LowLevel/Luma3DS-3GX
Archived
1
0
Fork 0
Code Issues Pull Requests Releases 2 Wiki Activity

New reboot patch (works on N3DS, no more GBA/DS or 80 MB games toggle), fixed N3DS 3D bug (thanks TiniVi and Cakes), code cleanup, new universal MPU code (thanks Cakes)

Browse Source 
Thanks to a very skilled reverser for the reboot patch!
This commit is contained in:
Aurora 2016-02-25 20:19:20 +01:00
parent e53c186144
commit 23fd26630f
14 changed files with 332 additions and 350 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
Makefile
View File

@ -33,7 +33,7 @@ objects_cfw = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
.PHONY: all .PHONY: all
all: launcher a9lh emunand emunando3ds reboot rebootntr ninjhax all: launcher a9lh emunand reboot ninjhax
.PHONY: launcher .PHONY: launcher
launcher: $(dir_out)/$(name).dat launcher: $(dir_out)/$(name).dat
@ -42,16 +42,10 @@ launcher: $(dir_out)/$(name).dat
a9lh: $(dir_out)/arm9loaderhax.bin a9lh: $(dir_out)/arm9loaderhax.bin
.PHONY: emunand .PHONY: emunand
emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin emunand: $(dir_out)/rei/emunand/emunand.bin
.PHONY: emunando3ds
emunando3ds: $(dir_out)/rei-o3ds/emunand/emunand.bin
.PHONY: reboot .PHONY: reboot
reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot2.bin reboot: $(dir_out)/rei/reboot/reboot.bin
.PHONY: rebootntr
rebootntr: $(dir_out)/ntr-o3ds/reboot/reboot1.bin $(dir_out)/ntr-o3ds/reboot/reboot2.bin
.PHONY: ninjhax .PHONY: ninjhax
ninjhax: $(dir_out)/3ds/$(name) ninjhax: $(dir_out)/3ds/$(name)
@ -62,11 +56,11 @@ clean:
@$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean @$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean
rm -rf $(dir_out) $(dir_build) rm -rf $(dir_out) $(dir_build)
$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/ $(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei
@$(MAKE) $(FLAGS) -C $(dir_mset) launcher @$(MAKE) $(FLAGS) -C $(dir_mset) launcher
dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144 dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144
$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/ $(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei
@cp -av $(dir_build)/main.bin $(dir_out)/arm9loaderhax.bin @cp -av $(dir_build)/main.bin $(dir_out)/arm9loaderhax.bin
$(dir_out)/3ds/$(name): $(dir_out)/3ds/$(name):
@ -75,36 +69,18 @@ $(dir_out)/3ds/$(name):
@mv $(dir_out)/$(name).3dsx $@ @mv $(dir_out)/$(name).3dsx $@
@mv $(dir_out)/$(name).smdh $@ @mv $(dir_out)/$(name).smdh $@
$(dir_out)/rei-n3ds/: $(dir_out)/rei:
@mkdir -p "$(dir_out)/rei-n3ds" @mkdir -p "$(dir_out)/rei"
$(dir_out)/rei-o3ds/: $(dir_out)/rei/emunand/emunand.bin: $(dir_emu)/emuCode.s
@mkdir -p "$(dir_out)/rei-o3ds"
$(dir_out)/rei-n3ds/emunand/emunand.bin: $(dir_emu)/emuCode.s
@armips $< @armips $<
@mkdir -p "$(dir_out)/rei-n3ds/emunand" @mkdir -p "$(dir_out)/rei/emunand"
@cp -av emunand.bin $(dir_out)/rei-n3ds/emunand @mv emunand.bin $(dir_out)/rei/emunand
$(dir_out)/rei-o3ds/emunand/emunand.bin: emunand.bin $(dir_out)/rei/reboot/reboot.bin: $(dir_reboot)/rebootCode.s
@mkdir -p "$(dir_out)/rei-o3ds/emunand"
@mv emunand.bin $(dir_out)/rei-o3ds/emunand
$(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
@armips $< @armips $<
@mkdir -p "$(dir_out)/rei-o3ds/reboot" @mkdir -p "$(dir_out)/rei/reboot"
@mv reboot1.bin $(dir_out)/rei-o3ds/reboot @mv reboot.bin $(dir_out)/rei/reboot
$(dir_out)/rei-o3ds/reboot/reboot2.bin: reboot2.bin
@cp -av reboot2.bin $(dir_out)/rei-o3ds/reboot
$(dir_out)/ntr-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCodeNtr.s
@armips $<
@mkdir -p "$(dir_out)/ntr-o3ds/reboot"
@mv reboot1.bin $(dir_out)/ntr-o3ds/reboot
$(dir_out)/ntr-o3ds/reboot/reboot2.bin: reboot2.bin
@mv reboot2.bin $(dir_out)/ntr-o3ds/reboot
$(dir_build)/main.bin: $(dir_build)/main.elf $(dir_build)/main.bin: $(dir_build)/main.elf
$(OC) -S -O binary $< $@ $(OC) -S -O binary $< $@

