Ios_ioctlv( fd, 0x2E, 0, 1, vec) // ES_GetBoot2Version(u32 *version) Ios_ioctlv( fd, 0x2D, 3, 2, vec) // ES_Decrypt(u32 keynum, u8 *iv, u8 *source, u32 size, u8 *dest) Ios_ioctlv( fd, 0x2C, 3, 2, vec) // ES_Encrypt(u32 keynum, u8 *iv, u8 *source, u32 size, u8 *dest)
Ios_ioctlv( fd, 0x2B, 1, 0, vec) // ES_AddTmd Ios_ioctlv( fd, 0x2A, 0, 0, vec) // ES_ExportTitleDone(void) Ios_ioctlv( fd, 0x29, 1, 0, vec) // ES_ExportContentEnd Ios_ioctlv( fd, 0x28, 1, 1, vec) // ES_ExportContentData Ios_ioctlv( fd, 0x27, 2, 0, vec) // ES_ExportContentBegin Ios_ioctlv( fd, 0x26, 1, 1, vec) // ES_ExportTitleInit Ios_ioctlv( fd, 0x24, 3, 0, vec) // ES_OpenTitleContent(u64 titleID, const tikview *view, u16 index) Ios_ioctlv( fd, 0x23, 3, 0, vec) // ES_SeekContent Ios_ioctlv( fd, 0x22, 1, 0, vec) // ES_DeleteTitleContent(u64 titleID) - deletes all files containing 'app' in a /title/xxxxxxxx/yyyyyyyy/content Ios_ioctlv( fd, 0x20, 0, 1, vec) // ES_GetTitleId Ios_ioctlv( fd, 0x1F, 6, 0, vec) // ES_ImportBoot( const signed_blob *tik, u32 tik_size, const signed_blob *tik_certs, u32 tik_certs_size, const signed_blob *tmd, u32 tmd_size, const signed_blob *tmd_certs, u32 tmd_certs_size, const u8 *content, u32 content_size ) Ios_ioctlv( fd, 0x1E, 0, 1, vec) // ES_GetDeviceCert(u8 *outbuf) Ios_ioctlv( fd, 0x1D, 1, 1, vec) // ES_GetDataDir Ios_ioctlv( fd, 0x1C, 4, 2, vec) // ES_DiVerify Ios_ioctlv( fd, 0x1B, 1, 1, vec) // ES_DiGetTicketView Ios_ioctlv( fd, 0x1A, 2, 1, vec) // ES_DiGetTmdView Ios_ioctlv( fd, 0x19, 1, 1, vec) // ES_DIGetTmdViewSize( u8 *TMD, u32 *TMDViewSize ) Ios_ioctlv( fd, 0x18, 1, 0, vec) // ES_DeleteTicket Ios_ioctlv( fd, 0x17, 1, 0, vec) // ES_DeleteTitle Ios_ioctlv( fd, 0x16, 1, 2, vec) // ES_GetConsumption Ios_ioctlv( fd, 0x15, 2, 1, vec) // ES_GetTmdView Ios_ioctlv( fd, 0x14, 1, 1, vec) // ES_GetTmdViewSize Ios_ioctlv( fd, 0x13, 2, 1, vec) // ES_GetTicketViews(u64 titleID, tikview *views, u32 cnt) Ios_ioctlv( fd, 0x12, 1, 1, vec) // ES_GetNumTicketViews(u64 titleID, u32 *cnt) Ios_ioctlv( fd, 0x11, 2, 1, vec) // ES_GetTitleContent Ios_ioctlv( fd, 0x10, 1, 1, vec) // ES_GetTitleContentsCount Ios_ioctlv( fd, 0x0F, 1, 1, vec) // ES_GetTitles Ios_ioctlv( fd, 0x0E, 0, 1, vec) // ES_GetTitlesCount Ios_ioctlv( fd, 0x0D, 1, 1, vec) // ES_GetOwnedTitles Ios_ioctlv( fd, 0x0C, 0, 1, vec) // ES_GetOwnedTitlesCount Ios_ioctlv( fd, 0x0B, 1, 0, vec) // ES_CloseContent(s32 cfd) Ios_ioctlv( fd, 0x0A, 1, 1, vec) // ES_ReadContent(s32 cfd, u8 *data, u32 data_size) Ios_ioctlv( fd, 0x09, 1, 0, vec) // ES_OpenContent(u16 index) Ios_ioctlvReboot(fd, 0x08, 2, 0, vec) // ES_LaunchTitle(u64 titleID, const tikview *view) Ios_ioctlv( fd, 0x07, 0, 1, vec) // ES_GetDeviceID Ios_ioctlv( fd, 0x06, 0, 0, vec) // ES_AddTitleFinish(void) Ios_ioctlv( fd, 0x05, 1, 0, vec) // ES_AddContentFinish(u32 cid) Ios_ioctlv( fd, 0x04, 2, 0, vec) // ES_AddContentData(s32 cfd, u8 *data, u32 data_size) Ios_ioctlv( fd, 0x03, 2, 0, vec) // ES_AddContentStart(u64 titleID, u32 cid) Ios_ioctlv( fd, 0x02, 4, 0, vec) // ES_AddTitleStart(const signed_blob *stmd, u32 tmd_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size) Known ES Functions ios_ioctlv( fd, 0x01, 3, 0, vec) // ES_AddTicket(const signed_blob *stik, u32 stik_size, const signed_blob *certificates, u32 certificates_size, const signed_blob *crl, u32 crl_size) Up to 0x45 ioctlvs available depending on the version. 1016 will be returned if the maximum amount of handles is exceeded.
Please feel free to submit patches to implement the remaining functions.ĮS never directly launches PPC titles instead, it writes the title information to /sys/launch.sys, then reloads into the requested IOS (even if it is the same IOS), and the new IOS sees /sys/launch.sys when it boots and launches the title, deleting the file and replacing it with /sys/space.sys.ĮS is also notable for having the most IOS exploits, some directly affecting title installation, and others allowing for arbitrary code execution.ĮS keeps track of three contexts, one per active handle, so only three handles can be opened at once.
Most of these are now implemented in libogc. It runs with more privileges than any other process and has access to most syscalls.Īlong with the rest of IOS, this is generally considered a "private interface" - game developers never call any of these functions directly.
This module is always part of the main, bootable binary, along with the IOS kernel, crypto code (IOSC) and the flash filesystem driver (FFS). ES (E-Ticket Services) is the IOS module that is notably responsible for title management, bootstrapping the Broadway, and giving it access to title contents.