NSKBL: Difference between revisions

From Vita Development Wiki
Jump to navigation Jump to search
m (CelesteBlue moved page NSBL to NSKBL: Official name is Non Secure Kernel Boot Loader)
No edit summary
Line 1: Line 1:
NSBL is a program that performs emmc setup, base kernel module loading, etc. when vita boot
NSKBL is a program that performs emmc setup, base kernel module loading, etc. during PSVita boot.


== Module ==
== Module ==
Line 5: Line 5:
The non-secure kernel bootloader contains an embedded and likely stripped version of [[SceSysmem]], [[SceKernelModulemgr]], [[SceSblSmschedProxy]], [[SceExcpmgr]], [[SceKernelIntrMgr]], [[SceSblAuthMgr]], [[SceProcessmgr]] (maybe), [[SceSdif]], [[SceIofilemgr]] (Simple version?), and some other core drivers.
The non-secure kernel bootloader contains an embedded and likely stripped version of [[SceSysmem]], [[SceKernelModulemgr]], [[SceSblSmschedProxy]], [[SceExcpmgr]], [[SceKernelIntrMgr]], [[SceSblAuthMgr]], [[SceProcessmgr]] (maybe), [[SceSdif]], [[SceIofilemgr]] (Simple version?), and some other core drivers.


=== How to debug NSBL ===
== How to debug NSKBL ==


NSBL reads from sd0: instead, if a read error(?) Occurs in os0: during vita startup.
NSKBL reads from sd0: instead, if a read error(?) occurs in os0: during PSVita startup.


but, in order to generate os0: read errors, os0: must be damaged in some way, so there must be a way to physically recover vita.
But, in order to generate os0: read errors, os0: must be damaged in some way, so there must be a way to physically recover vita.


== types ==
== types ==
Line 15: Line 15:
<source lang="C">
<source lang="C">


/* Many ptrs are nsbl heap relationships */
/* Many ptrs are NSKBL heap relationships */
typedef struct SceNskblSysrootInfo {
typedef struct SceNskblSysrootInfo {
SceUID unk_0x00; // ex:0x10089
SceUID unk_0x00; // ex:0x10089
Line 81: Line 81:
! Version !! Name !! World !! Visibility !! NID
! Version !! Name !! World !! Visibility !! NID
|-
|-
| 3.60 || [[NSBL#SceKblForKernel|SceKblForKernel]] || Non-secure || Kernel || 0xD0FC2991
| 3.60 || [[NSKBL#SceKblForKernel|SceKblForKernel]] || Non-secure || Kernel || 0xD0FC2991
|}
|}


Line 96: Line 96:
In 3.60 this function is at 0x510172BD
In 3.60 this function is at 0x510172BD


<source lang="C">
<source lang="C">int sceKblDebugPutcharForKernel(void *args, char c);</source>
int sceKblDebugPutcharForKernel(void *args, char c);
</source>


=== sceKblDebugPrintfForKernel ===
=== sceKblDebugPrintfForKernel ===
Line 110: Line 108:
In 3.60 this function is at 0x510137A9
In 3.60 this function is at 0x510137A9


<source lang="C">
<source lang="C">int sceKblDebugPrintfForKernel(const char *fmt, ...);</source>
int sceKblDebugPrintfForKernel(const char *fmt, ...);
</source>


=== SceKblForKernel_0x161D6FCC ===
=== SceKblForKernel_0x161D6FCC ===
Line 134: Line 130:
|}
|}


Maybe call a thread related function, and if it fails, do a panic call
Maybe call a thread related function, and if it fails, do a panic call.


In 3.60 this function is at 0x510123A1
In 3.60 this function is at 0x510123A1.


=== SceKblForKernel_0x261F2747 ===
=== SceKblForKernel_0x261F2747 ===
Line 148: Line 144:
Related to initialization?
Related to initialization?


In 3.60 this function is at 0x51001321
In 3.60 this function is at 0x51001321.


<source lang="C">
<source lang="C">int SceKblForKernel_0x261F2747(void);</source>
int SceKblForKernel_0x261F2747(void);
</source>


=== SceKblForKernel_0x314AA770 ===
=== SceKblForKernel_0x314AA770 ===
Line 164: Line 158:
same to SceSysrootForKernel_AE55B7CC
same to SceSysrootForKernel_AE55B7CC


In 3.60 this function is at 0x510124FD
In 3.60 this function is at 0x510124FD.


