Reboot after sctrlKernelLoadExecVSHMs2

[_BenJi]

Hi,

I'm using 'sctrlKernelLoadExecVSHMs2' to launch an homebrew in my own plugin, but when the launched hombrew stop, the psp restart itself...

Is it normal ? Or do I something wrong ?

[Hellcat]

How does the homebrew exit?
If it's using sceKernelExitGame() the reboot is pretty much the way it's supposed to go, yes....

[_BenJi]

I don't know :P

I've just tried with an hombrew using sceKernelExitGame() and yes, it reset the PSP. But if I launch this hombrew directly from the XMB, when it stops, the PSP go back on the XMB.

Is there a meaning to avoid the reset ?

[Hellcat]

The return to the XMB actually is a reboot, but it skips the coldboot sequence usually in that case.

Only thing I could think of at the moment to prevent the reboot would be to patch/redirect the sceKernelExitGame() syscall to a function of your own that goes back into your app, instead of rebooting the PSP.

[_BenJi]

Ok... but why that doens't skip the coldboot here ? :(

I'll try to find how to patch/redirect the sceKernelExitGame()

[moonlight]

Ok... but why that doens't skip the coldboot here ? :(

I'll try to find how to patch/redirect the sceKernelExitGame()

You have to pass certain params in the vshmain_args fields of the structure, as the XMB does.

[Cpasjuste]

Ok... but why that doens't skip the coldboot here ? :(

I'll try to find how to patch/redirect the sceKernelExitGame()

If your goal is to hook the sceKernelExitGame function, you can take a look at the excellent psplink sources on svn (look at psplink.c i think).

[_BenJi]

You have to pass certain params in the vshmain_args fields of the structure, as the XMB does.

I don't find the correct params ; I looked at the source of Dark_Alex's 1.5 POC, but the params to skip the coldboot doesn't work here... It may have changed for a while.

But it can be found somewhere... ahhhhhh

I'll have a look at psplink sources...

EDIT: http://forums.ps2dev.org/viewtopic.php?p=42242#42242 that doesn't work :/ (it's like in the source that I mentioned above)

[_BenJi]

Well, does somebody know what is correct the vshmain_args ?

I looked at the psplink sources, but it uses functions that require kernel mode, and on my psp slim I cannot use them. Is it possible to hook function without being in kernel mode ?

[Hellcat]

Is it possible to hook function without being in kernel mode ?

I don't think so, I doubt the memory parts you have to manipulate are writable from usermose.... didn't try so far, always put my hooking/patching stuff in a kernel module, since I anticipate it failing in usermode anyway.... worth a try ;)

However, you could make a simple replacement vshmain.prx that dumps the arguments passed to it into a file....

[moonlight]

This is what i dumped within vshctrl in 3.80.

Code: Select all

u8 vshmain_args[0x400];
struct SceKernelLoadExecVSHParam param;

memset(vshmain_args, 0, sizeof(vshmain_args));
vshmain_args[0x40] = 1;
vshmain_args[0x280] = 1;
vshmain_args[0x284] = 3;
vshmain_args[0x286] = 5;

memset(&param, 0, sizeof(param));
param.size = sizeof(param);
param.args = strlen(EBOOT) + 1;
param.argp = EBOOT;
param.key = "game";
param.vshmain_args_size = sizeof(vshmain_args);
param.vshmain_args = vshmain_args;

[_BenJi]

This is what i dumped within vshctrl in 3.80.

Code: Select all

u8 vshmain_args[0x400];
struct SceKernelLoadExecVSHParam param;

memset(vshmain_args, 0, sizeof(vshmain_args));
vshmain_args[0x40] = 1;
vshmain_args[0x280] = 1;
vshmain_args[0x284] = 3;
vshmain_args[0x286] = 5;

memset(&param, 0, sizeof(param));
param.size = sizeof(param);
param.args = strlen(EBOOT) + 1;
param.argp = EBOOT;
param.key = "game";
param.vshmain_args_size = sizeof(vshmain_args);
param.vshmain_args = vshmain_args;

Wow thx a lot ! That doesn't work [The game could not be started (80010002)] but I think it's because I'm running 3.71. Can you explain how did you dump this ? I'll test on a 3.80M33

[moonlight]

Well, M33 vsh core hooks some LoadExec functions to do its stuff, so i just dumped the params in the hooked function.

[Torch]

Can you explain the vshmain_args in a bit more detail?

I made a replacement vshmain.prx and when booting from power off, it has argc=0. If I exit recovery menu, then it has argc=19.

How do I capture the arguements in my replacement vshmain.prx and forward them to vshmain_real.prx?
You've decalred vshmain_args with 0x400 (1024) chars... Does each char correspond to one element in the *argv[] array or what?

Is vshmain_args even the same as *argv[] ??