LowLevel/Luma3DS-3GX
Archived
1
0
Fork 0
Code Issues Pull Requests Releases 2 Wiki Activity

New reboot patch (works on N3DS, no more GBA/DS or 80 MB games toggle), fixed N3DS 3D bug (thanks TiniVi and Cakes), code cleanup, new universal MPU code (thanks Cakes)

Browse Source 
Thanks to a very skilled reverser for the reboot patch!
This commit is contained in:
Aurora
2016-02-25 20:19:20 +01:00
parent e53c186144
commit 23fd26630f
14 changed files with 332 additions and 350 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
source/crypto.h
View File

@@ -131,7 +131,6 @@ void rsa_use_keyslot(u32 keyslot);
int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
//NAND/FIRM stuff
void getNandCTR(u8 *buf, u8 console);
void nandFirm0(u8 *outbuf, const u32 size, u8 console);
void arm9loader(void *armHdr, u8 mode);

2
source/draw.c
View File

@@ -17,7 +17,7 @@ void clearScreen(void){
}
void loadSplash(void){
//Check that it's a no-LCD-init boot via PDN_GPU_CNT
//Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
if (*((u8*)0x10141200) == 0x1) return;
clearScreen();
if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;

1
source/draw.h
View File

@@ -12,5 +12,4 @@ struct fb {
u8 *bottom;
};
void clearScreen(void);
void loadSplash(void);

95
source/firm.c
View File

@@ -13,6 +13,7 @@
firmHeader *firmLocation = (firmHeader *)0x24000000;
firmSectionHeader *section;
vu32 *arm11Entry = (vu32*)0x1FFFFFF8;
u32 firmSize = 0;
u8 mode = 1,
console = 1,
@@ -20,13 +21,14 @@ u8 mode = 1,
updatedSys = 0;
u16 pressed;
//Load firm into FCRAM
u8 loadFirm(void){
void setupCFW(void){
//Detect the console being used
if(PDN_MPCORE_CFG == 1) console = 0;
//Get pressed buttons
pressed = HID_PAD;
//Determine if A9LH is installed via PDN_SPI_CNT and an user flag
if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){
a9lhSetup = 1;
@@ -34,17 +36,20 @@ u8 loadFirm(void){
if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
}
section = firmLocation->section;
/* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
is not pressed, boot 9.0 FIRM */
if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
}
//If not using an A9LH setup, do so by decrypting FIRM0
//Load firm into FCRAM
u8 loadFirm(void){
//If not using an A9LH setup, load 9.0 FIRM from NAND
if(!a9lhSetup && !mode){
//Read FIRM from NAND and write to FCRAM
firmSize = console ? 0xF2000 : 0xE9000;
nandFirm0((u8*)firmLocation, firmSize, console);
//Check for correct decryption
if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1;
}
//Load FIRM from SD
@@ -56,6 +61,10 @@ u8 loadFirm(void){
if (!firmSize) return 1;
fileRead((u8*)firmLocation, pathPtr, firmSize);
}
section = firmLocation->section;
//Check that the loaded FIRM matches the console
if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
@@ -96,6 +105,7 @@ u8 loadEmu(void){
*pos_sdmmc = sdmmcOffset;
*pos_offset = emuOffset;
*pos_header = emuHeader;
//Patch emuNAND code in memory for O3DS and 9.0 N3DS
if(!console || !mode){
u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
@@ -121,82 +131,69 @@ u8 patchFirm(void){
(!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){
if (loadEmu()) return 1;
}
else if(a9lhSetup){
else if (a9lhSetup){
//Patch FIRM partitions writes on SysNAND to protect A9LH
u32 writeOffset = 0;
getFIRMWrite(firmLocation, firmSize, &writeOffset);
memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock));
}
//Disable signature checks
u32 sigOffset = 0,
sigOffset2 = 0;
//Disable signature checks
getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
//Apply FIRM reboot patch. Not needed on N3DS
if(!console && mode && pressed != SAFEMODE &&
fileExists("/rei/reversereboot") == (pressed & BUTTON_A)){
//Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
if(mode){
u32 rebootOffset = 0,
rebootOffset2 = 0;
fOpenOffset = 0;
//Read reboot code from SD and write patched FIRM path in memory
char path[] = "/rei/reboot/reboot1.bin";
//Read reboot code from SD
char path[] = "/rei/reboot/reboot.bin";
u32 size = fileSize(path);
if (!size) return 1;
getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2);
getReboot(firmLocation, firmSize, &rebootOffset);
fileRead((u8*)rebootOffset, path, size);
memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2);
path[18] = '2';
size = fileSize(path);
if (!size) return 1;
fileRead((u8*)rebootOffset2, path, size);
//Calculate the fOpen offset and put it in the right location
u32 *pos_fopen = memsearch((u32*)rebootOffset, "OPEN", size, 4);
getfOpen(firmLocation, firmSize, &fOpenOffset);
*pos_fopen = fOpenOffset;
//Write patched FIRM to SD
if (fileWrite((u8*)firmLocation, PATCHED_FIRM_PATH, firmSize) != 0) return 1;
if(fileWrite((u8*)firmLocation, "/rei/patched_firmware.bin", firmSize) != 0) return 1;
}
return 0;
}
//De-initialize the screens, fixes N3DS 3D
void __attribute__((naked)) deinitScreen(void)
{
*arm11Entry = 0;
*(vu32*)0x10202A44 = 0;
*(vu32*)0x10202244 = 0;
*(vu32*)0x1020200C = 0;
*(vu32*)0x10202014 = 0;
while (!*arm11Entry);
((void (*)())*arm11Entry)();
}
//Firmlaunchhax
void launchFirm(void){
//Set MPU
__asm__ (
"msr cpsr_c, #0xDF\n\t" //Set system mode, disable interrupts
"ldr r0, =0x10000035\n\t" //Memory area 0x10000000-0x18000000, enabled, 128MB
"ldr r4, =0x18000035\n\t" //Memory area 0x18000000-0x20000000, enabled, 128MB
"mcr p15, 0, r0, c6, c3, 0\n\t" //Set memory area 3 (0x10000000-0x18000000)
"mcr p15, 0, r4, c6, c4, 0\n\t" //Set memory area 4 (0x18000000-0x20000000)
"mrc p15, 0, r0, c2, c0, 0\n\t" //read data cacheable bit
"mrc p15, 0, r4, c2, c0, 1\n\t" //read inst cacheable bit
"mrc p15, 0, r1, c3, c0, 0\n\t" //read data writeable
"mrc p15, 0, r2, c5, c0, 2\n\t" //read data access permission
"mrc p15, 0, r3, c5, c0, 3\n\t" //read inst access permission
"orr r0, r0, #0x30\n\t"
"orr r4, r4, #0x30\n\t"
"orr r1, r1, #0x30\n\t"
"bic r2, r2, #0xF0000\n\t"
"bic r3, r3, #0xF0000\n\t"
"orr r2, r2, #0x30000\n\t"
"orr r3, r3, #0x30000\n\t"
"mcr p15, 0, r0, c2, c0, 0\n\t" //write data cacheable bit
"mcr p15, 0, r4, c2, c0, 1\n\t" //write inst cacheable bit
"mcr p15, 0, r1, c3, c0, 0\n\t" //write data writeable
"mcr p15, 0, r2, c5, c0, 2\n\t" //write data access permission
"mcr p15, 0, r3, c5, c0, 3\n\t" //write inst access permission
::: "r0", "r1", "r2", "r3", "r4"
);
//Copy firm partitions to respective memory locations
memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
*(u32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry;
*arm11Entry = (u32)deinitScreen;
while (*arm11Entry);
*arm11Entry = (u32)firmLocation->arm11Entry;
//Final jump to arm9 binary
console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();

