How PS3MAPI is Integrated into webMAN MOD for Remote Process Management and Debugging

PS3MAPI is embedded into webMAN MOD as an optional TCP server running on port 7887 that exposes process management and memory debugging capabilities through both raw socket commands and HTTP endpoints, gated by compile-time flags and runtime admin authentication.

The aldostools/webman-mod repository implements PS3MAPI (PlayStation 3 Memory API) as a modular debugging interface that allows developers to inspect running processes, read and write memory, and load VSH plugins remotely. This integration enables powerful runtime analysis without requiring physical access to the console, all controlled through conditional compilation macros and Cobra syscall interfaces.

Architecture of the PS3MAPI Integration

The PS3MAPI integration follows a layered architecture that bridges low-level system calls with high-level HTTP accessibility. The implementation spans multiple header files and utilizes the Cobra SYSCALL-8 opcode 0x7777 to negotiate privileged access with the PS3 firmware.

Conditional Compilation and Thread Initialization

The feature is entirely optional and controlled by the PS3MAPI preprocessor macro. In main.c (around line 74), the server thread is only created when this macro is defined and the user has not disabled the feature in the configuration:

#ifdef PS3MAPI
if (!webman_config->ftpd && (webman_config->ftp_port != PS3MAPIPORT) &&
    (webman_config->sc8mode != PS3MAPI_DISABLED))
    sys_ppu_thread_create(&thread_id_ps3mapi,
                          ps3mapi_thread, NULL,
                          THREAD_PRIO,
                          THREAD_STACK_SIZE_PS3MAPI_SVR,
                          SYS_PPU_THREAD_CREATE_JOINABLE,
                          THREAD_NAME_PS3MAPI);
#endif

This creates a dedicated PPU thread (ps3mapi_thread) that runs independently of the main webMAN HTTP server, ensuring that memory-intensive debugging operations do not block the primary user interface.

Core Version Validation and TCP Server Setup

Before accepting connections, the thread validates that the loaded PS3MAPI core matches the required version. In include/ps3mapi/ps3mapi_server.h (lines 1264-1266), the code performs a version handshake:

int core_minversion = 0;
system_call_2(SC_COBRA_SYSCALL8,
              SYSCALL8_OPCODE_PS3MAPI,
              PS3MAPI_OPCODE_GET_CORE_MINVERSION);
core_minversion = (int)p1;
if ((core_minversion != 0) && (PS3MAPI_CORE_MINVERSION == core_minversion)) {
    /* server runs */
}

Once validated, the server opens a listening socket on port 7887 using slisten(PS3MAPIPORT, PS3MAPI_BACKLOG) as implemented at lines 1273-1275 in ps3mapi_server.h.

Connection Handling and Command Dispatch

For each incoming connection, the server checks sys_admin status and spawns a per-client handler thread (handleclient_ps3mapi) to process commands in parallel. The command dispatcher (ps3mapi_command) parses textual instructions through a switch-case structure:

• GETPROC: Lists running processes
• GETMEM: Reads process memory via ps3mapi_getmem
• SETMEM: Writes process memory via ps3mapi_setmem
• VSHPLUGIN: Loads or unloads VSH plugins

These commands wrap low-level operations defined in include/ps3mapi/debug_mem.h, where ps3mapi_get_memory executes the actual syscall:

static int ps3mapi_get_memory(u32 pid, u32 address,
                              char *mem, u32 size)
{
    system_call_6(SC_COBRA_SYSCALL8,
                  SYSCALL8_OPCODE_PS3MAPI,
                  PS3MAPI_OPCODE_GET_MEMORY,
                  pid, address, (u64)mem, size);
    return (int)p1;   // 0 = success, else error code
}

HTTP Endpoint Exposure

Beyond raw TCP sockets, webMAN MOD exposes PS3MAPI functionality through browser-friendly URLs. The include/www/www_isadmin.h file routes requests ending in .ps3mapi to the same internal command functions, enabling remote debugging from any HTTP client.

Key endpoints include:

• /getmem.ps3mapi?pid=1024&addr=0x1000&size=64 — Returns hex dump of memory
• /setmem.ps3mapi?pid=1024&addr=0x2000&hex=DEADBEEF — Writes bytes to address
• /home.ps3mapi — Opens the PS3MAPI web console interface

This dual-interface design allows developers to choose between programmatic socket connections for automation or simple browser requests for quick inspections.

