SceAppMgr

AppId
Some functions take an AppId as argument.

Data segment layout
On 3.60 :

Explanation
AppMgr operates with such term as.

Different ids correspond to different paths and are described at SceAppMgr_Mount_IDs

There are many different mount functions in AppMgr which mount different paths with corresponding.

However on the bottom level there is only one single function that is responsible for all mount operations.

It is located in segment 0 at offset 0x19B51 on 3.60.


 * pid - current process pid.


 * mount_ctx_holder - root holder of appmgr_mount_t (stored in segment 1).


 * mount_id - mount id to use for this mount operation.


 * title_id - title id of the application.


 * physical_path - path like ux0:app/


 * mount_drive - virtual drive like app0:. This may be also randomly generated. This argument goes to . This argument is optional. When empty - will be generated by.


 * klicensee - klicensee for this mount operation. This argument is optional.


 * mount_point_result - mountpoint for the user. Returned from.

AppMgr maintains two parallel lists in segment 1.

One of the lists contains  items.

These are the items that are exposed to user of AppMgr library.

is what is returned as  when user calls some mount functions in AppMgr.

in many cases is randomly generated (but not always).

Other list is an internal list of  items.

These items store arguments that are used for calling PFS mount.

Each item also has randomly generated  in form of PDXXXXXXXXXXXXd.

When  is called, it creates both   and   items and links them with.

Each item is put in a corresponding list.

This mapping relation is important and shows how AppMgr mountpoint translates to PfsMgr mountpoint.

All basic relations are shown on a diagram example with black color.

However there is another  relation between items which is especially important for sceAppMgrGameDataMountForDriver.

This relation is illustrated on diagram with red color and applies to pairs of s: 0x3E8,0x3E9 or 0x3EA, 0x3EB.

Such relation is used to setup multiple mount levels. For example app (0x3E8) with patch (0x3E9) on top. Or addcont (ro) (0x3EA) with addcont (rw) (0x3EB) on top.

Additionally multiple mount levels are controlled using fios overlays, hence  in.

Overlay is a concept of filesystem path redirection/remapping. Additional description is at SceFios2Kernel

Table below shows how overlays are created for 0x3E8, 0x3E9, 0x3EA, 0x3EB for given

Overlay is created with sceFiosKernelOverlayAddForProcessForDriver

This results in a path remapping, where when user reads from  virtual drive, he will actually read from.

However if patch directory was present, further path remapping will happen, so that user will read from.

sceAppMgrAcInstGetAcdirParamForDriver

 * mount PFS drive 0 to path gro0:acinst/ with mountid 0x3EA
 * read keystone from :sce_sys/keystone into outputData
 * extract klicensee from gro0:license/addcont/ //xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.rif
 * execute pfs ioctl command 0x4402 with klicensee
 * execute pfs ioctl command 0x4403
 * read gro0:acinst/ //sce_sys/param.sfo
 * read game title into outputData

sceAppMgrAppDataMountByIdForDriver
Only valid appmgr mount ids are:,  ,  ,

sceAppMgrAppDataMountForDriver
Only valid appmgr mount ids are:,  ,  ,  ,  ,  ,  ,  ,

sceAppMgrCloudDataDstCreateMountForDriver

 * check authid SceShell(0x2800000000000001), SceContentManager(0x280000000000002D)
 * do some ioctl check 0x3001
 * create directory ux0:user/XX/savedata_plus/work/
 * create sealedkey
 * retrieve klicensee
 * pure mount PFS PDXXXXXXXXXXXX mountpoint to pfs mount ux0:user/XX/savedata_plus/work/ path and authid 0x2800000000000001 or 0x280000000000002D
 * create directory ux0:user/XX/savedata_plus/work//sce_sys
 * write file ux0:user/XX/savedata_plus/work//sce_sys/sealedkey
 * unmount PFS PDXXXXXXXXXXXX mountpoint
 * mount PFS tsXXXXXXXXXXXX: mountpoint to ux0:user/XX/savedata_plus/work/ path with mountid 0x3ED

sceAppMgrCloudDataSrcMountForDriver

 * check auth id SceShell(0x2800000000000001), SceContentManager(0x280000000000002D), SceDailyCheckerBg(0x2800000000000039)
 * select path depending on mode: ux0:/user/XX/savedata/ or grw0:savedata/
 * read sealedkey from ux0:/user/XX/savedata/ /sce_sys/sealedkey or grw0:savedata/ /sce_sys/sealedkey
 * mount PFS tsXXXXXXXXXXXX: mountpoint to ux0:/user/XX/savedata/ or grw0:savedata/ path with mountid 0x3ED

