VSH

VSH is the internal name used by Sony for the VShell aka VirtualShell. It then loads up the XMB you know.XrossMediaBar (XMB). This, is a user space executable (vsh.self), loaded by lv2_kernel/sys_init_osd.

from here several other functions/syscalls to other modules are made, e.g. lv2 (SELF decryption), lv1 (Secure_RTC, Storage_Manager, Gelic_Device, BD_Drive) etc.

not much is documented (yet) about this module. Please fill in where possible.

Modes

possible arguments to pass when executing vsh.self:

• --mode=gametool
• --mode=gametool2
• --arcade=true

Offsets

Function	3.55	3.41	3.15	Notes
-	-	-	-	-
			sub_308EE4	check_Is_Act_Dat_for_This_Acc_ID

Exports

Export Library	Export NID	Notes	Usage
sys_io	-	-	-
sys_fs	-	-	-
sys_fs	0x18DD4604	cellFsOpen2	-
sys_fs_ps2disc	0x8160A811	switches /dev_ps2disc(1) mount?
sysConsoleId	-	-
sysConsoleId	0xF220F751	Get ConsoleID	sysConsoleId_F220F751(int8_t* buff)
sysPrxForUser	-	-
sysPrxForUser	0x2E20EC1	Returns the address of the null byte terminator of the given string.	const char* sysPrxForUser_2E20EC1(const char* s)
vsh	-	-
vsh	0xF48562D	cellSsAimIsCEX
vsh	0x145991B4	cellSsAimIsArcade
vsh	0x172B05CD	update_mgr_write_eprom syscall
vsh	0x1B890AD2	update_mgr_get_token_seed syscall
vsh	0x1F80E287	cellSsAimIsTool
vsh	0x2C563C92	update_mgr_read_eprom syscall
vsh	0x3231E012	vtrm_Decrypt_Master syscall
vsh	0x349F1535	update_mgr_set_token syscall
vsh	0x3B4A1AC4	AIM GetDeviceId syscall
vsh	0x3F062337	AIM GetPsCode syscall
vsh	0xE44F29F4	cellFsUtilMount syscall
vsh	0xE7C34044	retrieves vsh memory container by "id" 0=game,1=app,2=debug,3=fg, 4=bg	sys_memory_container_t vsh_E7C34044(int id)
vsh	0xE932A8C0	reboot and show minimum version char can be "text whatever you like", no check etc.	int vsh_E932A8C0(char * )
vsh	0xFF4A1633	cellFsUtilMount syscall
vsh	0x7D73E7CD	inflate_init
vsh	0x4DB8DD87	inflate_end
vsh	0x20215547	inflate_buffer
vsh	0x1C68CC75	inflate
sdk	-	-
sdk	0x832304BC	getBattery	int sdk_832304BC(int portNo, uint16_t * status_level)
sdk	0x31BB1D05	getPower	int sdk_31BB1D05(int portNo, uint16_t * status)
sdk	0x4AF81871	Disconnect GamePad	int sdk_4AF81871(int portNo)
sdk	0xBAC90F2	avset_finish
sdk	0xFA304515	avset_finish
sdk	0x9E445E9F	avset_finish
sdk	0x990D6A8D	avset_acp_ctrl
sdk	0x7B4DEEAD	avset_setaudiomute (1)
sdk	0x5C306D39	avset_setaudiomute (0)
sdk	0xEB4716D4	avset_setvideomute
sdk	0x60D34743	avset_setvideoformat
sdk	0x2140F339	avset_setbackendmute
sdk	0x16AA3407	avset_setvideopitch
sdk	0xFA45245D	avset_setroute
sdk	0xE0B77114	avset_setvideomode (1)
sdk	0x6DFF610C	avset_setvideomode (0)
sdk	0x61D5F528	avset_gethwconfig
sdk	0x677BC574	avset_getksv (0,0)
sdk	0x18E4FC82	avset_getksv
sdk	0x15D3C74C	avset_sethdmimode
sdk	0x98146E83	avset_setaudioactive (0)
sdk	0xBA3FF070	avset_setaudioactive (1)
sdk	0xDF2DCF22	avset_audiomode (2)
sdk	0xF37209FA	avset_audiomode (0)
sdk	0x26067778	avset_settvmute (1)
sdk	0x8EFAF138	avset_settvmute (0)
sdk	0x3543A1A2	avset_ytrapcontrol
sdk	0x3F9DC158	avset_portoption
sdk	0x1F6E56C3	avset_makeaudiochstat
sdk	0x2E09D1C4	avset_setmv
sdk	0xFF17D731	avset_addsigctrl (0)
sdk	0xA3ED6917	avset_addsigctrl (1)
sdk	0xDAF887EA	avset_setccmulti
sdk	0xD449B80C	avset_clrccfifo
sdk	0x8D74012D	avset_audioctrlinfo
sdk	0xE508B17	avset_audioubinfo
sdk	0x915D28A3	avset_setcgmswss
sdk	0x55A1F3B9	avset_acp_packet (4)
sdk	0x5AC8605C	avset_acp_packet (0xA)
sdk	0xD7A665F4	avset_cs_direct
sdk	0xA9009E9F	avset_ctrlhdcpenc
sdk	0x509D1588	avset_get_cec_config
sdk	0xB5877BBF	cellAvsetGetMonitorInformation	int cellAvsetGetMonitorInformation ( uint8_t [0xCC], 0, 0xCC)
sdk	0x5FAFE92B	cellCryptoPuSha1Hash
sdk	0xB45387CD	AesCbcCfb128Decrypt
sdk	0x55ACAB8A	sha1_init
sdk	0x831E89EE	sha1_update
sdk	0x3CABD075	sha1_final
sdk	0x4484A101	sha1_hmac_update
sdk	0x547B602C	sha1_hmac_init
sdk	0x300B99F2	sha1_hmac_final
sdk	0x74A2A1FE	sha1_hmac_buffer
sdk	0x68B630D5	aes_omac_mode1
sdk	0x4C751D97	unmap_port_from_pad	int (int port_no, int pad_no), e.g. (0, 0) unmap first pad
