How webMAN MOD Handles Syscalls for CFW (8/9) vs PS3HEN (6/7)

webMAN MOD detects the payload type at startup and selects between Cobra syscall 8/9 for CFW or LV2 peek/poke syscalls 6/7 for PS3HEN, enabling full functionality on both custom firmware and homebrew-enabler environments.

The open-source PlayStation 3 utility webMAN MOD, maintained in the aldostools/webman-mod repository, must operate across two distinct system environments: Custom Firmware (CFW) with Cobra payload support and the PS3HEN homebrew enabler. Understanding how webMAN MOD handles syscalls differently for CFW (using syscall numbers 8 and 9) versus PS3HEN (using syscall numbers 6 and 7) reveals the plugin's architecture for runtime compatibility and stealth operations.

Detecting PS3HEN vs CFW at Runtime

During initialization, webMAN MOD checks for the presence of PS3HEN binaries to set the global execution environment. This detection occurs in _Projects_/updater/source/main.c, where the code searches standard paths for the PS3HEN payload.

Global Flag Declaration

The boolean flag payload_ps3hen serves as the single source of truth throughout the codebase. When set to true, the system operates in PS3HEN mode; when false, it assumes a Cobra-based CFW environment.

Detection Logic

The updater scans multiple locations for PS3HEN.BIN, setting the global flag when found:

/* _Projects_/updater/source/main.c */
bool payload_ps3hen = false;

if (file_exists("/dev_flash/hen/PS3HEN.BIN") ||
    file_exists(HDDROOT_DIR "/hen/PS3HEN.BIN") ||
    file_exists("/dev_usb000/PS3HEN.BIN") ||
    file_exists("/dev_usb001/PS3HEN.BIN"))
{
    payload_ps3hen = true;   // PS3HEN environment detected
}

This runtime detection enables the plugin to adapt its behavior without requiring separate builds for CFW and HEN systems.

Syscall Number Mappings for CFW and PS3HEN

The underlying syscall numbers differ fundamentally between environments. CFW utilizes the Cobra syscall 8 (and its extended variant 9), while PS3HEN relies on legacy LV2 peek (6) and poke (7) syscalls for memory operations.

CFW Cobra Syscalls

In main.c at line 131, the Cobra syscall is defined for CFW environments:

/* main.c */
#define SC_COBRA_SYSCALL8 (8)

Syscall 8 serves as the primary entry point for Cobra payload operations, with syscall 9 typically reserved for extended or "disable-Cobra" operations.

PS3HEN Peek and Poke Syscalls

For PS3HEN environments, the definitions reside in include/ps3mapi/peek_poke.h:

/* include/ps3mapi/peek_poke.h */
#define SC_PEEK_LV2 (6)
#define SC_POKE_LV2 (7)

These lower-numbered syscalls provide direct memory access capabilities that predate the Cobra payload standard.

Runtime Syscall Dispatch Mechanism

The generic syscall parser in include/feat/syscall.h abstracts the platform differences. The call_syscall function accepts a syscall number and parameter array, dispatching to the appropriate system_call_N helper based on parameter count.

Unified System Call Interface

/* include/feat/syscall.h */
static u64 call_syscall(u16 sc, u64 sp[], u8 num)
{
    switch (num) {
        case 0: system_call_0(sc);                     return p1;
        case 1: system_call_1(sc, sp[0]);              return p1;
        case 2: system_call_2(sc, sp[0], sp[1]);       return p1;
        /* … cases 3-7 follow same pattern … */
        case 8: system_call_8(sc, sp[0], sp[1], sp[2], sp[3], 
                              sp[4], sp[5], sp[6], sp[7]); 
                              return p1;
    }
    return FAILED;
}

The parse_syscall function (also in include/feat/syscall.h) handles string-to-integer conversion for command parameters before invocation.

