SceSblSsMgr

sceSblSsMgrGetSysconDataForKernel
for example gets 0x20 bytes of data for act_sm.self command 0x4 call.

this is done by passing offset 0x520 as first argument.

return_ffffffff
return -1; // 0xFFFFFFFF

sceSblQafManagerGetQafNameForKernel
Uses string "qaf_workaround" under certain conditions.

SceSblSsMgrForDriver
Cryptographic functions in this module typically have 3 variations:
 * 1) Use   - meaning that the key that you provide is used directly for encryption/decryption.
 * 2) Use   - meaning that you have to use sceSblAuthMgrSetDmac5Key function to set the key into a specific slot.
 * 3) * Note that in this case you select a key from F00D by . It will be encrypted by F00D and placed into the slot selected by.
 * 4) Use   - meaning that the call to sceSblAuthMgrSetDmac5Key will happen internally.
 * 5) * In this case the key from F00D is also selected by  and encrypted by F00D. It is then placed into one of the available slots. Default slot range is 0xC-0x17.

sceSblSsMgrGetRandomDataForDriver
Generates random data of length 0x40 by executing Dmac5 command 0x04

used in SceKrm, SceSblGcAuthMgr

sceSblSsMgrGetRandomDataCropForDriver
Generates random data of length 0x40 by executing Dmac5 command 0x04

Data is then cropped to fit the size in outputBuffer.

used by SceMsif

sceSblSsMgrAESECBEncryptForDriver
Executes Dmac5 command 0x1

used in ScePfsMgr

sceSblSsMgrAESECBDecryptForDriver
Executes Dmac5 command 0x02

used ScePfsMgr

sceSblSsMgrAESECBEncryptForDriver
Executes Dmac5 command 0x01

used in SceSblMgKeyMgr

sceSblSsMgrAESECBDecryptForDriver
Executes Dmac5 command 0x02

used by SceSblMgKeyMgr

sceSblSsMgrAESECBEncryptWithKeygenForDriver
Executes Dmac5 command 0x01

used in ScePfsMgr

sceSblSsMgrAESECBDecryptWithKeygenForDriver
Executes Dmac5 command 0x02

no usages found

sceSblSsMgrDES64ECBEncryptForDriver
This also implements 3DES. Chosen function depends on key size.

for 0x40 - DES

for 0x80 - not tested. assuming 3DES with K1 = K3.

for 0xC0 - 3DES

Executes Dmac5 command 0x41

used in SceMsif, SceSblMgKeyMgr

sceSblSsMgrDES64ECBDecryptForDriver
This also implements 3DES. Chosen function depends on key size.

for 0x40 - DES

for 0x80 - not tested. assuming 3DES with K1 = K3.

for 0xC0 - 3DES

Executes Dmac5 command 0x42

used in SceSblMgKeyMgr

sceSblSsMgrDES64CBCEncryptForDriver
This also probably implements 3DES. Chosen function depends on key size.

for 0x40 - DES

for 0x80 - not tested. assuming 3DES with K1 = K3.

for 0xC0 - 3DES

Executes Dmac5 command 0x49

no usages found

sceSblSsMgrDES64CBCDecryptForDriver
This also probably implements 3DES. Chosen function depends on key size.

for 0x40 - DES

for 0x80 - not tested. assuming 3DES with K1 = K3.

for 0xC0 - 3DES

Executes Dmac5 command 0x4A

no usages found

sceSblSsMgrAESCBCEncryptForDriver
Executes Dmac5 command 0x09

used by ScePfsMgr

sceSblSsMgrAESCBCDecryptForDriver
Executes Dmac5 command 0x0A

used by ScePfsMgr

sceSblSsMgrAESCBCEncryptWithKeygenForDriver
Executes Dmac5 command 0x09

used by ScePfsMgr

sceSblSsMgrAESCBCDecryptWithKeygenForDriver
Executes Dmac5 command 0x0A

used by ScePfsMgr

sceSblSsMgrAESCTREncryptForDriver
Executes Dmac5 command 0x21

used by SceNpDrm

this function can also be used for decryption since CTR is symmetric function

sceSblSsMgrAESCTRDecryptForDriver
Executes Dmac5 command 0x22

no usages found

this function can also be used for encryption since CTR is symmetric function

sceSblSsMgrSHA1ForDriver
Executes Dmac5 command 0x03

used by ScePfsMgr

key_size is always 0x100 bits

sceSblSsMgrHMACSHA1ForDriver
Executes Dmac5 command 0x23

used by ScePfsMgr

key_size is always 0x100 bits

sceSblSsMgrHMACSHA1WithKeygenForDriver
Executes Dmac5 command 0x23

no usages found

key_size is always 0x100 bits

sceSblSsMgrHMACSHA256ForDriver
Executes Dmac5 command 0x33

no usages found

sceSblSsMgrAESCMACForDriver
Executes Dmac5 command 0x3B

used in ScePfsMgr

sceSblSsMgrAESCMACWithKeygenForDriver
Executes Dmac5 command 0x3B

used in ScePfsMgr

sceSblSsMgrAESCMACForDriver
Executes Dmac5 command 0x3B

no usages found

sceSblSsMgrExecuteDmac5HashCommandForDriver
Executes Dmac5 commands related to hashe functions

