyRing;
int sceSblSsCrepoInitializeForDriver(void);

sceSblSsCrepoGetKeyForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0x2D794404
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

This is a guessed name.

Uses Crepo Key Ring. 

// idx: must be in range 0-3
// size: must be 0x20
// pKey: pointer to a buffer of size 0x20 bytes
int sceSblSsCrepoGetKeyForDriver(SceUInt32 idx, SceSize size, void *pKey);

sceSblSsCrepoGetKeyInfoByIdxForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0x52BC448C
3.100.081-3.740.011 not present

This is a guessed name.

Gets 0x10 bytes of data from the cached Crepo Key Ring.

Index Offset Value
0 0 "CFK1\0\0\0\0\0\0\0\0\0\0\0\0" Crepo Key Ring header
1 0x80 To document with the result of decrypt with portability.
2 0x90 To document with the result of decrypt with portability.
3 0xA0 To document with the result of decrypt with portability.
4 0xB0 To document with the result of decrypt with portability. 
// idx: must be in range 0-4
// size: must be 0x10
// pKey: pointer to a buffer of size 0x10 bytes
int sceSblSsCrepoGetKeyInfoByIdxForDriver(SceUInt32 idx, SceSize size, void *pInfo);

sceSblSsCrepoStopForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0x2B3EF6DF
3.100.081-3.740.011 not present

This is a guessed name.

Clears Crash Report key ring. Always return 0. 

int sceSblSsCrepoStopForDriver(void);

sceSblSsDebugDecryptKeystoneForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0x9084AEDB
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblSsDebugEncryptKeystoneForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0xDFB5E945
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblSsEncryptSealedkeyForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0xB36051C4
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblSsDecryptSealedkeyForDriver

Version NID
0.931.010 not present
0.990.000-3.010.031 0xEC0D967A
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

sceSblSsCloudDataGetEncDecCryptHandleForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.010.031 0xB7C1A72B
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

This is a guessed name.

Gets the entire Cloud Data Key Ring.

Used in SceAppMgr#sceAppMgrCloudDataCreateHeaderForDriver. 

typedef struct SceCloudDataKeyRing { // size is 0x2A0
    char magic[8]; // "CloudBU\0"
    SceUInt32 unk_8; // ex: 0 or 1
    SceUInt8 unk_0xC[0x294];
} SceCloudDataKeyRing;

typedef struct SceCloudDataSignCryptHandle { // size is 0x2A0
    SceCloudDataKeyRing keyring;
} SceCloudDataSignCryptHandle;

int sceSblSsCloudDataGetEncDecCryptHandleForDriver(SceCloudDataSignCryptHandle *pHandle);

sceSblSsCloudDataGetSignCryptHandleForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.010.031 0x7970D8B4
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

This is a guessed name.

Used in SceAppMgr#sceAppMgrCloudDataVerifyHeaderForDriver and SceAppMgr#sceAppMgrLocalBackupVerifyOfflineHeader. 

typedef struct SceCloudDataSignCryptHandleBlock { // size is 0x104
    SceUInt8 data[0x100];
    SceSize size; // ex: 4 for exponent, 0x100 for modulus. Normal range is 0-0x100.
} SceCloudDataSignCryptHandleBlock;

typedef struct SceCloudDataSignCryptHandle { // size is 0x208
    SceCloudDataSignCryptHandleBlock rsa_modulus;
    SceCloudDataSignCryptHandleBlock rsa_exponent;
} SceCloudDataSignCryptHandle;

// mode: must be 1
// idx: must be 1
int sceSblSsCloudDataGetSignCryptHandleForDriver(SceUInt32 mode, SceUInt32 idx, SceCloudDataSignCryptHandle *pHandle);

sceSblSsCloudDataStopForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.010.031 0x51ACBC5F
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

This is a guessed name.

Clears Cloud Data Key Ring. 

int sceSblSsCloudDataStopForDriver(void);

sceSblSsGenerateAppKeyForDriver

Version NID
0.931.010-1.81 not present
2.000.081-3.010.031 0x9610A871
3.100.081-3.740.011 not present. Moved to SceSblPostSsMgr.

