diff --git a/Core/ELF/PrxDecrypter.cpp b/Core/ELF/PrxDecrypter.cpp index 7e7451f171..79b6dfdb66 100644 --- a/Core/ELF/PrxDecrypter.cpp +++ b/Core/ELF/PrxDecrypter.cpp @@ -311,21 +311,10 @@ static const u32 g_keyUPDATER_PSAR[] = { static const u8 keys_9DC14891_1[] = {0x39, 0xF7, 0xDF, 0x19, 0xD7, 0x10, 0xEA, 0x9F, 0x02, 0xDB, 0x3F, 0xB1, 0x10, 0x9F, 0x26, 0x6B}; static const u8 keys_9DC14891_2[] = {0x46, 0x1D, 0xC9, 0xC2, 0x1D, 0x44, 0xA6, 0x68, 0xF2, 0x06, 0x37, 0xBF, 0x62, 0xCD, 0x11, 0x9E}; static const u8 keys_9DC14891_3[] = {0x11, 0x0D, 0x1A, 0x4C, 0x8A, 0x19, 0x17, 0xDC, 0xD0, 0x5A, 0x65, 0x47, 0xA5, 0x03, 0x85, 0x22}; -// The same family for the older firmware generations, read out of each firmware's own -// mesg_led_XXg.prx: that tag table is 24-byte entries of tag plus 16-byte key. Extracting the -// 6.6x triple this way reproduces keys_9DC14891_1/2/3 above byte for byte, which is what -// establishes the layout. Each generation has one key per PSP model, and flash0:/vsh/etc/ -// index_XXg.dat - the index of what the XMB shows - is tagged with the one for its model, so a -// shell whose key is missing decrypts nothing, draws no icons and gives up with the red error -// screen. Names are _. -// 3.0x and 3.5x predate the per-model split and have a single flash0:/vsh/etc/index.dat. -static const u8 keys_9DC14891_31x[] = {0x27, 0xE1, 0x31, 0xF5, 0xF7, 0x9B, 0xE7, 0x88, 0xD6, 0x8D, 0x7C, 0x0D, 0x99, 0x73, 0xA1, 0x8F}; -static const u8 keys_9DC14891_28x[] = {0xC3, 0x1A, 0x78, 0xC5, 0xF5, 0xBE, 0xC6, 0x92, 0xF9, 0xEF, 0x94, 0xEA, 0x51, 0xE5, 0x57, 0x11}; -// 2.6x and 2.7x tag their index.dat 0x495BE403 rather than with the 0x0B2Bxxx0 the rest of this -// family uses. The scramble code makes no difference to this file - every value tried decrypts it -// to the same plaintext - so it keeps the 0x5C the neighbouring entries have. static const u8 keys_9DC14891_26x[] = {0xE4, 0x98, 0x8E, 0x93, 0x5B, 0x94, 0xAF, 0x19, 0xEA, 0x30, 0x6C, 0xEA, 0x6F, 0x1F, 0x11, 0x59}; +static const u8 keys_9DC14891_28x[] = {0xC3, 0x1A, 0x78, 0xC5, 0xF5, 0xBE, 0xC6, 0x92, 0xF9, 0xEF, 0x94, 0xEA, 0x51, 0xE5, 0x57, 0x11}; static const u8 keys_9DC14891_30x[] = {0x96, 0x86, 0xDD, 0x78, 0x87, 0xA7, 0x2B, 0xD9, 0xDD, 0xC6, 0x6C, 0x4F, 0x89, 0xFB, 0xD4, 0xD7}; +static const u8 keys_9DC14891_31x[] = {0x27, 0xE1, 0x31, 0xF5, 0xF7, 0x9B, 0xE7, 0x88, 0xD6, 0x8D, 0x7C, 0x0D, 0x99, 0x73, 0xA1, 0x8F}; static const u8 keys_9DC14891_35x[] = {0x6B, 0x3F, 0x91, 0x58, 0xED, 0x40, 0x68, 0x54, 0x93, 0xD6, 0x45, 0x3F, 0x2C, 0xD4, 0x23, 0x43}; static const u8 keys_9DC14891_50x_01g[] = {0xF8, 0x15, 0xCC, 0x79, 0x10, 0x89, 0x16, 0xD6, 0x25, 0x11, 0x00, 0xEB, 0x6B, 0xB1, 0x13, 0xE2}; static const u8 keys_9DC14891_50x_02g[] = {0x1A, 0x26, 0xFD, 0x16, 0x32, 0x0E, 0x71, 0xD0, 0xDC, 0xD1, 0x3C, 0xE5, 0x53, 0xD5, 0x44, 0x99}; diff --git a/Core/HLE/sceImpose.cpp b/Core/HLE/sceImpose.cpp index ce47386216..c8b506aea1 100644 --- a/Core/HLE/sceImpose.cpp +++ b/Core/HLE/sceImpose.cpp @@ -165,13 +165,9 @@ enum : u32 { PSP_IMPOSE_00000100 = 0x100, PSP_IMPOSE_BACKLIGHT_OFF_INTERVAL = 0x200, PSP_IMPOSE_SOUND_REDUCTION = 0x400, - // Named after their own values, as in JPCSP - real meanings unknown. - // 40000000 is a real setting in every impose.prx from 1.50 to 5.55: their sceImposeGetParam - // dispatches on it and returns a field of the impose context that also gates the backlight - // brightness answer. Rejecting it froze 3.11 - the shell read the error back, blanked the - // display with sceDisplaySetFrameBuf(0, 0, 0) and never turned it on again. - PSP_IMPOSE_40000000 = 0x40000000, + // Real meanings of the below are unknown. PSP_IMPOSE_20000000 = 0x20000000, + PSP_IMPOSE_40000000 = 0x40000000, PSP_IMPOSE_80000001 = 0x80000001, PSP_IMPOSE_80000002 = 0x80000002, PSP_IMPOSE_80000003 = 0x80000003, @@ -270,19 +266,10 @@ const HLEFunction sceImpose_driver[] = { {0X5557F4E2, &WrapU_UU, "sceImposeGetBatteryIconStatus", 