Advertising (This ad goes away for registered users. You can Login or Register)

[Question] sceCamera API behavior

Open discussions on programming specifically for the PS Vita.
Forum rules
Forum rule Nº 15 is strictly enforced in this subforum.
Post Reply
Posts: 161
Joined: Sun Jul 12, 2015 1:15 pm

[Question] sceCamera API behavior

Post by OperationNT » Thu Aug 31, 2017 9:35 pm

Hello everybody,

I am currently working on some evolutions for "FakeCamera" plugin: I try to put a user image as camera output.
I made a code following sceCamera API specifications (which I found on some leaked Vita SDK documentation): it only works on some rare titles.
The sceCamera API should get everytime a "pIBase" buffer to write output data (some camera format could also need "pUBase" and "pVBase" additional buffers). This buffer pointer can be given by "SceCameraInfo" at camera open or by "SceCameraRead" at camera read call.
Unfortunatly, most titles (where my code fails) doesn't follow this specification. On camera open call, I get null pointers which means I should wait camera read call to get the pointers. But on camera read call, I get a null pointer too for "pIBase" and "pVBase" and I get "0x12c000" value for "pUBase" (gotten on Tearaway and Welcome Park "Snap + Slide" mini-game). This "0x12c000" value is definily not a pointer I can write (the application crashes if I try to write a single byte at this address).

Do you have any idea about expected behavior when this "0x12c000" is sent to the sceCamera API? Low level framebuffer output? Where should I write my image data when I see this "sceCameraOpen/sceCameraRead" pattern?

I also noticed that most official application send a "SceCameraRead->size" of 72 bytes which is 16 bytes bigger than the structure we have in "psp2/camera.h" (the structure in the leaked documentation is the same). When a known pattern is followed, those 16 bytes contains some "0xdead" data so it is definitly trash. However, when there is a pattern involving "0x12c000", I got those data from "Welcome Park" (I didn't have time to test other titles):
{0x43656b61, 0x72656d61, 0x4c412f61, 0x61425f4c}
Any idea about this data meaning? Does it look like trash? (the first 3 values aren't aligned so I would assume they are not valid pointers and directly writing to the address interpreted from the 4th one leads to a crash)

Thank you for your help!

User avatar
Posts: 912
Joined: Sat Mar 26, 2011 10:02 am

Re: [Question] sceCamera API behavior

Post by Rinnegatamante » Fri Sep 01, 2017 3:35 pm

sceCamera can be initialized in several modes. Depending on the mode, paramters of the structs can be fullified with different kind of values.

Feel free to join #vitasdk or #henkaku to get help.
If you want, visit my website: :D

Posts: 161
Joined: Sun Jul 12, 2015 1:15 pm

Re: [Question] sceCamera API behavior

Post by OperationNT » Fri Sep 01, 2017 8:45 pm

Ok, thank you for your indication. I am currently on holidays (without my computer :-) ). I will join the IRC channel you gave me when I will be back for further information. Thanks!

User avatar
Posts: 777
Joined: Thu Oct 07, 2010 4:29 pm

Re: [Question] sceCamera API behavior

Post by noname120 » Mon Sep 04, 2017 10:19 pm

If you come there, make sure to stay long enough so that we can see your message and answer. It happens often that people leave the channel before we get the chance to help them.
If nobody answers, don't hesitate to type my name 'noname120' so that I can get notified and help you.
Funny stuff
<yifanlu> I enjoy being loud and obnoxious
<yifanlu> rooting an android is like getting a hooker pregnant
<xerpi> I sometimes think I should leave all this stressing **** and be a farmer instead

Posts: 161
Joined: Sun Jul 12, 2015 1:15 pm

Re: [Question] sceCamera API behavior

Post by OperationNT » Wed Sep 06, 2017 8:15 am

Ok, I keep this in mind. Thanks.
For the moment, I am still in holidays without my computer to develop.

EDIT: I was dumping the wrong bytes (beyond the structure size) so this this why I didn't get any valid pointers. The "72 bytes" structure seems to match the following:

Code: Select all

typedef struct SceCameraRead2 {
	SceSize size; //!< sizeof(SceCameraRead2)
	int mode;
	int pad;
	int status;
	uint64_t frame;
	uint64_t timestamp;
    int unknown0;
    int unknown1;
    int unknown2;
    void* unknownNullCheck;
	SceSize sizeIBase;
	SceSize sizeUBase;
	SceSize sizeVBase;
	void *pIBase;
	void *pUBase;
	void *pVBase;
} SceCameraRead2;

Post Reply

Return to “Programming and Security”