<source lang="C">
<source lang="C">void SceKblForKernel_0x314AA770(void);</source>
void SceKblForKernel_0x314AA770(void);
</source>


=== sceKblIsCEXForKernel ===
=== sceKblIsCEXForKernel ===
Line 178: Line 170:
|}
|}


In 3.60 this function is at 0x510171B5
In 3.60 this function is at 0x510171B5.


<source lang="C">
<source lang="C">int sceKblIsCEXForKernel(void);</source>
int sceKblIsCEXForKernel(void);
</source>


=== sceKblIsCEXJpFatForKernel ===
=== sceKblIsCEXJpFatForKernel ===
Line 192: Line 182:
|}
|}


In 3.60 this function is at 0x51017175
In 3.60 this function is at 0x51017175.


<source lang="C">
<source lang="C">int sceKblIsCEXJpFatForKernel(void);</source>
int sceKblIsCEXJpFatForKernel(void);
</source>


=== sceKblIsDEXForKernel ===
=== sceKblIsDEXForKernel ===
Line 206: Line 194:
|}
|}


In 3.60 this function is at 0x51017159
In 3.60 this function is at 0x51017159.


<source lang="C">
<source lang="C">int sceKblIsDEXForKernel(void);</source>
int sceKblIsDEXForKernel(void);
</source>


=== sceKblIsToolForKernel ===
=== sceKblIsToolForKernel ===
Line 220: Line 206:
|}
|}


In 3.60 this function is at 0x51017139
In 3.60 this function is at 0x51017139.


<source lang="C">
<source lang="C">int sceKblIsToolForKernel(void);</source>
int sceKblIsToolForKernel(void);
</source>


=== sceKblIsTestForKernel ===
=== sceKblIsTestForKernel ===
Line 234: Line 218:
|}
|}


In 3.60 this function is at 0x5101711D
In 3.60 this function is at 0x5101711D.


<source lang="C">
<source lang="C">int sceKblIsTestForKernel(void);</source>
int sceKblIsTestForKernel(void);
</source>


=== sceKblLoadModuleForKernel ===
=== sceKblLoadModuleForKernel ===
Line 248: Line 230:
|}
|}


In 3.60 this function is at 0x51001551
In 3.60 this function is at 0x51001551.


<source lang="C">
<source lang="C">
Line 268: Line 250:
In 3.60 this function is at 0x51001571
In 3.60 this function is at 0x51001571


<source lang="C">
<source lang="C">int sceKblStartModuleForKernel(SceUID *uid_list, int count, SceSize args, void *argp);</source>
int sceKblStartModuleForKernel(SceUID *uid_list, int count, SceSize args, void *argp);
</source>


=== SceKblForKernel_0x752E7EEC ===
=== SceKblForKernel_0x752E7EEC ===
Line 282: Line 262:
Debug function, same to SceDebugForDriver_1A3F2AA4
Debug function, same to SceDebugForDriver_1A3F2AA4


In 3.60 this function is at 0x51013841
In 3.60 this function is at 0x51013841.


=== SceKblForKernel_0x79241ACF ===
=== SceKblForKernel_0x79241ACF ===
Line 294: Line 274:
Related to initialization?
Related to initialization?


In 3.60 this function is at 0x51001345
In 3.60 this function is at 0x51001345.
 
<source lang="C">
 
int SceKblForKernel_0x79241ACF(void);


</source>
<source lang="C">int SceKblForKernel_0x79241ACF(void);</source>


=== SceKblForKernel_0x807B4437 ===
=== SceKblForKernel_0x807B4437 ===
Line 312: Line 288:
same to SceSysrootForKernel_8E4B61F1
same to SceSysrootForKernel_8E4B61F1


In 3.60 this function is at 0x510124E5
In 3.60 this function is at 0x510124E5.


<source lang="C">
<source lang="C">void SceKblForKernel_0x807B4437(int a1);</source>
void SceKblForKernel_0x807B4437(int a1);
</source>


=== sceKblIsVITAForKernel ===
=== sceKblIsVITAForKernel ===
Line 326: Line 300:
|}
|}


In 3.60 this function is at 0x51017299
In 3.60 this function is at 0x51017299.


<source lang="C">
<source lang="C">int sceKblIsVITAForKernel(void);</source>
int sceKblIsVITAForKernel(void);
</source>


=== sceKblIsDolceForKernel ===
=== sceKblIsDolceForKernel ===
Line 340: Line 312:
|}
|}


In 3.60 this function is at 0x510172A1
In 3.60 this function is at 0x510172A1.