sceAppMgrFakeSaveDataCreateMountForDriver

 * check authid fake_package_installer(0x280000000000002E)
 * resolve overlay for
 * create directory
 * do some ioctl check 0x3001
 * create sealedkey
 * pure mount PFS PDXXXXXXXXXXXX mountpoint to pfs mount path without klicensee and authid 0x280000000000002E
 * create directory /sce_sys
 * write file /sce_sys/sealedkey
 * write empty file /sce_sys/keystone
 * unmount PFS PDXXXXXXXXXXXX mountpoint
 * mount PFS tsXXXXXXXXXXXX: mountpoint to path with mountid 0x3ED

sceAppMgrGameDataMountForDriver

 * read and parse /sce_sys/param.sfo
 * check that path does not start from one of these host0:, ux0:data, vs0:
 * create /sce_pfs folder if required
 * check if /sce_sys/clearsign exists
 * get klicensee from rif (from fixed name at /license/app/ or from )
 * check /sce_sys/package/head.bin vs /sce_sys/clearsign
 * mount PFS gpXXXXXXXXXXXd: mountpoint to <app_path> path with mountid 0x3E8
 * override with another mount PFS gpXXXXXXXXXXXd: mountpoint to <patch_path> path with 0x3E9 if <patch_path> exists
 * check that path does not start with ux0:data
 * create ux0:patch/<TITLEID> or grw0:patch/<TITLEID> path
 * override with another mount PFS gpXXXXXXXXXXXd: mountpoint to ux0:patch/<TITLEID> or grw0:patch/<TITLEID> path with 0x3E9 if path exists

sceAppMgrLaunchAppByPathForDriver
Loads a SELF at a given path with optional arguments. Arguments is a null-separated string. Arguments are passed directly to the app as a list of strings.

Special arguments are listed below:

Example:

sceAppMgrMmsMountForDriver

 * check that mountId is 0x190 or 0x191 or 0x192
 * calls non exported function equal to kernel level of sceAppMgrAppDataMountForDriver

sceAppMgrPhotoMountForDriver
Call sceAppMgrAppDataMountForDriver with mount_id 0x64.

sceAppMgrTrophyMountForDriver

 * check that mountId is 0x12C or 0x12E
 * calls non exported function equal to kernel level of sceAppMgrAppDataMountForDriver

sceAppMgrUmountForDriver
derived from _sceAppMgrUmount

The following mount points can be derived from the code:
 * "photo0:" (0x64)
 * "music0:" (0x69)
 * "video0:" (0x6D)
 * "addcont0:"
 * "addcont1:"

sceAppMgrWorkDirMountForDriver
only valid appmgr mount ids are:,  ,  ,  ,  ,

sceAppMgrGetUserDirPathForDriver
derived from _sceAppMgrGetUserDirPath

SceAppMgrForDriver_unk_504023C8
Used by SceDeci4pLoadp. if SceSblACMgrForDriver_AD717E7A return's not 0, callable this function.

sceAppMgrSpawnProcessExtForDriver
Call sceKernelSpawnProcessExtForKernel.

sceAppMgrKillAppForDebugger
Temp name was sceAppMgrKillProcessForDriver.

__sceAppMgrGetAppState
exported to user by

_sceAppMgrAcidDirSet
exported to user by

_sceAppMgrAcquireSoundOutExclusive3
exported to user by

_sceAppMgrAddContAddMount
exported to user by


 * verify that titleid belongs to one of currently running titleids
 * mount PFS to ux0:addcont/ or grw0:addcont/ path with mountid 0x3EA
 * read keystone from :sce_sys/keystone
 * verify keystone passcode

_sceAppMgrAddContMount
exported to user by


 * if path is gro0:
 * produce path gro0:addcont/
 * else
 * obtain path ux0:addcont/ or grw0:addcont/