sdk	0xCF03F47A	map_port_to_pad	int (int port_no, int pad_no), e.g. (2, 0) map first pad to port 3
sdk	0xA33FC21C	unmap_port_from_keybord	int (int port_no, int kb_no)
sdk	0x650A537E	map_port_to_keybord	int (int port_no, int kb_no)
sdk	0x2D3B4E2B	unmap_port_from_mouse	int (int port_no, int mouse_no)
sdk	0x5C06471E	map_port_to_mouse	int (int port_no, int mouse_no)
paf	-	-
paf	0x3ADA193F	AudioOutGetState
paf	0x538E485C	AudioOutGetNumberOfDevice
paf	0x95748E9E	AudioOutGetDeviceInfo
paf	0xBB04609B	GetSparkInfo
paf	0x65BE85B3	_UnloadView	_paf_65BE85B3(char * plugin_name,0,0)
paf	0x350B4536	Job_Start
paf	0xD385A4FC	Job End?/Stop?/DeQueue?
paf	0xFE0C1F10	Job_Queue
paf	0xA1DC401	sets Interface from plugin	uint32_t SetInterface(unknown, uint32_t identifier, void * ptr_structure)
paf	0x23AFB290	gets Interface from plugin, should allow calling its exports/funcs	uint32_t plugin->GetInterface(uint32_t return from paf_F21655F3, uint32_t identifier)
paf	0x3A8454FC	finds/gets Texture resource	Example: out: uint32_t* texture, return from paf_F21655F3, "tex_notification_info"
paf	0x50CDB465	finds/gets Sound resource	uint32_t paf_50CDB465(uint32_t plugin /*paf_F21655F3*/, const char* sound)
paf	0x3CEC3833	sets up a plugin widget ? (page_...)
paf	0x794CEACB	finds widget in a plugin	Example: plugin->FindWidget(return from paf_F21655F3, "page_autooff_guide")
paf	0x89B67B9C	gets localized string text from plugin resource (Different strings are returned depending on the system language)	Example: (w)char (paf_F21655F3("system_plugin"), "msg_signed_out")
paf	0xF21655F3	finds a loaded plugin	uint32_t paf::View::Find(const char* plugin) Example: uint32_t paf::View::Find("system_plugin")
paf	0xCF068D31	load (optional on memcontainer) and start sprx	void paf_CF068D31(int32_t* prx_struct, const char* path, int /*ignored*/, int /*0*/, (optional) const sys_memory_container_t *mem_container)
paf	0x2F5CEE6D	stop and unload sprx	void paf_2F5CEE6D(int32_t* prx_struct)
paf	0x546B3D02	returns "PhWidget"	const char* paf_546B3D02()
paf	0x41BBFE5E	returns "PhScene"	const char* paf_41BBFE5E()
paf	0x10DEDCC7	returns "PhPlane"	const char* paf_10DEDCC7()
paf	0xE36C18F5	returns "PhPlaneDiv"	const char* paf_E36C18F5()
paf	0x24A5BD6B	returns "PhButton"	const char* paf_24A5BD6B()
paf	0xB7DFCE90	returns "PhText"	const char* paf_B7DFCE90()
paf	0x9207F4	returns "PhScroll"	const char* paf_9207F4()
paf	0xBA6D149A	returns "PhLabelPrim"	const char* paf_BA6D149A()
paf	0xC88CA4B2	returns "PhLevelMeter"	const char* paf_C88CA4B2()
paf	0xE801C345	returns "PhProgress"	const char* paf_E801C345()
paf	0xBF66BF2D	returns "PhCheckBox"	const char* paf_BF66BF2D()
paf	0x703117AD	returns "PhXmBar"	const char* paf_703117AD()
paf	0x4FF7B8A9	returns "PhXmList"	const char* paf_4FF7B8A9()
paf	0xC84FD77B	returns "PhXmItem"	const char* paf_C84FD77B()
paf	0x4C36ABBB	returns "PhItemSpin"	const char* paf_4C36ABBB()
paf	0xCA9160F6	returns "PhNumSpin"	const char* paf_CA9160F6()
paf	0x59A11C82	returns "PhNumSpin"	const char* paf_59A11C82()
paf	0xD64EDE7C	returns "PhList"	const char* paf_D64EDE7C()
paf	0xF7630798	returns "PhInfoList"	const char* paf_F7630798()
paf	0xA98865F8	returns "PhMenuList"	const char* paf_A98865F8()
paf	0x90F4F801	returns "PhCheckBoxList"	const char* paf_90F4F801()
paf	0xDDD4ACF6	returns "PhLabelText"	const char* paf_DDD4ACF6()
paf	0x545D47A2	returns "PhClock"	const char* paf_545D47A2()
paf	0x3806365F	returns "PhIPAddr"	const char* paf_3806365F()
paf	0xB93AFE7E	Play Resource Sound (located in .rco)	void paf_B93AFE7E(uint32_t plugin, const char* sound, float, int) Example: paf_B93AFE7E( paf_F21655F3("system_plugin"), "snd_trophy", 1, 0)
paf	0x11E195B3	Finds Resource Object (located in .rco)	void* paf_11E195B3(uint32_t plugin, const char* object) Example: paf_B93AFE7E( paf_F21655F3("system_plugin"), "page_notification")
paf	0xAF58E756	Gets the base of loaded plugins. The pointer returned is used in paf::View::Find to find plugins.	void* paf_AF58E756()
