View source for PRX

== SceModuleInfo ==

It contains information on the module, and on its imports/exports.

=== Location ===

* For non-stripped modules, SceModuleInfo structure is located in ".sceModuleInfo.rodata" memory block.

* For ET_SCE_EXEC modules, when e_entry is not null, SceModuleInfo structure is located in text segment at offset e_entry. Else it is located in text segment (first LOAD segment) at offset Elf32_Phdr[text_seg_id].p_paddr - Elf32_Phdr[text_seg_id].p_offset.

* For ET_SCE_RELEXEC modules, SceModuleInfo structure is located in the segment indexed by the upper two bits of e_entry of the ELF header. The structure is stored at the base offset of the segment plus the offset defined by the bottom 30 bits of e_entry.

=== Structure ===

Some fields are optional and can be set to zero. The other fields determine how this module is loaded and linked. All offset fields are formatted as follows: top 2 bits is an index to the segment to start at and bottom 30 bits is an offset from the segment start. Currently, the segment start index must match the segment that the module information structure is in.

{| class="wikitable"
|-
! Name
! Description
|-
| modattribute
| Attributes of the module. See [[#Module attribute]]
|-
| modversion
| Major version of the module (usually set to 1) followed by Minor version of the module (usually set to 1).
|-
| modname
| Name of the module. Not necessarily null-terminated string.
|-
| terminal
| Null-terminating character (0x00). Name was "terminal" since PSP.
|-
| infoversion
| SceModuleInfo version. Seen values are: 0 on PSP and PS3, 1 never seen, 2 on PS Vita FW 0.902, 3 on PS Vita FW 0.931.010, 4 and 5 never seen, 6 on PS Vita FWs 0.940-3.740.011.
|-
| gp_value / resreve
| global pointer value for MIPS, TOC address (address of .toc) for PowerPC, always 0 for ARM.
|-
| ent_top
| Offset to top of [[#Exports|exports]] array
|-
| ent_end
| Offset to end of [[#Exports|exports]] array
|-
| stub_top
| Offset to top of [[#Imports|imports]] array
|-
| stub_end
| Offset to end of [[#Imports|imports]] array
|-
| dbg_fingerprint
| It was wrongly named module NID. It is a sort of hash to ensure integrity and versioning.
|-
| tls_top
| Offset to top of the Thread Local Storage (TLS).
|-
| tls_filesz
| Certainly equals (tls_end - tls_top).
|-
| tls_memsz
| Certainly equals (tls_initialized_data_end - tls_top).
|-
| start_entry
| Offset to module_start function. -1 to disable.
|-
| stop_entry
| Offset to module_stop function. -1 to disable.
|-
| arm_exidx_top
| Offset to top of ARM EXIDX (optional)
|-
| arm_exidx_end
| Offset to end of ARM EXIDX (optional)
|-
| arm_extab_top
| Offset to top of ARM EXTAB (optional)
|-
| arm_extab_end
| Offset to end of ARM EXTAB (optional)
|}

<source lang="C">
#define MODULE_NAME_MAX_LEN 27

typedef struct SceModuleInfo_common { // size is 0x20
  unsigned short modattribute;
  unsigned char modversion[2];
  char modname[26]; // MODULE_NAME_MAX_LEN - 1
  char terminal; // \0
  char infoversion;
} SceModuleInfo_common;

typedef struct _scemoduleinfo { // size is 0x34
  SceModuleInfo_common c; // c.infoversion must be 0
  Elf32_Addr gp_value;
  Elf32_Addr ent_top;
  Elf32_Addr ent_end;
  Elf32_Addr stub_top;
  Elf32_Addr stub_end;
} sceModuleInfo;

typedef struct _scemoduleinfo1 { // size is 0x40
  SceModuleInfo_common c; // c.infoversion must be 1
  Elf32_Addr gp_value;
  Elf32_Addr ent_top;
  Elf32_Addr ent_end;
  Elf32_Addr stub_top;
  Elf32_Addr stub_end;
  Elf32_Word dbg_fingerprint;
  Elf32_Addr start_entry;
  Elf32_Addr stop_entry;
} sceModuleInfo1;

typedef struct _scemoduleinfo_arm { // size is 0x48
  SceModuleInfo_common c; // c.infoversion must be 2
  Elf32_Addr resreve;
  Elf32_Addr ent_top;
  Elf32_Addr ent_end;
  Elf32_Addr stub_top;
  Elf32_Addr stub_end;
  Elf32_Word dbg_fingerprint;
  Elf32_Addr start_entry;
  Elf32_Addr stop_entry;
  Elf32_Addr arm_exidx_top;
  Elf32_Addr arm_exidx_end;
} sceModuleInfo_arm;

typedef struct _scemoduleinfo_arm_tls { // size is 0x54
  SceModuleInfo_common c; // c.infoversion must be 3
  Elf32_Addr resreve;
  Elf32_Addr ent_top;
  Elf32_Addr ent_end;
  Elf32_Addr stub_top;
  Elf32_Addr stub_end;
  Elf32_Word dbg_fingerprint;
  Elf32_Addr start_entry;
  Elf32_Addr stop_entry;
  Elf32_Addr arm_exidx_top;
  Elf32_Addr arm_exidx_end;
  Elf32_Addr tls_top;
  Elf32_Addr tls_filesz;
  Elf32_Addr tls_memsz;
} sceModuleInfo_arm_tls;

// Note: There is no sceModuleInfo format for ARM that has version 4 or 5 so these versions may be
// the sceModuleInfo_ppu32, sceModuleInfo_ppu64 or sceModuleInfo1_ppu32 formats.