used by SceNpDrm

sceSblSsMgrGetConsoleIdForDriver
This function obtains ConsoleId by executing aimgr_sm.self F00D command 0x1

sceSblSsMgrGetOpenPsIdForDriver
This function returns information from a static buffer that is initialized on module_start.

Read OpenPsId from sysroot_buffer+0x70 using sceSysrootGetSysrootBufferForKernel.

sceSblSsMgrEncryptWithPortabilityForDriver
derived from

strangely enough does not use communication with F00D through command 0x1000A from encdec_w_portability_sm.self

sceSblSsMgrDecryptWithPortabilityForDriver
derived from

decrypts or derives aes key that is used in msif to decrypt static sha224 table

communication with F00D is done with command 0x2000A from encdec_w_portability_sm.self

sceSblSsMgrGetVisibleId
In old firmwares this function was named.

derived from

Executes F00D aimgr_sm.self command 0x3.

sceSblSsMgrGetNvsDataForDriver
derived from

uses syscon function to get the data

sceSblSsMgrSetNvsDataForDriver
derived from

uses syscon function to set the data

sceSblSsMgrGetPscodeForDriver
derived from

This function returns information from a static buffer that is initialized on module_start.

Read PsCode from sysroot_buffer+0xA0 using sceSysrootGetSysrootBufferForKernel.

sceSblSsMgrGetPscode2ForDriver
Executes F00D aimgr_sm.self command 0x4.

derived from

sceSblSsMgrCreatePassPhraseForDriver
executes F00D aimgr_sm.self command 0x5

derived from

unk_e0b13ba7
Used by SceSblUpdateMgr - does some initialization

unk_c38d0cea
Used by SceSblUpdateMgr - does some cleanup

sceSblSsMgrMemsetForDriver
Used by SceSblPostSsMgr

SceSblSsMgr
This library exists on 1.69 but doesn't exist on 3.60.

sceSblQafMgrGetQafToken
On 3.60 returns 0x80010058.

sceSblQafManagerSetQafTokenForUser
On 3.60 returns 0x80010058.

sceSblQafManagerDeleteQafTokenForUser
On 3.60 returns 0x80010058.

sceSblQafManagerGetQafNameForUser
Wrapper to sceSblQafManagerGetQafNameForKernel.

sceSblQafMgrIsAllowMinimumDebugMenuDisplay
return sysroot_buffer->qa_flags[0xF] & 1;

sceSblQafMgrIsAllowLimitedDebugMenuDisplay
return (sysroot_buffer->qa_flags[6] >> 1) & 1;

sceSblQafMgrIsAllowAllDebugMenuDisplay
return (sysroot_buffer->qa_flags[0xC] >> 1) & 1;

sceSblQafManagerIsAllowKernelDebugForUser
return sysroot_buffer->qa_flags[0xD] & 1;

sceSblQafMgrIsAllowForceUpdate
return (sysroot_buffer->qa_flags[0xF] >> 1) & 1;

sceSblQafMgrIsAllowNpFullTest
return (sysroot_buffer->qa_flags[6] >> 1) & 1;

sceSblQafMgrIsAllowNonQAPup
return sysroot_buffer->qa_flags[0xF] & 1;

sceSblQafMgrIsAllowScreenShotAlways
return (sysroot_buffer->qa_flags[6] >> 1) & 1;

sceSblQafMgrIsAllowRemoteSysmoduleLoad
return (sysroot_buffer->qa_flags[0xD] >> 1) & 1;

sceSblDmac5HashTransform
This function can execute the following dmac5 commands:
 * 0x3B: CMAC-AES (length 0x10)
 * 0x3: SHA1 (length 0x14)
 * 0x23: HMAC-SHA1 (length 0x14)
 * 0x13: SHA256 (length 0x20)
 * 0x33: HMAC-SHA256 (length 0x20)

sceSblDmac5EncDecKeyGen
This function is also called  or   in

sceSblDmac5HmacKeyGen
This function called  in SceSysLibTrace but is also called   in