Syscalls: Difference between revisions

From PS4 Developer wiki
Jump to navigation Jump to search
(added system call idc script)
Line 41: Line 41:
{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! Number !! Prototype !! Notes !! Name
! Number !! Name !! Prototype !! Notes
|-
|-
| 532 || - || - || sys_regmgr_call
| 532 || sys_regmgr_call || - || -
|-
|-
| 533 || - || - || sys_jitshm_create
| 533 || sys_jitshm_create || - || Only callable from a jit compiler process, else returns EPERM (0x1)
|-
|-
| 534 || - || - || sys_jitshm_alias
| 534 || sys_jitshm_alias || - || Only callable from a jit compiler/application process, else returns EPERM (0x1)
|-
|-
| 535 || - || - || sys_dl_get_list
| 535 || sys_dl_get_list || - || Only callable from a debugger, core dump, or syscore process, else returns EPERM (0x1)
|-
|-
| 536 || - || - || sys_dl_get_info
| 536 || sys_dl_get_info || - || Only callable from a debugger, core dump, or syscore process, else returns EPERM (0x1)
|-
|-
| 537 || disabled || always returns 0x4e || sys_dl_notify_event
| 537 || sys_dl_notify_event || - || Always returns ENOSYS (0x4E) (may only be implemented in devkits)
|-
|-
| 538 || - || - || sys_evf_create
| 538 || sys_evf_create || int sys_evf_create(char* name, int flag, struct evFlag *evf) || -
|-
|-
| 539 || - || - || sys_evf_delete
| 539 || sys_evf_delete || int sys_evf_delete(int id) || -
|-
|-
| 540 || - || - || sys_evf_open
| 540 || sys_evf_open || int sys_evf_open(struct evFlag *evf) || -
|-
|-
| 541 || - || - || sys_evf_close
| 541 || sys_evf_close || int sys_evf_close(int id) || -
|-
|-
| 542 || - || - || sys_evf_wait
| 542 || sys_evf_wait || - || -
|-
|-
| 543 || - || - || sys_evf_trywait
| 543 || sys_evf_trywait || - || -
|-
|-
| 544 || - || - || sys_evf_set
| 544 || sys_evf_set || int sys_evf_set(int id) || -
|-
|-
| 545 || - || - || sys_evf_clear
| 545 || sys_evf_clear || int sys_evf_clear(int id) || -
|-
|-
| 546 || - || - || sys_evf_cancel
| 546 || sys_evf_cancel || int sys_evf_cancel(int id) || -
|-
|-
| 547 || - || - || sys_query_memory_protection
| 547 || sys_query_memory_protection || - || -
|-
|-
| 548 || - || - || sys_batch_map
| 548 || sys_batch_map || - || -
|-
|-
| 549 || - || - || sys_osem_create
| 549 || sys_osem_create || - || -
|-
|-
| 550 || - || - || sys_osem_delete
| 550 || sys_osem_delete || - || -
|-
|-
| 551 || - || - || sys_osem_open
| 551 || sys_osem_open || - || -
|-
|-
| 552 || - || - || sys_osem_close
| 552 || sys_osem_close || - || -
|-
|-
| 553 || - || - || sys_osem_wait
| 553 || sys_osem_wait || - || -
|-
|-
| 554 || - || - || sys_osem_trywait
| 554 || sys_osem_trywait || - || -
|-
|-
| 555 || - || - || sys_osem_post
| 555 || sys_osem_post || - || -
|-
|-
| 556 || - || - || sys_osem_cancel
| 556 || sys_osem_cancel || - || -
|-
|-
| 557 || - || - || sys_namedobj_create
| 557 || sys_namedobj_create || - || -
|-
|-
| 558 || - || - || sys_namedobj_delete
| 558 || sys_namedobj_delete || - || -
|-
|-
| 559 || - || - || sys_set_vm_container
| 559 || sys_set_vm_container || - || Successful call requires privileges (uid0), else returns EPERM (0x1)
|-
|-
| 560 || - || - || sys_debug_init
| 560 || sys_debug_init || - || -
|-
|-
| 561 || - || - || sys_suspend_process
| 561 || sys_suspend_process || int sys_suspend_process(int pid) || Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
|-
|-
