forums.ps2dev.org

testereto · Joined: 26 Sep 2005 Posts: 5

Hello

I wonder if someone could tell me what are the addresses for each syscall when working in user space mode (instead kernel mode).

I'd like to develope some programs in my psp2.0 so any help will be appreciated.

Following code belongs to "flash-backup" which uses the new 2.0 exploit:

Chrighton · Joined: 15 Jun 2005 Posts: 58

For a specific <function>

printf("0x%x\n", *(u32 *)(<function>+4));

may work. You can always disassemble as well.

PspPet · Joined: 30 Mar 2005 Posts: 210

> I wonder if someone could tell me what are the addresses for each syscall when working in user space mode (instead kernel mode).
FWIW: the syscalls are only for user space (they syscall is an implementation detail of the USER->SYSTEM switch)
The SYSCALL order is a side-effect of the entries being registered. The order may be different under 2.0 than 1.0/1.50.

TRY: printf("0x%x\n", *((u32 *)(<function>)+1) / 0x40)
BTW: SYSCALL opcode is the second (32bit) opcode in the library stub. The SYSCALL opcode is the syscall number * 0x40 + 0xc (0x208f * 0x40 + 0xc = 0x823cc)

That only works if the function has not been called. Once the function is called, the SYSCALL stub gets replaced with something else.
What you call the "long address" is really a "NID" (a SHA1 hash value). It is not the same thing and not directly mappable (system and user entries have NIDs, only user entries have SYSCALLs). The PSPSDK only supports the NID approach. The NID approach is version independent.
----
Here's my SYSCALL list:
http://www.aibohack.com/psp/syscall_expt1.txt
See warnings at top of file !!
Scraped from 1.0 firmware - not guaranteed to be the same as 2.0

mrbrown · Joined: 17 Jan 2004 Posts: 1536

groepaz · Joined: 01 Sep 2005 Posts: 305

i've compared the list from pspinside (v1.5 syscalls) with the one from psppet, see the result here: http://hitmen.c02.at/files/releases/psp/syscalls.txt

as you can see even between 1.0 and 1.5 a bunch are different... now it would be interisting to see a list of proofed working ones from 2.0 (or well, even extensions/corrections to the other two lists for that matter :))
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/

PspPet · Joined: 30 Mar 2005 Posts: 210

> i've compared the list from pspinside (v1.5 syscalls)...
Haven't seen that one. Please post a URL.

> as you can see even between 1.0 and 1.5 a bunch are different...
Not only the names, but also the order. The SYSCALL numbers are determined by the order. By the time you get to the Dcache entries the 1.0 syscall numbers are out of whack -- don't use that first list.

Here's an updated list using the 1.52 firmware (I can't experimentally confirm it on a 1.52, but should be closer to 1.50 and hopefully 2.0)
http://www.aibohack.com/psp/syscall_expt152.txt

ZMaster · Joined: 02 Sep 2005 Posts: 29

Stupid questions: How do you get this information out of the PRX files? I thought they where encrypted?!? I actually can't disassemble them, or am I doing something wrong? Sorry for my noob-ness :-)

groepaz · Joined: 01 Sep 2005 Posts: 305

i've made a better list ... http://hitmen.c02.at/files/releases/psp/syscalls.txt

@PspPet: the 1.50 list is in the config dir of pspinside, get it from our homepage at http://hitmen.c02.at/html/psp_releases.html
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/

testereto · Joined: 26 Sep 2005 Posts: 5

How did u get the syscall list for psp 2.0 flash-dump? by trial and error?

testereto · Joined: 26 Sep 2005 Posts: 5

groepaz · Joined: 01 Sep 2005 Posts: 305

hrm yes, the second list was bugged :=)

i've fixed the bug and generated it again....this time also showing which ones changed in the second list.... so redownload :)
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/

testereto · Joined: 26 Sep 2005 Posts: 5

Saotome · Joined: 03 Apr 2004 Posts: 182

here are some more pretty usefull syscalls :)

0x2148, sceDisplaySetFrameBuf
0x2150, sceDisplayWaitVblank
0x2152, sceDisplayWaitVblankStart

and not tested, but probably these too:
0x2151, sceDisplayWaitVblankCB
0x2153, sceDisplayWaitVblankStartCB
_________________
infj

testereto · Joined: 26 Sep 2005 Posts: 5

PspPet · Joined: 30 Mar 2005 Posts: 210

> 0x2148, sceDisplaySetFrameBuf
I assume that was found experimentally under 2.0 (the syscall number is greater than those on the earlier 1.0/1.5x)

Once you find one syscall in a module, you can guess that all the others will shift up in order. That's why the 1.52 list is only a starting point.
When the user export table of one system PRX grows, the syscall numbers of the later modules will increase (but typically the order will not). If they change the load order or add new user modules things may change more significantly.

