NSKBL
NSBL is a program that performs emmc setup, base kernel module loading, etc. when vita boot
Module
The non-secure kernel bootloader contains an embedded and likely stripped version of SceSysmem, SceKernelModulemgr, SceSblSmschedProxy, SceExcpmgr, SceKernelIntrMgr, SceProcessmgr (maybe), SceSdif, SceIofilemgr (Simple version?), and some other core drivers.
How to debug NSBL
NSBL reads from sd0: instead, if a read error(?) Occurs in os0: during vita startup.
but, in order to generate os0: read errors, os0: must be damaged in some way, so there must be a way to physically recover vita.
Libraries
Known NIDs
| Version | Name | World | Visibility | NID |
|---|---|---|---|---|
| 3.60 | SceKblForKernel | Non-secure | Kernel | 0xD0FC2991 |
SceKblForKernel
SceKblForKernel_0x08E9FAEB
| Version | NID |
|---|---|
| 3.60 | 0x08E9FAEB |
In 3.60 this function is at 0x510172BD
SceKblForKernel_0x13A5ABEF
| Version | NID |
|---|---|
| 3.60 | 0x13A5ABEF |
In 3.60 this function is at 0x510137A9
SceKblForKernel_0x161D6FCC
| Version | NID |
|---|---|
| 3.60 | 0x161D6FCC |
In 3.60 this function is at 0x510123DD
SceKblForKernel_0x1DB28F02
| Version | NID |
|---|---|
| 3.60 | 0x1DB28F02 |
Maybe call a thread related function, and if it fails, do a panic call
In 3.60 this function is at 0x510123A1
SceKblForKernel_0x261F2747
| Version | NID |
|---|---|
| 3.60 | 0x261F2747 |
Related to initialization?
In 3.60 this function is at 0x51001321
int SceKblForKernel_0x261F2747(void);SceKblForKernel_0x314AA770
| Version | NID |
|---|---|
| 3.60 | 0x314AA770 |
same to SceSysrootForKernel_AE55B7CC
In 3.60 this function is at 0x510124FD
void SceKblForKernel_0x314AA770(void);sceKblIsCEXForKernel
| Version | NID |
|---|---|
| 3.60 | 0x8A416887 |
In 3.60 this function is at 0x510171B5
int sceKblIsCEXForKernel(void);sceKblIsCEXJpFatForKernel
| Version | NID |
|---|---|
| 3.60 | 0xC3DDDE15 |
In 3.60 this function is at 0x51017175
int sceKblIsCEXJpFatForKernel(void);sceKblIsDEXForKernel
| Version | NID |
|---|---|
| 3.60 | 0x5945F065 |
In 3.60 this function is at 0x51017159
int sceKblIsDEXForKernel(void);sceKblIsToolForKernel
| Version | NID |
|---|---|
| 3.60 | 0xB6C9ACF1 |
In 3.60 this function is at 0x51017139
int sceKblIsToolForKernel(void);sceKblIsTestForKernel
| Version | NID |
|---|---|
| 3.60 | 0x943E7537 |
In 3.60 this function is at 0x5101711D
int sceKblIsTestForKernel(void);sceKblLoadModuleForKernel
| Version | NID |
|---|---|
| 3.60 | 0x6D7A1F18 |
In 3.60 this function is at 0x51001551
typedef struct SceModuleLoadList {
const char *filename;
} __attribute__((packed)) SceModuleLoadList;
int sceKblLoadModuleForKernel(const SceModuleLoadList *list, SceUID *uid, int count, int some_flag);sceKblStartModuleForKernel
| Version | NID |
|---|---|
| 3.60 | 0x9A92436E |
In 3.60 this function is at 0x51001571
int sceKblStartModuleForKernel(SceUID *uid_list, int count, SceSize args, void *argp);SceKblForKernel_0x752E7EEC
| Version | NID |
|---|---|
| 3.60 | 0x752E7EEC |
Debug function, same to SceDebugForDriver_1A3F2AA4
In 3.60 this function is at 0x51013841
SceKblForKernel_0x79241ACF
| Version | NID |
|---|---|
| 3.60 | 0x79241ACF |
Related to initialization?
In 3.60 this function is at 0x51001345
int SceKblForKernel_0x79241ACF(void);SceKblForKernel_0x807B4437
| Version | NID |
|---|---|
| 3.60 | 0x807B4437 |
In 3.60 this function is at 0x510124E5
sceKblIsVITAForKernel
| Version | NID |
|---|---|
| 3.60 | 0x838466E9 |
In 3.60 this function is at 0x51017299
int sceKblIsVITAForKernel(void);sceKblIsDolceForKernel
| Version | NID |
|---|---|
| 3.60 | 0xA7BD4417 |
In 3.60 this function is at 0x510172A1
int sceKblIsDolceForKernel(void);sceKblIsGenuineDolceForKernel
| Version | NID |
|---|---|
| 3.60 | 0xB6D00D6D |
In 3.60 this function is at 0x510171E5
int sceKblIsGenuineDolceForKernel(void);SceKblForKernel_0x9B868276
| Version | NID |
|---|---|
| 3.60 | 0x9B868276 |
return value is ptr?
In 3.60 this function is at 0x51013765
int SceKblForKernel_9B868276(void);SceKblForKernel_0x9F4F3F98 (set some state?)
| Version | NID |
|---|---|
| 3.60 | 0x9F4F3F98 |
set some state?
related to sceKblStartModuleForKernel
In 3.60 this function is at 0x51001561
int SceKblForKernel_9F4F3F98(void);sceKblGetCpuIdForKernel
| Version | NID |
|---|---|
| 3.60 | 0xB506A10E |
In 3.60 this function is at 0x510147C9
int sceKblGetCpuIdForKernel(void);SceKblForKernel_0xC011935A
| Version | NID |
|---|---|
| 3.60 | 0xC011935A |
get some info?
In 3.60 this function is at 0x51013921
int SceKblForKernel_C011935A(void);SceKblForKernel_0xC7B77991
| Version | NID |
|---|---|
| 3.60 | 0xC7B77991 |
In 3.60 this function is at 0x5101297D
sceKblCheckDipswForKernel
| Version | NID |
|---|---|
| 3.60 | 0xC8F4DE71 |
In 3.60 this function is at 0x51015851
int sceKblCheckDipswForKernel(int bit);sceKblIsAllowKernelDebugForKernel
| Version | NID |
|---|---|
| 3.60 | 0xCE94F329 |
same to sceQafMgrIsAllowKernelDebugForDriver
In 3.60 this function is at 0x51016FD1
int sceKblIsAllowKernelDebugForKernel(void);SceKblForKernel_0xD3A516D5
| Version | NID |
|---|---|
| 3.60 | 0xD3A516D5 |
get some device info function
In 3.60 this function is at 0x510128AD
typedef struct SceKblSomeSysrootInfo {
uint32_t data[4];
} __attribute__((packed)) SceKblSomeSysrootInfo;
int SceKblForKernel_D3A516D5(SceKblSomeSysrootInfo *some_flag);sceKblCpuSwitchInterruptsForKernel
| Version | NID |
|---|---|
| 3.60 | 0xDDB3A1A8 |
In 3.60 this function is at 0x51003554
void sceKblCpuSwitchInterruptsForKernel(void);SceKblForKernel_0xF7AF8690
| Version | NID |
|---|---|
| 3.60 | 0xF7AF8690 |
In 3.60 this function is at 0x5100124D