Search results

{| class="wikitable" border="1" | 1

| bits[1:0]: Video mode (0 = Progressive, 0b11 = Interlaced) | bits[31:0]: <code>(htotal * clocks_per_pixel) >> 1</code>

Tag Latency Control Register is set to <1, 1, 1> (writes 0 to the L2 register), and Tag Latency Control Register to <2, 4, | 1

| 1 | Port 1 I/O request address

| Port mode (1=out, 0=in) (1 bit each port) | Port read (0=low, 1=high) (1 bit each port)

| Interrupt pending and ack/clear, 1 bit each | Interrupt enable/mask, 1 bit each

* $1 = arg0 * DIV = 1: 32-bit divide instruction on

| Start transfer (bit 0 or 1), transfer direction (bit 0 or 1)?

| Enable port (1 = enable, 0 = disable) {| class="wikitable" border="1"

sceKernelUnlockMutex (*mutex, 1); sceKernelLockMutex (*mutex, 1, 0);

| Version || 0x4 || 0x4 || 00000001, 00000002 || 1(old) or 2(current) | Unknown3 || 0x860 || 0x10 || N.A|| Encrypted_data for v.1 / Padding for v.2

1) Apply ARM filter. See [[#ARM Filter]]. At least 1 byte of data is required. 0 byte data cannot be encoded.

| 1.69-3.60 || Non-secure || Kernel | 1.69 || [[SceError#SceErrorForDriver|SceErrorForDriver]] || Non-secure || Ker

| 1 | Same net as pin 1

| 1 | Net 1 (Battery)

// Step 1: Change the processor mode to Monitor Mode scr = ReadCPReg(base, 15, 0, 1, 1, 0);

sceKernelRegisterMonitorCallHandler(0x11a, FUN_81000184 + 1);

# Only state 1 handles flag <code>0x18</code>. # Main Function in state 1 is called with target state 9. It does some unknown tasks (maybe power on d

* syscall 1: Unload * while(1) sleep()

...www.telecomarchive.com/docs/bsp-archive/365/365-353-011_I2.pdf] at chapter 1.2.7.2 Facility Terminating Unit and Integrated | CRTC mask: bit 0 = enable scanout to engine/CRTC of OLED/LCD, bit 1 = enable scanout to engine/CRTC of HDMI

* key_size - 0:1:2:3, 64:128:192:256

| 1.69-3.60 || Non-secure || Kernel | 1.69 || [[SceUsbstorVStorDriver#SceUsbstorVStorForDriver|SceUsbstorVStorForDr

...and its content moved to [[SceSblPostSsMgr]] since System Software version 1.800.071. | 0.990.000-1.692.000 || Non-secure || Kernel

..., c1, #4 || DBGBVR1 || [[SceKernelThreadMgr]] || Breakpoint Value Register 1 ...c1, #5 || DBGBCR1 || [[SceKernelThreadMgr]] || Breakpoint Control Register 1

...actually at 0x00040000. However, EVA/IVA still works as expected when EVM=1. Both [[Secure Kernel]] and [[Second Loader]] set EVM=0 at the start. This | 1

| Argument 1 | Host Control 1

| 1.69-3.60 || Non-secure || Kernel | 1.69 || [[SceUsbSerial#SceUsbSerialForDriver|SceUsbSerialForDriver]] || Non-s

| 1.69-3.60 || Non-secure | 1.69 - 3.60 || SceDeci4pCpupForDriver || Non-secure || 0x5E323A42

| 1.69-3.740.011 || Non-secure || Kernel | 1 || 0xDD || SceSdif1

The following table is split in two depending on the Kermit version (1.0 or 1.5). <code>X</code> and <code>Y</code> from the <code>ESX.Y</code> column co ! colspan="4" | Kermit 1.0

| 1 || Mode 2 - Alternative Secure? | 4 || Read/Write address byte 1 and allow non-0x10-aligned address read

// format must be 0, 1 or 2

char ernie_challenge[8]; // random from Ernie during step 1 ...d buffer from the previous command (written to Cmep keyring 0x50B), if bit 1 at byte offset 0x4 is set, then the version check is skipped. Then, if boot

// If initialization is successful - pHandle will be initialized to 1 Issues [[Secure_Modules_Functions#Request_Buffer|kprx_auth_sm command -1]].

Below format is as parsed by firmware 1.692 or below, firmware 1.800 or later expect a newer AFV format. # format_version=1

// maybe_devnum: must be 0 or 1 // maybe_devnum: must be 1

#define CRY_INTERRUPT_INDEX1 1 #define MAILBOX_ID1 1

| 1.69-3.60 || Non-secure || Kernel | 1.69-3.60 || [[SceRegistryMgr#SceRegMgrForDriver|SceRegMgrForDriver]] || Non-

| 1.69-3.60 || Non-secure || User Same as [[#sceShellSvcClearEventFlag]], but returns 1 in *pWasCancelled if the flag was set, 0 if not.