'x', "xx"}, // The 1.50 - 2.xx NIDs for the same two calls - impose.prx of that era exports them to kernel // mode only, with no user-mode alias to match them against, so these were identified from the - // function bodies: GetParam is the same dispatch on a0 returning 0x8000xxxx for a bad index, - // and Changes is the same read-and-clear of one word in the impose context (at +0x84 there, - // +0xBC by 6.60). The VSH calls Changes once a frame, so unresolved they were most of the - // boot log on those versions. - // NOTE: new entries go at the end - the syscall opcode in a savestate is an index into this array. + // function bodies. {0X531C9778, &WrapI_I, "sceImposeGetParam", 'i', "i" }, {0XB415FC59, &WrapI_V, "sceImposeChanges", 'i', "" }, - // And the 5.xx NIDs for four of them, identified the same way against 6.61's impose_02g.prx: - // each body is instruction-for-instruction the same, differing only in the offset of the field - // it touches in the impose context (Changes reads-and-clears +0xB4 here where 6.61 uses +0xBC, - // SetStatus works on +0x9C where 6.61 uses +0xA4). They sit in the same order at almost the - // same addresses in both modules. Unresolved, GetParam and Changes were most of the 5.50 VSH - // boot log, since it calls them every frame. + // And the 5.xx NIDs for four of them, identified by code. {0XC860DB52, &WrapI_I, "sceImposeSetStatus", 'i', "i" }, {0X4B02F047, &WrapI_I, "sceImposeGetParam", 'i', "i" }, {0XD1E9019F, &WrapI_II, "sceImposeSetParam", 'i', "ii"}, diff --git a/Core/HLE/sceKernelHeap.cpp b/Core/HLE/sceKernelHeap.cpp index 1ed7c22645..c153ace0a9 100644 --- a/Core/HLE/sceKernelHeap.cpp +++ b/Core/HLE/sceKernelHeap.cpp @@ -202,15 +202,9 @@ const HLEFunction SysMemForKernel[] = { { 0XEB7A74DB, &WrapI_IUU, "sceKernelAllocHeapMemoryWithOption", 'i', "ixp" , HLE_KERNEL_SYSCALL }, { 0x6373995d, &WrapI_V, "sceKernelGetModel", 'i', "", HLE_KERNEL_SYSCALL}, // 220 { 0x07C586A1, &WrapI_V, "sceKernelGetModel", 'i', "", HLE_KERNEL_SYSCALL }, // 220 - // The 5.xx NID for the same call. vshbridge wraps it in a user-level check and re-exports it, - // and 6.61's vshbridge wraps sceKernelGetModel with an identical body - that pairing is how - // this NID was identified. Unresolved, the 5.50 VSH read a garbage model number and went - // looking for PSP-3000 resources on a dump that is a 1000. - // NOTE: new entries go at the end - the syscall opcode in a savestate is an index into this array. + // The 5.xx NID for the same call. { 0xDA07DC6E, &WrapI_V, "sceKernelGetModel", 'i', "", HLE_KERNEL_SYSCALL }, - // 3.95/4.05, 6.00/6.20 and 6.31/6.39 each use another NID again. Same identification: in every - // one of those firmwares vshbridge wraps it in the identical user-level check 6.61 wraps - // sceKernelGetModel in, and it is the only SysMemForKernel import their shells actually call. + // 3.95/4.05, 6.00/6.20 and 6.31/6.39 each use another NID again. { 0x4823B9D9, &WrapI_V, "sceKernelGetModel", 'i', "", HLE_KERNEL_SYSCALL }, { 0x864EBFD7, &WrapI_V, "sceKernelGetModel", 'i', "", HLE_KERNEL_SYSCALL }, { 0x458A70B5, &WrapI_V, "sceKernelGetModel", 'i', "", HLE_KERNEL_SYSCALL }, diff --git a/Core/HLE/sceKernelModule.cpp b/Core/HLE/sceKernelModule.cpp index 2de51ebbd7..641d150f05 100644 --- a/Core/HLE/sceKernelModule.cpp +++ b/Core/HLE/sceKernelModule.cpp @@ -3211,19 +3211,12 @@ const HLEFunction ModuleMgrForKernel[] = { {0xD675EBB8, &WrapU_UUU, "sceKernelSelfStopUnloadModule", 'x', "xxx", HLE_KERNEL_SYSCALL }, {0xD5DDAB1F, &WrapU_CUU, "sceKernelLoadModuleVSH", 'x', "sxx", HLE_KERNEL_SYSCALL }, {0xD86DD11B, &WrapU_C, "sceKernelSearchModuleByName", 'x', "s", HLE_KERNEL_SYSCALL }, - // The 1.x NID for sceKernelLoadModuleVSH - same function, matched by its callee set in - // modulemgr.prx (sceKernelIsIntrContext, sceIoOpen/Ioctl/Close, sceKernelGetUserLevel). - // This is how the VSH loads its own