355
reboot/rebootCode.s
View File

@ -1,148 +1,221 @@
.arm.little .nds
.create "reboot.bin", 0
firm_size equ 0x000EA000 byteswritten equ 0x2000E000
firm_addr equ 0x24000000 externalFirm equ 0x2000A000
fopen equ 0x08059D10 kernelCode equ 0x080F0000
fread equ 0x0804CC54 buffer equ 0x24000000
pxi_wait_recv equ 0x08054134 fileOpen equ 0x4E45504F ;dummy
.create "reboot1.bin", 0x080849DC
.org 0x080849DC
.arm .arm
patch005: //Code jumps here right after the sprintf call
ldr r0, =0x2000E000 process9Reboot:
mov r1, #0x200 doPxi:
mov r2, #0 ldr r4, =0x44846
add r1, r1, r0 ldr r0, =0x10008000
@@memset_loop: readPxiLoop1:
str r2, [r0] ldrh r1, [r0,#4]
add r0, r0, #4 .word 0xE1B01B81 //lsls r1, r1, #0x17
cmp r0, r1 bmi readPxiLoop1
blt @@memset_loop ldr r0, [r0,#0xC]
ldr r0, =0x2000E000 cmp r0, r4
ldr r1, =firm_fname bne doPxi
mov r2, #1
blx fopen GetFirmPath:
ldr r0, =0x2000E000 add r0, sp, #0x3A8-0x70+0x24
ldr r1, =0x2000E100 ldr r1, [r0], #4
mov r2, #firm_addr ldr r2, =0x00300030
mov r3, #firm_size cmp r1, r2
blx fread ldreq r1, [r0], #4
ldreq r2, =0x002F0032
cmpeq r1, r2
OpenFirm:
ldreq r1, =(FileName - OpenFirm - 12)
addeq r1, pc
addne r1, sp, #0x3A8-0x70
ldr r0, =externalFirm
moveq r2, #1
movne r2, #0
str r2, [r0]
mov r2, #1
add r0, r7, #8
ldr r6, =fileOpen
blx r6
SeekFirm:
ldr r0, =externalFirm
ldr r0, [r0]
cmp r0, #1
moveq r0, r7
ldreq r1, =byteswritten
ldreq r2, =buffer
ldreq r3, =0x0
ldreq r6, [sp,#0x3A8-0x198]
ldreq r6, [r6,#0x28] //fread function stored here
blxeq r6
ReadFirm:
mov r0, r7
ldr r1, =byteswritten
ldr r2, =buffer
ldr r3, =0x200000
ldr r6, [sp,#0x3A8-0x198]
ldr r6, [r6,#0x28] //fread function stored here
blx r6
ldr r4, =0x44846 KernelSetState:
blx pxi_wait_recv mov r2, #0
cmp r0, r4 mov r3, r2
bne patch005 mov r1, r2
mov r2, #0 mov r0, r2
mov r3, r2 .word 0xEF00007C //SVC 0x7C
mov r1, r2
mov r0, r2 GoToReboot:
swi 0x7C ldr r0, =(KernelCodeStart - GoToReboot - 12)
ldr r0, =0x80FF4FC add r0, pc
swi 0x7B ldr r1, =kernelCode
ldr r2, =0x300
bl Memcpy
ldr r0, =kernelCode
.word 0xEF00007B //SVC 0x7B
InfiniteLoop:
b InfiniteLoop
Memcpy:
MOV R12, LR
STMFD SP!, {R0-R4}
ADD R2, R2, R0
memcpyLoop:
LDR R3, [R0],#4
STR R3, [R1],#4
CMP R0, R2
BLT memcpyLoop
LDMFD SP!, {R0-R4}
MOV LR, R12
BX LR
FileName:
.dcw "sdmc:/rei/patched_firmware.bin"
.word 0x0
@@inf_loop:
b @@inf_loop
.pool
firm_fname:
.close
.create "reboot2.bin", 0x080933CC
.org 0x080933CC
.arm
stmfd sp!, {r4-r11,lr}
sub sp, sp, #0x3C
mrc p15, 0, r0, c2, c0, 0 ; dcacheable
mrc p15, 0, r12, c2, c0, 1 ; icacheable
mrc p15, 0, r1, c3, c0, 0 ; write bufferable
mrc p15, 0, r2, c5, c0, 2 ; daccess
mrc p15, 0, r3, c5, c0, 3 ; iaccess
ldr r4, =0x18000035 ; 0x18000000 128M
bic r2, r2, #0xF0000 ; unprotect region 4
bic r3, r3, #0xF0000 ; unprotect region 4
orr r0, r0, #0x10 ; dcacheable region 4
orr r2, r2, #0x30000 ; region 4 r/w
orr r3, r3, #0x30000 ; region 4 r/w
orr r12, r12, #0x10 ; icacheable region 4
orr r1, r1, #0x10 ; write bufferable region 4
mcr p15, 0, r0, c2, c0, 0
mcr p15, 0, r12, c2, c0, 1
mcr p15, 0, r1, c3, c0, 0 ; write bufferable
mcr p15, 0, r2, c5, c0, 2 ; daccess
mcr p15, 0, r3, c5, c0, 3 ; iaccess
mcr p15, 0, r4, c6, c4, 0 ; region 4 (hmmm)
mrc p15, 0, r0, c2, c0, 0 ; dcacheable
mrc p15, 0, r1, c2, c0, 1 ; icacheable
mrc p15, 0, r2, c3, c0, 0 ; write bufferable
orr r0, r0, #0x20 ; dcacheable region 5
orr r1, r1, #0x20 ; icacheable region 5