* <code>t = (prescale_factor + 1) / src_clk</code> in seconds (multiply by 10^9 for ns) * <code>f = 1 / t = src_clk / (prescale_factor+1)</code> in Hz (divide by 10^6 for MHz)

| 1.69-3.60 || Non-secure || Kernel uint16_t unk_14; // 1

mov $1,0x8 sw $1,0($0)

| 0x0 || 0x1 || Type (ex: 1, 2, 3, 0x10, 0x20) ...Firmware Version. Version of the Ernie software update. (ex: 0x0100060B -> 1.0.6.11)

| 0xA || 0x2 || Version (always 1)

| 1.69-3.65 || Non-secure || Kernel typedef struct SceCompatSettings { // size is 8 on FW 1.03

...elf]] functions 1 and 2. Function 1 is used to obtain some data from Cmep (1 byte). Function 2 is used to set key, that is obtained from Memory Card, in

| 1.80-3.60 || ScePromoterUtil || Non-secure || User | 1.69-3.60 || ScePromoterUtil || Non-secure || User || 0x31F237B6

| 0.931.010-1.692.000 || [[SceSblSsSmComm#SceSblSsSmComm|SceSblSsSmComm]] || Non-secure | | 1.800.071-3.740.011 || [[SceSblSsSmComm#SceSblSsSmComm|SceSblSsSmComm]] || No

| 1.69-3.60 || Non-secure || Kernel | 1.69 || [[SceOled#SceOledForDriver|SceOledForDriver]] || Non-secure || Kernel

challenge[1] = trng_read32(); challenge[3] = challenge[1];

uint16_t unk16; // ex: 1 uint16_t unk16; // ex: 1

| 0x10 || 0x8 || HMAC Key ID (always 1) | 0x18 || 0x8 || HMAC Key ID (Always 1)

#define SCE_SDFMGR_EXCP_TYPE_DABT (1) #define SCE_DFMGR_EVENT_READ (1) // Protocol data available to read

...9CC || int sceHdmiCmdSetEdidModeForDriver(SceBool mode); // mode: 0: Pass, 1: On ...|| int sceHdmiCecCmdOneTouchPlayForDriver(SceUInt32 cmd); // cmd can be 0, 1 or 2

...LF consists of 4 segments: SKBL reset vector, SKBL segment 0, SKBL segment 1, NSKBL. == SKBL Segment 1 ==

res = sceIoDevctl("md0:", 1, &memid, sizeof(memid), &md_res, sizeof(md_res));

| 1.69-3.65 || Non-secure || Kernel | 1.69 || [[SceMtpIfDriver#SceMtpIfForDriver|SceMtpIfForDriver]] || Non-secure

...that reference the accessory port were permanently disabled as of firmware 1.69, however this is not actually true: even on FW 3.73 the accessory port c | 1

* key_size - 0:1:2:3, 64:128:192:256

| 1.69-3.65 || Non-secure || Kernel | 1.69-3.60 || [[SceWlanBt#SceWlanBtForDriver|SceWlanBtForDriver]] || Non-secur

...hen the flag set by [[SceSysmem#set_info_dump_flag|set_info_dump_flag]] is 1, ttyinfo is sent to the pc host instead of fault information, but due to a

...eturn. In the Worker Loop, flag <code>0x32</code> can be handled by states 1, 3, 8, 9. In any of these states, the Jig Handler is called. # In states 0, 1, 3, 8, or 9, flag <code>0x79</code> is handled.

...f package files on FW 1.69 (the kernel functions called are specific to FW 1.69 prototypes). It is an attempted reproduction of the main code in <code>S args[1] = code1;

sceIoChstatForDriver("ux0:id.dat", &stat, 1);

Game card can be accessed with [[SceSdif]] device index 1. === packet 1 (cmd56 request)===

| 1.000.041-3.730.011 || [[SceDeci4pDbgp#SceDeci4pDbgpForDriver|SceDeci4pDbgpFo @param[in] is_thumb - 1 if CPU ran in Thumb mode when breakpoint was hit, 0 otherwise

#define SYSTIMER_TYPE_LONG 1 //<! 64-bit timer // Timer frequency = (clock source frequency) / (prescaleFactor + 1)

<span style="color:#8a2be2;">1</span> <span style="color:#8a2be2;">UID bit. should be 1.</span>

| 1 || SELF || signed-elf || Used for storing ELF and PRX * Step 1: Get SELF metadata decryption key and IV

