Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - Graphene

Pages: [1] 2
Reverse Engineering / sceTriggerUtil - library header + how to use
« on: July 06, 2020, 08:26:01 PM »
sceTriggerUtil is library used to schedule one time or daily application events.

Prerequisites to use sceTriggerUtil:

1. SCE_SYSMODULE_TRIGGER_UTIL sysmodule must be loaded
2. "Settings->System->Auto-Start Settings" for application must be enabled (enabled by default). This will only appear in setting after at least one event has been registered by the application.
3. "app/*titleid*/sce_sys/incoming_dialog.xml" must be present. Examples of this file can be found in Radiko and Wake-Up Club applications. Multilanguage is supported (ex. incoming_dialog_JP.xml)

Information about events:

1. Max 8 events per one application can be registered.
2. Events will be triggered even when system is in sleep mode.

Library header can be found here:

Thread optimizer is plugin + config application set that allows you to adjust thread priority and CPU affinity mask of any threads created by game to achieve maximum performance.


This plugin is intended for users who at the very least understand the concept of threading.
If you have no idea what you are doing, you have the option to wait until someone else shares their preset for the game you want.

I am not responsible for any lost game progress or corrupted savedata caused by improper thread adjustments.

Please read all instructions carefully before installing!

1. Required plugins:

Thread Optimizer requires following plugins to be installed on your system:
- CoreUnlocker80000H (,203.0.html).
- ioPlus (,205.0.html).

Make sure you have both of them installed before continuing.

2. What is snapshot?

Snapshot is the file that holds information about all threads that game has created. Once snapshot has been made, it is also used as preset to store user-edited thread parameters.
Snapshot contains following information for each of the threads:
- CRC16 (checksum used to identify thread)
- Thread entry function address (used only to calculate CRC16)
- Thread name
- Thread priority <- can be edited in config app
- Thread CPU affinity mask <- can be edited in config app

3. Thread parameters that you can change:

- CPU afiinity mask
Determines wich CPU cores will be allowed to run the thread.

- Priority
Determines thread priority. Lower the number, higher the priority. It is not recommended to adjust it unless you know what you are doing.

4. Usage procedure:

- Install plugin and application.
Plugin can be installed under *ALL or under games you want to use it with.

- Launch the game you want to create preset for.

- Take a snapshot of game threads by holding LTRIGGER + RTRIGGER + SQUARE until you see notification.
Since snapshot accumulates all thread data since the game start, it is recommended that you at least get into the actual gameplay before taking a snapshot.
You can delete snapshot you just created by holding LTRIGGER + RTRIGGER + TRIANGLE. However, snapshots that has been taken in different game session can only be deleted from config app.

- Exit the game, open config app and adjust thread parameters of the snapshot and save it.

- Open the game again. New thread parameters will be applied automatically.

- You can delete snapshot from config application if you are not happy with your adjustments and start from scratch.

- Snapshots are stored in ux0:data/ThreadOptimizer/*titleid*/
Snapshots do not contain any personal data and can be shared with other users.

5. Current limitations:

- Parameters of the main thread cannot be adjusted.
- Threads that have same name, entry function address, priority and CPU affinity mask are considered to be the same.

TO usage guide:,210.msg627.html#msg627

Download here:

Example of good snapshot profile (download link in the video description):

With Thread Optimizer:

Same level without Thread Optimizer:

Plugin for PS Vita that allows game mode applications to use system-reserved CPU core (CPU3).

This is part 1 of the plugin and app set that will allow to fine tune threading in games.

Install under *KERNEL.


1. But Vita has 4-core CPU. Why do we need that plugin?
- Games are allowed to use only 3 CPU cores out of 4 (CPU0, CPU1 and CPU2). CPU3 core is reserved for system processes, such as loading modules, and usually stays at around 10-15% during the game.

2. Will it improve performance in games?
- No, this plugin will not improve performance in games by itself. It only removes check that prevents games from using system-reserved core CPU affinity mask. Improving performance will be the task of the second plugin and config app that will be released soon.

3. I am hombrew developer. How can I use system-reserved core in my game?
- When creating new thread, specify 0x80000 for CPU affinity mask. You can also use that value with sceKernelChangeThreadCpuAffinityMask() to change affinity mask of already existing thread.


SceNotificationUtil is sysmodule that allows applications to send notifications, simple-type and progress-type(BGDL).

Full libraries header here:

PoC BGDL-type notification here:

Some notes:

1. Most of the text buffers can be intentionally overflown to allow for more text.
2. Since SceNotificationUtil is just a wrapper for SceShellSvc, it is highly possible that reimplementing some of it's functions will allow for more customization (such as enabling "Pause" button for BGDL-type and custom icons).
3. If you are using notifications with app that uses vita2d or vita2d_sys, notification functions must be called from separate dedicated thread, otherwise SceShellSvc will get stuck in internal loop for unknown reasons.