This name was derived from SceVshBridge#_vshSblSsGenerateAppKey. 

int sceSblSsGenerateAppKeyForDriver(void *in, void *out);

SceSblSsMgr

This library exists on FW 1.69 but does not exist on FW 3.60.

sceSblSsInfraAllocatePARangeVector

Version NID
0.931-1.69 0x8C2822A9 
int sceSblSsInfraAllocatePARangeVector(void *buf, SceSize size, SceUID blockid, SceKernelPAVector *pPAV);

sceSblSsInfraFreePARangeVector

Version NID
0.931-1.69 0xFAD42134 
int sceSblSsInfraFreePARangeVector(SceUID blockid, SceKernelPAVector *pPAV);

SceSblQafMgr

sceSblQafMgrGetQafToken

Version NID
1.69-3.60 0xB6BAE81D

On 3.60 returns 0x80010058 (SCE_ERROR_ERRNO_ENOSYS). 

int sceSblQafMgrGetQafToken(SceQafToken *qaf_token);

sceSblQafMgrGetQafToken2

Version NID
3.60 0xDFBA8569 
int sceSblQafMgrGetQafToken2(SceQafToken *qaf_token);

sceSblQafManagerSetQafTokenForUser

Version NID
1.69-3.60 0x56A16392

On 3.60 returns 0x80010058 (SCE_ERROR_ERRNO_ENOSYS). 

int sceSblQafManagerSetQafTokenForUser(SceQafToken qaf_token);

sceSblQafMgrSetQafToken2

Version NID
3.60 0xF4B5C8A5 
int sceSblQafMgrSetQafToken2(SceQafToken qaf_token);

sceSblQafManagerDeleteQafTokenForUser

Version NID
0.940-3.60 0xD542583F

On 3.60 returns 0x80010058 (SCE_ERROR_ERRNO_ENOSYS). 

int sceSblQafManagerDeleteQafTokenForUser(void);

sceSblQafMgrDeleteQafToken2

Version NID
3.60 0x62E30BF4 
  int ret;
  int ret2;
  int ret3;
  signed int result;
  char flag;
  char data[0x80];
  char sig[0x100];

  memset(data, (char)0xFF, 0x180);
  SceKernelSuspendForDriver_4DF40893_0(0);
  ret = sceSblNvsWriteDataForKernel(0x400, data, 0x80);
  if ( ret ) {
    SceKernelSuspendForDriver_4DF40893(0);
    result = ret;
  } else {
    ret2 = sceSblNvsWriteDataForKernel(0x5A0, sig, 0x100);
    if ( ret2 ) {
      SceKernelSuspendForDriver_4DF40893(0);
      result = ret2;
    } else {
      flag = 1;
      ret3 = sceSblNvsWriteDataForKernel(0x480, &flag, 1);
      SceKernelSuspendForDriver_4DF40893(0);
      result = ret3;
    }
  }
  return result;
int sceSblQafMgrDeleteQafToken2(void);

sceSblQafManagerGetQafNameForUser

Version NID
0.940-3.60 0x0F7EA8C2

Wrapper to sceSblQafManagerGetQafNameForKernel. 

int sceSblQafManagerGetQafNameForUser(char *buffer, unsigned int max_len);

sceSblQafManagerGetQafName2ForUser

Version NID
3.60 0xF0CA8766 
memset(buf, 0, 0x180);
sceSblNvsReadDataForKernel(0x480, buf, 1);
sceSblNvsReadDataForKernel(0x400, buf, 0x80);
memcpy(buffer, buf, 0x18);
sceSblNvsReadDataForKernel(0x5A0, buf, 0x100);
// if all functions returned success
sceSblQafManagerGetQafNameForKernel(buf2, len);
sceKernelMemcpyKernelToUserForDriver(buffer, buf2, len)) != 0 )
int sceSblQafManagerGetQafName2ForUser(char *buffer, unsigned int max_len);

sceSblQafMgrIsAllowMinimumDebugMenuDisplay

Version NID
3.60 0xA156BBD2

return pKblParam->qa_flags[0xF] & 1; 

int sceSblQafMgrIsAllowMinimumDebugMenuDisplay(void);

sceSblQafMgrIsAllowLimitedDebugMenuDisplay

Version NID
1.69-3.60 0xC456212D

return (pKblParam->qa_flags[6] >> 1) & 1; 

int sceSblQafMgrIsAllowLimitedDebugMenuDisplay(void);

sceSblQafMgrIsAllowAllDebugMenuDisplay

Version NID
1.69-3.60 0x66843305

return (pKblParam->qa_flags[0xC] >> 1) & 1; 

int sceSblQafMgrIsAllowAllDebugMenuDisplay(void);

sceSblQafManagerIsAllowKernelDebugForUser

Version NID
0.940-3.60 0x11D30766

return pKblParam->qa_flags[0xD] & 1; 

int sceSblQafManagerIsAllowKernelDebugForUser(void);

sceSblQafMgrIsAllowForceUpdate

Version NID
1.69-3.60 0x63F29BA0

return (pKblParam->qa_flags[0xF] >> 1) & 1; 

int sceSblQafMgrIsAllowForceUpdate(void);

