# How webMAN MOD Handles Syscalls for CFW (8/9) vs PS3HEN (6/7)

> Explore how webMAN MOD handles syscalls for CFW 8/9 and PS3HEN 6/7. Discover the differences and ensure full functionality on your PS3.

- Repository: [Aldo Vargas/webman-mod](https://github.com/aldostools/webman-mod)
- Tags: internals
- Published: 2026-02-24

---

**webMAN MOD detects the payload type at startup and selects between Cobra syscall 8/9 for CFW or LV2 peek/poke syscalls 6/7 for PS3HEN, enabling full functionality on both custom firmware and homebrew-enabler environments.**

The open-source PlayStation 3 utility webMAN MOD, maintained in the `aldostools/webman-mod` repository, must operate across two distinct system environments: Custom Firmware (CFW) with Cobra payload support and the PS3HEN homebrew enabler. Understanding how webMAN MOD handles syscalls differently for CFW (using syscall numbers 8 and 9) versus PS3HEN (using syscall numbers 6 and 7) reveals the plugin's architecture for runtime compatibility and stealth operations.

## Detecting PS3HEN vs CFW at Runtime

During initialization, webMAN MOD checks for the presence of PS3HEN binaries to set the global execution environment. This detection occurs in [`_Projects_/updater/source/main.c`](https://github.com/aldostools/webman-mod/blob/main/_Projects_/updater/source/main.c), where the code searches standard paths for the PS3HEN payload.

### Global Flag Declaration

The boolean flag `payload_ps3hen` serves as the single source of truth throughout the codebase. When set to `true`, the system operates in PS3HEN mode; when `false`, it assumes a Cobra-based CFW environment.

### Detection Logic

The updater scans multiple locations for `PS3HEN.BIN`, setting the global flag when found:

```c
/* _Projects_/updater/source/main.c */
bool payload_ps3hen = false;

if (file_exists("/dev_flash/hen/PS3HEN.BIN") ||
    file_exists(HDDROOT_DIR "/hen/PS3HEN.BIN") ||
    file_exists("/dev_usb000/PS3HEN.BIN") ||
    file_exists("/dev_usb001/PS3HEN.BIN"))
{
    payload_ps3hen = true;   // PS3HEN environment detected
}

```

This runtime detection enables the plugin to adapt its behavior without requiring separate builds for CFW and HEN systems.

## Syscall Number Mappings for CFW and PS3HEN

The underlying syscall numbers differ fundamentally between environments. CFW utilizes the **Cobra syscall 8** (and its extended variant 9), while PS3HEN relies on legacy **LV2 peek (6) and poke (7)** syscalls for memory operations.

### CFW Cobra Syscalls

In [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) at line 131, the Cobra syscall is defined for CFW environments:

```c
/* main.c */
#define SC_COBRA_SYSCALL8 (8)

```

Syscall 8 serves as the primary entry point for Cobra payload operations, with syscall 9 typically reserved for extended or "disable-Cobra" operations.

### PS3HEN Peek and Poke Syscalls

For PS3HEN environments, the definitions reside in [`include/ps3mapi/peek_poke.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/peek_poke.h):

```c
/* include/ps3mapi/peek_poke.h */
#define SC_PEEK_LV2 (6)
#define SC_POKE_LV2 (7)

```

These lower-numbered syscalls provide direct memory access capabilities that predate the Cobra payload standard.

## Runtime Syscall Dispatch Mechanism

The generic syscall parser in [`include/feat/syscall.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/syscall.h) abstracts the platform differences. The `call_syscall` function accepts a syscall number and parameter array, dispatching to the appropriate `system_call_N` helper based on parameter count.

### Unified System Call Interface

```c
/* include/feat/syscall.h */
static u64 call_syscall(u16 sc, u64 sp[], u8 num)
{
    switch (num) {
        case 0: system_call_0(sc);                     return p1;
        case 1: system_call_1(sc, sp[0]);              return p1;
        case 2: system_call_2(sc, sp[0], sp[1]);       return p1;
        /* … cases 3-7 follow same pattern … */
        case 8: system_call_8(sc, sp[0], sp[1], sp[2], sp[3], 
                              sp[4], sp[5], sp[6], sp[7]); 
                              return p1;
    }
    return FAILED;
}

```

The `parse_syscall` function (also in [`include/feat/syscall.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/syscall.h)) handles string-to-integer conversion for command parameters before invocation.