Guess work and experimental confirmation needed (at least until we can decrypt 2.0 PRXs or at least grab the 2.0 kernel memory space)

Syscalls are very ugly for this reason. The best answer is to write a standard ELF loader so all other 2.0 programs can go back to using NIDs (like 1.0 and 1.50 homebrew)

stefan · Joined: 14 Nov 2004 Posts: 10

Saotome · Joined: 03 Apr 2004 Posts: 182

Vampire · Joined: 12 Apr 2005 Posts: 138

cheqmate · Joined: 28 Sep 2005 Posts: 4

here are 2 more tables i dumped today.
0000 means couldnt be resolved to syscall ( see above)

ChaosKnight · Joined: 14 Apr 2005 Posts: 142 Location: Florida, USA

Very cool stuff with the syscalls.

Saotome - Any chance you will release some documentation on the single tif exploit? Or at least point me in that direction? Great job on the Pong by the way, looks like that syscall research is a lot of fun.
_________________
w00t

groepaz · Joined: 01 Sep 2005 Posts: 305

i have updated the comparison table with the info from cheqmate.... its slowly becoming obvious which are the same as 1.52 and which have moved etc... :)
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/

Saotome · Joined: 03 Apr 2004 Posts: 182

ChaosKnight: actualy jonny2002 on the pspupdates forum did most of the tif work. I did the code. I've written a tool for PS2 that automaticaly inserts the code (compiled with the PS2 toolchain) into the tif-file. That means the tool and the psp code gets compiled from one c-file into one ELF file, I run it on my PS2 and it stores the tif file on my harddrive, then I just need to copy it on my psp :)
If you want to use the tif from the pong game, the code starts from pos 0x01c0 to end of file.

And yea, syscall research is fun, but downgrading and do some 1.50 developing is tempting as well ;)

groepaz:
found some more
0x21a1, scePowerGetBusClockFrequency
0x21a2, scePowerGetCpuClockFrequency
0x21a8, scePowerSetClockFrequency
_________________
infj

groepaz · Joined: 01 Sep 2005 Posts: 305

updatet again :)
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/

Fanjita · Joined: 28 Sep 2005 Posts: 217

Saotome, any chance you could help by releasing some snippets from the pong source?

I've been working on a tetris port, which is mostly working except I can't work out how you managed to read the key input. Everything I've tried with sceCtrl* has either crashed, or just not returned any data.

A few pointers on how you managed it would be really appreciated.

Thanks.

Fanjita · Joined: 28 Sep 2005 Posts: 217

Of course I've tried disassembly, btw - but I'm having problems building pspdis (can't figure out how to get libintl into Cygwin :-( ) and ps2dis seems to give misleading results.

PspPet · Joined: 30 Mar 2005 Posts: 210

Commentary / IMHO:
Probably not worth continuing down this path. The SYSCALL numbers are very version specific (and can vary depending on how a program loads additional library PRXs)

Thanks to the MPH/TIFF version tweek, I suspect everyone with a 1.51/1.52/2.0 PSP who wants to run homebrew will "downgrade" to version 1.50 [BTW: Good job to everyone involved]

The main appeal for homebrew 2.0 is exploiting 2.0 features (like new codecs and web browser) *AND* so you can stay on the track for future updates. However it is very likely the TIFF hole will be closed in any future 2.1 update from Sony. So the 2.0 TIFF hack will have a very short lifetime in the terms of homebrew expliots (long enough to "downgrade" to 1.50 that is ;-)

Fanjita · Joined: 28 Sep 2005 Posts: 217

Surely it's worth getting homebrew working on the latest version, if it is at all possible?

Even if Sony decide to update the firmware again, it's better to have a 2.0 PSP than a 1.5 PSP, if the homebrew capability is the same.

The syscall interface doesn't seem like a huge barrier at the end of the day.

BTW, ignore my earlier request for help with source - I narrowed down my problem to invalid assumptions about register usage when compiling under the PSPSDK toolchain, and now my syscalls are all working fine.

Saotome · Joined: 03 Apr 2004 Posts: 182

groepaz · Joined: 01 Sep 2005 Posts: 305

i agree with fanjita. hacking 2.0 will be all worth it and it has to be done imho. will be done anyway :=P
_________________
http://www.hitmen-console.org
http://hitmen.c02.at/files/yapspd/

cheqmate · Joined: 28 Sep 2005 Posts: 4

psppet: i think you're misunderstanding the purpose.
sure nid imports are much nicer, but to get there we need to use kernel functions somehow, dont we ?