 * mount PFS to one of 3 paths with mountid 0x3EA


 * if first mount succeeded
 * check that mount drive is addcont0:
 * read keystone form :sce_sys/keystone
 * verify keystone content
 * if path is gro0:
 * obtain path ux0:addcont/ or grw0:addcont/
 * mount PFS to one of 2 paths with mountid 0x3EB
 * check that mount drive is addcont0:
 * read keystone form :sce_sys/keystone
 * verify keystone content


 * if first mount failed:
 * if path is gro0:
 * obtain path ux0:addcont/ or grw0:addcont/
 * mount PFS to one of 2 paths with mountid 0x3EA
 * check that mount drive is addcont0:
 * read keystone form :sce_sys/keystone
 * verify keystone content


 * check that mounted drive is indeed addcont0:

_sceAppMgrAppDataMountById
exported to user by

Only valid appmgr mount ids are:,  ,  ,

_sceAppMgrAppDataMount
exported to user by

Use sceAppMgrUmount to unmount this.

Only valid appmgr mount ids are:,  ,  ,  ,  ,  ,  ,  ,

_sceAppMgrAppMount
exported to user by

_sceAppMgrAppParamGetInt
exported to user by

_sceAppMgrAppParamGetString
exported to user by

This is used to retrieve SFO information. The cmd probably corresponds to and index of SFO entries. See the examples for which entries they may be. Example from store_checkout_plugin.

On WebKit:

0xC - return current process application name

0x8 - gda

On PSM Dev:

_sceAppMgrAppParamSetString
exported to user by

_sceAppMgrAppUmount
exported to user by

_sceAppMgrBgdlGetQueueStatus
exported to user by

_sceAppMgrCaptureFrameBufDMACByAppId
exported to user by

_sceAppMgrCaptureFrameBufIFTUByAppId
exported to user by

_sceAppMgrCheckRifGD
exported to user by

Checks game data rif from \license\app\.

_sceAppMgrContentInstallPeriodStart
exported to user by

Example from store_checkout_plugin. Parameters are uncertain.

_sceAppMgrContentInstallPeriodStop
exported to user by

Example from store_checkout_plugin.


 * calls non exported function equal to kernel level of sceAppMgrAddContMount
 * clears flag 0x1000000 if it is set (in internal structure of one of mountpoints in list in AppMgr )

_sceAppMgrConvertVs0UserDrivePath
Exported to user by SceDriverUser.

Pass in a non-restricted vs0: path and an empty buffer and the buffer will be filled with the path of a temporary mount point.

Example from libssl.

_sceAppMgrDeclareShellProcess2
exported to user by

_sceAppMgrDestroyAppByName
exported to user by

_sceAppMgrDrmClose
exported to user by

_sceAppMgrDrmOpen
exported to user by

_sceAppMgrForceUmount
exported to user by

_sceAppMgrGameDataMount
exported to user by

_sceAppMgrGetAppInfo
exported to user by

_sceAppMgrGetAppMgrState
exported to user by

_sceAppMgrGetAppParam2
exported to user by

_sceAppMgrGetAppParam
exported to user by

_sceAppMgrGetBootParam
exported to user by

_sceAppMgrGetBudgetInfo
exported to user by

Example from webcore

_sceAppMgrGetCoredumpStateForShell
exported to user by

_sceAppMgrGetCurrentBgmState2
exported to user by

_sceAppMgrGetCurrentBgmState
exported to user by

_sceAppMgrGetDevInfo
exported to user by

Example from store_checkout_plugin.

_sceAppMgrGetFgAppInfo
exported to user by

_sceAppMgrGetIdByName
exported to user by

_sceAppMgrGetMediaTypeFromDriveByPid
exported to user by

_sceAppMgrGetMediaTypeFromDrive
exported to user by

_sceAppMgrGetMountProcessNum
exported to user by

_sceAppMgrGetNameById
exported to user by

_sceAppMgrGetPfsDrive
exported to user by

_sceAppMgrGetPidListForShell
exported to user by

This function has two IsShell checks, AuthId and pid check

_sceAppMgrGetRawPathOfApp0ByAppIdForShell
exported to user by

appId possible values

_sceAppMgrGetRawPathOfApp0ByPidForShell
exported to user by

_sceAppMgrGetRawPath
exported to user by

_sceAppMgrGetRecommendedScreenOrientation
exported to user by

_sceAppMgrGetRunningAppIdListForShell
exported to user by

_sceAppMgrGetSaveDataInfoForSpecialExport
exported to user by


 * check that current app auth id is SceContentManager (0x280000000000002D)
 * check some flag set by SceSblPostSsMgrForDriver (related to utoken_sm.self F00D commands)
 * read sealedkey from /sce_sys/sealedkey to restore klicensee
 * mount PFS tsXXXXXXXXXXXX: mountpoint to path with mount ID 0x3ED
 * get ACCOUNT_ID from /sce_sys/param.sfo

