New reboot patch (works on N3DS, no more GBA/DS or 80 MB games toggle), fixed N3DS 3D bug (thanks TiniVi and Cakes), code cleanup, new universal MPU code (thanks Cakes)
Thanks to a very skilled reverser for the reboot patch!
This commit is contained in:
Aurora
parent
e53c186144
commit
23fd26630f
50
Makefile
50
Makefile
@ -33,7 +33,7 @@ objects_cfw = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
|
||||
|
||||
|
||||
.PHONY: all
|
||||
all: launcher a9lh emunand emunando3ds reboot rebootntr ninjhax
|
||||
all: launcher a9lh emunand reboot ninjhax
|
||||
|
||||
.PHONY: launcher
|
||||
launcher: $(dir_out)/$(name).dat
|
||||
@ -42,16 +42,10 @@ launcher: $(dir_out)/$(name).dat
|
||||
a9lh: $(dir_out)/arm9loaderhax.bin
|
||||
|
||||
.PHONY: emunand
|
||||
emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin
|
||||
|
||||
.PHONY: emunando3ds
|
||||
emunando3ds: $(dir_out)/rei-o3ds/emunand/emunand.bin
|
||||
emunand: $(dir_out)/rei/emunand/emunand.bin
|
||||
|
||||
.PHONY: reboot
|
||||
reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot2.bin
|
||||
|
||||
.PHONY: rebootntr
|
||||
rebootntr: $(dir_out)/ntr-o3ds/reboot/reboot1.bin $(dir_out)/ntr-o3ds/reboot/reboot2.bin
|
||||
reboot: $(dir_out)/rei/reboot/reboot.bin
|
||||
|
||||
.PHONY: ninjhax
|
||||
ninjhax: $(dir_out)/3ds/$(name)
|
||||
@ -62,11 +56,11 @@ clean:
|
||||
@$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean
|
||||
rm -rf $(dir_out) $(dir_build)
|
||||
|
||||
$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
|
||||
$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei
|
||||
@$(MAKE) $(FLAGS) -C $(dir_mset) launcher
|
||||
dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144
|
||||
|
||||
$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
|
||||
$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei
|
||||
@cp -av $(dir_build)/main.bin $(dir_out)/arm9loaderhax.bin
|
||||
|
||||
$(dir_out)/3ds/$(name):
|
||||
@ -75,36 +69,18 @@ $(dir_out)/3ds/$(name):
|
||||
@mv $(dir_out)/$(name).3dsx $@
|
||||
@mv $(dir_out)/$(name).smdh $@
|
||||
|
||||
$(dir_out)/rei-n3ds/:
|
||||
@mkdir -p "$(dir_out)/rei-n3ds"
|
||||
$(dir_out)/rei:
|
||||
@mkdir -p "$(dir_out)/rei"
|
||||
|
||||
$(dir_out)/rei-o3ds/:
|
||||
@mkdir -p "$(dir_out)/rei-o3ds"
|
||||
|
||||
$(dir_out)/rei-n3ds/emunand/emunand.bin: $(dir_emu)/emuCode.s
|
||||
$(dir_out)/rei/emunand/emunand.bin: $(dir_emu)/emuCode.s
|
||||
@armips $<
|
||||
@mkdir -p "$(dir_out)/rei-n3ds/emunand"
|
||||
@cp -av emunand.bin $(dir_out)/rei-n3ds/emunand
|
||||