orr r2, r2, #0x20 ; write bufferable region 5
mcr p15, 0, r0, c2, c0, 0 ; dcacheable
mcr p15, 0, r1, c2, c0, 1 ; icacheable
mcr p15, 0, r2, c3, c0, 0 ; write bufferable
mov r4, #firm_addr
add r3, r4, #0x40
ldr r0, [r3] ; offset
add r0, r0, r4 ; src
ldr r1, [r3,#4] ; dst
ldr r2, [r3,#8] ; size
bl memcpy32
add r3, r4, #0x70
ldr r0, [r3]
add r0, r0, r4 ; src
ldr r1, [r3,#4] ; dst
ldr r2, [r3,#8] ; size
bl memcpy32
add r3, r4, #0xA0
ldr r0, [r3]
add r0, r0, r4 ; src
ldr r1, [r3,#4] ; dst
ldr r2, [r3,#8] ; size
bl memcpy32
mov r2, #0
mov r1, r2
@flush_cache:
mov r0, #0
mov r3, r2, lsl#30
@flush_cache_inner_loop:
orr r12, r3, r0, lsl#5
mcr p15, 0, r1, c7, c10, 4 ; drain write buffer
mcr p15, 0, r12, c7, c14, 2 ; clean and flush dcache entry (index and segment)
add r0, r0, #1
cmp r0, #0x20
bcc @flush_cache_inner_loop
add r2, r2, #1
cmp r2, #4
bcc @flush_cache
mcr p15, 0, r1, c7, c10, 4 ; drain write buffer
@mpu_enable:
ldr r0, =0x42078 ; alt vector select, enable itcm
mcr p15, 0, r0, c1, c0, 0
mcr p15, 0, r1, c7, c5, 0 ; flush dcache
mcr p15, 0, r1, c7, c6, 0 ; flush icache
mcr p15, 0, r1, c7, c10, 4 ; drain write buffer
mov r0, #firm_addr
mov r1, 0X1FFFFFFC
ldr r2, [r0,#8] ; arm11 entry
str r2, [r1]
ldr r0, [r0,#0xC] ; arm9 entry
add sp, sp, #0x3C
ldmfd sp!, {r4-r11,lr}
bx r0
.pool
memcpy32: ; memcpy32(void *src, void *dst, unsigned int size)
mov r12, lr
stmfd sp!, {r0-r4}
add r2, r2, r0
@memcpy_loop:
ldr r3, [r0], #4
str r3, [r1], #4
cmp r0, r2
blt @memcpy_loop
ldmfd sp!, {r0-r4}
mov lr, r12
bx lr
.pool .pool
// Kernel Code
.align 4
KernelCodeStart:
memorySetting:
MRC p15, 0, R0,c2,c0, 0
MRC p15, 0, R12,c2,c0, 1
MRC p15, 0, R1,c3,c0, 0
MRC p15, 0, R2,c5,c0, 2
MRC p15, 0, R3,c5,c0, 3
LDR R4, =0x18000035
BIC R2, R2, #0xF0000
BIC R3, R3, #0xF0000
ORR R0, R0, #0x10
ORR R2, R2, #0x30000
ORR R3, R3, #0x30000
ORR R12, R12, #0x10
ORR R1, R1, #0x10
MCR p15, 0, R0,c2,c0, 0
MCR p15, 0, R12,c2,c0, 1
MCR p15, 0, R1,c3,c0, 0
MCR p15, 0, R2,c5,c0, 2
MCR p15, 0, R3,c5,c0, 3
MCR p15, 0, R4,c6,c4, 0
MRC p15, 0, R0,c2,c0, 0
MRC p15, 0, R1,c2,c0, 1
MRC p15, 0, R2,c3,c0, 0
ORR R0, R0, #0x20
ORR R1, R1, #0x20
ORR R2, R2, #0x20
MCR p15, 0, R0,c2,c0, 0
MCR p15, 0, R1,c2,c0, 1
MCR p15, 0, R2,c3,c0, 0
copyFirmPartitions:
LDR R4, =buffer
ADD R3, R4, #0x40
LDR R0, [R3]
ADD R0, R0, R4
LDR R1, [R3,#4]
LDR R2, [R3,#8]
bl KernelMemcpy
ADD R3, R4, #0x70
LDR R0, [R3]
ADD R0, R0, R4
LDR R1, [R3,#4]
LDR R2, [R3,#8]
bl KernelMemcpy
ADD R3, R4, #0xA0
LDR R0, [R3]
ADD R0, R0, R4
LDR R1, [R3,#4]
LDR R2, [R3,#8]
bl KernelMemcpy
ADD R3, R4, #0xD0
LDR R0, [R3]
CMP R0, #0
BEQ invalidateDataCache
ADD R0, R0, R4
LDR R1, [R3,#4]
LDR R2, [R3,#8]
bl KernelMemcpy
invalidateDataCache:
MOV R2, #0
MOV R1, R2
loc_809460C:
MOV R0, #0
MOV R3, R2,LSL#30
loc_8094614:
ORR R12, R3, R0,LSL#5
MCR p15, 0, R1,c7,c10, 4
MCR p15, 0, R12,c7,c14, 2
ADD R0, R0, #1
CMP R0, #0x20
BCC loc_8094614
ADD R2, R2, #1
CMP R2, #4
BCC loc_809460C
jumpToEntrypoint:
MCR p15, 0, R1,c7,c10, 4
LDR R0, =0x42078
MCR p15, 0, R0,c1,c0, 0
MCR p15, 0, R1,c7,c5, 0
MCR p15, 0, R1,c7,c6, 0
MCR p15, 0, R1,c7,c10, 4
LDR R4, =buffer
MOV R1, #0x1FFFFFFC
LDR R2, [R4,#8]
STR R2, [R1]
LDR R0, [R4,#0xC]
BX R0
.pool
KernelMemcpy:
MOV R12, LR
STMFD SP!, {R0-R4}
ADD R2, R2, R0
kmemcpyLoop:
LDR R3, [R0],#4
STR R3, [R1],#4
CMP R0, R2
BLT kmemcpyLoop
LDMFD SP!, {R0-R4}
MOV LR, R12
BX LR
.pool
KernelCodeEnd:
.close .close