_sceAppMgrGetSaveDataInfo
exported to user by

_sceAppMgrGetStatusByAppId
exported to user by

_sceAppMgrGetStatusById
exported to user by

_sceAppMgrGetStatusByName
exported to user by

_sceAppMgrGetSystemDataFilePlayReady
exported to user by

_sceAppMgrGetUserDirPathById
exported to user by

_sceAppMgrGetUserDirPath
exported to user by

_sceAppMgrGetVs0UserDataDrive
exported to user by

Get drive for mountId 0x3EF.

_sceAppMgrGetVs0UserModuleDrive
exported to user by

Get drive for mountId 0x3EE.

_sceAppMgrInitSafeMemoryById
exported to user by

_sceAppMgrInstallDirMount
exported to user by

_sceAppMgrIsCameraActive
exported to user by

_sceAppMgrLaunchAppByName2ForShell
exported to user by

_sceAppMgrLaunchAppByName2
exported to user by

_sceAppMgrLaunchAppByName2ndStage
exported to user by

_sceAppMgrLaunchAppByNameForShell
exported to user by

_sceAppMgrLaunchAppByName
exported to user by

_sceAppMgrLaunchAppByPath4
exported to user by

_sceAppMgrLaunchAppByUri2
exported to user by

_sceAppMgrLaunchAppByUri
exported to user by

_sceAppMgrLaunchVideoStreamingApp
exported to user by

Note: Can only be run from SceShell or Webkit context or 0x8080201F is returned.

_sceAppMgrLoadExec
exported to user by

_sceAppMgrLoadSaveDataSystemFile
exported to user by


 * check auth id SceShell(0x2800000000000001), fake_package_installer(0x280000000000002E)
 * resolve overlay for
 * create directory if required
 * create /sce_pfs directory if required
 * mount PFS to path with mountid 0x3ED
 * read /sce_sys/param.sfo

_sceAppMgrLoopBackFormat
exported to user by

_sceAppMgrLoopBackMount
exported to user by


 * check that mountId is 0x258
 * calls non exported function equal to kernel level of

_sceAppMgrMmsMount
exported to user by

_sceAppMgrOverwriteLaunchParamForShell
exported to user by

_sceAppMgrPeekLaunchParamForShell
exported to user by

_sceAppMgrPhotoMount
exported to user by

_sceAppMgrPhotoUmount
exported to user by

_sceAppMgrPspSaveDataGetParams
exported to user by

_sceAppMgrPspSaveDataRead
exported to user by

_sceAppMgrPspSaveDataRootMount
exported to user by


 * check that mountId is 0xCA
 * calls non exported function equal to kernel level of sceAppMgrAppDataMountForDriver

_sceAppMgrReceiveEventNum
exported to user by

_sceAppMgrReceiveEvent
exported to user by

_sceAppMgrReceiveNotificationRequestForShell
exported to user by

_sceAppMgrReceiveShellEvent
exported to user by

_sceAppMgrReceiveSystemEvent
exported to user by

_sceAppMgrSaveDataAddMount
exported to user by


 * verify that titleid belongs to one of currently running titleids
 * create ux0:/user/XX/savedata_vc/ or ux0:/user/XX/savedata/ directory if required
 * mount PFS to ux0:/user/XX/savedata_vc/ or ux0:/user/XX/savedata/ path with mountid 0x3ED
 * read keystone from :sce_sys/keystone
 * verify keystone passcode