sceSblQafMgrIsAllowNpTest

Version NID
1.69-3.60 0xA9EBCBAC 
if (pKblParam->qa_flags[0xF] << 31)
   return 1;
else
   return sceSysrootUtMgrHasNpTestFlagForKernel(a1, a2, a3);
int sceSblQafMgrIsAllowNpTest(int a1, int a2, int a3);

sceSblQafMgrIsAllowNpFullTest

Version NID
3.60 0x72168C6E

return (pKblParam->qa_flags[6] >> 1) & 1; 

int sceSblQafMgrIsAllowNpFullTest(void);

sceSblQafMgrIsAllowNonQAPup

Version NID
1.69-3.60 0xB5621615

return pKblParam->qa_flags[0xF] & 1; 

int sceSblQafMgrIsAllowNonQAPup(void);

sceSblQafMgrIsAllowScreenShotAlways

Version NID
1.69-3.60 0xD22A8731

return (pKblParam->qa_flags[6] >> 1) & 1; 

int sceSblQafMgrIsAllowScreenShotAlways(void);

sceSblQafMgrIsAllowRemoteSysmoduleLoad

Version NID
0.940-3.60 0xF45AA706

return (pKblParam->qa_flags[0xD] >> 1) & 1; 

int sceSblQafMgrIsAllowRemoteSysmoduleLoad(void);

SceSblRng

sceSblRngGenuineRandomNumber

Version NID
0.940-0.990 0xD1189305
3.60 not present

Temp name was sceSblSsMgrGetRandomData.

Calls #sceSblRngGenuineRandomNumberForDriver.

sceSblRngGenuineRandomNumber2

Version NID
0.940-0.990 0xBA5242FE
3.60 not present

sceSblRngPseudoRandomNumber

Version NID
0.940-0.990 0xD8BC42B8
3.60 not present

Calls #sceSblRngPseudoRandomNumberForDriver.

sceSblRngPseudoRandomNumber2

Version NID
0.940-0.990 0xD84424230
3.60 not present

_sceKernelGetRandomNumber

Version NID
0.940-0.990 not present
1.69-3.60 0xC37E818C

Calls #sceSblRngPseudoRandomNumberForDriver. 

// length: length in bytes of the random number to generate. The actual length written to pDst is in pParam. Must be <= 0x40.
int _sceKernelGetRandomNumber(void *pDst, SceSize length, SceKernelGetRandomNumberParam *pParam);

SceSblDmac5Mgr

sceSblDmac5EncDec

Version NID
0.931 not present
0.990-3.60 0xD0B1F759 
int sceSblDmac5EncDec(SceSblDmac5EncDecParam *pParam, SceUInt32 command);

sceSblDmac5EncDecNP

Version NID
0.931 not present
0.940-0.990 0x30702CC7
3.60 not present 
int sceSblDmac5EncDecNP(void *args, SceUInt32 key_id, SceUInt32 command);

sceSblDmac5EncDecKeyGen

Version NID
1.69-3.60 0x5BF4F924

official:

AesCbcEncrypt command to sceSblDmac5AesCbcEncKeyGen in SceGameDataPlugin.

AesCbcDecrypt command to sceSblDmac5AesCbcDecKeyGen in SceGameDataPlugin.


theory:

AesCtrEncrypt command to sceSblDmac5AesCtrEncKeyGen. 

int sceSblDmac5EncDecKeyGen(SceSblDmac5EncDecParam *pParam, SceUInt32 key_id, SceUInt32 command);

sceSblDmac5HashTransform

Version NID
1.69-3.60 0x09EBC6EF

Support to Sha1/Sha224/Sha256 only. 

int sceSblDmac5HashTransform(SceSblDmac5HashTransformParam *pParam, SceUInt32 command, SceUInt32 extra);

sceSblDmac5HmacKeyGen

Version NID
3.60 0xCCE57D33

This function is named sceSblDmac5HmacKeyGen in SceSysLibTrace.

HmacSha256 command to sceSblDmac5Sha256HmacKeyGen in SceGameDataPlugin (official name).

Theory:

HmacSha1 command to sceSblDmac5Sha1HmacKeyGen.

HmacSha224 command to sceSblDmac5Sha224HmacKeyGen. 

int sceSblDmac5HmacKeyGen(SceSblDmac5HashTransformParam *pParam, SceUInt32 key_id, SceUInt32 command, SceUInt32 extra);

SceSblAimgr

_sceKernelGetOpenPsId

Version NID
1.69-3.60 0x6E283E2E 
int _sceKernelGetOpenPsId(SceOpenPsId *pOpenPsId);
Retrieved from "http://wiki.henkaku.xyz/index.php?title=SceSblSsMgr&oldid=21286"