plugins, so leaving it unresolved meant vshmain got - // module id 0 back and the sceKernelStartModule after it failed with UNKNOWN_MODULE. - // NOTE: new entries go at the end - the syscall opcode in a savestate is an index into this array. + // The 1.x NID for sceKernelLoadModuleVSH - same function. + // This is how the VSH loads its own plugins. {0xA4370E7C, &WrapU_CUU, "sceKernelLoadModuleVSH", 'x', "sxx", HLE_KERNEL_SYSCALL }, - // And the 5.x NID for it, confirmed the same way: in 5.50's modulemgr.prx this NID has the - // identical callee set to 6.61's 0xD5DDAB1F. Without it 5.50's vshbridge couldn't load the - // XMB plugins (opening_plugin, impose_plugin, ...) and the VSH stopped at a black screen. + // And the 5.x NID for it. {0xCCDE84A8, &WrapU_CUU, "sceKernelLoadModuleVSH", 'x', "sxx", HLE_KERNEL_SYSCALL }, - // And the four remaining NIDs it has worn, all matched by the same callee set: 3.80 and 3.90 - // share one, 3.95 and 4.05 another, 6.00 and 6.20 another, 6.31 and 6.39 the last. Each of - // those shells loaded no plugins at all and sat on a black screen until its NID was here. + // And the four remaining NIDs it has had. {0xFE586962, &WrapU_CUU, "sceKernelLoadModuleVSH", 'x', "sxx", HLE_KERNEL_SYSCALL }, {0x329C89DB, &WrapU_CUU, "sceKernelLoadModuleVSH", 'x', "sxx", HLE_KERNEL_SYSCALL }, {0x8909A807, &WrapU_CUU, "sceKernelLoadModuleVSH", 'x', "sxx", HLE_KERNEL_SYSCALL }, diff --git a/Core/HLE/sceReg.cpp b/Core/HLE/sceReg.cpp index 6b01098c81..e85f901542 100644 --- a/Core/HLE/sceReg.cpp +++ b/Core/HLE/sceReg.cpp @@ -38,8 +38,7 @@ struct OpenCategory { }; static int g_openRegistryMode; -// How many sceRegOpenRegistry calls are outstanding - the same reference count registry.prx keeps -// in its per-registry object. See sceRegCloseRegistry. +// How many sceRegOpenRegistry calls are outstanding. It really is refcounted. static int g_openRegistryCount; static int g_handleGen; // TODO: The real PSP seems to use memory addresses. Probably it's doing allocations, which we don't really want to do unless we can match them exactly. static std::map g_openCategories; @@ -944,11 +943,7 @@ static const KeyValue tree_CONFIG[] = { static const KeyValue tree_REGISTRY[] = { // A real 6.6x PSP has 0x66 here, which is what this tree was dumped from - but the VSH treats a // category_version higher than the schema it knows as a corrupt registry and offers to reset your - // settings instead of booting, which is where 1.50 through 5.50 stopped. The check is - // one-directional: an older version is always accepted and no firmware tried to migrate anything, - // so report the oldest rather than the one we dumped. Measured on --vsh boots, the ceiling drops - // with the firmware - 5.50 takes up to 0x58, 5.03 rejects 0x55, 1.50 rejects 0x10 - while 1 gets - // every version from 1.50 to 6.61 to an interactive XMB. + // settings instead of booting. So we go very low. { "category_version", ValueType::INT, "", 1 }, }; @@ -1047,14 +1042,6 @@ int sceRegCloseRegistry(int regHandle) { if (regHandle != 0) { return hleLogError(Log::sceReg, SCE_REG_ERROR_REGISTRY_NOT_FOUND); } - // registry.prx keeps one object per open registry in a list and hands back its index in that - // list, which is why the system registry is always handle 0 - and the object carries a - // reference count that repeated opens bump. sceRegCloseRegistry there walks the list to the - // handle, and if that count is non-zero it just decrements it and returns; only the last close - // tears the object down. Do the same rather than dropping every open category on the first - // close, which would take down ones another opener still owns. The VSH's alarm scan does - // exactly that: it holds /CONFIG/ALARM open, then opens and closes the registry again once per - // alarm slot, and used to find its own category gone by the end. if (g_openRegistryCount > 0) { g_openRegistryCount--; }