@mkdir -p "$(dir_out)/rei/emunand"
|
||||
@mv emunand.bin $(dir_out)/rei/emunand
|
||||
|
||||
$(dir_out)/rei-o3ds/emunand/emunand.bin: emunand.bin
|
||||
@mkdir -p "$(dir_out)/rei-o3ds/emunand"
|
||||
@mv emunand.bin $(dir_out)/rei-o3ds/emunand
|
||||
|
||||
$(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
|
||||
$(dir_out)/rei/reboot/reboot.bin: $(dir_reboot)/rebootCode.s
|
||||
@armips $<
|
||||
@mkdir -p "$(dir_out)/rei-o3ds/reboot"
|
||||
@mv reboot1.bin $(dir_out)/rei-o3ds/reboot
|
||||
|
||||
$(dir_out)/rei-o3ds/reboot/reboot2.bin: reboot2.bin
|
||||
@cp -av reboot2.bin $(dir_out)/rei-o3ds/reboot
|
||||
|
||||
$(dir_out)/ntr-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCodeNtr.s
|
||||
@armips $<
|
||||
@mkdir -p "$(dir_out)/ntr-o3ds/reboot"
|
||||
@mv reboot1.bin $(dir_out)/ntr-o3ds/reboot
|
||||
|
||||
$(dir_out)/ntr-o3ds/reboot/reboot2.bin: reboot2.bin
|
||||
@mv reboot2.bin $(dir_out)/ntr-o3ds/reboot
|
||||
@mkdir -p "$(dir_out)/rei/reboot"
|
||||
@mv reboot.bin $(dir_out)/rei/reboot
|
||||
|
||||
$(dir_build)/main.bin: $(dir_build)/main.elf
|
||||
$(OC) -S -O binary $< $@
|
||||
|
||||
@ -1,148 +1,221 @@
|
||||
.arm.little
|
||||
.nds
|
||||
.create "reboot.bin", 0
|
||||
|
||||
firm_size equ 0x000EA000
|
||||
firm_addr equ 0x24000000
|
||||
fopen equ 0x08059D10
|
||||
fread equ 0x0804CC54
|
||||
pxi_wait_recv equ 0x08054134
|
||||
byteswritten equ 0x2000E000
|
||||
externalFirm equ 0x2000A000
|
||||
kernelCode equ 0x080F0000
|
||||
buffer equ 0x24000000
|
||||
fileOpen equ 0x4E45504F ;dummy
|
||||
|
||||
.create "reboot1.bin", 0x080849DC
|
||||
.org 0x080849DC
|
||||
.arm
|
||||
patch005:
|
||||
ldr r0, =0x2000E000
|
||||
mov r1, #0x200
|
||||
mov r2, #0
|
||||
add r1, r1, r0
|
||||
@@memset_loop:
|
||||
str r2, [r0]
|
||||
add r0, r0, #4
|
||||
cmp r0, r1
|
||||
blt @@memset_loop
|
||||
ldr r0, =0x2000E000
|
||||
ldr r1, =firm_fname
|
||||
mov r2, #1
|
||||
blx fopen
|
||||
ldr r0, =0x2000E000
|
||||
ldr r1, =0x2000E100
|
||||
mov r2, #firm_addr
|
||||
mov r3, #firm_size
|
||||
blx fread
|
||||
//Code jumps here right after the sprintf call
|
||||
process9Reboot:
|
||||
doPxi:
|
||||
ldr r4, =0x44846
|
||||
ldr r0, =0x10008000
|
||||
readPxiLoop1:
|
||||
ldrh r1, [r0,#4]
|
||||
.word 0xE1B01B81 //lsls r1, r1, #0x17
|
||||
bmi readPxiLoop1
|
||||
ldr r0, [r0,#0xC]
|
||||
cmp r0, r4
|
||||
bne doPxi
|
||||
|
||||
ldr r4, =0x44846
|
||||
blx pxi_wait_recv
|
||||
cmp r0, r4
|
||||
bne patch005
|
||||
mov r2, #0
|
||||
mov r3, r2
|
||||
mov r1, r2
|
||||
mov r0, r2