48
reboot/rebootCodeNtr.s
View File

@ -1,48 +0,0 @@
.arm.little
firm_size equ 0x000EB000
firm_addr equ 0x24000000
fopen equ 0x0805B180
fread equ 0x0804D9B0
pxi_wait_recv equ 0x08055178
.create "reboot1.bin", 0x080859C8
.org 0x080859C8
.arm
patch005:
ldr r0, =0x2000E000
mov r1, #0x200
mov r2, #0
add r1, r1, r0
@@memset_loop:
str r2, [r0]
add r0, r0, #4
cmp r0, r1
blt @@memset_loop
ldr r0, =0x2000E000
ldr r1, =firm_fname
mov r2, #1
blx fopen
ldr r0, =0x2000E000
ldr r1, =0x2000E100
mov r2, #firm_addr
mov r3, #firm_size
blx fread
ldr r4, =0x44846
blx pxi_wait_recv
cmp r0, r4
bne patch005
mov r2, #0
mov r3, r2
mov r1, r2
mov r0, r2
swi 0x7C
ldr r0, =0x80FF4FC
swi 0x7B
@@inf_loop:
b @@inf_loop
.pool
firm_fname:
.close

1
source/crypto.h
View File

@ -131,7 +131,6 @@ void rsa_use_keyslot(u32 keyslot);
int rsa_verify(const void* data, u32 size, const void* sig, u32 mode); int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
//NAND/FIRM stuff //NAND/FIRM stuff
void getNandCTR(u8 *buf, u8 console);
void nandFirm0(u8 *outbuf, const u32 size, u8 console); void nandFirm0(u8 *outbuf, const u32 size, u8 console);
void arm9loader(void *armHdr, u8 mode); void arm9loader(void *armHdr, u8 mode);

2
source/draw.c
View File

@ -17,7 +17,7 @@ void clearScreen(void){
} }
void loadSplash(void){ void loadSplash(void){
//Check that it's a no-LCD-init boot via PDN_GPU_CNT //Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
if (*((u8*)0x10141200) == 0x1) return; if (*((u8*)0x10141200) == 0x1) return;
clearScreen(); clearScreen();
if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return; if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;

1
source/draw.h
View File

@ -12,5 +12,4 @@ struct fb {
u8 *bottom; u8 *bottom;
}; };
void clearScreen(void);
void loadSplash(void); void loadSplash(void);