<source lang="C">
<source lang="C">int sceKblIsDolceForKernel(void);</source>
int sceKblIsDolceForKernel(void);
</source>


=== sceKblIsGenuineDolceForKernel ===
=== sceKblIsGenuineDolceForKernel ===
Line 354: Line 324:
|}
|}


In 3.60 this function is at 0x510171E5
In 3.60 this function is at 0x510171E5.


<source lang="C">
<source lang="C">int sceKblIsGenuineDolceForKernel(void);</source>
int sceKblIsGenuineDolceForKernel(void);
</source>


=== SceKblForKernel_0x9B868276 ===
=== SceKblForKernel_0x9B868276 ===
Line 370: Line 338:
return value is ptr?
return value is ptr?


In 3.60 this function is at 0x51013765
In 3.60 this function is at 0x51013765.
 
<source lang="C">
 
int SceKblForKernel_9B868276(void);


</source>
<source lang="C">int SceKblForKernel_9B868276(void);</source>


=== SceKblForKernel_0x9F4F3F98 (set some state?) ===
=== SceKblForKernel_0x9F4F3F98 (set some state?) ===
Line 390: Line 354:
related to sceKblStartModuleForKernel
related to sceKblStartModuleForKernel


In 3.60 this function is at 0x51001561
In 3.60 this function is at 0x51001561.


<source lang="C">
<source lang="C">int SceKblForKernel_9F4F3F98(void);</source>
int SceKblForKernel_9F4F3F98(void);
</source>


=== sceKblGetCpuIdForKernel ===
=== sceKblGetCpuIdForKernel ===
Line 404: Line 366:
|}
|}


In 3.60 this function is at 0x510147C9
In 3.60 this function is at 0x510147C9.


<source lang="C">
<source lang="C">int sceKblGetCpuIdForKernel(void);</source>
int sceKblGetCpuIdForKernel(void);
</source>


=== SceKblForKernel_0xC011935A ===
=== SceKblForKernel_0xC011935A ===
Line 420: Line 380:
get some info?
get some info?


In 3.60 this function is at 0x51013921
In 3.60 this function is at 0x51013921.


<source lang="C">
<source lang="C">int SceKblForKernel_C011935A(void);</source>
 
int SceKblForKernel_C011935A(void);
 
</source>


=== SceKblForKernel_0xC7B77991 ===
=== SceKblForKernel_0xC7B77991 ===
Line 438: Line 394:
same to SceSysrootForKernel_F6A6D205
same to SceSysrootForKernel_F6A6D205


In 3.60 this function is at 0x5101297D
In 3.60 this function is at 0x5101297D.


=== sceKblCheckDipswForKernel ===
=== sceKblCheckDipswForKernel ===
Line 448: Line 404:
|}
|}


In 3.60 this function is at 0x51015851
In 3.60 this function is at 0x51015851.


<source lang="C">
<source lang="C">int sceKblCheckDipswForKernel(int bit);</source>
int sceKblCheckDipswForKernel(int bit);
</source>


=== sceKblIsAllowKernelDebugForKernel ===
=== sceKblIsAllowKernelDebugForKernel ===
Line 466: Line 420:
In 3.60 this function is at 0x51016FD1
In 3.60 this function is at 0x51016FD1


<source lang="C">
<source lang="C">int sceKblIsAllowKernelDebugForKernel(void);</source>
int sceKblIsAllowKernelDebugForKernel(void);
</source>


=== sceKblGetHardwareFlagsForKernel ===
=== sceKblGetHardwareFlagsForKernel ===
Line 498: Line 450:
|}
|}


In 3.60 this function is at 0x51003554
In 3.60 this function is at 0x51003554.


<source lang="C">
<source lang="C">void sceKblCpuSwitchInterruptsForKernel(void);</source>
 
void sceKblCpuSwitchInterruptsForKernel(void);
 
</source>


=== sceKblInitDeviceForKernel ===
=== sceKblInitDeviceForKernel ===
Line 516: Line 464:
some device init function
some device init function


In 3.60 this function is at 0x5100124D
In 3.60 this function is at 0x5100124D.
 
<source lang="C">void sceKblInitDeviceForKernel(void);</source>


<source lang="C">
void sceKblInitDeviceForKernel(void);
</source>


[[Category:Modules]]
[[Category:Modules]]
[[Category:Kernel]]
[[Category:Kernel]]

Revision as of 12:26, 26 December 2019

NSKBL is a program that performs emmc setup, base kernel module loading, etc. during PSVita boot.