paf	0x5F5DA385	Gets Dialog Size	int paf_5F5DA385( uint16_t * size_width, uint16_t * size_height, int dialog_type)
vshcommon	-	-
vshcommon	0xABEB01DA	PageCreates "page_pointcursor"
vshcommon	0xBB2EC9CD	PageCloses "page_pointcursor"
vshcommon	0x7F5C551B	System_plugin#1_Interface func 11	vshcommon_7F5C551B(int * texture_dialog, int* texture_dialog_shadow, wchar * infotext1, wchar * infotext2, int)
vshcommon	0x94F43BE7	System_plugin#1_Interface func 12	vshcommon_94F43BE7(uint8 )
vshcommon	0xF9E43DA2	returns localized string of "msg_ok"
vshcommon	0xCCD2C319	returns localized string of "msg_cancel"
vshcommon	0x746C5F88	returns localized string of "msg_option"
vshcommon	0xF995E53F	returns localized string of "msg_back"
vshcommon	0x26F18EDF	returns localized string of "msg_enter"
vshcommon	0xE9E8DA5	returns localized string of "msg_no"
vshcommon	0xB8E256D7	returns localized string of "msg_yes"
vshcommon	0x79A562D5	System_plugin#1_Interface func 25 circle_cross
vshcommon	0x75DC9C2D	System_plugin#1_Interface func 26 cross_circle
vshcommon	0x60DEE5B3	System_plugin#1_Interface func 27 triangle
vshcommon	0xF7A67D49	System_plugin#1_Interface func 28 rectangle
vshcommon	0x2438F1A4	System_plugin#1_Interface func 21 - anim_cross_circle_show_hide
vshcommon	0x9BD8429E	System_plugin#1_Interface func 22 - anim_cross_circle_show_hide
vshcommon	0xE011E7D0	System_plugin#1_Interface func 23 - anim_triangle_show_hide
vshcommon	0x73F85259	System_plugin#1_Interface func 24 - anim_rectangle_show_hide	vshcommon_73F85259(uint8 )
vshcommon	0x16106ACD	returns "impose_plugin" interface 1	uint vshcommon_16106ACD()
vshcommon	0x8B2110D5	reads boot_history.dat
vshcommon	0x9A43140	adds info to /pushlist/patch.dat
vshcommon	0x9EA67737	vsh::ws_boot_history::Set() { uint8 type, char TitleId [0x1F] } titleid to boot_history.dat (creates if not present)
vshcommon	0xCC2C67F2	reads /pushlist/patch.dat	vshcommon_CC2C67F2(int* count,uint8_t buf[0x680])
vshcommon	0xA20E43DB	Displays a notification in XMB with texture	void(*vshcommon_A20E43DB)(int32_t, const char* eventName, int32_t, int32_t* texture, int32_t*, const char*, const char*, float, const wchar_t* text, int32_t, int32_t, int32_t); int dummy = 0; vshcommon_A20E43DB(0, const char* eventName, int32_t, int32_t* texture /*paf_3A8454FC*/, &dummy, "", "", 0f, L"notification", 0, 0, 0)
x3	-	-
x3	0x16FA740A	xCore_GetInterface()	uint32_t* interface xCore_GetInterface()
x3	0x11409ED3	xRegistryGetDefaultInstance	int xRegistryGetDefaultInstance (1, &handle)
x3	0x9C246A91	xBDVDGetInstance
x3	0xCB1D791D	Obtains SS Key
x3	0xECACA8AD	xRegistry SetValue	Example: int SetValue(handle, "/setting/categoryVersion", 0,0,0)
mms_db	0x8EC9A2A7	xCB_Interface::GetInterface
vshnet	-	-
vshnet	0x59106229	overrides regular update.txt url	int vshnet_59106229_setUpdateUrl( char * url )
vshnet	0xEBEA23A1	sceNetHttpXmlConsoleInfoBitOpe
vshnet	0xC1BC3E57	sceNpUpdateClockAbort
vshnet	0x89801F5D	sceNpC7yTusDestroyTransaction
vshnet	0xE806058	sceNpC7yTusCreateTransaction
vshnet	0xE2201D8B	sceNpC7yTusEnd
vshnet	0xF9884100	sceNpC7yTusInit
vshnet	0x122AF93C	sceNPC7yLookupTssImageResult
vshnet	0x9012A265	sceNpC7yLookupTssImageRequest?
vshnet	0xEEF8AC4B	sceNpC7yLookupAvatarImageResult?
vshnet	0x11823D97	sceNpC7yLookupAvatarImageRequest?
vshnet	0xF4F94F46	sceNpC7yLookupUserProfileResult?
vshnet	0x3F680668	sceNpC7yLookupUserProfileRequest?
vshnet	0x9EA2D869	sceNpC7yLookupNpIdResult?
vshnet	0xF7A88701	sceNpC7yLookupNpIdRequest?
vshnet	0xEC969F67	sceNpC7yLookupDestroyTransaction?
vshnet	0x8BD9F160	sceNpCc7yLookupCreateTransaction?
vshnet	0xB45F6C17	sceNpC7yLookupAbort?	int sceNpC7yLookupAbort( transid)
vshnet	0x66EA9546	sceNpC7yLookupInit?
vshnet	0xF02E64BF	sceNpC7yLookupEnd?
vshnet	0xD79D5840	sceNpC7yScoreGetGameDataResult?
vshnet	0xF5FBFB50	sceNpC7yScoreGetGameDataRequest?
vshnet	0xF67C877	sceNpC7yScoreRecordGameDataRequest?