95
source/firm.c
View File

@ -13,6 +13,7 @@
firmHeader *firmLocation = (firmHeader *)0x24000000; firmHeader *firmLocation = (firmHeader *)0x24000000;
firmSectionHeader *section; firmSectionHeader *section;
vu32 *arm11Entry = (vu32*)0x1FFFFFF8;
u32 firmSize = 0; u32 firmSize = 0;
u8 mode = 1, u8 mode = 1,
console = 1, console = 1,
@ -20,13 +21,14 @@ u8 mode = 1,
updatedSys = 0; updatedSys = 0;
u16 pressed; u16 pressed;
//Load firm into FCRAM void setupCFW(void){
u8 loadFirm(void){
//Detect the console being used //Detect the console being used
if(PDN_MPCORE_CFG == 1) console = 0; if(PDN_MPCORE_CFG == 1) console = 0;
//Get pressed buttons //Get pressed buttons
pressed = HID_PAD; pressed = HID_PAD;
//Determine if A9LH is installed via PDN_SPI_CNT and an user flag //Determine if A9LH is installed via PDN_SPI_CNT and an user flag
if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){ if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){
a9lhSetup = 1; a9lhSetup = 1;
@ -34,17 +36,20 @@ u8 loadFirm(void){
if(fileExists("/rei/updatedsysnand")) updatedSys = 1; if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
} }
section = firmLocation->section;
/* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
is not pressed, boot 9.0 FIRM */ is not pressed, boot 9.0 FIRM */
if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0; if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
}
//If not using an A9LH setup, do so by decrypting FIRM0 //Load firm into FCRAM
u8 loadFirm(void){
//If not using an A9LH setup, load 9.0 FIRM from NAND
if(!a9lhSetup && !mode){ if(!a9lhSetup && !mode){
//Read FIRM from NAND and write to FCRAM //Read FIRM from NAND and write to FCRAM
firmSize = console ? 0xF2000 : 0xE9000; firmSize = console ? 0xF2000 : 0xE9000;
nandFirm0((u8*)firmLocation, firmSize, console); nandFirm0((u8*)firmLocation, firmSize, console);
//Check for correct decryption
if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1; if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1;
} }
//Load FIRM from SD //Load FIRM from SD
@ -56,6 +61,10 @@ u8 loadFirm(void){
if (!firmSize) return 1; if (!firmSize) return 1;
fileRead((u8*)firmLocation, pathPtr, firmSize); fileRead((u8*)firmLocation, pathPtr, firmSize);
} }
section = firmLocation->section;
//Check that the loaded FIRM matches the console
if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1; if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
if(console) arm9loader((u8*)firmLocation + section[2].offset, mode); if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
@ -96,6 +105,7 @@ u8 loadEmu(void){
*pos_sdmmc = sdmmcOffset; *pos_sdmmc = sdmmcOffset;
*pos_offset = emuOffset; *pos_offset = emuOffset;
*pos_header = emuHeader; *pos_header = emuHeader;
//Patch emuNAND code in memory for O3DS and 9.0 N3DS //Patch emuNAND code in memory for O3DS and 9.0 N3DS
if(!console || !mode){ if(!console || !mode){
u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4); u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
@ -121,82 +131,69 @@ u8 patchFirm(void){
(!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){ (!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){
if (loadEmu()) return 1; if (loadEmu()) return 1;
} }
else if(a9lhSetup){ else if (a9lhSetup){
//Patch FIRM partitions writes on SysNAND to protect A9LH //Patch FIRM partitions writes on SysNAND to protect A9LH
u32 writeOffset = 0; u32 writeOffset = 0;
getFIRMWrite(firmLocation, firmSize, &writeOffset); getFIRMWrite(firmLocation, firmSize, &writeOffset);
memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock)); memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock));
} }
//Disable signature checks
u32 sigOffset = 0, u32 sigOffset = 0,
sigOffset2 = 0; sigOffset2 = 0;
//Disable signature checks
getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2); getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1)); memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2)); memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
//Apply FIRM reboot patch. Not needed on N3DS //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
if(!console && mode && pressed != SAFEMODE && if(mode){
fileExists("/rei/reversereboot") == (pressed & BUTTON_A)){
u32 rebootOffset = 0, u32 rebootOffset = 0,
rebootOffset2 = 0; fOpenOffset = 0;
//Read reboot code from SD and write patched FIRM path in memory //Read reboot code from SD
char path[] = "/rei/reboot/reboot1.bin"; char path[] = "/rei/reboot/reboot.bin";
u32 size = fileSize(path); u32 size = fileSize(path);
if (!size) return 1; if (!size) return 1;
getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2); getReboot(firmLocation, firmSize, &rebootOffset);
fileRead((u8*)rebootOffset, path, size); fileRead((u8*)rebootOffset, path, size);
memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2); //Calculate the fOpen offset and put it in the right location
path[18] = '2'; u32 *pos_fopen = memsearch((u32*)rebootOffset, "OPEN", size, 4);
size = fileSize(path); getfOpen(firmLocation, firmSize, &fOpenOffset);
if (!size) return 1; *pos_fopen = fOpenOffset;
fileRead((u8*)rebootOffset2, path, size);
//Write patched FIRM to SD //Write patched FIRM to SD
if (fileWrite((u8*)firmLocation, PATCHED_FIRM_PATH, firmSize) != 0) return 1; if(fileWrite((u8*)firmLocation, "/rei/patched_firmware.bin", firmSize) != 0) return 1;
} }
return 0; return 0;
} }
//De-initialize the screens, fixes N3DS 3D
void __attribute__((naked)) deinitScreen(void)
{
*arm11Entry = 0;
*(vu32*)0x10202A44 = 0;
*(vu32*)0x10202244 = 0;
*(vu32*)0x1020200C = 0;
*(vu32*)0x10202014 = 0;
while (!*arm11Entry);
((void (*)())*arm11Entry)();
}
//Firmlaunchhax //Firmlaunchhax
void launchFirm(void){ void launchFirm(void){
//Set MPU
__asm__ (
"msr cpsr_c, #0xDF\n\t" //Set system mode, disable interrupts
"ldr r0, =0x10000035\n\t" //Memory area 0x10000000-0x18000000, enabled, 128MB
"ldr r4, =0x18000035\n\t" //Memory area 0x18000000-0x20000000, enabled, 128MB
"mcr p15, 0, r0, c6, c3, 0\n\t" //Set memory area 3 (0x10000000-0x18000000)
"mcr p15, 0, r4, c6, c4, 0\n\t" //Set memory area 4 (0x18000000-0x20000000)
"mrc p15, 0, r0, c2, c0, 0\n\t" //read data cacheable bit
"mrc p15, 0, r4, c2, c0, 1\n\t" //read inst cacheable bit
"mrc p15, 0, r1, c3, c0, 0\n\t" //read data writeable
"mrc p15, 0, r2, c5, c0, 2\n\t" //read data access permission
"mrc p15, 0, r3, c5, c0, 3\n\t" //read inst access permission
"orr r0, r0, #0x30\n\t"
"orr r4, r4, #0x30\n\t"
"orr r1, r1, #0x30\n\t"
"bic r2, r2, #0xF0000\n\t"
"bic r3, r3, #0xF0000\n\t"
"orr r2, r2, #0x30000\n\t"
"orr r3, r3, #0x30000\n\t"
"mcr p15, 0, r0, c2, c0, 0\n\t" //write data cacheable bit
"mcr p15, 0, r4, c2, c0, 1\n\t" //write inst cacheable bit
"mcr p15, 0, r1, c3, c0, 0\n\t" //write data writeable
"mcr p15, 0, r2, c5, c0, 2\n\t" //write data access permission
"mcr p15, 0, r3, c5, c0, 3\n\t" //write inst access permission
::: "r0", "r1", "r2", "r3", "r4"
);
//Copy firm partitions to respective memory locations //Copy firm partitions to respective memory locations
memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size); memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size); memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size); memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
*(u32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry; *arm11Entry = (u32)deinitScreen;
while (*arm11Entry);
*arm11Entry = (u32)firmLocation->arm11Entry;
//Final jump to arm9 binary //Final jump to arm9 binary
console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)(); console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();