Module

The non-secure kernel bootloader contains an embedded and likely stripped version of SceSysmem, SceKernelModulemgr, SceSblSmschedProxy, SceExcpmgr, SceKernelIntrMgr, SceSblAuthMgr, SceProcessmgr (maybe), SceSdif, SceIofilemgr (Simple version?), and some other core drivers.

How to debug NSKBL

NSKBL reads from sd0: instead, if a read error(?) occurs in os0: during PSVita startup.

But, in order to generate os0: read errors, os0: must be damaged in some way, so there must be a way to physically recover vita.

types


/* Many ptrs are NSKBL heap relationships */
typedef struct SceNskblSysrootInfo {
	SceUID unk_0x00; // ex:0x10089
	int unk_0x04;
	void *unk_0x08;
	void *unk_0x0C;
	void *unk_0x10;
	void *unk_0x14;
	void *unk_0x18;
	void *unk_0x1C;
	void *unk_0x20;
	void *unk_0x24;
	void *unk_0x28;
	void *unk_0x2C;
	SceUID unk_0x30; // ex:0x1000B
	const void *unk_0x34; // mapped paddr in vaddr
	const void *unk_0x38; // mapped paddr in vaddr
	void *unk_0x3C;
	int unk_0x40; // ex:0x80000000
	int unk_0x44; // ex:0x20000000
	void *unk_0x48;
	void *unk_0x4C;
	void *unk_0x50;
	void *unk_0x54;
	void *unk_0x58;
	void *unk_0x5C;
	void *unk_0x60;
	void *unk_0x64;
	void *unk_0x68;
	void *unk_0x6C;
	void *unk_0x70;
	void *unk_0x74;
	void *unk_0x78;
	void *unk_0x7C;
	void *unk_0x80;
	void *unk_0x84;
	void *unk_0x88;
	void *unk_0x8C;
	void *unk_0x90;
	void *unk_0x94;
	void *unk_0x98;
	uint32_t magic; // 0x19442EA8
	int unk_0xA0; // ex:0x1000
	int unk_0xA4; // ex:0x1000
	int unk_0xA8; // ex:0x40000
	int unk_0xAC; // ex:0x200000
	int unk_0xB0; // ex:7
	int unk_0xB4;
	int unk_0xB8; // ex:0x80
	sysbase360_t *sysbase;
	void *unk_0xC0;
	void *unk_0xC4;
	// more...?
} SceNskblSysrootInfo; // 3.60

SceNskblSysrootInfo *nskbl_sysroot_info = (SceNskblSysrootInfo *)(0x51000000 + 0x138980); // 3.60

Libraries

Known NIDs

Version Name World Visibility NID
3.60 SceKblForKernel Non-secure Kernel 0xD0FC2991

SceKblForKernel

sceKblDebugPutcharForKernel

Version NID
3.60 0x08E9FAEB

In 3.60 this function is at 0x510172BD 

int sceKblDebugPutcharForKernel(void *args, char c);

sceKblDebugPrintfForKernel

Version NID
3.60 0x13A5ABEF

In 3.60 this function is at 0x510137A9 

int sceKblDebugPrintfForKernel(const char *fmt, ...);

SceKblForKernel_0x161D6FCC

Version NID
3.60 0x161D6FCC

Similar to SceKblForKernel_0x1DB28F02

In 3.60 this function is at 0x510123DD

SceKblForKernel_0x1DB28F02

Version NID
3.60 0x1DB28F02

Maybe call a thread related function, and if it fails, do a panic call.

In 3.60 this function is at 0x510123A1.

SceKblForKernel_0x261F2747

Version NID
3.60 0x261F2747

Related to initialization?

In 3.60 this function is at 0x51001321. 

int SceKblForKernel_0x261F2747(void);

SceKblForKernel_0x314AA770

Version NID
3.60 0x314AA770

same to SceSysrootForKernel_AE55B7CC

In 3.60 this function is at 0x510124FD. 

void SceKblForKernel_0x314AA770(void);

sceKblIsCEXForKernel

Version NID
3.60 0x8A416887

In 3.60 this function is at 0x510171B5. 

int sceKblIsCEXForKernel(void);

sceKblIsCEXJpFatForKernel

Version NID
3.60 0xC3DDDE15

In 3.60 this function is at 0x51017175. 

int sceKblIsCEXJpFatForKernel(void);

sceKblIsDEXForKernel

Version NID
3.60 0x5945F065

In 3.60 this function is at 0x51017159. 