vshnet	0x250E633D	sceNpC7yScoreRecordScoreResult?	int sceNpC7yScoreRecordScoreResult( int transid, int * RankNumber )
vshnet	0x42332FFA	sceNpC7yScoreGetBoardInfoResult?	int sceNpC7yScoreGetBoardInfoResult (int transid, uint8_t ScoreBoardInfo [ ])
vshnet	0xFC015E62	sceNpC7yScoreGetBoardInfoRequest?	int sceNpC7yScoreGetBoardInfoRequest( int transid, uint8_t SelfNpId [ ], uint8_t TitleId [0xC], int ScoreBoardId )
vshnet	0xCC014646	sceNpC7yScoreDestroyTransaction?	int sceNpC7yScoreDestroyTransaction (int transid )
vshnet	0x372E972A	sceNpC7yScoreFreeTransactionResource?	int sceNpC7yScoreFreeTransactionResource ( int transid )
vshnet	0xDF1FF79F	sceNpC7yScoreCreateTransaction?	int sceNpC7yScoreCreateTransaction(uint8_t psHandle[0x14], uint8_t ScorePassphrase [0x80] )
vshnet	0x3F59F7B6	sceNpC7yScoreAbort?	int sceNpC7yScoreAbort ( int transid)
vshnet	0x71DF362C	sceNpC7yScoreEnd?	int sceNpC7yScoreEnd()
vshnet	0x56779FBD	sceNpC7yScoreInit? / SceNpRankingVshInit?	int sceNpC7yScoreInit(void * callback, uint8_t np_debug_flag)
vshnet	0xCF725EB1	sceNpInstallerRegetSigninTicket	int sceNpInstallerRegetSigninTicket (0)
vshnet	0x7084A801	sceNpCommerceSetDataFlagFinish	int sceNpCommerceSetDataFlagFinish ( int req_id )
vshnet	0x572A4D1D	sceNpSommerceSetDataFlagStart	int sceNpSommerceSetDataFlagStart ( ctx_id, licensee_id, dataflagContainer, dataflag_num, * req_id )
vshnet	0xFF500259	sceNpCommerceGetDataFlagFinish	int sceNpCommerceGetDataFlagFinish ( int req_id )
vshnet	0x15910AE7	sceNpCommerceGetDataFlagState	int sceNpCommerceGetDataFlagState ( int req_id, dataflagContainer, dataflag_num )
vshnet	0x13D56523	sceNpCommerceGetDataFlagAbort	int sceNpCommerceGetDataFlagAbort ( int req_id )
vshnet	0x854FE623	sceNpCommerceGetDataFlagStart	int sceNpCommerceGetDataFlagStart ( ctx_id, licensee_id, dataflag [0x10] , dataflag_num, * req_id )
vshnet	0xE2A0CB65	sceNpCommerceGetProductCategoryResult	int sceNpCommerceGetProductCategoryResult ( int req_id, uint8_t result_buf_size [0x10] )
vshnet	0xE84BBCAF	sceNpCommerceGetProductCategoryFinish	int sceNpCommerceGetProductCategoryFinish ( int req_id )
vshnet	0xD297EF28	sceNpCommerceGetProductCategoryAbort	int sceNpCommerceGetProductCategoryAbort ( int req_id )
vshnet	0x3E20181D	sceNpCommerceGetProductCategoryStart	int sceNpCommerceGetProductCategoryStart ( int ctx_id, int category_id, int lang_code, int * req_id )
vshnet	0x2A4C99A6	sceNpCommerceDestroyCtx	int sceNpCommerceDestroyCtx (ctx_id)
vshnet	0x98340E57	sceNpCommerceCreateCtx	int sceNpCommerceCreateCtx ( int version, uint8_t npId[0x24], void * callback, int * arg,int * ctx_id, int (1) )
vshnet	0x594266BE	sceNpBasicGetInitialPresence
vshnet	0xEF85527	sceNpSignalingAddExtendedHandler	int sceNpSignalingAddExtendedHandler (ctx_id, 1)
vshnet	0xFC663F7F	sceNpSignalingGetPeerNetInfoResult	int sceNpSignalingGetPeerNetInfoResult ( ctx_id, req_id, uint8_t netinfo[0x1C], 1)
vshnet	0x2B2E098F	sceNpSignalingGetLocalNetInfo	int sceNpSignalingGetLocalNetInfo ( ctx_id, uint8_t netinfo[0x1C], 1)
vshnet	0xE5CBDF3D	sceNpSignalingGetConnectionInfo	int sceNpSignalingGetConnectionInfo ( ctx_id, conn_id, code, * rtt/bandwith/addr/port/packet_loss, 1 )
vshnet	0x995D1D2F	sceNpSignalingGetConnectionStatus	int sceNpSignalingGetConnectionStatus ( ctx_id, conn_id, int * conn_status,int * peer_addr,uint16_t * peer_port, 1 )
vshnet	0x158032C9	sceNpSignalingDestroyCtx	int sceNpSignalingDestroyCtx ( ctx_id, 1)
vshnet	0x8478A915	sceNpMatchingGetRoomMemberListLocal	int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], int * size, uint8_t roomStatus[ ], int (1) )
vshnet	0x3139980	sceNpMatchingGetRoomMemberList	int sceNpMatchingGetRoomMemberList ( ctx_id, uint8_t opt[0x1C], req_id, int (1) )
vshnet	0x24B26C3F	sceNpMatchingLeaveRoom	int sceNpMatchingLeaveRoom ( ctx_id, uint8_t opt[0x1C], req_id, int (1) )
vshnet	0x14211FB9	sceNpMatchingDestroyCtx	int sceNpMatchingDestroyCtx ( ctx_id, 1 )
vshnet	0x4C9F0992	sceNpManagerGetPsHandle	int sceNpManagerGetPsHandle ( int (0), uint8_t psHandle[0x14]