...Sony finally changed <code>X-Platform-Passphrase</code> but because of the 1-2 week grace period, people were still able to access SEN for a short amoun

| 1.800.071-3.720.011 || Non-secure || Kernel | 1.800.071-3.720.011 || [[SceDeci4pSDbgp#SceDeci4pSdbgpForKernel|SceDeci4pSdbg

| 1.00 - 1.67 || 2011/08/01 | 1.80 || 2012/06/01

== Boot type indicator 1 for SLSK == ...yring 0x50C. It is defined at same time as [[KBL Param#Boot type indicator 1]] and embeds some common information but with different flags.

// unk_bool: a boolean with value 0 or 1

...e <code>dev_off</code>, do <code>*REG32(0xE3100000 + (dev_off / 32) * 4) = 1 << (31 - (dev_off % 32))</code>. ...control? - 3.3V by default; <code>1 << sdif_idx</code> to set the SDIF to 1.8V

| 0.931-1.692.000 || SceSblUpdateMgrForKernel || Non-secure || Kernel || 0xC4466E48 | 0.931-1.692.000 || SceSblUpdateMgrForDriver || Non-secure || Kernel || 0x0E04CD3D

...s is only in the PSP type PKG files inside the .ext section. If it is type 1, then use the PSP key as normal, if it is type 2, use the PSV2 key with the ...f]] on FW 1.69 and [[ScePromoterUtil#scePromoterUtilityPromotePkg]] on FWs 1.80+ to "promote" (i.e. install) the files into the right directory in ux0.

| 1.03-3.60 || [[SceSblPostSsMgr#SceSblPostSsMgrForDriver|SceSblPostSsMgrForDri | 0.990-1.692 || [[SceSblPostSsMgr#SceZlibForDriver|SceZlibForDriver]] || Non-secure

- 1 = Error (Bits 30-0 follow the format described below) - 1 = Fatal error

| 1.69-3.740.011 || Non-secure || User int data_0x5C; // ex:1

| 1.69-3.740.011 || Non-secure || Kernel | 1.69-3.740.011 || [[SceDisplay#SceDisplayForDriver|SceDisplayForDriver]] || N

| 1 || Game card || MMC/SD || Gamecard/?SD card? | 1 || MMC || [[#get_sd_context_part_validate_mmc|get_sd_context_part_validate_

# Compute the SHA-1 hash of the (optionally salted) name: <code>hash = sha1(name + nid_suffix) ! colspan="2" | "Sce"^-1 + libname

<div style="font-weight:bold;line-height:1.6;">The following is sample C# code for sending and receiving custom protoc packet[1] = 0xF0;

* bus: Must be 0 or 1.

uint32_t index; // 0x0 - some index or number 0, 1, 2, 3, 4, 5 uint8_t slow_mode_state; //5D = 0/1

...: for example, DMAC0 Channel 0 delivers interrupts via ID 0x70 and Channel 1 via ID 0x71. /*280*/ Dmac5Key ch1Key; //!< Channel 1 external key

There need to be 2 digital pins (UART TX and RX) and at least 1 analog pin (Jig enable sense) accessible to the factory agent in order for The UART interface is enabled if the *"Jig Sense 1"* probe is at 0.47v-0.738v during *"Jig Sense 2"* probe state change (float

| 1 || bit set | 1 || 0 || 0 || sa ||

The product's name is "EMMA Mobile™1-S". This chip promoted as a «''Multimedia Processor for Mobile Application Hi-Speed USB Transceiver with 1.8V-3.3V UPLI interface. Connected to the [[Communication Processor#SMSC USB

...ference <code>SECTOR_SIZE/sizeof(u16) - 1 = 255</code> leaves (the <code>- 1</code> is needed because a table consumes one entry for itself) * Empty: area has all bits set to 1 (i.e., 0xFF)

SceSize size; // 1 or 2 - size of st_attr | 1 || privilege || system ||

| 1.69-3.65 || Non-secure || Kernel | 1.69 || [[SceLowio#ScePervasiveForDriver|ScePervasiveForDriver]] || Non-secur

| 1.69-3.60 || Non-secure || Kernel | 1.69 || [[SceCoredump#SceCoredumpForDriver|SceCoredumpForDriver]] || Non-secu

| 0.931.010-1.69 || [[ScePfsMgr#ScePfsFacadeForKernel|ScePfsFacadeForKernel]] || Non-secu | 1.800.071-3.740.011 || [[ScePfsMgr#ScePfsFacadeForKernel|ScePfsFacadeForKerne

| 1.030.071-3.740.011 || Non-secure || Kernel | 1.030.071-3.740.011 || [[SceUlobjMgr#SceUlobjMgr|SceUlobjMgr]] || Non-secure