| 562 || - || - || sys_resume_process
| 562 || sys_resume_process || int sys_resume_process(int pid) || Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
|-
|-
| 563 || - || - || sys_opmc_enable
| 563 || sys_opmc_enable || - || -
|-
|-
| 564 || - || - || sys_opmc_disable
| 564 || sys_opmc_disable || - || -
|-
|-
| 565 || - || - || sys_opmc_set_ctl
| 565 || sys_opmc_set_ctl || - || -
|-
|-
| 566 || - || - || sys_opmc_set_ctr
| 566 || sys_opmc_set_ctr || - || -
|-
|-
| 567 || - || - || sys_opmc_get_ctr
| 567 || sys_opmc_get_ctr || - || -
|-
|-
| 568 || disabled || always returns 0x4e || sys_budget_create
| 568 || sys_budget_create || - || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 569 || disabled || always returns 0x4e || sys_budget_delete
| 569 || sys_budget_delete || - || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 570 || disabled || always returns 0x4e || sys_budget_get
| 570 || sys_budget_get || - || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 571 || disabled || always returns 0x4e || sys_budget_set
| 571 || sys_budget_set || - || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 572 || - || - || sys_virtual_query
| 572 || sys_virtual_query || - || -
|-
|-
| 573 || disabled || always returns 0x4e || sys_mdbg_call
| 573 || sys_mdbg_call || - || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 574 || - || - || sys_sblock_create
| 574 || sys_sblock_create || - || -
|-
|-
| 575 || - || - || sys_sblock_delete
| 575 || sys_sblock_delete || - || -
|-
|-
| 576 || - || - || sys_sblock_enter
| 576 || sys_sblock_enter || - || -
|-
|-
| 577 || - || - || sys_sblock_exit
| 577 || sys_sblock_exit || - || -
|-
|-
| 578 || - || - || sys_sblock_xenter
| 578 || sys_sblock_xenter || - || -
|-
|-
| 579 || - || - || sys_sblock_xexit
| 579 || sys_sblock_xexit || - || -
|-
|-
| 580 || - || - || sys_eport_create
| 580 || sys_eport_create || - || -
|-
|-
| 581 || - || - || sys_eport_delete
| 581 || sys_eport_delete || - || -
|-
|-
| 582 || - || - || sys_eport_trigger
| 582 || sys_eport_trigger || - || -
|-
|-
| 583 || - || - || sys_eport_open
| 583 || sys_eport_open || - || -
|-
|-
| 584 || - || - || sys_eport_close
| 584 || sys_eport_close || - || -
|-
|-
| 585 || - || - || sys_is_in_sandbox
| 585 || sys_is_in_sandbox || - || -
|-
|-
| 586 || - || - || sys_dmem_container
| 586 || sys_dmem_container || - || Successful call requires privileges (uid0), else returns EPERM (0x1)
|-
|-
| 587 || - || - || sys_get_authinfo
| 587 || sys_get_authinfo || - || Some functionality requires privileges (uid0)
|-
|-
| 588 || - || - || sys_mname
| 588 || sys_mname || - || -
|-
|-
| 589 || disabled || always returns 0x4e || sys_dynlib_dlopen
| 589 || sys_dynlib_dlopen || - || Always returns ENOSYS (0x4E) (may only be implemented in devkits)
|-
|-
| 590 || - || - || sys_dynlib_dlclose
| 590 || sys_dynlib_dlclose || - || -
|-
|-
| 591 || - || - || sys_dynlib_dlsym
| 591 || sys_dynlib_dlsym || int sys_dynlib_dlsym(int moduleHandle, char* functionName, int *destFuncOffset) || -
|-
|-
| 592 || - || - || sys_dynlib_get_list
| 592 || sys_dynlib_get_list || int sys_dynlib_get_list(int *destModuleHandles, int max, int *count) || -
|-
|-
| 593 || - || - || sys_dynlib_get_info
| 593 || sys_dynlib_get_info || int sys_dynlib_get_info(int moduleHandle, int *destModuleInfo) || Sony has stripped module information since 1.76 FW (STO) *