typedef struct _scemoduleinfo_prx2arm { // size is 0x5C
  SceModuleInfo_common c; // c.infoversion must be 6
  Elf32_Addr resreve;
  Elf32_Addr ent_top;
  Elf32_Addr ent_end;
  Elf32_Addr stub_top;
  Elf32_Addr stub_end;
  Elf32_Word dbg_fingerprint;
  Elf32_Addr tls_top;
  Elf32_Addr tls_filesz;
  Elf32_Addr tls_memsz;
  Elf32_Addr start_entry;
  Elf32_Addr stop_entry;
  Elf32_Addr arm_exidx_top;
  Elf32_Addr arm_exidx_end;
  Elf32_Addr arm_extab_top;
  Elf32_Addr arm_extab_end;
} sceModuleInfo_prx2arm;
</source>

=== Module attribute ===

The attributes of a module (PSP, PS Vita, ?PS3 to check?). Bitwise OR'ed values from ::SceModuleAttribute and ::SceModulePrivilegeLevel. Since PS Vita SDK 0.940, SceModulePrivilegeLevel are not set anymore and unused in PS Vita OS.

* Most usermode modules and a few kernel modules have it set to 0.
* Most kernel modules have it set to 7.
* Attribute 0x800 was seen in FW 0.902 cui_update_starter_module.self and FW 0.995 debug comicreader.elf. That attribute was set because these ELFs were compiled with an old PS Vita SDK (<= 0.930) that inherited privilege level attributes from the PSP SDK.

{| class="wikitable"
! Value !! Name !! Comments
|-
| ?0x20? || SCE_MODULE_ATTR_CANT_SHARE || 
|-
| ?0x10? || SCE_MODULE_ATTR_CAN_RELOCATE || 
|-
| ?0x8? || SCE_MODULE_ATTR_CAN_RESTART || 
|-
| 0x4 || SCE_MODULE_ATTR_EXCLUSIVE_START || Only one instance of the module can be started. If you want to start another version of that module, you have to stop the currently running version first.
|-
| 0x2 || SCE_MODULE_ATTR_EXCLUSIVE_LOAD || Only one instance of the module can be loaded. If you want to load another version of that module, you have to unload the currently loaded version first.
|-
| 0x1 || SCE_MODULE_ATTR_CANT_STOP || Resident module i.e. module that stays in memory til poweroff. Such a module cannot be unloaded.
|-
| 0x0 || SCE_MODULE_ATTR_NONE || No module attributes.
|}

<source lang="C">
/** 
 * Module type attributes. 
 */
enum SceModuleAttribute {
    SCE_MODULE_ATTR_NONE             = 0x0000,
    SCE_MODULE_ATTR_CANT_STOP        = 0x0001,
    SCE_MODULE_ATTR_EXCLUSIVE_LOAD   = 0x0002,
    SCE_MODULE_ATTR_EXCLUSIVE_START  = 0x0004,
};

/** 
 * Module Privilege Levels - These levels define the permissions a 
 * module can have.
 */
enum SceModulePrivilegeLevel {
    /** Lowest permission. */
    SCE_MODULE_USER                 = 0x0000,
    /** MS modeul. POPS/Demo. */
    SCE_MODULE_MS                   = 0x0200,
    /** USB WLAN module. Gamesharing */
    SCE_MODULE_USBWLAN              = 0x0400,
    /** Application module. */
    SCE_MODULE_APP                  = 0x0600,
    /** VSH module. */
    SCE_MODULE_VSH                  = 0x0800,
    /** Kernel module. Highest permission. */
    SCE_MODULE_KERNEL               = 0x1000,
    /** The module uses KIRK's memlmd resident library. */
    SCE_MODULE_KIRK_MEMLMD_LIB      = 0x2000,
    /** The module uses KIRK's semaphore resident library. */
    SCE_MODULE_KIRK_SEMAPHORE_LIB   = 0x4000
};
</source>

== Modules imports-exports ==

Each module contains zero or more library exports and zero or more library imports. An exported library groups together related functions along with their [[NID]] and exports it for [[SceKernelModulemgr]] to link with a library import in another module.

=== Exports ===

An array of export entries defines all the libraries exported by the module.

==== Structure ====

Kernel modules that export syscalls (user accessible libraries) also get entries added to the [[Syscalls|syscall]] table. The syscall table is randomized on each boot so the same function will likely get a different [[Syscalls|syscall]] number assigned each time.

{| class="wikitable"
! Name !! Description
|-
| structsize || Size of the structure in bytes (usually 0x1C or 0x20)
|-
| auxattribute || Unknown. Was added recently. "reserved1" in SDK 0.945, may be reserved since.
|-
| version || Library version (usually 1)
|-
| attribute || [[Modules#Library_attribute|Library attributes bitflag]]
|-
| nfunc || Number of exported functions
|-
| nvar || Number of exported variables
|-
| ntlsvar || Number of exported TLS variables
|-
| hashinfo || Hash info (funcinfo + varinfo<<4). See [[Modules#Hash_Info]].
|-
| hashinfotls || TLS hash info. See [[Modules#Hash_Info]].
|-
| reserved2 || Reserved.
|-
| nidaltsets || Unknown. Usually 0.
|-
| libname || Pointer to library name. 0 for NONAME library.
|-
| libname_nid || Library [[NID]] (=NID computed from library name)
|-
| nidtable || Pointer to array of the exports' [[NID]]s
|-
| addtable || Pointer to array of the exports' addresses
|}