vshnet	0x4E276F38	sceNpManagerGetSubjectRegion	int sceNpManagerGetSubjectRegion ( int (0), uint8_t subjectRegion[4]
vshnet	0x58AB86D8	sceNpManagerGetSubjectStatus	int sceNpManagerGetSubjectStatus ( int (0), uint8_t subjectStatus[4]
vshnet	0x7A9421D8	sceNpManagerGetStatusDuration	int sceNpManagerGetStatusDuration ( int (0), uint64_t * statusDuration
vshnet	0x4216DF9F	sceNpManagerRegisterCallbackExt	int sceNpManagerRegisterCallbackExt ( void * callback, void * arg)
vshnet	0x572FFDFB	sceNpManagerGetSubHandle	int sceNpManagerGetSubHandle (int (0), uint8_t subHandle[0x34])
vshnet	0x2C393B42	sceNpManagerUnregisterCallbackExt	int sceNpManagerUnregisterCallbackExt ()
vshnet	0x4DD12D0C	sceNpManagerGetUserIconURL	int sceNpManagerGetUserIconURL ( int (0), uint8_t icon[0x80] )
vshnet	0x99666F31	sceNpManagerGetEnvnamae	int sceNpManagerGetEnvnamae ( uint8_t envname[0x0F] )
vshnet	0x319E53BD	sceNpManagerLoadCachedInfo	int sceNpManagerLoadCachedInfo ( int userId, uint8_t cachedInfo[0xF8] )
vshnet	0x9EF14F7C	sceNpManagerIsPlus	int attr_is_plus sceNpManagerIsPlus ( int (0) )
vshnet	0xC3417866	sceNpManagerGetTicketParam
vshnet	0x788759C6	sceNpManagerGetSigninTicket	sceNpManagerGetSigninTicket ( int (0), uint8_t signinTicketData[], int * signinTicketSize
vshnet	0x1FA25660	sceNpManagerSubSignout	int sceNpManagerSubSignout (int (0), uint8_t npId [0x24]
vshnet	0xB79B2FE0	sceNpManagerGetNetworkTime	int sceNpManagerGetNetworkTime (int (0), uint8_t casualClock[8])
vshnet	0xFACC5962	sceNpManagerGetMyLanguages	int sceNpManagerGetMyLanguages (int (0), uint8_t myLang[0x10]
vshnet	0xFC7303C5	sceNpManagerGetNpId	int sceNpManagerGetNpId ( int (0), uint8_t npId[0x24]
vshnet	0x1D555F5F	sceNpUpdateClockStart
vshnet	0x50EE5602	gets updatelist txt and compares version
vshnet	0x731E546F	prints Firmware version ("%02d.%02d)	int vshnet_731E546F(out: const char*)
vshnet	0xEBEA23A1	sceNetHttpXmlConsoleInfoBitOpe	int sceNetHttpXmlConsoleInfoBitOpe(0x190, xml?,1,1)
vshnet	0xA5E88D4E	checks if hdd has been replaced
vshmain	-	-
vshmain	0x905D36E1	load "autodownload_plugin"	vshmain_905D36E1(int load_mode, void * callback?)
vshmain	0x5F95D6F5	rtc alarm shutdown/stop	int vshmain_5F95D6F5(char * app_id)
vshmain	0xF078B063	avset_cec_control (0)
vshmain	0x624D3AE	returns game process id
vshmain	0xF32CEC81	loadRegistryNetautoDlFlag	int loadRegistryNetautoDlFlag ( void )
vshmain	0xB84B751A	saveRegistryNetautoDlFlag	saveRegistryNetautoDlFlag ( uint8 )
vshmain	0xAE35CF2D	Executes Action based on Input (More Info: XMB Plugin XMM0 Interface 23) Example: "http://www.psdevwiki.com",0 "copy:device",1 "regcam:reg?",1	int vshmain_AE35CF2D(char *, int value)
vshmain	0x85CB2261	sys_event_port_send using static sys_event_port_t	int vshmain_85CB2261(uint64_t data1, uint64_t data2, uint64_t data3)
vshmain	0x71EC82E	sys_event_port_send using static sys_event_port_t	int vshmain_71EC82E(uint64_t data1, uint64_t data2, uint64_t data3)
vshmain	0xF3F75BE	sysutil::BeginService
vshmain	0x505FA917	cxmlutil::GetFile	int GetFile( const cxml::Element & elm, const char * attrname, cxml::File * file )
vshmain	0x79EFF338	cxml::File::GetAddr
vshmain	0xAFF2957B	cxml::File::Load
vshmain	0xE04F6BC8	cxml::Element::NumAttribute
vshmain	0x54CC1C3F	cxml::Element::GetFirstChild
vshmain	0xE7D9F074	cxml::Element::GetNextSibling
vshmain	0x7606AF6F	VersionFile::Get
vshmain	0x981D7E9F	Gets ScreenShot Flag	int vshmain_981D7E9F()
vshmain	0xD257CFF	Get dev_type, port_num (pad id), intr_type	vshmain_D257CFF(1, int * [3] {dev_type, port_num (pad id), intr_type} )
vshmain	0x6D5FC398	Begin InGame XMB	int vshmain_6D5FC398(int dev_type, int port_num (pad id), int intr_type)
vshmain	0xA3E81C3B	ViewLoad InGameXMB, loads up Ingame XMB	int vshmain_A3E81C3B(-1,-1,0)
vshmain	0x5C3E01A1	End InGame XMB	void vshmain_5C3E01A1(void)
vshmain	0xD609A2F6	Login XMB	void vshmain_D609A2F6(int user_id /*starting from 1*/, bool connected /*true if already in a session*/ )