int sceKblIsDEXForKernel(void);

sceKblIsToolForKernel

Version NID
3.60 0xB6C9ACF1

In 3.60 this function is at 0x51017139. 

int sceKblIsToolForKernel(void);

sceKblIsTestForKernel

Version NID
3.60 0x943E7537

In 3.60 this function is at 0x5101711D. 

int sceKblIsTestForKernel(void);

sceKblLoadModuleForKernel

Version NID
3.60 0x6D7A1F18

In 3.60 this function is at 0x51001551. 

typedef struct SceModuleLoadList {
  const char *filename;
} __attribute__((packed)) SceModuleLoadList;

int sceKblLoadModuleForKernel(const SceModuleLoadList *list, SceUID *uid, int count, int some_flag);

sceKblStartModuleForKernel

Version NID
3.60 0x9A92436E

In 3.60 this function is at 0x51001571 

int sceKblStartModuleForKernel(SceUID *uid_list, int count, SceSize args, void *argp);

SceKblForKernel_0x752E7EEC

Version NID
3.60 0x752E7EEC

Debug function, same to SceDebugForDriver_1A3F2AA4

In 3.60 this function is at 0x51013841.

SceKblForKernel_0x79241ACF

Version NID
3.60 0x79241ACF

Related to initialization?

In 3.60 this function is at 0x51001345. 

int SceKblForKernel_0x79241ACF(void);

SceKblForKernel_0x807B4437

Version NID
3.60 0x807B4437

same to SceSysrootForKernel_8E4B61F1

In 3.60 this function is at 0x510124E5. 

void SceKblForKernel_0x807B4437(int a1);

sceKblIsVITAForKernel

Version NID
3.60 0x838466E9

In 3.60 this function is at 0x51017299. 

int sceKblIsVITAForKernel(void);

sceKblIsDolceForKernel

Version NID
3.60 0xA7BD4417

In 3.60 this function is at 0x510172A1. 

int sceKblIsDolceForKernel(void);

sceKblIsGenuineDolceForKernel

Version NID
3.60 0xB6D00D6D

In 3.60 this function is at 0x510171E5. 

int sceKblIsGenuineDolceForKernel(void);

SceKblForKernel_0x9B868276

Version NID
3.60 0x9B868276

return value is ptr?

In 3.60 this function is at 0x51013765. 

int SceKblForKernel_9B868276(void);

SceKblForKernel_0x9F4F3F98 (set some state?)

Version NID
3.60 0x9F4F3F98

set some state?

related to sceKblStartModuleForKernel

In 3.60 this function is at 0x51001561. 

int SceKblForKernel_9F4F3F98(void);

sceKblGetCpuIdForKernel

Version NID
3.60 0xB506A10E

In 3.60 this function is at 0x510147C9. 

int sceKblGetCpuIdForKernel(void);

SceKblForKernel_0xC011935A

Version NID
3.60 0xC011935A

get some info?

In 3.60 this function is at 0x51013921. 

int SceKblForKernel_C011935A(void);

SceKblForKernel_0xC7B77991

Version NID
3.60 0xC7B77991

same to SceSysrootForKernel_F6A6D205

In 3.60 this function is at 0x5101297D.

sceKblCheckDipswForKernel

Version NID
3.60 0xC8F4DE71

In 3.60 this function is at 0x51015851. 

int sceKblCheckDipswForKernel(int bit);

sceKblIsAllowKernelDebugForKernel

Version NID
3.60 0xCE94F329

same to sceQafMgrIsAllowKernelDebugForDriver

In 3.60 this function is at 0x51016FD1 

int sceKblIsAllowKernelDebugForKernel(void);

sceKblGetHardwareFlagsForKernel

Version NID
3.60 0xD3A516D5

get some device flags function

In 3.60 this function is at 0x510128AD 

typedef struct SceSysrootHardwareFlags {
	uint32_t data[4];
} __attribute__((packed)) SceSysrootHardwareFlags;

int sceKblGetHardwareFlagsForKernel(SceSysrootHardwareFlags *data);

sceKblCpuSwitchInterruptsForKernel

Version NID
3.60 0xDDB3A1A8

In 3.60 this function is at 0x51003554. 

void sceKblCpuSwitchInterruptsForKernel(void);

sceKblInitDeviceForKernel

Version NID
3.60 0xF7AF8690

some device init function

In 3.60 this function is at 0x5100124D. 

void sceKblInitDeviceForKernel(void);
Retrieved from "http://wiki.henkaku.xyz/index.php?title=NSKBL&oldid=12650"