<source lang="C">
typedef struct _scelibent_psp { // size is 0x10 or 0x14 | Unofficial name? 0x14 form may be sceKernelLibraryEntryTable
	Elf32_Addr libname; /* <libname> (0 if NONAME) */
	unsigned short version; /* <version> */
	unsigned short attribute; /* <attribute> */
	unsigned char size; /* struct size in dwords */
	unsigned char nvar; /* number of variables */
	unsigned short nfunc; /* number of functions */
	Elf32_Addr entry_table; /* <entry_table> addr (in .rodata.sceResident) */
	union {
		unsigned int unk_0x10; /* Not always present. Might be alias_table. ex: 0x20000 */
	};
} SceLibEntryTable_psp;

typedef struct _scelibent { //Not used on PSP2. Used for PSP when structsize == 0x14?
  Elf32_Addr libname;
  unsigned short version;
  unsigned short attribute;
  unsigned char structsize;
  unsigned char nvar;
  unsigned short nfunc;
  Elf32_Addr entrytable;
  unsigned short nvar2;
  unsigned char hashinfo;
  unsigned char nidaltsets;
} sceKernelLibraryEntryTable;


typedef struct _scelibent_ppu_common {
    unsigned char structsize;
    unsigned char reserved1[1]; //a.k.a. 'auxattribute'
    unsigned short version;
    unsigned short attribute;
    unsigned short nfunc;
    unsigned short nvar;
    unsigned short ntlsvar;
    unsigned char hashinfo;
    unsigned char hashinfotls;
    unsigned char reserved2[1];
    unsigned char nidaltsets;
} sceKernelLibraryEntryTable_ppu_common;

typedef struct _scelibent_ppu32 {
  sceKernelLibraryEntryTable_ppu_common c;
  Elf32_Addr libname;
  Elf32_Addr nidtable;
  Elf32_Addr addtable;
} sceKernelLibraryEntryTable_ppu32;

//Old name: SceLibEntryTable_1C. Used in PRX1 format.
typedef struct _scelibent_ppu32 sceKernelLibraryEntryTable_arm;

typedef struct _scelibent_ppu_common sceKernelLibraryEntryTable_prx2_common;
typedef struct _scelibent_prx2arm {
    sceKernelLibraryEntryTable_prx2_common c;
    Elf32_Word libname_nid;
    Elf32_Addr libname;
    Elf32_Addr nidtable;
    Elf32_Addr addtable;
} sceKernelLibraryEntryTable_prx2arm; //Old name: SceLibEntryTable_20. Used in PRX2 format.
</source>

==== Hash Info ====

Hash info is a number which depends of the number of exports. It can have values: 0, 2, 4 or 6.

It is related to NID Hash Table, which is still a mystery.

<source lang="C">
#define HASHINFO_LIMIT 0x10
int getHashInfo(uint16_t num) {
	if ((HASHINFO_LIMIT == 0) || (num < HASHINFO_LIMIT))
		return 0;
	else if (num < 0x40)
		return 2;
	else if (num < 0x100)
		return 4;
	else
		return 6;
}

int getHashInfo(SceLibEntryTable_common *table) {
	return getHashInfo(table->nfunc) + getHashInfo(table->nvar) << 4;
}

int getHashInfoTls(SceLibEntryTable_common *table) {
	return getHashInfo(table->ntls);
}
</source>

==== NONAME exports ====

Old name was "syslib", short name for "system library".

There is a special export entry that always shows up (even when the module exports no libraries) with attribute 0x8000 and NID 0x00000000 that exports the module_start, module_stop, module_exit functions for example.

The NIDs for these exports are common for all modules. See [https://www.psdevwiki.com/ps3/NID here] for NID generation algorithm.

For PS Vita:

{| class="wikitable"
! Name !! Type !! NID !! Definition
|-
| module_start || Function || 0x935CD196 || <code>int module_start(SceSize arglen, const void *argp);</code>
|-
| module_stop || Function || 0x79F8E492 || <code>int module_stop(SceSize arglen, const void *argp);</code>
|-
| module_exit || Function || 0x913482A9 || <code>int module_exit(SceSize arglen, const void *argp);</code>
|-
| module_bootstart || Function || 0x5C424D40 || <code>int module_bootstart(SceSize arglen, const void *argp);</code>
|-
| module_suspend || Function || 0xDD42FA37 || <code>int module_suspend(void);</code> Supported in FW 0.990.030, unsupported as of firmware 3.65. Present in FW 0.990.030 [[SceKernelModulemgr]].
|-
| module_proc_create || Function || 0xE640E30C || <code>SceInt32 module_proc_create(ScePID pid, void* pParam, void* pCommon);</code> Supported in FW 0.931.010-0.990.030, unsupported as of firmware 3.65. Seemingly never used.
|-
| module_proc_exit || Function || 0x4F0EE5BD || <code>SceInt32 module_proc_exit(ScePID pid, void* pParam, void* pCommon);</code> Supported in FW 0.931.010-0.990.030, unsupported as of firmware 3.65. Seemingly never used.
|-
| module_proc_kill || Function || 0xDF0212B9 || <code>SceInt32 module_proc_kill(ScePID pid, void* pParam, void* pCommon);</code> Supported in FW 0.931.010-0.990.030, unsupported as of firmware 3.65. Seemingly never used.
|-
| module_info || Variable || 0x6C2224BA || <code>SceModuleInfo</code> structure
|-
| module_proc_param || Variable || 0x70FBA1E7 || <code>SceProcessParam</code> structure
|-
| module_sdk_version || Variable || 0x936C8A78 || <code>SceUInt32</code> variable - Used since at least System Software version 2.10.
|-
| module_dtrace_probes_info || Variable || 0x9318D9DD || <code>sdt_probes_info_t</code> structure. Present in [[SceKernelThreadMgr]], [[SceProcessmgr]], [[SceDisplay]]. Reserved for kernel modules. Used by [[SceDeci4pDtracep]].
|-
| module_dtrace_probes || Variable || 0x8CE938B1 || An array of <code>sdt_probes_info_t.count</code> pointers to <code>sdt_probedesc_t</code>. Present in [[SceKernelThreadMgr]], [[SceProcessmgr]], [[SceDisplay]]. Reserved for kernel modules. Used by [[SceDeci4pDtracep]].
|-
| sce_module_start_thread_parameter || Variable || 0x1A9822A4 || Pointer to <code>SceModuleThreadParameter</code>. Defines the parameters used to create the thread that runs the <code>module_start</code> function. Reserved for usermode modules.
|-
| sce_module_stop_thread_parameter || Variable || 0xD20886EB || Pointer to <code>SceModuleThreadParameter</code>. Defines the parameters used to create the thread that runs the <code>module_stop</code> function. Reserved for usermode modules.
|}

