SceSblSsSmComm

SceSblSsSmComm is a kernel module that is primary responsible for sending F00D commands.

Module

Known NIDs

Version	Name	World	Privilege	NID
1.69	SceSblSsSmComm	Non-secure	Kernel	0xA6A2A041
3.57	SceSblSsSmComm	Non-secure	Kernel	0x301EDC39
3.60	SceSblSsSmComm	Non-secure	Kernel	0xBB4B5D92

Libraries

Known NIDs

Version	Name	World	Visibility	NID
1.69	SceSblSmCommForKernel	Non-secure	Kernel	0xCD3C89B6
3.60	SceSblSmCommForKernel	Non-secure	Kernel	0xCD3C89B6
1.69	SceSblSsSmComm	Non-secure	User	0xD8DC7847

Types

/* example of caller_self_info
char data[0x90] =
{
   0x01,0x00,0x00,0x00, 0x00,0x00,0x08,0x28, // max program-authority-id
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x80,0x00,0x00,0x00, 0xC0,0x00,0xF0,0x00,
   0x00,0x00,0x00,0x00, 0xFF,0xFF,0xFF,0xFF,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x80,0x09,0x80,0x03, 0x00,0x00,0xC3,0x00,
   0x00,0x00,0x80,0x09, 0x80,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0xFF,0xFF,0xFF,0xFF,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
   0x00,0x00,0x00,0x00, 0x00,0x00,0x00,0x00,
}; */

typedef struct SceSblSmCommContext130 // size is 0x130 as its name indicates
{
   uint32_t unk_0;
   uint32_t self_type; // kernel = 0, user = 1, SM = 2
   SceSelfInfo caller_self_info; // can be obtained with sceKernelGetSelfInfoForKernel
   SceSelfInfo called_self_info; // set by F00D in F00D SceSblSmCommContext130 response
   uint32_t pathId; // can be obtained with sceSblACMgrGetPathIdForKernel or sceIoGetPathIdExForDriver
   uint32_t unk_12C;
} SceSblSmCommContext130;

SceSblSmCommForKernel

sceSblSmCommStopSm

Version	NID
1.69	0x0631F8ED
3.60	0x0631F8ED

This function calls sceSblSmCommCallFunc with -1 as command_id and then calls sceSblSmSchedProxyWait.

int sceSblSmCommStopSm(int id, int result[2]);

sceSblSmCommStartSmFromData

Version	NID
1.69	0x992BB9DB
3.60	0x039C73B1

int sceSblSmCommStartSmFromData(int priority, const char *sm_self_data, int sm_self_size, int num1, SceSblSmCommContext130 *ctx_130, int* id);

sceSblSmCommStartSmFromFile

Version	NID
3.60	0x7863A0CC

int sceSblSmCommStartSmFromFile(int priority, char* sm_self_path, int num1, SceSblSmCommContext130* ctx_130, int* id);

Priority is binary: 1 = low, 0 = high. Running a high priority SM module while a low priority one is currently running will suspend it.

sceSblSmCommCallFunc

Version	NID
1.69	0xDB9FC204
3.60	0xDB9FC204

sm_comm_context is described more here

f00d_resp comes from Request Buffer from offset 0x08

gc_param is generated by game card and has value 0x01

typedef struct SceSblSmCommGcData {
	int unk_0; // 1
	int gc_command;
	char gc_buffer[0x800];
	int gc_param;
	int length;
	int unk_810; // 0
} SceSblSmCommGcData; /* size = 0x814 */

typedef struct SceSblSmCommMsifData {
	unsigned int unk00;
	unsigned int unk04;
	unsigned int unk08;
	unsigned int unk0C;
	unsigned int unk10;
	unsigned int unk14;
	unsigned int unk18;
	unsigned int unk1C;
} SceSblSmCommMsifData; /* size = 0x20 */

int sceSblSmCommCallFunc(int id, int service_id, int *f00d_resp, void *data, int size);

SceSblSsSmComm

sceSblSmCommStopSm

Version	NID
1.69	0x631F8ED

sceSblSmCommStartSm_

Version	NID
1.69	0x992BB9DB

sceSblSmCommCallFunc

Version	NID
1.69	0xDB9FC204