3
source/firm.h
View File

@@ -14,10 +14,9 @@
#define BUTTON_L1 (1 << 9)
#define BUTTON_A 1
#define SAFEMODE (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6))
#define PATCHED_FIRM_PATH "/rei/patched_firmware.bin"
void setupCFW(void);
u8 loadFirm(void);
u8 loadEmu(void);
u8 patchFirm(void);
void launchFirm(void);

1
source/main.c
View File

@@ -13,6 +13,7 @@
u8 main(){
mountSD();
loadSplash();
setupCFW();
if (loadFirm()) return 1;
if (patchFirm()) return 1;
launchFirm();

18
source/patches.c
View File

@@ -43,13 +43,21 @@ void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
*off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
}
void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
void getReboot(void *pos, u32 size, u32 *off){
//Look for FIRM reboot code
unsigned char pattern[] = {0x8D, 0xE5, 0x00, 0xC0, 0x91};
unsigned char pattern2[] = {0xF0, 0x4F, 0x2D, 0xE9, 0x3C};
unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
*off = (u32)memsearch(pos, pattern, size, 5) + 2;
*off2 = (u32)memsearch(pos, pattern2, size, 5);
*off = (u32)memsearch(pos, pattern, size, 4) - 0x10;
}
void getfOpen(void *pos, u32 size, u32 *off){
//Calculate fOpen
u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
*off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;
}
void getFIRMWrite(void *pos, u32 size, u32 *off){

3
source/patches.h
View File

@@ -22,7 +22,8 @@ u8 emuInstr[5];
* Functions
**************************************************/
void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
void getReboot(void *pos, u32 size, u32 *off, u32 *off2);
void getReboot(void *pos, u32 size, u32 *off);
void getfOpen(void *pos, u32 size, u32 *off);
void getFIRMWrite(void *pos, u32 size, u32 *off);
#endif