For PSP:

{| class="wikitable"
! Name !! Type !! NID !! Definition
|-
| module_start || Function || 0xD632ACDB || <code>int module_start(int arglen, const void *argp);</code>
|-
| module_stop || Function || 0xCEE8593C || <code>int module_stop(int arglen, const void *argp);</code>
|-
| module_bootstart || Function || 0xD3744BE0 || <code>int module_bootstart(int arglen, const void *argp);</code>
|-
| module_reboot_before || Function || 0x2F064FA6 || <code>int module_reboot_before(void);</code>
|-
| module_reboot_phase || Function || 0xADF12745 || <code>int module_reboot_phase(void)</code>
|-
| module_info || Variable || 0xF01D73A7 || <code>SceModuleInfo</code>
|-
| module_start_thread_parameter || Variable || 0x0F7C276C || <code>SceModuleThreadParameter</code>
|-
| module_stop_thread_parameter || Variable || 0xCF0CC697 || <code>SceModuleThreadParameter</code>
|-
| module_reboot_before_thread_parameter || Variable || 0xF4F4299D || <code>SceModuleThreadParameter</code>
|-
| module_sdk_version || Variable || 0x11B97506 || <code>int</code>
|-
| module_linked || Variable || 0x900DADE1 || 
|-
| module_unlinked || Variable || 0x592743D8 || 
|-
| module_text_checksum || Variable || 0x1D4042A5 || Checksum algorithm to be documented (MD5, CRC32, SHA-1?)
|}

<source lang="C">
# Temporary name was: SceModuleEntryThread
typedef struct SceModuleThreadParameter { // Size is 0x10 bytes on PSP, 0x14 on Vita
    /* The number of thread parameters. Must be 4 on Vita. */
    SceUInt32 numParams;
    /* The initial priority of the entry thread. Default value is SCE_KERNEL_DEFAULT_PRIORITY. */
    SceUInt32 initPriority;
    /* The stack size of the entry thread. Default value is SCE_KERNEL_THREAD_STACK_SIZE_DEFAULT_USER_MAIN (256KiB). */
    SceSize stackSize;
    /* The attributes of the entry thread. Always ignored on Vita. */
    SceUInt32 attr;
    /* The CPU affinity mask of the entry thread. Only present on Vita. Default value is SCE_KERNEL_THREAD_CPU_AFFINITY_MASK_DEFAULT. */
    SceInt32 cpuAffinityMask;
} SceModuleThreadParameter;

// Temporary names were: SceModuleStaticProbesInfo, SceModuleDTraceProbesInfo 
typedef struct sdt_probes_info { // size is 0x8 bytes on FWs 0.931.010-3.740.011
    unsigned int version; // Always 1
    unsigned int count; // Number of probes. ex: 1, 5, 7, 16
} sdt_probes_info_t;

typedef union {
	void (*handler0)(const struct sdt_probedesc *desc);
	void (*handler1)(const struct sdt_probedesc *desc, uintptr_t arg0);
	void (*handler2)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1);
	void (*handler3)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2);
	void (*handler4)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3);
	void (*handler5)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, uintptr_t arg4);
	void (*handler6)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5);
	void (*handler7)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6);
	void (*handler8)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6, uintptr_t arg7);
	void (*handler9)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6, uintptr_t arg7, uintptr_t arg8);
	void (*handler10)(const struct sdt_probedesc *desc, uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, uintptr_t arg4, uintptr_t arg5, uintptr_t arg6, uintptr_t arg7, uintptr_t arg8, uintptr_t arg9);
} sdpd_handler_t;

// Temporary names were: SceModuleStaticProbe, SceModuleDTraceProbe
typedef struct sdt_probedesc { // size is 0x28 on FWs 0.931.010-3.740.011
	unsigned int *sdpd_id; // probe ID
	const char *sdpd_provider; // name of provider
	const char *sdpd_name; // name of probe
	void *sdpd_offset; // instrumentation point (address)
	sdpd_handler_t *sdpd_handler_fn; // probe handler_fn function (NULL if disabled)
	void *sdpd_private; // probe private data
	void (*sdpd_create_fn)(const struct sdt_probedesc *desc); // probe create helper function (NULL if unused)
	void (*sdpd_enable_fn)(const struct sdt_probedesc *desc); // probe enable helper function (NULL if unused)
	void (*sdpd_disable_fn)(const struct sdt_probedesc *desc); // probe disable helper function (NULL f unused)
	void (*sdpd_destroy_fn)(const struct sdt_probedesc *desc); // probe destroy helper function (NULL if unused)
} sdt_probedesc_t;