### Dynamic Syscall Selection

When executing commands, the code selects the appropriate syscall number based on the `payload_ps3hen` flag:

```c
/* Example from command handler logic */
u16 sc = payload_ps3hen ? SC_PEEK_LV2          // Use HEN syscall 6
                         : SC_COBRA_SYSCALL8;   // Use CFW syscall 8

u64 result = call_syscall(sc, params, param_cnt);

```

This conditional selection ensures identical functionality across both platforms without requiring duplicate code paths.

## Selective Syscall Removal for Stealth Mode

webMAN MOD can disable CFW-specific syscalls while maintaining PS3HEN functionality. This "stealth" capability, guarded by the `REMOVE_SYSCALLS` compile-time flag, removes syscall 8/9 visibility for online safety without breaking HEN-based tools.

### CFW-Only Syscall Patching

The `remove_cfw_syscalls` function in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) demonstrates this selective patching:

```c
/* main.c – compiled with REMOVE_SYSCALLS */
static void remove_cfw_syscalls(bool keep_ccapi)
{
    // Backup original SC_COBRA_SYSCALL8 address for later restoration
    backup_cfw_syscalls();

    // Disable Cobra via opcode 0 – leaves HEN syscalls (6/7) untouched
    system_call_3(SC_COBRA_SYSCALL8,
                  SYSCALL8_OPCODE_DISABLE_COBRA,
                  0);        // 0 = disable only
}

```

This approach ensures that while the **Cobra syscall (8)** is disabled and hidden from network checks, the **HEN syscalls (6/7)** remain fully operational for memory debugging and homebrew applications that depend on peek/poke access.

### Restoration Capability

The companion function `restore_cfw_syscalls()` re-enables the original Cobra syscall table entry when stealth mode is no longer required, providing reversible protection for CFW users while maintaining uninterrupted HEN functionality.

## Summary

- **Environment Detection**: webMAN MOD scans for `PS3HEN.BIN` at startup to set the `payload_ps3hen` flag in [`_Projects_/updater/source/main.c`](https://github.com/aldostools/webman-mod/blob/main/_Projects_/updater/source/main.c), determining whether the system runs CFW or HEN.
- **Syscall Abstraction**: The plugin defines `SC_COBRA_SYSCALL8` (8) for CFW in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) and `SC_PEEK_LV2`/`SC_POKE_LV2` (6/7) for PS3HEN in [`include/ps3mapi/peek_poke.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/peek_poke.h).
- **Runtime Dispatch**: The `call_syscall` function in [`include/feat/syscall.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/syscall.h) provides a unified interface that selects the correct syscall number based on the environment flag, supporting up to 8 parameters.
- **Stealth Capability**: The `remove_cfw_syscalls` function disables only CFW syscalls (8/9) while preserving HEN syscalls (6/7), allowing stealth operation without breaking homebrew functionality that relies on memory access.

## Frequently Asked Questions

### What syscall numbers does webMAN MOD use on CFW versus PS3HEN?

On CFW (Cobra), webMAN MOD uses **syscall 8** (`SC_COBRA_SYSCALL8`) as the primary entry point, with syscall 9 available for extended operations. On PS3HEN, it uses **syscall 6** (`SC_PEEK_LV2`) for memory reading and **syscall 7** (`SC_POKE_LV2`) for memory writing, as defined in [`include/ps3mapi/peek_poke.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/peek_poke.h).

### How does webMAN MOD detect whether to use CFW or PS3HEN syscalls?

During startup, the code in [`_Projects_/updater/source/main.c`](https://github.com/aldostools/webman-mod/blob/main/_Projects_/updater/source/main.c) checks for the existence of `PS3HEN.BIN` in paths like `/dev_flash/hen/` and `/dev_usb000/`. If found, it sets `payload_ps3hen = true`, causing the syscall dispatcher to use the HEN syscall numbers (6/7) instead of the Cobra numbers (8/9).

### Can webMAN MOD hide CFW syscalls without breaking PS3HEN functionality?

Yes. The `remove_cfw_syscalls` function, compiled with the `REMOVE_SYSCALLS` flag, specifically patches only the Cobra syscall table entry (8). Because PS3HEN uses separate syscall numbers (6/7), tools relying on peek/poke operations continue to function normally even when the CFW syscalls are hidden for stealth mode.

### Where is the syscall dispatch logic implemented in webMAN MOD?

The generic dispatch mechanism resides in [`include/feat/syscall.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/syscall.h), specifically within the `call_syscall` function. This function accepts a syscall number and parameter array, then routes to the appropriate `system_call_0` through `system_call_8` primitive based on the argument count, enabling unified operation across both CFW and PS3HEN environments.