...T0 is a debugging console used by ARM, cMep and Syscon. The logic level is 1.8V. ...PortForDriver]](1);</code>, or to manually flip the switch (green point to 1.8V).

| 1 ...| Ernie version. Comes from [[Ernie]] Code Flash memory ([[Ernie]] command 1). 4 bytes. If lower (older) than 0x00090903, old Ernie protocols (unencrypt

1 = Request succeeded | 0xE0000004 || RW || Result || Cmep to ARM. 1: success. 3: command not found. 5: Invalid arguments. Used by SMC 0x12d, 0x

| 1.69-3.60 || Non-secure || Kernel | 1.69-3.60 || [[SceSblSsMgr#SceSblSsMgrForKernel|SceSblSsMgrForKernel]] || Non

| 1.000.071-3.740.011 || [[SceNpDrm#SceNpDrm|SceNpDrm]] || Non-secure || User | | 1.000.071-3.740.011 || [[SceNpDrm#SceNpDrmPackage|SceNpDrmPackage]] || Non-se

...ze is 0x8000 bytes, and each command consumes a ~16 bytes fixed overhead + 1 byte per argument byte. This gives a rough estimation of a maximum of aroun |+ Script locations for firmware 1.00-2.06

| 1 || Write | 1 || ARM Core0

| 1.69-3.60 || Non-secure || Kernel | 1.69 || Secure || Kernel

| 0x0 || 0x2 || second_loader || Version (usually 1) ...|| second_loader || [[KBL Param#Boot type indicator 1|Boot type indicator 1]]

| 1.69-3.60 || Non-secure || Kernel | 1.000.071-3.740.011 || [[ScePower#ScePower|ScePower]] || Non-secure || User |

| 1.69-3.65 || Non-secure || Kernel SCE_AUDIO_IN_GETSTATUS_MUTE = 1

| 0.931.010-1.69 || Secure || Kernel | 0.931.010-1.80 || [[SceExcpmgr#SceExcpmgrForTZS|SceExcpmgrForTZS]] || Secure || Kernel

| 1.000.071-3.740.011 || 0x2229EF51 Returns 0 on success. Returns -1 if no remote is connected.

...(usually set to 1) followed by Minor version of the module (usually set to 1). | SceModuleInfo version. Seen values are: 0 on PSP and PS3, 1 never seen, 2 on PS Vita FW 0.902, 3 on PS Vita FW 0.931.010, 4 and 5 never

| 1.69-3.60 || Non-secure || Kernel | 1.69-3.60 || [[SceTouch#SceTouchForDriver|SceTouchForDriver]] || Non-secure |

sha256_vector(1, &key, &key_len, tk); _addr[i + 1] = addr[i];

1 = Secure kernel boot value? 8 = Soft rebooting. Set by syscall 1.

| 0x28 || 0x4 || Flags requirements: 0 normal, 1 QA flag (sceQafMgrIsAllowQAUpdateForDriver) required, 2 manufacturing mode | 0x2C || 0x4 || Platform: 0 all platforms accepted, 1 Dolce (PSTV), 0x10000000 Test / Tool, 0x20000000 DEX, 0x40000000 CEX

...slots <code>0</code> to <code>0xFF</code>. However, as of System Software 1.69, there has been no observed usage of fast syscalls. If a syscall is not ...t is loaded), this counter is first incremented for a random value between 1 and 5 (unless incrementing it will overflow). Next, for each exporting entr

#define SCE_CACHED_SECURE_MODULE_RMAUTH 1 // os0:sm/rmauth_sm.self // Size of SceSysrootForKernel_D29BCA77_struct for FWs 1.000.071-1.500.151 (maybe higher) is 0x5C

CMD, CLK, and DAT0 are needed to flash the eMMC. '''Note that the Vita uses 1.8V logic and most if not all SD card adapters use 3.3V logic so unlike othe ...you can flash but not boot up the Vita. This has been fixed in psvemmc v3.1 and you no longer need to use the orange point at all.

| 1.69-3.60 || Non-secure || Kernel | 1.69 || [[SceUdcd#SceUdcd|SceUdcd]] || Non-secure || User || 0xA84BDE8A

| 1.69-3.60 || Non-secure || Kernel | 1.69-3.60 || [[SceSblGcAuthMgr#SceSblGcAuthMgrDrmBBForDriver|SceSblGcAuthMgrD

| 1.000.071-3.740.011 || Non-secure || User | 1.000.071-3.740.011 || [[SceVideoExport#SceVideoExport|SceVideoExport]] || No

int16_t last_wait_core; // 0:core3, 1:core0, 2:core1, 3:core2

The MP3 decoder used is <code>SoCrates MP3 Decoder FIXED-1-16</code>.