typedef struct SceLibcParam { // size is 0x1C on FW 0.930, 0x30 on FWs 1.80-1.81, 0x38 on FWs 2.00-3.740.011
	SceSize size; // Size of this structure
	SceLibEntryTable_1C *_SceLibcParam_0001_ent_head; // Pointer to SceLibcParam library information
	SceSize *sceLibcHeapSize; // Pointer to heap size
	SceSize *__sceLibcHeapSizeDefault; // Pointer to heap size
	SceUInt32 *sceLibcHeapExtendedAlloc; // Pointer to flag to dynamically extend heap size
	SceUInt32 *sceLibcHeapDelayedAlloc; // Pointer to flag to allocate heap on first call to malloc
	SceUInt32 sdk_version; // SDK version
	SceUInt32 unk_1C; // ex: 9
	void *__sce_libc_alloc_replace; // Pointer to replacement functions for Libc memory allocation functions
	void *__sce_libcxx_alloc_replace; // Pointer to replacement functions for Libcxx (C++) memory allocation functions
	SceSize *heap_initial_size; // Pointer to dynamically allocated heap initial size
	SceUInt32 *heap_unit_1mb; // Pointer to flag to change alloc unit size from 64kB to 1MB
	union {
		struct {
			SceUInt32 *heap_detect_overrun; // Pointer to flag to detect heap buffer overruns
			void *__sce_libc_tls_alloc_replace; // Pointer to replacement functions for TLS memory allocation functions
		};
	};
} SceLibcParam;

typedef struct SceProcessParam { // size is 0x20 on FW 0.895, 0x2C on FW 0.931.010, 0x30 on FW 0.945, 0x34 on FW 3.60
	SceSize size; // Size of this structure
	SceUInt32 magic; // "PSP2"
	SceUInt32 version; // Version of this structure. Implies number of extended entries. ex: 1 on FW 0.895, 4 on FW 0.931.010, 5 on FW 0.945, 6 on FW 3.60
	SceUInt32 sdk_version; // ex: 0x00895000 on FW 0.895.000, 0x00931010 on FW 0.931.010
	union {
		struct {
			char *sceUserMainThreadName; // ex: "main_thread"
			SceInt32 sceUserMainThreadPriority; // ex: 0x20, 0xA0, 0x10000100
			SceUInt32 sceUserMainThreadStackSize; // ex: 256 * 1024, 1024 * 1024
			SceUInt32 sceUserMainThreadAttribute;
			char *sceProcessName;
			SceUInt32 sce_process_preload_disabled;
			SceUInt32 sceUserMainThreadCpuAffinityMask;
			SceLibcParam *sce_libcparam;
			SceUInt32 unk_0x30;
		};
	};
} SceProcessParam;
</source>

=== Imports ===

Each module can import any number of libraries from other modules by specifying the library [[NID]] to import along with a list of functions and variables [[NID]]s to import. [[SceKernelModulemgr]] does the dynamic linking by overwriting the import thunk (with an absolute address jump if both modules are in the same domain (usermode or kernel), or a [[Syscalls|syscall]] sequence for a usermode module importing a kernel-exported library). Kernel modules cannot import usermode libraries.

{| class="wikitable"
! Name !! Description
|-
| structsize || Size of the structure (usually 0x24, 0x2C or 0x34)
|-
| version || Library version (ex: 1, 5)
|-
| attribute || [[PRX#Library_attribute|Library attributes bitflag]]
|-
| nfunc || Number of imported functions
|-
| nvar || Number of imported variables
|-
| ntlsvar || Number of imported TLS variables
|-
| reserved || Reserved
|-
| libname_nid || Library [[NID]]
|-
| libname || Pointer to library name
|-
| sce_sdk_version || Usually 0
|-
| func_nidtable || Pointer to array of imported functions [[NID]]s
|-
| func_table || Pointer to array of imported functions thunks
|-
| var_nidtable || Pointer to array of imported variables [[NID]]s
|-
| var_table || Pointer to array of pointers to imported variables' reftables
|-
| tls_nidtable || Pointer to array of imported TLS variables [[NID]]s
|-
| tls_table || Pointer to array of pointers to imported TLS variables' reftables
|}

<source lang="C">
typedef struct _scelibstub_psp { // size is 0x14 or 0x18
  Elf32_Addr libname; /* library name */
  unsigned short version; /* version */
  unsigned short attribute; /* attribute */
  unsigned char size; /* struct size */
  unsigned char nvar; /* number of variables */
  unsigned short nfunc; /* number of function stubs */
  Elf32_Addr nid_table; /* functions/variables NID table */
  Elf32_Addr stub_table; /* functions stub table */
  union {
    Elf32_Addr var_table; /* variables table */
  };
} SceLibStubTable_psp;

typedef struct _scelibstub { // size is 0x1C. Not used on PSP2. Maybe used on PSP.
  Elf32_Addr libname;
  unsigned short version;
  unsigned short attribute;
  unsigned char structsize;
  unsigned char nvar;
  unsigned short nfunc;
  Elf32_Addr nidtable;
  Elf32_Addr stubtable;
  Elf32_Addr vstubtable;
  unsigned short nvar2;
  unsigned char reverse1;
  unsigned char reverse2;
} sceKernelLibraryStubTable;

typedef struct _scelibstub_ppu_common {
  unsigned char structsize;
  unsigned char reserved1[1];
  unsigned short version;
  unsigned short attribute;
  unsigned short nfunc;
  unsigned short nvar;
  unsigned short ntlsvar;
  unsigned char reserved2[4];
} sceKernelLibraryStubTable_ppu_common;

typedef struct _scelibstub_ppu32 {
  sceKernelLibraryStubTable_ppu_common c;
  Elf32_Addr libname;
  Elf32_Addr func_nidtable;
  Elf32_Addr func_table;
  Elf32_Addr var_nidtable;
  Elf32_Addr var_table;
  Elf32_Addr tls_nidtable;
  Elf32_Addr tls_table;
} sceKernelLibraryStubTable_ppu32;

typedef struct _scelibstub_ppu32 sceKernelLibraryStubTable_arm; // Old name: SceLibStubTable_2C. Used in PRX1 format.