|-
|-
| 594 || - || - || sys_dynlib_load_prx
| 594 || sys_dynlib_load_prx || int sys_dynlib_load_prx(char* prxPath) || -
|-
|-
| 595 || - || - || sys_dynlib_unload_prx
| 595 || sys_dynlib_unload_prx || int sys_dynlib_unload_prx(int prxID) || -
|-
|-
| 596 || - || - || sys_dynlib_do_copy_relocations
| 596 || sys_dynlib_do_copy_relocations || - || -
|-
|-
| 597 || - || - || sys_dynlib_prepare_dlclose
| 597 || sys_dynlib_prepare_dlclose || - || Contains an exploitable integer overflow FW <= 1.76, patched FW >= 2.00 **
|-
|-
| 598 || - || - || sys_dynlib_get_proc_param
| 598 || sys_dynlib_get_proc_param || - || -
|-
|-
| 599 || - || - || sys_dynlib_process_needed_and_relocate
| 599 || sys_dynlib_process_needed_and_relocate || - || -
|-
|-
| 600 || - || - || sys_sandbox_path
| 600 || sys_sandbox_path || - || Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
|-
|-
| 601 || - || - || sys_mdbg_service
| 601 || sys_mdbg_service || - || -
|-
|-
| 602 || - || - || sys_randomized_path
| 602 || sys_randomized_path || - || Some functionality requires privileges (uid0)
|-
|-
| 603 || - || - || sys_rdup
| 603 || sys_rdup || - || Successful call requires privileges (uid0), else returns EPERM (0x1)
|-
|-
| 604 || - || - || sys_dl_get_metadata
| 604 || sys_dl_get_metadata || - || Only callable from a debugger, core dump, or syscore process, else returns EPERM (0x1)
|-
|-
| 605 || - || - || sys_workaround8849
| 605 || sys_workaround8849 || - || -
|-
|-
| 606 || - || - || sys_is_development_mode
| 606 || sys_is_development_mode || - || -
|-
|-
| 607 || - || - || sys_get_self_auth_info
| 607 || sys_get_self_auth_info || - || -
|-
|-
| 608 || - || - || sys_dynlib_get_info_ex
| 608 || sys_dynlib_get_info_ex || int sys_dynlib_get_info_ex(int moduleHandle, struct Unk *unk, int *destModuleInfoEx) || Returns EPERM (0x1) if unk->unknown340 is 0***
|-
|-
| 609 || disabled || always returns 0x4e || sys_budget_getid
| 609 || sys_budget_getid || int sys_budget_getid() // no arguments || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 610 || disabled || always returns 0x4e || sys_budget_get_ptype
| 610 || sys_budget_get_ptype || int sys_budget_get_ptype(int budgetID) || -
|-
|-
| 611 || - || - || sys_get_paging_stats_of_all_threads
| 611 || sys_get_paging_stats_of_all_threads || - || Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
|-
|-
| 612 || - || - || sys_get_proc_type_info
| 612 || sys_get_proc_type_info || int sys_get_proc_type_info(int *destProcessInfo) || Only callable from certain processes mainly involving media and JiT
|-
|-
| 613 || - || - || sys_get_resident_count
| 613 || sys_get_resident_count || int sys_get_resident_count(int pid) || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 614 || - || - || sys_prepare_to_suspend_process
| 614 || sys_prepare_to_suspend_process || int sys_prepare_to_suspend_process(int pid) || Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
|-
|-
| 615 || - || - || sys_get_resident_fmem_count
| 615 || sys_get_resident_fmem_count || int sys_get_resident_fmem_count(int pid) || Some functionality requires privileges (uid0)
|-
|-
| 616 || - || - || sys_thr_get_name
| 616 || sys_thr_get_name || int sys_thr_get_name(int threadID) || -
|-
|-
| 617 || - || - || sys_set_gpo
| 617 || sys_set_gpo || - || Only callable on development kit (devkit) units
|-
|-
|}
|}