Remote Debugging Workflow

Enabling and using PS3MAPI integration requires both configuration changes and specific URL patterns.

1. Enable the feature in /setup.ps3 by navigating to "XMB / In-Game PAD SHORTCUTS → PS3MAPI" and rebooting the system.

2. Verify thread creation by checking that ps3mapi_thread appears in the system thread list (port 7887 will be listening).

3. Read process memory by opening a browser and entering:

   http://<ps3_ip>:7887/getmem.ps3mapi?pid=1024&addr=0x1000&size=64

4. Write process memory using the setmem endpoint:

   http://<ps3_ip>:7887/setmem.ps3mapi?pid=1024&addr=0x2000&hex=DEADBEEF

5. Load debugging plugins through the web UI at /home.ps3mapi, which internally calls ps3mapi_load_vsh_plugin(path).

All operations execute within the handleclient_ps3mapi thread context, ensuring that memory patches and process inspections occur asynchronously from the main system operations.

Security and Access Control Mechanisms

The integration implements multiple security layers to prevent unauthorized access. Compile-time flags (COBRA_ONLY, PS3MAPI) ensure the code is only built into Cobra-enabled firmware variants. Runtime checks require sys_admin authentication before any command execution.

Additional macros (PS3MAPI_ENABLE_ACCESS_SYSCALL8, PS3MAPI_DISABLE_ACCESS_SYSCALL8) guard the syscall-8 opcode access, and administrators can disable the server entirely by setting webman_config->sc8mode to PS3MAPI_DISABLED. This architecture ensures that remote debugging capabilities remain inaccessible to standard users or network-based attackers without administrative credentials.

Summary

• PS3MAPI integration is controlled by the PS3MAPI compile-time macro and can be disabled via runtime configuration.
• A dedicated PPU thread (ps3mapi_thread) creates a TCP server on port 7887 for raw socket communication.
• The command dispatcher (ps3mapi_command) in ps3mapi_server.h routes textual commands to memory and process management functions.
• HTTP endpoints (.ps3mapi URLs) in www_isadmin.h provide browser-based access to the same debugging features.
• Security relies on sys_admin checks and Cobra syscall gating to restrict access to authorized administrators only.

Frequently Asked Questions

What is PS3MAPI and how does it integrate with webMAN MOD?

PS3MAPI (PlayStation 3 Memory API) is a debugging interface that allows remote inspection and modification of running processes on the PS3. In webMAN MOD, it integrates as an optional module that creates a dedicated TCP server thread when the PS3MAPI macro is defined during compilation. This thread listens on port 7887 and exposes both raw socket commands and HTTP endpoints for process listing, memory peek/poke operations, and VSH plugin management.

How do I enable PS3MAPI remote debugging on my PS3?

Navigate to /setup.ps3 in the webMAN MOD interface, locate the "XMB / In-Game PAD SHORTCUTS" section, and enable the PS3MAPI option. After saving the configuration and rebooting, the ps3mapi_thread will automatically start and listen for connections on port 7887. Ensure your build was compiled with the PS3MAPI flag and that you have administrative access (sys_admin) to issue commands.

What HTTP endpoints are available for PS3MAPI in webMAN MOD?

The include/www/www_isadmin.h file exposes several .ps3mapi endpoints: /getmem.ps3mapi for reading memory with pid, addr, and size parameters; /setmem.ps3mapi for writing hex data to specific addresses; and /home.ps3mapi for accessing the web console interface. These endpoints map directly to the underlying ps3mapi_getmem and ps3mapi_setmem functions implemented in ps3mapi.h.

Is PS3MAPI access secure in webMAN MOD?

Yes, the implementation requires sys_admin authentication for all connections and can be completely disabled by setting webman_config->sc8mode to PS3MAPI_DISABLED. The feature is also guarded by compile-time checks (COBRA_ONLY, PS3MAPI macros) ensuring it only runs on appropriate firmware. Access to the Cobra SYSCALL-8 opcode is further protected by PS3MAPI_ENABLE_ACCESS_SYSCALL8 and PS3MAPI_DISABLE_ACCESS_SYSCALL8 macros to prevent unauthorized system calls.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}