3
source/firm.h
View File

@ -14,10 +14,9 @@
#define BUTTON_L1 (1 << 9) #define BUTTON_L1 (1 << 9)
#define BUTTON_A 1 #define BUTTON_A 1
#define SAFEMODE (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6)) #define SAFEMODE (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6))
#define PATCHED_FIRM_PATH "/rei/patched_firmware.bin"
void setupCFW(void);
u8 loadFirm(void); u8 loadFirm(void);
u8 loadEmu(void);
u8 patchFirm(void); u8 patchFirm(void);
void launchFirm(void); void launchFirm(void);

1
source/main.c
View File

@ -13,6 +13,7 @@
u8 main(){ u8 main(){
mountSD(); mountSD();
loadSplash(); loadSplash();
setupCFW();
if (loadFirm()) return 1; if (loadFirm()) return 1;
if (patchFirm()) return 1; if (patchFirm()) return 1;
launchFirm(); launchFirm();

18
source/patches.c
View File

@ -43,13 +43,21 @@ void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
*off2 = (u32)memsearch(pos, pattern2, size, 4) - 1; *off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
} }
void getReboot(void *pos, u32 size, u32 *off, u32 *off2){ void getReboot(void *pos, u32 size, u32 *off){
//Look for FIRM reboot code //Look for FIRM reboot code
unsigned char pattern[] = {0x8D, 0xE5, 0x00, 0xC0, 0x91}; unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
unsigned char pattern2[] = {0xF0, 0x4F, 0x2D, 0xE9, 0x3C};
*off = (u32)memsearch(pos, pattern, size, 5) + 2; *off = (u32)memsearch(pos, pattern, size, 4) - 0x10;
*off2 = (u32)memsearch(pos, pattern2, size, 5); }
void getfOpen(void *pos, u32 size, u32 *off){
//Calculate fOpen
u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
*off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;
} }
void getFIRMWrite(void *pos, u32 size, u32 *off){ void getFIRMWrite(void *pos, u32 size, u32 *off){

3
source/patches.h
View File

@ -22,7 +22,8 @@ u8 emuInstr[5];
* Functions * Functions
**************************************************/ **************************************************/
void getSignatures(void *pos, u32 size, u32 *off, u32 *off2); void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
void getReboot(void *pos, u32 size, u32 *off, u32 *off2); void getReboot(void *pos, u32 size, u32 *off);
void getfOpen(void *pos, u32 size, u32 *off);
void getFIRMWrite(void *pos, u32 size, u32 *off); void getFIRMWrite(void *pos, u32 size, u32 *off);
#endif #endif