Dynamic Syscall Selection

When executing commands, the code selects the appropriate syscall number based on the payload_ps3hen flag:

/* Example from command handler logic */
u16 sc = payload_ps3hen ? SC_PEEK_LV2          // Use HEN syscall 6
                         : SC_COBRA_SYSCALL8;   // Use CFW syscall 8

u64 result = call_syscall(sc, params, param_cnt);

This conditional selection ensures identical functionality across both platforms without requiring duplicate code paths.

Selective Syscall Removal for Stealth Mode

webMAN MOD can disable CFW-specific syscalls while maintaining PS3HEN functionality. This "stealth" capability, guarded by the REMOVE_SYSCALLS compile-time flag, removes syscall 8/9 visibility for online safety without breaking HEN-based tools.

CFW-Only Syscall Patching

The remove_cfw_syscalls function in main.c demonstrates this selective patching:

/* main.c – compiled with REMOVE_SYSCALLS */
static void remove_cfw_syscalls(bool keep_ccapi)
{
    // Backup original SC_COBRA_SYSCALL8 address for later restoration
    backup_cfw_syscalls();

    // Disable Cobra via opcode 0 – leaves HEN syscalls (6/7) untouched
    system_call_3(SC_COBRA_SYSCALL8,
                  SYSCALL8_OPCODE_DISABLE_COBRA,
                  0);        // 0 = disable only
}

This approach ensures that while the Cobra syscall (8) is disabled and hidden from network checks, the HEN syscalls (6/7) remain fully operational for memory debugging and homebrew applications that depend on peek/poke access.

Restoration Capability

The companion function restore_cfw_syscalls() re-enables the original Cobra syscall table entry when stealth mode is no longer required, providing reversible protection for CFW users while maintaining uninterrupted HEN functionality.

Summary

• Environment Detection: webMAN MOD scans for PS3HEN.BIN at startup to set the payload_ps3hen flag in _Projects_/updater/source/main.c, determining whether the system runs CFW or HEN.
• Syscall Abstraction: The plugin defines SC_COBRA_SYSCALL8 (8) for CFW in main.c and SC_PEEK_LV2/SC_POKE_LV2 (6/7) for PS3HEN in include/ps3mapi/peek_poke.h.
• Runtime Dispatch: The call_syscall function in include/feat/syscall.h provides a unified interface that selects the correct syscall number based on the environment flag, supporting up to 8 parameters.
• Stealth Capability: The remove_cfw_syscalls function disables only CFW syscalls (8/9) while preserving HEN syscalls (6/7), allowing stealth operation without breaking homebrew functionality that relies on memory access.

Frequently Asked Questions

What syscall numbers does webMAN MOD use on CFW versus PS3HEN?

On CFW (Cobra), webMAN MOD uses syscall 8 (SC_COBRA_SYSCALL8) as the primary entry point, with syscall 9 available for extended operations. On PS3HEN, it uses syscall 6 (SC_PEEK_LV2) for memory reading and syscall 7 (SC_POKE_LV2) for memory writing, as defined in include/ps3mapi/peek_poke.h.

How does webMAN MOD detect whether to use CFW or PS3HEN syscalls?

During startup, the code in _Projects_/updater/source/main.c checks for the existence of PS3HEN.BIN in paths like /dev_flash/hen/ and /dev_usb000/. If found, it sets payload_ps3hen = true, causing the syscall dispatcher to use the HEN syscall numbers (6/7) instead of the Cobra numbers (8/9).

Can webMAN MOD hide CFW syscalls without breaking PS3HEN functionality?

Yes. The remove_cfw_syscalls function, compiled with the REMOVE_SYSCALLS flag, specifically patches only the Cobra syscall table entry (8). Because PS3HEN uses separate syscall numbers (6/7), tools relying on peek/poke operations continue to function normally even when the CFW syscalls are hidden for stealth mode.

Where is the syscall dispatch logic implemented in webMAN MOD?

The generic dispatch mechanism resides in include/feat/syscall.h, specifically within the call_syscall function. This function accepts a syscall number and parameter array, then routes to the appropriate system_call_0 through system_call_8 primitive based on the argument count, enabling unified operation across both CFW and PS3HEN environments.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}