typedef struct _scelibstub_ppu_common sceKernelLibraryStubTable_prx2_common;

typedef struct _scelibstub_prx2arm { // size is 0x34 - Used in PRX2 format.
  sceKernelLibraryStubTable_prx2_common c;
  Elf32_Word libname_nid;
  Elf32_Addr libname;
  Elf32_Word sce_sdk_version;
  Elf32_Addr func_nidtable;
  Elf32_Addr func_table;
  Elf32_Addr var_nidtable;
  Elf32_Addr var_table;
  Elf32_Addr tls_nidtable;
  Elf32_Addr tls_table;
} sceKernelLibraryStubTable_prx2arm; // Old name: SceLibStubTable_34

typedef struct _scelibstub_prx2arm_new { // size is 0x24 - Used in PRX2 format. This is a guessed name.
  unsigned char structsize;
  unsigned char reserved1[1];
  unsigned short version;
  unsigned short attribute;
  unsigned short nfunc;
  unsigned short nvar;
  unsigned short ntlsvar;
  Elf32_Word libname_nid;
  Elf32_Addr libname;
  Elf32_Addr func_nidtable;
  Elf32_Addr func_table;
  Elf32_Addr var_nidtable;  // Variable + TLS variable NIDs (?)
  Elf32_Addr var_table;     // Variable + TLS variable entries (?)
} sceKernelLibraryStubTable_prx2arm_new; // Old name: SceLibStubTable_24
</source>

==== <code>reftable</code> (Variable/function-address imports) ====

Variable imports are handled differently from function imports. While the entry in the function import table points to an import thunk, the entry in the variable import table points to a so-called <code>reftable</code> (probably '''ref'''erence '''table'''). If an imported function is used for other purposes than a function call, a <code>reftable</code> can also be generated for this function.

For example, the following C code verifies if a loosely imported function has been successfully bound to before calling it:
<source lang="c">
//NOTE: this may work with non-loosely imported functions but is non-sensical:
//Modulemgr will never start a module if non-loose imports can't be bound, 
//so the check will always evaluate to true for such functions.
//(The exception is app modules (e.g. eboot.bin) since ALL their imports are considered loose)
if (&loose_import_func != NULL) { 
  loose_import_func();
}
</source>

There are two <code>reftable</code> formats corresponding to the two executable formats supported by the OS.

===== Prx1 format =====

'''Prx1''' is the old format of PS vita executables. These executables use either the standard ELF types <code>ET_EXEC</code> and <code>ET_REL</code>, or the legacy 0xFFA5 (<code>ET_SCE_ARMRELEXEC</code>) as the value in the ELF header's <code>e_type</code>.

In this format, the <code>reftable</code> is simply an array of <code>Prx1RefInfo</code>s terminated by a NULL entry.

<source lang="c">
//8 bytes
typedef struct Prx1RefInfo {
    //N.B. bit fields are in little-endian order
    //For example, reltype occupies bits 7-0 of the SceUInt32
    SceUInt32 reltype:8; //Relocation type (r_type)
    SceUInt32 addend:24; //Relocation addend (r_addend) - sign-extended to 32-bits
    void* P;             //Virtual address where the reference lies
} Prx1RefInfo;

typedef struct ScePrx1RefTable {
    Prx1RefInfo info[];
} ScePrx1RefTable;

//Sample code to walk Prx1 reftable
void walk_Prx1_reftable(ScePrx1RefTable* pTable) {
    unsigned* infoptr = (unsigned*)&reftable->info;
    while (*infoptr != 0) {
      Prx1RefInfo* info = (Prx1RefInfo*)infoptr;

      //...do something with info...

      infoptr += sizeof(Prx1RefInfo)/sizeof(unsigned);
    }
}
</source>

===== Prx2 format =====

'''Prx2''' is the new format of PS Vita executables, in use since around PS Vita SDK 0.940. These executables use 0xFE00 (<code>ET_SCE_EXEC</code>) or 0xFE04 (<code>ET_SCE_RELEXEC</code>) as <code>e_type</code>.

In this format, a 32-bit value is prepended to the table and there are two possible forms for <code>refinfo</code> instead of a single one.

There are two revisions of the <code>reftable</code> that change the meaning of this 32-bit value (note that the <code>size</code> includes the 32-bit value in it):

{| class="wikitable"
|-
! Bit mask !! Header text
|-
! colspan="2" | New firmwares
|-
| 0xF0000000 || Must be 0
|-
| 0x0FFFFFF0 || <code>reftable</code> size (in bytes)
|-
| 0x0000000F || Reftable version? Must be 0
|-
! colspan="2" | Old firmwares
|-
| 0xFFFF0000 || Unused
|-
| 0x0000FFF0 || <code>reftable</code> size (in bytes)
|-
| 0x0000000F || Reftable version? Must be 0
|}

<source lang="c">
//8 bytes
typedef struct Prx2RefInfoForm1 {
    SceUInt32 form:4;    //1
    SceUInt32 segment:4; //Segment where reference lies
    SceUInt32 reltype:8; //Relocation type (r_type)
    SceUInt32 addend:16; //Relocation addend (r_addend) - sign-extended to 32-bits
    SceUInt32 offset;    //Offset where reference lies in segment (r_offset)
} Prx2RefInfoForm1;