...specifies the data that goes after the header. The special command id of -1 (<code>0xFFFFFFFF</code>) is used to stop the current loaded [[Secure_Modul ...ption. The header is copied to the cmep private memory region first (on FW 1.69 with 0x1000 sized header, it is at <code>0x00811CC0</code> in cmep memor

...is executable, but in thumb mode, the function pointer always has bit 0 as 1, so if the entry point is the last 4-bytes of a memory page, then the next SceUID target = -1;

| 0.931.010 || 0x40300000 || 0x5FFFFFFF || 0x10 || For ES1 rev0/1 Kermit only === 1.50 cleanup ===

| 1.800.071-3.740.011 || Non-secure || Kernel '''For the equivalent of this module on System Software versions older than 1.800.071, see [[SceVeneziaWrapper]].'''

...6C DA EF 64 CA 71 01 4A A9 D5 31 | 0.......R.m.......Gc..J.Z...:l..d.q.J..1], chk=0x4B ...6C DA EF 64 CA 71 01 4A A9 D5 31 | 0.......R.m.......Gc..J.Z...:l..d.q.J..1], chk=0xF5, unk=0x00

| 1 || implemented || implemented || implemented || implemented || implemented | 1 || implemented || implemented || 0 || implemented || implemente

...://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01_01&PC=007&TC=N&PK=1&FN=299ul&SN=%94%46%8F%D8&LN=5&R1=*****&R2=***** 007WWCUL0634] March 23, 201

| SHA 1/224/256

int unk_5C; // ex: -1 SceUInt32 unk_0; // ex: 0, 1

uint16_t header_type; /* 1 self, 2 unknown, 3 pkg */ uint64_t elf_offset; /* ELF #1 offset */

SceUInt8 tx[32]; // tx[0..1] = cmd, tx[2] = size i.e. sizeof(actual_data)+1, rx[3..31] = actual_data SceUInt8 rx[32]; // rx[0..1] = cmd, rx[2] = size i.e. sizeof(actual_data)+2, rx[3] = error_code, rx[4..

...n for platforms ES1 and ES2 (and later) respectively. Every TOOL PUP since 1.00 only contains a single CpUp. | 0x4 || u32 || Version. Ex: 01 00 03 01 (1.3.0.1)

==== WebKit 531.22.8 (PS Vita FW <= 1.81) (CVE-2010-4577 and CVE-2010-1807) ==== ==== WebKit 536.26 (PS Vita FW 2.00-3.20) (CVE-2012-3748) (PSA 2013-09-03-1) ====

| 1.69-3.60 || [[SceIofilemgr#SceIofilemgrForDriver|SceIofilemgrForDriver]] || | 1.69-3.60 || [[SceIofilemgr#SceIofilemgr|SceIofilemgr]] || Non-secure || User

=== Version 1 === |align=center|'''1.03'''<br />December 17, 2011

...c. The virtual address for the smaller mappings is randomized in the first 1 MiB of the address space (255 page-sized slots - first slot is reserved for ...point, there are no other kernel heaps available. Sysroot status is set to 1 by this function.

| 1.69-3.73 || Non-secure || Kernel | 0.990-1.69 || [[SceNgs#SceNgsForDriver|SceNgsForDriver]] || Non-secure || Kernel ||

| 1.69-3.60 || Non-secure || Kernel | 1.69-3.60 || [[SceAppMgr#SceAppMgrForDriver|SceAppMgrForDriver]] || Non-secur

<div style="font-weight:bold;line-height:1.6;">List sorted by group</div> | Gpio 1.

int mode; // kernel:0, user:1 #define SCE_KERNEL_THREADMGR_UID_CLASS_THREAD (1) /**< Thread class */

| 1.69-3.65 || Non-secure || Kernel | 1.030.071-3.740.011 || [[SceVshBridge#SceVshBridge|SceVshBridge]] || Non-secu

Returns 0 if tick_1 == tick_2, -1 if tick_1 < tick_2 and 1 else. This library is not present on FWs <= 1.03.

| 1.50-3.61 || Non-secure || Kernel | 1.69-1.80 || Secure || Kernel

| 1.000.071-3.740.011 || Non-secure || User | 1.030.071-3.740.011 || [[SceLibKernel#SceLibKernel|SceLibKernel]] || Non-secu

*REG32(0xE0010000) = 1; *REG32(0xE0010000) = 1;