ShellAudio is PS Vita library that is a result of reverse engineering Sony's static library that is used in system applications and Music application to play audio files using SceShell resources.

suprx module version:

1. Very easy to use.
2. Doesn't use any of the resources allocated to the application.
3. All decoding is performed on Codec Engine.
4. Supports EQ, different repeat modes, shuffle mode.
5. When in music mode, volume can be controlled with "Music" slider from quick menu.

Supported codecs:
1. MP3 (.mp3)
2. AAC (.m4a, .aac)
3. ATRAC9 (.at9)
4. WAV (.wav)

Examples of usage:

1. Application BGM (NOTE: in param.sfo, ATTRIBUTE flag ENABLE BGM PROXY must be set to 1)

SceShellSvcAudioCustomOpt optParams;
sceClibMemset(&optParams, 0, 0x10);
optParams.flag = -1;
shellAudioSetAudioForBGM("pd0:data/systembgm/near.at9", &optParams);
shellAudioSendCommandForBGM(SCE_SHELLAUDIO_DEFAULT, 0);

2. Music player with jazz EQ:

shellAudioSendCommandForMusicPlayer(SCE_SHELLAUDIO_STOP, 0);
shellAudioSetAudioForMusicPlayer("pd0:data/systembgm/near.at9", NULL);
shellAudioSendCommandForMusicPlayer(SCE_SHELLAUDIO_PLAY, 0);

PS Vita / [Release] MARISA HighLow PS Vita
« on: May 05, 2020, 01:50:46 AM »
MARISA HighLow port for PS Vita


ElevenMPV-A - Advanced Eleven Music Player VITA

A homebrew music player for Playstation VITA that aims to support many different audio formats compared to the offical PS VITA music application.

BG playback support:

1. By default: with most of the games
2. With [LowMemMode plugin]( with all games


1. Some performance issues for software decoding may occur.

Currently supported formats: (16 bit signed samples)

Hardware decoding (flawless performance even in games):
- MP3

Software decoding:
- IT
- S3M
- XM


- Browse ux0:/, ur0:/, uma0:/, xmc0:/, grw0:/ to play the above audio formats.
- BG playback.
- Pause/Play audio.
- Shuffle/Repeat/Repeat All.
- Equalizer.
- ALC.
- Next/Previous track in current working directory.
- Display ID3v1 and ID3v2 metadata for MP3 files. Other tags are displayed for OGG, FLAC, OPUS and XM.
- Touch support.
- Seeking support using touch screen.

About EQ modes (information by @realusagichan):

- Heavy EQ: bass and highs are boosted
- Pop EQ: bass and highs diminished, midrange boosted
- Jazz EQ: subbass and midrange diminished, mid-bass and treble boosted
- Unique EQ: subbass boosted, very high treble boosted, the rest slightly diminished

EQ modes may cause digital overload at max mixing level for loud music.
To mitigate that enable "Settings->Audio->Limit Volume Whith EQ" option (only software decoded codecs are supported).


In file manager:

- Enter button (cross/circle): enter folder/play supported audio file.
- Cancel button (cross/circle): go up parent folder.
- DPAD Up/Down: Navigate files.
- DPAD Left/Right: Top/Bottom of list.
- SELECT button: open settings.

In audio player:

- Enter button (cross/circle): Play/Pause.
- Cancel button (cross/circle): Return to file manager.
- L trigger: Previous audio file in current directory.
- R trigger: Next audio file in current directory.
- Triangle: Shuffle audio files in current directory.
- Square: Repeat audio files in current directory.
- Power Button: Turn off display and keep playing audio in background.
- SELECT button: open settings.

In background:

- Quick Menu: mixing volume adjustment.
- Interactive notifications.
- Power Button: Turn off display and keep playing audio in background.


- joel16: [ElevenMPV](
- @realusagichan for testing and helping with debug
- dr_libs by mackron.
- libvorbis, libogg and libopus contributors.
- libxmp-lite contributors.
- Preetisketch for startup.png (banner).
- LineageOS's Eleven Music Player contributors for design elements.