_sceAppMgrSaveDataDataRemove2
exported to user by

_sceAppMgrSaveDataDataRemove
exported to user by

_sceAppMgrSaveDataDataSave2
exported to user by

_sceAppMgrSaveDataDataSave
exported to user by

_sceAppMgrSaveDataGetQuota
exported to user by

_sceAppMgrSaveDataMount
exported to user by

_sceAppMgrSaveDataSlotCreate
exported to user by

_sceAppMgrSaveDataSlotDelete
exported to user by

_sceAppMgrSaveDataSlotFileClose
exported to user by

_sceAppMgrSaveDataSlotFileGetParam
exported to user by

_sceAppMgrSaveDataSlotFileOpen
exported to user by

_sceAppMgrSaveDataSlotGetParam
exported to user by

_sceAppMgrSaveDataSlotGetStatus
exported to user by

_sceAppMgrSaveDataSlotInit
exported to user by

_sceAppMgrSaveDataSlotSetParam
exported to user by

_sceAppMgrSaveDataSlotSetStatus
exported to user by

_sceAppMgrSaveDataUmount
exported to user by

_sceAppMgrSendNotificationRequest
exported to user by

_sceAppMgrSendParam
exported to user by

_sceAppMgrSendSystemEvent2
exported to user by

_sceAppMgrSendSystemEvent
exported to user by

Example from store_checkout_plugin.

_sceAppMgrSetBackRenderPortOwner
exported to user by

_sceAppMgrSetBgmProxyApp
exported to user by

_sceAppMgrSetNetworkDisconnectionWarningDialogState
exported to user by

_sceAppMgrSetPowerSaveMode
exported to user by

_sceAppMgrSetRecommendedScreenOrientationForShell
exported to user by

_sceAppMgrSetShellScreenOrientation
exported to user by

_sceAppMgrSetSystemDataFilePlayReady
exported to user by

_sceAppMgrSetSystemDataFile
exported to user by

_sceAppMgrSystemParamDateTimeGetConf
exported to user by

_sceAppMgrSystemParamGetInt
exported to user by

_sceAppMgrSystemParamGetString
exported to user by

_sceAppMgrThemeDataMount
exported to user by


 * check that program-authority-id is SceShell(0x2800000000000001) or SceSettings (0x2800000000000010)
 * read ux0:theme/<CONTENTID>/sce_sys/param.sfo or <theme_path>/<CONTENTID>/sce_sys/param.sfo (in case of debug custom theme)
 * check in param.sfo that CATEGORY = ac and get TITLEID
 * get klicensee from rif (from fixed name at path ux0:license/theme/<CONTENTID> or from <rif_file_path>)
 * check ux0:theme/<CONTENTID>/sce_sys/package/head.bin vs ux0:theme/<CONTENTID>/sce_sys/clearsign or <theme_path>/<CONTENTID>/sce_sys/package/head.bin vs <theme_path>/<CONTENTID>/sce_sys/clearsign
 * mount PFS tmXXXXXXXXXXXd: mountpoint to ux0:theme/<CONTENTID> or <theme_path>/<CONTENTID> path with mountid 0x3EC and TITLEID

_sceAppMgrTrophyMountById
exported to user by


 * check that mountId is 0x12F or 0x130
 * calls non exported function equal to kernel level of sceAppMgrWorkDirMountById

_sceAppMgrTrophyMount
exported to user by

_sceAppMgrUmountByPid
exported to user by

_sceAppMgrUmount
Exported to user by SceDriverUser.

This is the unmount command for the mount point created with _sceAppMgrWorkDirMount.

This unmount command is also called in pair with _sceAppMgrGameDataMount from SceShell.

_sceAppMgrUpdateSaveDataParam
exported to user by


 * resolve overlay for
 * if is ux0:/user/XX/savedata or grw0:/savedata/
 * mount PFS tsXXXXXXXXXXXXd mountpoint to path with mountid 0x3ED
 * verify open psid


 * if is ux0:/ or grw0:/
 * mount PFS tsXXXXXXXXXXXXd mountpoint to /user/XX/savedata path with mountid 0x3ED
 * verify open psid

_sceAppMgrWorkDirMountById
exported to user by

only valid appmgr mount ids are:
 * : ux0:cache/<TITLEID>

_sceAppMgrWorkDirMount
exported to user by

For example used by store_checkout_plugin, sqlite_vsh.

This creates a mount point that can be used as a filesystem.

Only valid appmgr mount ids are:
 * : ur0:temp/sqlite
 * : ur0:temp/attach
 * : ux0:pspemu
 * : ur0:temp/checkout
 * : ur0:temp/webbrowser
 * : ur0:temp/webbrowser

_sceAppMgrDestroyApp
Returns 0 on success.

sceSharedFbBegin
note : If do not call sceSharedFbEnd after calling sceSharedFbBegin, you cannot return to the home