//12 bytes
typedef struct Prx2RefInfoForm2 {
    SceUInt32 form:4;    //2
    SceUInt32 segment:4; //Segment where reference lies
    SceUInt32 reltype:8; //Relocation type (r_type)
    SceUInt32 unused:16; //Unused (padding)
    SceInt32 addend;     //Relocation addend (r_addend)
    SceUInt32 offset;    //Offset where reference lies in segment (r_offset)
} Prx2RefInfoForm2;

typedef struct ScePrx2RefTable_old { //Used until firmware ?.??
	SceUInt32 version:4; //Must be 0
        SceUInt32 size:12;
        SceUInt32 unused:16;
	unsigned char info[/* size - sizeof(SceUInt32) */];
} ScePrx2RefTable_old;

typedef struct ScePrx2RefTable { //Used since firmware ?.??
	SceUInt32 version:4; //Must be 0
        SceUInt32 size:24;
        SceUInt32 unk0_28:4; //Must be 0
	unsigned char info[/* size - sizeof(SceUInt32) */];
} ScePrx2RefTable;

//Sample code to walk Prx2 reftable
void walk_Prx2_reftable(ScePrx2RefTable* pTable) {
  /*assert(pTable->unk0_28 == 0); //for new format only */
    assert(pTable->version == 0);
    unsigned size = pTable->size;

    unsigned* infoptr = (unsigned*)pTable->info;
    unsigned* maxptr  = (unsigned*)(pTable->info + size);
    while(infoptr < maxptr) {
        unsigned form = *infoptr & 0xF;
        unsigned infosize;
        switch(form) {
          case 1:
            infosize = sizeof(Prx2RefInfoForm1);
            Prx2RefInfoForm1* info = (Prx2RefInfoForm1*)infoptr;
            //...do something with info...
            break;
          case 2:
            infosize = sizeof(Prx2RefInfoForm2);
            Prx2RefInfoForm2* info = (Prx2RefInfoForm2*)infoptr;
            //...do something with info...
            break;
          default:
            assert(0);
        }
        infoptr += size/sizeof(unsigned);
    }
    assert(infoptr == maxptr);
}
</source>

===== Function <code>reftable</code>s =====

To obtain the pointer to a function's associated <code>reftable</code>, use the following code:

<source lang="c">
void* get_function_reftable(SceLibStubTable_xxx* libstub, int function_index) {
    uintptr_t import_thunk = (uintptr_t)libstub->func_entry_table[function_index];

    //Import thunks are made of 3 ARM instructions (4 bytes each)
    //and a 4-byte pointer to the reftable (may be NULL)
    return *(void**)(import_thunk + 3 * 4);
}
</source>

=== Library attribute ===

Library attribute flags are ORed together and identified as follows:

{| class="wikitable"
! Bit !! Name !! Comments
|-
| 0x8000 || ?MAIN_EXPORT? || Set for main NONAME export.
|-
| 0x4000 || SYSCALL_EXPORT || In kernel modules only. Allow [[Syscalls|syscall]] export to usermode.
|-
| 0x2000 || PLUGIN_LINK || Lets the library's exports table be managed on-the-fly by the module itself. If used together with --plugin-header option, switches armlibgen.exe to some special mode, making it generate headers for use with [[SceLibKernel#sceKernelLinkFunctionTable]]. It also requires function prototypes to be defined in the EMD file. On PS3, it seems to indicate a non-PRX library (like "stdc" or "allocator") that comes from somewhere else (LV2?).
|-
| 0x8 || LOOSE_IMPORT || ?Set when the library has the WEAK_EXPORT flag in its exporting module.?
|-
| 0x4 || NOLINK_EXPORT || 
|-
| 0x2 || WEAK_EXPORT || ?kernel non-driver export?
|-
| 0x1 || AUTO_EXPORT || Makes the library importable. Should be set unless it is the main export.
|}

== Relocations ==

See [https://wiki.henkaku.xyz/vita/images/a/a2/Vita_SDK_specifications.pdf] for more information on how PS Vita relocations work.

Relocations are stored within the PT_SCE_RELA segment.

There are 10 relocation entry formats. It is determined by r_format (the first 4 bits of the relocation entry).

Warning! In PS Vita FWs <= 3.00, only relocation entry format 0 is available. Using any other relocation entry format gives error 0x8002D019.

<source lang="C">
// assuming LSB of bitfield is listed first
union {
	Elf32Word r_format: 4;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_symbol_segment : 4;
		Elf32Word r_type : 8;
		Elf32Word r_patch_segment : 4;
		Elf32Word r_type2 : 8;
		Elf32Word r_dist2 : 4;

		Elf32Word r_addend;

		Elf32Word r_offset;
	} r_entry_0;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_symbol_segment : 4;
		Elf32Word r_type : 8;
		Elf32Word r_patch_segment : 4;
		Elf32Word r_offset_lo : 12;

		Elf32Word r_offset_hi : 10;
		Elf32Word r_addend : 22;
	} r_entry_1;

	// Used by var import relocations
	struct {
		Elf32Word r_format : 4;
		Elf32Word r_symbol_segment : 4;
		Elf32Word r_type : 8;
		Elf32Word r_patch_segment : 2;
		Elf32Word r_unk : 2;
		Elf32Word r_pad : 4;

		Elf32Word r_offset;
	} r_entry_1_alt;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_symbol_segment : 4;
		Elf32Word r_type : 8;
		Elf32Word r_offset : 16;

		Elf32Word r_addend;
	} r_entry_2;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_symbol_segment : 4;
		Elf32Word r_ins_mode : 1; // ARM = 0, THUMB = 1
		Elf32Word r_offset : 18;
		Elf32Word r_dist2 : 5;