Operations with SceTextClipboardStorage

SceTextClipboardStorage is cached memory block with usable size of 0x1FFD bytes allocated by SceShellSvc on startup.
Normally you would access this storage with clipboard sysmodule, however it can also be accessed directly with SceShellSvc functions.
This memory can be accesed from any part of the system and is managed by SceShell.
For example, you can write to it in one application and access written data from the other.
Or you can write to it in application and access written data from the plugin.

int SceShellUtil_C4810C56(const void* data, SceSize size) /* sceShellUtilTextClipboardWrite */

data - pointer to the data to write
size - size of data to write. Must not exceed 0x1FFD.

int SceShellUtil_1B186905(void* data, SceSize size, SceSize *textlen) /* sceShellUtilTextClipboardRead */

data - pointer to the buffer where the read data will be placed
size - size of data to read
[out] textlen - length actually read

unsigned int SceShellUtil_D0DDEDBC(void) /* sceShellUtilTextClipboardGetUsedSize */

This function returns size of the data that was written to clipboard with sceShellUtilTextClipboardWrite()

Music playback using SceShell,158.0.html

Information Bar control:

SceShellUtil_40DFAC6B(char* unk, char* text) //sceShellUtilSetTimeText, sets text in time display, UTF-16 (remains until reboot?)
SceShellUtil_96BBF91B(int mode) //sceShellUtilSetAirplaneIconMode, 0 to hide, 1 to show
SceShellUtil_8B69AD27(int mode) //sceShellUtilSetBtIconMode, 0 to hide, 1 to show

Some other ShellUtil functions:

SceShellUtil_B65B60CA(int mode) //sceShellUtilSetBGMMode, 0 to disable, 1 to enable
SceShellUtil_040997D6(int languageId) //sceShellUtilSetSystemLanguage, takes about 5 sec to apply
SceShellUtil_8F2F143D(void) //sceShellUtilRequestPowerOff
SceShellUtil_636544FB(void) //sceShellUtilRequestReboot

SceShellUtil_BB54D049(int safeModeType, int errorCode, int errorMessageType) //sceShellUtilRequestRebootWithError, shows "A serious error has occured" message before reboot

safeModeType - sets type of safemode to reboot into, 0 to reboot normally
errorCode - error code to display in the message
errorMessageType - ex. 0 "Contact technical support"

If you have been using LowMemMode, please re-download it. Previous versions caused memory leak issue.

This is just a plugin, it will not magically download more RAM to your Vita. If you see C1-2609-7 error when starting application, it means there is not enough free RAM to start it.

Plugin for PS Vita that disables memory budget check during app launch in SceShell.

Allows you to launch other applications in LOWPHYMEM mode while enlarged memory mode app (+29MiB, +77MiB and +109MiB) is in the background.
Tested on 3.60-3.65 retail FW versions.

Install under *main

- Allows to launch Trophies, Friends, Messages, Music, Party and some other applications with +77MiB game (for example, Ys VIII).
- Allows to launch BGFTP with +109MiB game (for example, Darkest Dungeon).

Download link:

Reverse Engineering / All bootparams and their values
« on: April 19, 2020, 03:42:43 PM »
Since DolceSDK now support setting bootparams for applications, I decided to document all bootparams and their values.

1. Differences between "game mode" and "system mode" applications on PS Vita

These are general differences:

"Game mode":

1. Does not support multitasking.
2. "Unlimited" memory budget.
3. Can use only 3 out of 4 CPU cores.
4. Are expected to use normal framebuffer implementation.

"System mode":

1. Support multitasking (several apps of that type can be loaded simultaneosly with each other and with 1 "game mode" app).
2. Limited memory budget.
3. Can use all CPU cores.
4. Are expected to use shared framebuffer.
5. Can NOT use CDRAM.

2. Bootparams

All used bootparams are situated at the start of the bootparams section in the SELF file:

The general functions of these bootparams are:

1. 0x01 - "is used" flag - always set to 1.

2. 0x0000000E - ATTRIBUTE. Controls a lot of application parameters, such as: CPU Affinity mask, process priority, memory types accesible by application etc.
3. 0x001C0000 - PHY_MEMSIZE. Controls how much physically contiguous memory will be allocated to "system mode" application budget.
4. 0x00280100 - APP_MEMSIZE. Controls memory budget for "system mode" application.
6. 0x14 - FILE_OPEN_MAX_NUM. Maximum number of file descriptors opened at the same time.
7. 0x06 - DIRECTORY_MAX_LEVEL. Maximum directory level.
8. 0x04 - ENCRYPT_MOUNT_MAX_NUM. Function is unknown. Related to PFS.
9. 0x04 - REDIRECT_MOUNT_MAX_NUM. Function is unknown. Related to FIOS2.

10. Everything else is reserved area, always set to 0.

If APP_MEMSIZE is set to 0, application will run in "game mode".
If APP_MEMSIZE is set to anything other than 0, application will run in "system mode".

3. Bootparams that you can set for "game mode" applications and their values:

Allowed bootparams:

Only ATTRIBUTE can be set for "game mode" applications.

Values List:

Only one value is allowed: 0x00000002. Function is unknown, set in some apps developed by Sony.