vshmain	0xBC00D5EF	cellSysutilSharedMemoryFree	int vshmain_BC00D5EF(0 /*ignored*/, sys_addr_t start_addr, uint64_t mode /* 0x200 (unmap) or 0x400 (unmap and free) */)
vshmain	0x51E7CC21	cellSysutilSharedMemoryAlloc
vshmain	0x23DC28E8	cellSysutilEventPortSend	int vshmain_23DC28E8(uint64_t data1, uint64_t data2, uint64_t data3, bool)
vshmain	0xCFAD36DE	Creates a blank cxml document for VSH Service/Process Communication [[1]].	cxml::Document::Document()
vshmain	0x5EC145E2	Destroys a cxml document	cxml::Document::~Document()
vshmain	0x7F4E4139	Clears a cxml document	int cxml::Document::Document() (Constructor)
vshmain	0x2CD62587	Sets the header magic of a cxml Document	int cxml::Document::SetHeaderMagic( const char buf[4] ) Example: cxml::Document doc; doc.SetHeaderMagic("NPTR");
vshmain	0x7907768A	Gets the header magic of a cxml Document	void cxml::Document::GetHeaderMagic( char buf[4] ) Example: char buf[4]; cxml::Document doc; doc.GetHeaderMagic(buf);
vshmain	0x6EEE1B61	cxml::Document::CreateFromBuffer	int cxml::Document::CreateFromBuffer( const void * buf, unsigned int bufsize, AccessMode _access_mode )
vshmain	0x3848A5D4	cxml::Document::CreateFromFile	int cxml::Document::CreateFromFile( int fd, AccessMode _access_mode )
vshmain	0x6BA1D72F	Creates an element on a cxml document.	int cxml::Document::CreateElement(const char* name, int attr_num, Element * element) Example: cxml::Document doc; doc.CreateElement( "basicPresenceOffline", 0, element );
vshmain	0x4986187C	cxmlutil::CheckElementName?
vshmain	0xBA7437D9	cxmlutil::GetIDRef
vshmain	0xE77FAFB5	cxmlutil::SetInt	int cxmlutil::SetInt( const cxml::Element & elm, const char * attrname, int i )
vshmain	0x134034CE	cxmlutil::GetInt
vshmain	0x6CE65E82	cxmlutil::GetID
vshmain	0xA971E5A3	cxmlutil::GetFloat
vshmain	0xFB1E70A0	cxmlutil::SetString	int cxmlutil::SetString( const cxml::Element & elm, const char * attrname, const char * str )
vshmain	0xD80EA56E	cxmlutil::GetFloatArray	int cxmlutil::GetFloatArray(const cxml::Element& elm, const char* attrname, const float** f, unsigned int* num )
vshmain	0x633EDC2	cxmlutil::GetString	int cxmlutil::GetString( const cxml::Element & elm, const char * attrname, const char ** str, unsigned int * len )
vshmain	0x6AF9FD89	cxmlutil::FindChildElement	cxml::Element cxmlutil::FindChildElement(const cxml::Element& parent, const char* name, const char* idname, const char* idvalue)
vshmain	0x1C5F3492	Gets the attribute of a cxml element	int cxml::Element::GetAttribute( const char * name, Attribute * attr )
vshmain	0x58B963E5	cxml::Element::AppendChild ?	int cxml::Element::AppendChild( Element & child )
vshmain	0xB172E9CB	cxml::Document::WriteToBuffer	int cxml::Document::WriteToBuffer( void * buf, unsigned int bufsize )
vshmain	0x32EF17EE	cxml::Document::WriteToFile	int cxml::Document::WriteToFile( const char * filename )
vshmain	0xB401D9AD	Gets the size of a cxml document	int cxml::Document::GetSize()
vshmain	0xD03F99CF	cxml::Attribute::GetFloatArray	int cxml::Attribute::GetFloatArray( const float ** addr, unsigned int * num )
vshmain	0x3329CAAA	cxml::Attribute::GetFloat
vshmain	0xD526FD70	cxml::Attribute::GetInt
vshmain	0x4D89A149	cxml::Attribute::GetFile	int cxml::Attribute::GetFile(File * file)
vshmain	0xBCF4D026	Gets the name of an instance of cxml::Element	const char * cxml::Element::GetName()
vshmain	0xA2720DF2	(write_packet)
vshtask	-	-
vshtask	0x0F80B71F	auth_module, checks sprx SCE header	int vshtask_F80B71F(char * path)
vshtask	0x668E3C94	some RTC Alarm Register	int vshtask_668E3C94(char * app_id?, uint8_t [0x4C])
vshtask	0x166551C5	RTC Alarm Unregister	int vshtask_166551C5(char * app_id)
vshtask	0x784023D0	RTC Alarm Get Status	int vshtask_784023D0(uint8_t status[0x1D0])
vshtask	0xA02D46E7	Displays a notification in XMB	int vshtask_A02D46E7(0 /*ignored*, "your text" ) -> calls vshcommon_A20E43DB with texture "tex_notification_info"
cellHttp	-	-
cellHttp	0x8FC281F7	cellHttpCookieFlush
cellHttp	0xDCDF003A	cellHttpAuthCacheFlush