		Elf32Word r_addend : 22;
	} r_entry_3;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_offset : 23;
		Elf32Word r_dist2 : 5;
	} r_entry_4;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_dist1 : 9;
		Elf32Word r_dist2 : 5;
		Elf32Word r_dist3 : 9;
		Elf32Word r_dist4 : 5;
	} r_entry_5;

	struct {
		Elf32Word r_format : 4;
		Elf32Word r_offset : 28;
	} r_entry_6;

	struct {
		Elf32Word r_format : 4;
		// r_format 7 has 4 offsets, 7 bits each
		// r_format 8 has 7 offsets, 4 bits each
		// r_format 9 has 14 offsets, 2 bits each
		Elf32Word offsets : 28;
	} r_entry_7_8_9;
} SceRel;
</source>

=== Format 0 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 0.
|-
| 4 || 7 || Symbol segment index
|-
| 8 || 15 || Relocation type
|-
| 16 || 19 || Patch segment index
|-
| 20 || 26 || Second relocation type
|-
| 27 || 31 || Distance from offset (used for second relocation)
|-
| 32 || 63 || Addend
|-
| 64 || 95 || Offset
|}

=== Format 1 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 1.
|-
| 4 || 7 || Symbol segment index
|-
| 8 || 15 || Relocation type
|-
| 16 || 19 || Patch segment index
|-
| 20 || 41 || Offset
|-
| 42 || 63 || Addend
|}

=== Format 2 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 2.
|-
| 4 || 7 || Symbol segment index
|-
| 8 || 15 || Relocation type
|-
| 16 || 31 || Offset
|-
| 32 || 64 || Addend
|}

=== Format 3 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 3
|-
| 4 || 7 || Symbol segment index
|-
| 8 || 8 || Mode (ARM = 0, THUMB = 1)
|-
| 9 || 26 || Offset
|-
| 27 || 31 || Distance from offset
|-
| 32 || 64 || Addend
|}

=== Format 4 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 4.
|-
| 4 || 26 || Offset
|-
| 27 || 31 || Distance from offset
|}

=== Format 5 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 5.
|-
| 4 || 12 || Distance 1
|-
| 13 || 17 || Distance 2
|-
| 18 || 26 || Distance 3
|-
| 27 || 31 || Distance 4
|}

=== Format 6 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 6.
|-
| 4 || 31 || Offset
|}

=== Format 7 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 7.
|-
| 4 || 10 || Offset 1
|-
| 11 || 17 || Offset 2
|-
| 18 || 24 || Offset 3
|-
| 25 || 31 || Offset 4
|}

=== Format 8 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 8.
|-
| 4 || 7 || Offset 1
|-
| 8 || 11 || Offset 2
|-
| 12 || 15 || Offset 3
|-
| 16 || 19 || Offset 4
|-
| 20 || 23 || Offset 5
|-
| 24 || 27 || Offset 6
|-
| 28 || 31 || Offset 7
|}

=== Format 9 ===
{| class="wikitable"
|-
! Start !! End !! Description
|-
| 0 || 3 || Entry format. Set to 9.
|-
| 4 || 5 || Offset 1
|-
| 6 || 7 || Offset 2
|-
| 8 || 9 || Offset 3
|-
| 10 || 11 || Offset 4
|-
| 12 || 13 || Offset 5
|-
| 14 || 15 || Offset 6
|-
| 16 || 17 || Offset 7
|-
| 18 || 19 || Offset 8
|-
| 20 || 21 || Offset 9
|-
| 22 || 23 || Offset 10
|-
| 24 || 25 || Offset 11
|-
| 26 || 27 || Offset 12
|-
| 28 || 29 || Offset 13
|-
| 30 || 31 || Offset 14
|}

=== Supported Relocation Codes (as of FW 3.60) ===

{| class="wikitable"
|-
! Code !! Name !! Description
|-
| 0 || R_ARM_NONE || No relocation
|-
| 2 || R_ARM_ABS32 || Direct 32-bits address
|-
| 3 || R_ARM_REL32 || N/A
|-
| 10 || R_ARM_THM_CALL || bl/blx on Thumb mode
|-
| 28 || R_ARM_CALL || bl/blx on ARM mode
|-
| 29 || R_ARM_JUMP24 || N/A
|-
| 38 || R_ARM_TARGET1 || same as R_ARM_ABS32
|-
| 40 || R_ARM_V4BX || same as R_ARM_NONE
|-
| 41 || R_ARM_TARGET2 || same as R_ARM_REL32
|-
| 42 || R_ARM_PREL31 || N/A
|-
| 43 || R_ARM_MOVW_ABS_NC || movw on ARM mode
|-
| 44 || R_ARM_MOVT_ABS || movt on ARM mode
|-
| 47 || R_ARM_THM_MOVW_ABS_NC || movw on Thumb mode
|-
| 48 || R_ARM_THM_MOVT_ABS || movt on Thumb mode
|-
| 255 || R_ARM_RBASE || Ignored
|}

== Tools ==

=== Tools for IDA PRO ===

* [https://github.com/xyzz/vitadump PS Vita PRX Loader for IDA PRO by xyz]
* [https://github.com/xyzz/vita-ida-physdump PS Vita Physical Memory Dump Loader for IDA PRO by xyz]

=== Tools for Ghidra ===

* [https://github.com/xerpi/GhidraVitaLoader PS Vita PRX Loader for Ghidra by xerpi]
* [https://github.com/CreepNT/VitaLoaderRedux PS Vita PRX Loader for Ghidra by CreepNT]
* PS Vita/PSP PRX Loader for Ghidra by CelesteBlue (link to add)

=== Tools for Binary Ninja ===

* [https://github.com/computerman00/BinaryNinja-PSVitaLoader PS Vita PRX Loader for Binary Ninja by computerman00]