4. Bootparams that you can set for "system mode" applications and their values:

4.1 Allowed bootparams:

All bootparams are allowed

4.2 Values List:

4.2.1 APP_MEMSIZE (all values are little endian)

Smallest seen value: 0x00100000 (4 MB, some BG apps)
Highest seen value: 0x00280100 (74 MB, YouTube app)

Note that applications with APP_MEMSIZE smaller than 0x4000 can be started simultaneously with any game, including enlarged memory mode games, as long as title id check is disabled in SceShell (function of

Note that applications with APP_MEMSIZE bigger than 0x8000 have limited multitasking capabilities.

4.2.2 PHY_MEMSIZE (all values are little endian)

Not used: 0x00000000

Smallest seen value: 0x00100000 (4 MB)
Highest valid value: 0x00680000 (26 MB)

Note that phycont budget is substracted from main budget. For example if APP_MEMSIZE is set to 0x20 (8 MB) and PHY_MEMSIZE is set to 0x10 (4 MB), the resulting application budget will be: 4 MB of main memory and 4 MB of phycont memory.


Not used: 0x00000000. If set to 0, application is limited to system-reserved core. CPU affinity mask of all new threads within application must be set to 0.

Note: in case your app is allowed to use all CPU cores use following CPU affinity mask values when creating new thread:

/*CPU Affinity mask:
0x00000 - all user cores (auto)
0x80000 - system-reserved core

SAS is a library for performing synthesizer processing with software. Some of the functions are hardware accelerated using codec engine.
Audiodec is a library for decoding audio data with a Codec Engine.

libvitaSAS is easy-to-use SceSas and Audiodec library wrapper with system mode applications support.
Loading directly from FIOS2 overlay (for example, loading directly from PSARC archive) is supported. When calling vitaSAS_load_audio_XXX() specify 1 for io_type to use FIOS2 or 0 to use SceIo.

sceSas supports up to 31 voices simultaneous playback.
Pitch, panning, envelope processing and digital effects processing can be done.

Native SAS playback:

Only HE-ADPCM (.vag) and PCM (.pcm) files are supported.

Codec Engine hardware decoding and playback:

Supported input formats (all application modes):

Supported channels : 1 channel, 2 channels
Supported sampling frequencies : 12000/ 24000/ 48000 Hz
Supported bit rates : 48/ 60/ 70/ 84/ 96/ 120/ 144/ 168/ 192 kbps

Supported codecs : AAC-LC, HE-AAC v1/v2
Supported channels : 1 channel, 2 channels
Supported sampling frequencies : 8000/ 11025/ 12000/ 16000/ 22050/ 24000/ 32000/ 44100/ 48000 Hz
Supported bit rates : 16 - 576 kbps

Supported input formats (game applications only):

Supported codecs : MPEG1/ 2/ 2.5 Layer3
Supported channels : 1 channel, 2 channels
Supported sampling
frequencies: 8000/ 11025/ 12000/ 16000/ 22050/ 24000/ 32000/ 44100/ 48000 Hz
Supported bit rates : 8/ 16/ 24/ 32/ 40/ 48/ 56/ 64/ 80/ 96/ 112/ 128/ 144/ 160/ 192/ 224/ 256/ 320 kbps


Reverse Engineering / SceIncomingDialog - full library header + PoC
« on: April 04, 2020, 10:19:49 PM »
SceIncomingDialog is sysmodule that allows applications to show custom dialogs via SceShell.

Full library header here:

Incoming dialog PoC here:

PS Vita / [Release] BGFTP - Background FTP server
« on: February 22, 2020, 02:38:38 AM »
Background FTP server for PS Vita.

Works simultaneously with any game, including enlarged memory mode games, and in sleep mode. BGFTP can send various information to user via notifications.

More information and download:

Reverse Engineering / vshPowerSetPowerSwMode
« on: February 21, 2020, 06:37:22 PM »
int vshPowerSetPowerSwMode(int mode)

returns 0 if successful.

mode values:
0 - press does nothing, long press opens shutdown menu like usual;
1 - press does nothing, long press immediately shuts down;
2 - press immediately suspends, long press opens shutdown menu like usual;
3 - press immediately suspends, long press immediately shuts down;
4 - same as normal?
5 - same as normal?
6 - same as normal?
7 - press suspends as normal, long press immediately shuts down;

PS Vita / [Release] libvita2d_sys - libvita2d for system mode applications
« on: February 16, 2020, 10:59:11 PM »
libvita2d_sys is modification of libvita2d with new features and support for "system mode" applications.

Exclusive features of libvita2d_sys:

- "system mode" that actually works.
- support for custom display resolutions, including 1280x720 and 1920x1080 (with Sharpscale,112.0.html) or 1280x725 and 1920x1088 (without Sharpscale on PS TV).
- Hardware decoding for JPEG textures using Codec Engine.
- Supports loading textures using FIOS2 overlay (for example, directly from PSARC archives).
- Supports GXT textures.
- Extended PVF functionality.
- More coming soon!

Pages: [1] 2