Revision as of 02:58, 3 December 2016

PS4 kernel is based on FreeBSD 9.0; a list of FreeBSD 9.0 system calls can be found here.

Compatibility system calls, and some others, have been disabled.

The first custom Sony system call comes immediately after the last FreeBSD system call, wait6, and is number 533.

The final custom Sony system call is 617.

Calling any system calls higher than 617 gives the same result as calling a compatibility or unimplemented system call, "There is not enough free system memory" error.

Of these 85 (617 - 532), 9 always return 0x4e, ENOSYS, leaving us with just 76 which are usable (the disabled 9 may only be callable from development units).

As of firmware version 3.55 there is evidence of new syscalls!

https://i.gyazo.com/aa2bceacf5e5f45a15495fcdb79585cb.png


You can find an IDA Pro .idc script I made to label system calls in libkernel here:

http://pastebin.com/xch7pb2H

Functions of custom Sony system calls

Known calls include those relating to:

  1. Modules
  2. Memory
  3. Sandboxing
  4. Semaphores

Other potential calls could be for:

  1. Mutexes

Other operations, such as file IO and networking are handled through regular FreeBSD system calls.

Public system calls

Number Name Prototype Notes
532 sys_regmgr_call - -
533 sys_jitshm_create - Only callable from a jit compiler process, else returns EPERM (0x1)
534 sys_jitshm_alias - Only callable from a jit compiler/application process, else returns EPERM (0x1)
535 sys_dl_get_list - Only callable from a debugger, core dump, or syscore process, else returns EPERM (0x1)
536 sys_dl_get_info - Only callable from a debugger, core dump, or syscore process, else returns EPERM (0x1)
537 sys_dl_notify_event - Always returns ENOSYS (0x4E) (may only be implemented in devkits)
538 sys_evf_create int sys_evf_create(char* name, int flag, struct evFlag *evf) -
539 sys_evf_delete int sys_evf_delete(int id) -
540 sys_evf_open int sys_evf_open(struct evFlag *evf) -
541 sys_evf_close int sys_evf_close(int id) -
542 sys_evf_wait - -
543 sys_evf_trywait - -
544 sys_evf_set int sys_evf_set(int id) -
545 sys_evf_clear int sys_evf_clear(int id) -
546 sys_evf_cancel int sys_evf_cancel(int id) -
547 sys_query_memory_protection - -
548 sys_batch_map - -
549 sys_osem_create - -
550 sys_osem_delete - -
551 sys_osem_open - -
552 sys_osem_close - -
553 sys_osem_wait - -
554 sys_osem_trywait - -
555 sys_osem_post - -
556 sys_osem_cancel - -
557 sys_namedobj_create - -
558 sys_namedobj_delete - -
559 sys_set_vm_container - Successful call requires privileges (uid0), else returns EPERM (0x1)
560 sys_debug_init - -
561 sys_suspend_process int sys_suspend_process(int pid) Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
562 sys_resume_process int sys_resume_process(int pid) Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
563 sys_opmc_enable - -
564 sys_opmc_disable - -
565 sys_opmc_set_ctl - -
566 sys_opmc_set_ctr - -
567 sys_opmc_get_ctr - -
568 sys_budget_create - Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
569 sys_budget_delete - Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
570 sys_budget_get - Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
571 sys_budget_set - Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
572 sys_virtual_query - -
573 sys_mdbg_call - Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
574 sys_sblock_create - -
575 sys_sblock_delete - -