To help documenting offsets+exports, you can use this dumper tool for vsh (actually,no need to dump anymore).

Memory Containers

Type/Id	Name	Size	Usage
0	game	dex: 426.770.432 / cex: 223.346.688 Bytes
1	app	223.346.688 Bytes	Spurs (Tiff, Png, Jpg) autodownload_plugin custom_render_plugin dlna_plugin fchk (libfs_utility2) game_ext_plugin impose_plugin libfs_utility_init vshmain_util mms libsre libadec libac3dec paf_ext qglbase vshmain_ext msgdialog_plugin msmw1 msmw2 podl_plugin software_update_plugin soundvisualizer_plugin system_plugin vshmain_util xmb_plugin (XMB normal) ycon_manual_plugin
2	debug	203.423.744 Bytes
3	fg (foreground)	3.145.728 Bytes	User Information auth_plugin avc2_text_plugin comboplay_plugin ps3_savedata_plugin game_plugin deviceconf_plugin fchk (libfs_utility2) friendim_plugin friendlm_plugin friendtrophy_plugin game_plugin gameupdate_plugin libfs_utility_init vshmain_util mms np_eula_plugin np_sns_plugin np_multisignin_plugin npsignin_plugin osk_plugin photoUtil photoUtil2 photo_network_sharing_plugin print_plugin profile_plugin screenshot_plugin upload_util xmb_ingame
4	bg (background)	3.145.728 Bytes	avc_plugin avc2_game_plugin audioplayer_plugin audioplayer_plugin_mini music playback/decode rec_plugin imejp (service type=1) ime_atok_module

Loaded Views

These Views and prx files are loaded by default and are accessable without further loading, all others need to be loaded.

Regular XMB

system_plugin
xmb_plugin
explore_plugin
category_setting_plugin
impose_plugin

InGame XMB

system_plugin
xmb_plugin
explore_plugin
game_plugin
impose_plugin

InGame

game_plugin
impose_plugin

VSH Service Communication (CXML Header Magic)

