Modules

The executable ELF encrypted to a SELF formatted file is called a module. A module is distinctive by its NID and in most cases the module name, but the same module name can be used in both the non-secure kernel and the secure kernel.

Module Info
After the end of the code data, the module information structure can be found.

Attributes
The attributes field can be broken down into the following:

More information is needed on how the flags are used. Most kernel modules seem to have it set to 0x7.

Modules
Each Module contains zero or more library exports and zero or more library imports. An exported library groups together related functions along with their NID and exports it for SceKernelModulemgr to link with a library import in another Module.

Exports
An array of export entries defines all the libraries implemented in the module. There is a special export entry that always shows up (even when the module exports no libraries) with flags 0x8000 and NID set to 0x0 that exports the module init function, deinit (if available) function, module information data, and so on. Kernel modules that export user accessible libraries also get entries added to the syscall table. The table is randomized on each boot so the same function will likely get a different syscall number assigned each time. Each export entry is formatted like so:

Imports
Each module can also import any number of libraries from other modules by specifying the library NID to import along with a list of function NID to import. SceKernelModulemgr does the dynamic linking by either jumping to an address if the two libraries are in the same privilege level, or making a Syscall if it is user code importing a kernel library. Kernel modules cannot import user libraries. The import entries are similar to export entries and are structured as follows:

Flags
Flags in the export and import entries are identified as follows:

List of Modules
Below is a list of all known Modules in the system along with the lowest version number it was seen on.

3.60 Retail Modules
Module name obtained in decrypted SELF at offset (elf.entrypoint)+4 and SELF AuthId in SELF header at offset 0x80.