576 sys_sblock_enter - -
577 sys_sblock_exit - -
578 sys_sblock_xenter - -
579 sys_sblock_xexit - -
580 sys_eport_create - -
581 sys_eport_delete - -
582 sys_eport_trigger - -
583 sys_eport_open - -
584 sys_eport_close - -
585 sys_is_in_sandbox - -
586 sys_dmem_container - Successful call requires privileges (uid0), else returns EPERM (0x1)
587 sys_get_authinfo - Some functionality requires privileges (uid0)
588 sys_mname - -
589 sys_dynlib_dlopen - Always returns ENOSYS (0x4E) (may only be implemented in devkits)
590 sys_dynlib_dlclose - -
591 sys_dynlib_dlsym int sys_dynlib_dlsym(int moduleHandle, char* functionName, int *destFuncOffset) -
592 sys_dynlib_get_list int sys_dynlib_get_list(int *destModuleHandles, int max, int *count) -
593 sys_dynlib_get_info int sys_dynlib_get_info(int moduleHandle, int *destModuleInfo) Sony has stripped module information since 1.76 FW (STO) *
594 sys_dynlib_load_prx int sys_dynlib_load_prx(char* prxPath) -
595 sys_dynlib_unload_prx int sys_dynlib_unload_prx(int prxID) -
596 sys_dynlib_do_copy_relocations - -
597 sys_dynlib_prepare_dlclose - Contains an exploitable integer overflow FW <= 1.76, patched FW >= 2.00 **
598 sys_dynlib_get_proc_param - -
599 sys_dynlib_process_needed_and_relocate - -
600 sys_sandbox_path - Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
601 sys_mdbg_service - -
602 sys_randomized_path - Some functionality requires privileges (uid0)
603 sys_rdup - Successful call requires privileges (uid0), else returns EPERM (0x1)
604 sys_dl_get_metadata - Only callable from a debugger, core dump, or syscore process, else returns EPERM (0x1)
605 sys_workaround8849 - -
606 sys_is_development_mode - -
607 sys_get_self_auth_info - -
608 sys_dynlib_get_info_ex int sys_dynlib_get_info_ex(int moduleHandle, struct Unk *unk, int *destModuleInfoEx) Returns EPERM (0x1) if unk->unknown340 is 0***
609 sys_budget_getid int sys_budget_getid() // no arguments Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
610 sys_budget_get_ptype int sys_budget_get_ptype(int budgetID) -
611 sys_get_paging_stats_of_all_threads - Successful call requires credentials (td->td_proc->p_ucred), else returns EPERM (0x1)
612 sys_get_proc_type_info int sys_get_proc_type_info(int *destProcessInfo) Only callable from certain processes mainly involving media and JiT
613 sys_get_resident_count int sys_get_resident_count(int pid) Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
614 sys_prepare_to_suspend_process int sys_prepare_to_suspend_process(int pid) Successful call requires credentials (td->td_proc->p_ucred), else returns ENOSYS (0x4E)
615 sys_get_resident_fmem_count int sys_get_resident_fmem_count(int pid) Some functionality requires privileges (uid0)
616 sys_thr_get_name int sys_thr_get_name(int threadID) -
617 sys_set_gpo - Only callable on development kit (devkit) units
Reverse Engineering
Bootprocess  ·  BootLogo  ·  DataBases  ·  Disc Identification/Serialization Data  ·  Files on the PS4  ·  IOCTL  ·  Libraries  ·  Partitions  ·  Syscalls  ·  Kernel Patches  ·  sealedkey / pfsSKKey  ·  VTRM  ·  Bugs  ·  Vulnerabilities  ·  SBL  ·  Devices  ·  Registry  ·  Build Strings  ·  QA Flagging  ·  Strings  ·  Hardware Info
Dumps & Strings
Dumps
Strings
Communication
USB
Wifi/LAN
Keys, Commands & Digests
Emulation
General
Compatibility Lists
System Modules
Retrieved from "http://www.psdevwiki.com/ps4/index.php?title=Syscalls&oldid=276380"