70
source/start.s
View File

@ -5,39 +5,49 @@ _start:
@ Change the stack pointer @ Change the stack pointer
mov sp, #0x27000000 mov sp, #0x27000000
@ Give read/write access to all the memory regions
ldr r5, =0x33333333
mcr p15, 0, r5, c5, c0, 2 @ write data access
mcr p15, 0, r5, c5, c0, 3 @ write instruction access
@ Sets MPU permissions and cache settings @ Sets MPU permissions and cache settings
ldr r0, =0xFFFF001D @ ffff0000 32k ldr r0, =0xFFFF001D @ ffff0000 32k
ldr r1, =0x01FF801D @ 01ff8000 32k ldr r1, =0x01FF801D @ 01ff8000 32k
ldr r2, =0x08000027 @ 08000000 1M ldr r2, =0x08000027 @ 08000000 1M
ldr r3, =0x10000021 @ 10000000 128k ldr r3, =0x10000021 @ 10000000 128k
ldr r4, =0x10100025 @ 10100000 512k ldr r4, =0x10100025 @ 10100000 512k
ldr r5, =0x20000035 @ 20000000 128M ldr r5, =0x20000035 @ 20000000 128M
ldr r6, =0x2800801B @ 28008000 16k ldr r6, =0x1FF00027 @ 1FF00000 1M
ldr r7, =0x1800002D @ 18000000 8M ldr r7, =0x1800002D @ 18000000 8M
ldr r8, =0x33333336 mov r10, #0x25
ldr r9, =0x60600666 mov r11, #0x25
mov r10, #0x25 mov r12, #0x25
mov r11, #0x25 mcr p15, 0, r0, c6, c0, 0
mov r12, #0x25 mcr p15, 0, r1, c6, c1, 0
mcr p15, 0, r0, c6, c0, 0 mcr p15, 0, r2, c6, c2, 0
mcr p15, 0, r1, c6, c1, 0 mcr p15, 0, r3, c6, c3, 0
mcr p15, 0, r2, c6, c2, 0 mcr p15, 0, r4, c6, c4, 0
mcr p15, 0, r3, c6, c3, 0 mcr p15, 0, r5, c6, c5, 0
mcr p15, 0, r4, c6, c4, 0 mcr p15, 0, r6, c6, c6, 0
mcr p15, 0, r5, c6, c5, 0 mcr p15, 0, r7, c6, c7, 0
mcr p15, 0, r6, c6, c6, 0 mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5
mcr p15, 0, r7, c6, c7, 0 mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5
mcr p15, 0, r8, c5, c0, 2 @ Enable data r/w for all regions mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5
mcr p15, 0, r9, c5, c0, 3 @ Enable inst read for 0, 1, 2, 5, 7
mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5
mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5
mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5
@ Enables all the settings we specified above @ Enable caches
ldr r0, =0x5307D mrc p15, 0, r4, c1, c0, 0 @ read control register
mcr p15, 0, r0, c1, c0, 0 @ cp15 ctl register enable mpu, enable cache and use alt vector table orr r4, r4, #(1<<12) @ - instruction cache enable
orr r4, r4, #(1<<2) @ - data cache enable
orr r4, r4, #(1<<0) @ - mpu enable
mcr p15, 0, r4, c1, c0, 0 @ write control register
@ Undocumented: Fixes mounting of SDMC @ Flush caches
mov r5, #0
mcr p15, 0, r5, c7, c5, 0 @ flush I-cache
mcr p15, 0, r5, c7, c6, 0 @ flush D-cache
mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
@ Fixes mounting of SDMC
ldr r0, =0x10000020 ldr r0, =0x10000020
mov r1, #0x340 mov r1, #0x340
str r1, [r0] str r1, [r0]

34
source/start.s.a9lh
View File

@ -1,34 +0,0 @@
.section .text.start
.align 4
.global _start
_start:
@ Change the stack pointer
mov sp, #0x27000000
@ Give read/write access to all the memory regions
ldr r5, =0x33333333
mcr p15, 0, r5, c5, c0, 2 @ write data access
mcr p15, 0, r5, c5, c0, 3 @ write instruction access
@ Enable caches
mrc p15, 0, r4, c1, c0, 0 @ read control register
orr r4, r4, #(1<<12) @ - instruction cache enable
orr r4, r4, #(1<<2) @ - data cache enable
orr r4, r4, #(1<<0) @ - mpu enable
mcr p15, 0, r4, c1, c0, 0 @ write control register
@ Flush caches
mov r5, #0
mcr p15, 0, r5, c7, c5, 0 @ flush I-cache
mcr p15, 0, r5, c7, c6, 0 @ flush D-cache
mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
@ Fixes mounting of SDMC
ldr r0, =0x10000020
mov r1, #0x340
str r1, [r0]
bl main
.die:
b .die

1
source/types.h
View File

@ -13,6 +13,7 @@
typedef uint8_t u8; typedef uint8_t u8;
typedef uint16_t u16; typedef uint16_t u16;
typedef uint32_t u32; typedef uint32_t u32;
typedef volatile u32 vu32;
typedef uint64_t u64; typedef uint64_t u64;
//FIRM Header layout //FIRM Header layout