70
source/start.s
View File

@@ -5,39 +5,49 @@ _start:
@ Change the stack pointer
mov sp, #0x27000000
@ Give read/write access to all the memory regions
ldr r5, =0x33333333
mcr p15, 0, r5, c5, c0, 2 @ write data access
mcr p15, 0, r5, c5, c0, 3 @ write instruction access
@ Sets MPU permissions and cache settings
ldr r0, =0xFFFF001D @ ffff0000 32k
ldr r1, =0x01FF801D @ 01ff8000 32k
ldr r2, =0x08000027 @ 08000000 1M
ldr r3, =0x10000021 @ 10000000 128k
ldr r4, =0x10100025 @ 10100000 512k
ldr r5, =0x20000035 @ 20000000 128M
ldr r6, =0x2800801B @ 28008000 16k
ldr r7, =0x1800002D @ 18000000 8M
ldr r8, =0x33333336
ldr r9, =0x60600666
mov r10, #0x25
mov r11, #0x25
mov r12, #0x25
mcr p15, 0, r0, c6, c0, 0
mcr p15, 0, r1, c6, c1, 0
mcr p15, 0, r2, c6, c2, 0
mcr p15, 0, r3, c6, c3, 0
mcr p15, 0, r4, c6, c4, 0
mcr p15, 0, r5, c6, c5, 0
mcr p15, 0, r6, c6, c6, 0
mcr p15, 0, r7, c6, c7, 0
mcr p15, 0, r8, c5, c0, 2 @ Enable data r/w for all regions
mcr p15, 0, r9, c5, c0, 3 @ Enable inst read for 0, 1, 2, 5, 7
mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5
mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5
mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5
ldr r0, =0xFFFF001D @ ffff0000 32k
ldr r1, =0x01FF801D @ 01ff8000 32k
ldr r2, =0x08000027 @ 08000000 1M
ldr r3, =0x10000021 @ 10000000 128k
ldr r4, =0x10100025 @ 10100000 512k
ldr r5, =0x20000035 @ 20000000 128M
ldr r6, =0x1FF00027 @ 1FF00000 1M
ldr r7, =0x1800002D @ 18000000 8M
mov r10, #0x25
mov r11, #0x25
mov r12, #0x25
mcr p15, 0, r0, c6, c0, 0
mcr p15, 0, r1, c6, c1, 0
mcr p15, 0, r2, c6, c2, 0
mcr p15, 0, r3, c6, c3, 0
mcr p15, 0, r4, c6, c4, 0
mcr p15, 0, r5, c6, c5, 0
mcr p15, 0, r6, c6, c6, 0
mcr p15, 0, r7, c6, c7, 0
mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5
mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5
mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5
@ Enables all the settings we specified above
ldr r0, =0x5307D
mcr p15, 0, r0, c1, c0, 0 @ cp15 ctl register enable mpu, enable cache and use alt vector table
@ Enable caches
mrc p15, 0, r4, c1, c0, 0 @ read control register
orr r4, r4, #(1<<12) @ - instruction cache enable
orr r4, r4, #(1<<2) @ - data cache enable
orr r4, r4, #(1<<0) @ - mpu enable
mcr p15, 0, r4, c1, c0, 0 @ write control register
@ Undocumented: Fixes mounting of SDMC
@ Flush caches
mov r5, #0
mcr p15, 0, r5, c7, c5, 0 @ flush I-cache
mcr p15, 0, r5, c7, c6, 0 @ flush D-cache
mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
@ Fixes mounting of SDMC
ldr r0, =0x10000020
mov r1, #0x340
str r1, [r0]

34
source/start.s.a9lh
View File

@@ -1,34 +0,0 @@
.section .text.start
.align 4
.global _start
_start:
@ Change the stack pointer
mov sp, #0x27000000
@ Give read/write access to all the memory regions
ldr r5, =0x33333333
mcr p15, 0, r5, c5, c0, 2 @ write data access
mcr p15, 0, r5, c5, c0, 3 @ write instruction access
@ Enable caches
mrc p15, 0, r4, c1, c0, 0 @ read control register
orr r4, r4, #(1<<12) @ - instruction cache enable
orr r4, r4, #(1<<2) @ - data cache enable
orr r4, r4, #(1<<0) @ - mpu enable
mcr p15, 0, r4, c1, c0, 0 @ write control register
@ Flush caches
mov r5, #0
mcr p15, 0, r5, c7, c5, 0 @ flush I-cache
mcr p15, 0, r5, c7, c6, 0 @ flush D-cache
mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
@ Fixes mounting of SDMC
ldr r0, =0x10000020
mov r1, #0x340
str r1, [r0]
bl main
.die:
b .die

1
source/types.h
View File

@@ -13,6 +13,7 @@
typedef uint8_t u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef volatile u32 vu32;
typedef uint64_t u64;
//FIRM Header layout