Repository navigation
Conversation
…sole does A sweep of the 281 libSceHmd2 exports on a PS5 (firmware 13.60), each called from a payload before sceHmd2Initialize once with every argument null and once with every argument pointing at a zeroed 16 KiB buffer, found 127 that answer the same code both ways and write nothing. 125 of them are bound here, by NID, to one handler per answer: 45 return 0, 16 return 0x8a720008, 15 return 0x8a720004, 12 return -1, 10 reprojection exports return 0x8a72000b, 9 return 0x8a720002, 9 return 0x8a720009, 5 return 0x8a721002 and one each returns 0x8a72002c, 0x8a721003, 0x400 and 0x20000. Each handler returns its measured value while the library is not initialized and throws if sceHmd2Initialize ever succeeds, because the initialized behaviour is not measured; since b378541 it fails with UnsupportedFeature here, so these are the answers titles get. Left out: the export that returns a pointer-like value, the one answering 0x8a72000a (which sceHmd2Initialize also returns for some applications), the exports that answer differently to null and to zeroed arguments or write output, the 16 that crashed the probe, and the exports that main, boykopovar#7658 or boykopovar#7690 already implement. The debt entries list every NID with its aerolib name where one exists. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ation as the console does The hmd2s sweep left 81 libSceHmd2 exports that answer 0x8a720008 to all-null arguments but something else to zeroed buffers. A second probe called each of them six times before sceHmd2Initialize, every argument pointing at a zeroed 16 KiB buffer except one, to find which arguments are the checked pointers. 62 exports answer 0x8a720008 exactly when one of a fixed set of arguments is null and their all-present code otherwise: 48 check the first argument, 10 the second, 6 the first two, 2 the first and third, 2 all six. They are bound here, by NID, to 18 handlers with that many pointer parameters, each returning ParameterNull for a null checked pointer and otherwise the measured code (0x8a720004 for 20 of them, 0 for 11, 0x8a721002 for 10, -1 for 5, 0x8a720009 for 7, 0x8a72002c for 3, and 0x8a720003, 0x8a721003, 0x8a721010 and 0x800d0203 for the rest) while the library is not initialized, throwing if sceHmd2Initialize ever succeeds. Left out: 7 exports that write output and 12 whose first argument is a handle or slot number rather than a pointer. The debt entries list every NID with its aerolib name where one exists. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Progress report (b95ca1b → dd86478)📉 System libraries: 84.19% (-0.55%, +30 declared functions) 🆕 30 declared as stubs
|
|
Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.
|
Contributor
Author
|
Console log behind the table in the description: probe hmd2n, the 81 pointer-checking libSceHmd2 NIDs from the hmd2s sweep, each called six times before sceHmd2Initialize with every argument pointing at a zeroed 16 KiB buffer except one; payload process, firmware 13.60, no headset connected. 18-hmd2n-console.txtAI-assisted: yes. |
12 tasks done
2 tasks done
Contributor
|
This PR looks strictly contained in #7826: its two commits ( If the intent was one review thread, closing this in favour of #7826 would keep a single place for the maintainers to look — #7826 also has a verified rebase handoff onto current |
12 tasks done
12 tasks done
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Follow-up to #7798. That sweep left 81
libSceHmd2exports that answer0x8a720008(ParameterNull) to all-null arguments but something else to zeroed buffers, so they validate pointers. A second probe (hmd2n) called each of them six times beforesceHmd2Initialize, every argument pointing at its own zeroed 16 KiB buffer except one, to find which arguments are the checked pointers. 62 exports answer0x8a720008exactly when one of a fixed set of arguments is null and their all-present code otherwise; they are bound here by NID, as in #7798, to 18 handlers with that many pointer parameters:0x8a7200040x8a7210020x8a7200090x8a72002c0x8a7200090x8a7200090x800d0203,0x8a721003,0x8a721010; arguments 0 and 1 with0x8a721002,0x8a721003; arguments 0 and 2 with 0,0x8a721003; argument 1 with0x8a720003,0x8a721002Each handler returns
ParameterNullfor a null checked pointer and otherwise the measured code while the library is not initialized, through theBeforeInitializehelper from #7798, which throws ifsceHmd2Initializeever succeeds (it fails withUnsupportedFeatureonmainsince b378541). What the present arguments mean is not measured and is said so in the debt entries, which list every NID with its aerolib name where one exists (34 of the 62).Error1010andError800d0203are placeholder names.Left as they were: 7 exports that write output (their field widths are not known) and 12 whose answer to a single null argument is neither
ParameterNullnor their all-present code, which take a handle or slot number rather than a pointer first.Measurement: probe
hmd2n(81 NIDs, 486 calls, resumable across crashes), run from Payload Manager with no headset connected; log attached as a comment, together with the earlierhmd2ssweep it starts from.Tested
maineaae7e0 plus feat(libSceHmd2): answer 125 exports before initialization as the console does #7798:libs,guest_hmd2_testsandpatched_libraries_testsbuilt;ctest -R "guest_hmd2|patched_libraries"2/2 passed. The test calls every handler with all pointers present and with each checked pointer null, beforesceHmd2Initializeand after its failed call.maindb7763d plus feat(libSceHmd2): answer 125 exports before initialization as the console does #7798: same targets built, same two tests passed.tools/check_conventions.pyclean against bothmainand feat(libSceHmd2): answer 125 exports before initialization as the console does #7798's branch;tools/pr_overlap.py: feat(libSceHmd2): export missing firmware functions from database #6844 declares throwing stubs by name for 7 of these exports (sceHmd2GazeGetDeviceStatus,sceHmd2SetFieldOfViewand others), answered from measurement here, so whichever lands second rebases; feat(libs): the Hmd2 reprojection session #7658 and feat(libSceHmd2): return the console's display and mirroring buffer sizes #7690 shareHmd2.hppand the debt file only. No title was run: no known title calls these exports before initialization.Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file.mdfiles or images added to the repository (attach them to this PR)🤖 Generated with Claude Code