CMND - 
PARA - System Parameters Utility
MSGD - Message Dialog Utility
NTCL - netcl Utility
SAVE - Save Data Utility (surf autosave) 
USRI - User Information Utility
GAME - Game Utility
GDAT - Game Data Utility
GDTL - (uses DGAM)
DGAM - Disc Game-Mode Utility
GEXE - Game Execution Utility
GPS1 - Game PS1 Rumble
OSKD - On Screen Keyboard Utility
NPMG - NP Manager Utility
NPMT - NP Matching Utility
NMT2 - NP Matching 2 Utility
NPSN - NP Signaling Utility
NPBA - NP Basic Utility
NPTR - NP Trophy
NPFL - NP Friendlist Utility
NPCU - NP Commerce Registration?
NPDR - NP DRM Utility
NPCM - NP Commerce Utility
NPC2 - NP (Ingame) Commerce 2 Utility
NPIN - NP Install (Commerce)
WBRW - WebBrowser Utility
SYSC - System (Device/Pad) Configuration
NPRA - NP Score/Ranking Utility
NPLU - NP LookUp
NPUS - NP User Storage
STDT - Storage Data Copy Utility
PHEX - Photo Export
PHE2 - Photo Export (Utility 2)
PHIM - Photo Import
PHDE - Photo Decode
BGDL - Background Download Service
IMEJ - Input Method Engine Japanese
MUSC - Music Playback
MUDE - Music Decode
VDPL - Video Player
DTCP - DTCP IP Service
DPSN - Decrypt PSN Video Service
SRCH - Search
PNSU - Photo Network Sharing
PRIN - Printer Utility
AVCH - Audio-Voice/Video Chat Utility
AVC2 - Audio-Voice/Video Chat Utility 2
RMTP - Remote Play
SUBD - SubDisplay Utility
RECO - Recording Utility
APNT - Access Point Utility
VDUP - Video Upload
GUPD - Game Upate Check
RTCA - RTC Alarm
SSHT - ScreenShot
ATHD - (Password) Authentication Dialog
EULA - 
COMB - Combo Playing(Cross Controller)
PESM -
CHAT - System Chat
NSNS - NP Social Networking Services (Facebook Api)

Notification Window Textures

Notification Window Textures (inside dev_flash/vsh/resource/system_plugin.rco)

All the icons are 100x100 pixels size

• tex_notification_caution
• tex_notification_friend
• tex_notification_headset
• tex_notification_info
• tex_notification_keypad
• tex_notification_mediaserver
• tex_notification_music
• tex_notification_psbutton_insensitive
• tex_notification_settings
• tex_notification_trophy_bronze
• tex_notification_trophy_gold
• tex_notification_trophy_platinum
• tex_notification_trophy_silver

The other texture used by notification window is the frame of the notification window itself (called "tex_notification" with a size of 64x64 pixels), this frame is scalated in width automatically by XMB (to make the frame fit the width of the text that is displayed inside the window), and is posible to reskin the frame using a Theme

• Any texture from any plugin can be used actually. i.e.: tex_common_dialog. Would it be possible to create our own textures?
  • Sure, there is no security check over .RCO's (resource containers), what is not clear is if is posible to load a texture with a custom name from a .RCO with a custom name (e.g: tex_myicon from a file named: myresources.rco)... Initially .SPRX needs to be "indexed" by VSH to be available, and .RCO's are dependant of .SPRX... but in case of the resources is posible all are available --Sandungas (talk) 19:22, 20 May 2014 (EDT)

Display Buffers

VSH uses 2 of 8 available display buffers. Information about them can be aquired by vsh plugins using this code snippet: [[2]]
In FW 4.46 DEX the buffer info looks like this (for 1920x1080):

GCMBUFINFO 0
address: 0xdc80000
pitch: 0x2000
width: 0x780
height: 0x438

GCMBUFINFO 1
address: 0xe500000
pitch: 0x2000
width: 0x780
height: 0x438

Settings

VSH contains an array of structs which describes the xRegistry.sys. (More Information about its access Talk:VSH )

struct Setting_s
{
  int32_t index;
  const char* name;
  int32_t unk0;
  int8_t unk1;
  union
  {
     int32_t integer;
     const char* string;
  }default;
  int32_t type;
  int32_t unk2;
};

The first element of this array describes the password setting. Use this script to label all of the settings. link

.long 1                 # index
.long aSettingParen_4   # name # "/setting/parental/passwordNumber"
.long 1                 # unk0
.byte 1                 # unk1
.byte 0, 0, 0
.long a0000_1           # default # "0000"
.long 4                 # type
.long 0x28              # unk2

Events

Global Event Queue Id's:

Polling Service
0x8006020000000030
0x8006020000000010
0x8006020000000002
0x8006020000000000

CMND Service (Connect)
0x8006010000000100
0x8006010000000101
0x8006010000000102
0x8006010000000103

SceNpTusVsh
0x0800604000000902 

Title IDs

Clears a Memory Container in relation of this game and a camera (disables video chat etc.?)
BLUS20001 Ridge Racer 7
BCAS20001 Ridge Racer 7
BLJS10001 Ridge Racer 7
BCES00009 Ridge Racer 7
BCKS10001 Ridge Racer 7

Circumvents an AudioOut Setting that made the game freeze/black screen
BLUS30264 Afro Samurai 
BLES00516 Afro Samurai
NPUB90215 Afro Samurai (Demo)

BLJM60130 Street Fighter IV
BLUS30265 Street Fighter IV
BLES00481 Street Fighter IV

BCJB95006 Torne
NPIA00005 PlayStation Home
NPIA00009 
NPIA00010 PlayStation Home
NPIA00011
NPEA00013 PlayStation Home

WebBrowser finalize executed without mutex/lock syncs
NPJB00001 Tekken 5: Dark Resurrection
NPUB30009 Tekken 5: Dark Resurrection

NPJB00023 Crystal Defenders 
NPUB30092 Crystal Defenders