|
||||
swi 0x7C
|
||||
ldr r0, =0x80FF4FC
|
||||
swi 0x7B
|
||||
GetFirmPath:
|
||||
add r0, sp, #0x3A8-0x70+0x24
|
||||
ldr r1, [r0], #4
|
||||
ldr r2, =0x00300030
|
||||
cmp r1, r2
|
||||
ldreq r1, [r0], #4
|
||||
ldreq r2, =0x002F0032
|
||||
cmpeq r1, r2
|
||||
|
||||
OpenFirm:
|
||||
ldreq r1, =(FileName - OpenFirm - 12)
|
||||
addeq r1, pc
|
||||
addne r1, sp, #0x3A8-0x70
|
||||
ldr r0, =externalFirm
|
||||
moveq r2, #1
|
||||
movne r2, #0
|
||||
str r2, [r0]
|
||||
mov r2, #1
|
||||
add r0, r7, #8
|
||||
ldr r6, =fileOpen
|
||||
blx r6
|
||||
|
||||
SeekFirm:
|
||||
ldr r0, =externalFirm
|
||||
ldr r0, [r0]
|
||||
cmp r0, #1
|
||||
moveq r0, r7
|
||||
ldreq r1, =byteswritten
|
||||
ldreq r2, =buffer
|
||||
ldreq r3, =0x0
|
||||
ldreq r6, [sp,#0x3A8-0x198]
|
||||
ldreq r6, [r6,#0x28] //fread function stored here
|
||||
blxeq r6
|
||||
|
||||
ReadFirm:
|
||||
mov r0, r7
|
||||
ldr r1, =byteswritten
|
||||
ldr r2, =buffer
|
||||
ldr r3, =0x200000
|
||||
ldr r6, [sp,#0x3A8-0x198]
|
||||
ldr r6, [r6,#0x28] //fread function stored here
|
||||
blx r6
|
||||
|
||||
KernelSetState:
|
||||
mov r2, #0
|
||||
mov r3, r2
|
||||
mov r1, r2
|
||||
mov r0, r2
|
||||
.word 0xEF00007C //SVC 0x7C
|
||||
|
||||
GoToReboot:
|
||||
ldr r0, =(KernelCodeStart - GoToReboot - 12)
|
||||
add r0, pc
|
||||
ldr r1, =kernelCode
|
||||
ldr r2, =0x300
|
||||
bl Memcpy
|
||||
|
||||
ldr r0, =kernelCode
|
||||
.word 0xEF00007B //SVC 0x7B
|
||||
|
||||
InfiniteLoop:
|
||||
b InfiniteLoop
|
||||
|
||||
Memcpy:
|
||||
MOV R12, LR
|
||||
STMFD SP!, {R0-R4}
|
||||
ADD R2, R2, R0
|
||||
|
||||
memcpyLoop:
|
||||
LDR R3, [R0],#4
|
||||
STR R3, [R1],#4
|
||||
CMP R0, R2
|
||||
BLT memcpyLoop
|
||||
LDMFD SP!, {R0-R4}
|
||||
MOV LR, R12
|
||||
BX LR
|
||||
|
||||
FileName:
|
||||
.dcw "sdmc:/rei/patched_firmware.bin"
|
||||
.word 0x0
|
||||
|
||||
@@inf_loop:
|
||||
b @@inf_loop
|
||||
.pool
|
||||
firm_fname:
|
||||
.close
|
||||
|
||||
.create "reboot2.bin", 0x080933CC
|
||||
.org 0x080933CC
|
||||
.arm
|
||||
stmfd sp!, {r4-r11,lr}
|
||||
sub sp, sp, #0x3C
|
||||
mrc p15, 0, r0, c2, c0, 0 ; dcacheable
|
||||
mrc p15, 0, r12, c2, c0, 1 ; icacheable
|
||||
mrc p15, 0, r1, c3, c0, 0 ; write bufferable
|
||||
mrc p15, 0, r2, c5, c0, 2 ; daccess
|
||||
mrc p15, 0, r3, c5, c0, 3 ; iaccess
|
||||
ldr r4, =0x18000035 ; 0x18000000 128M
|
||||
bic r2, r2, #0xF0000 ; unprotect region 4
|
||||
bic r3, r3, #0xF0000 ; unprotect region 4
|
||||
orr r0, r0, #0x10 ; dcacheable region 4
|
||||
orr r2, r2, #0x30000 ; region 4 r/w
|
||||
orr r3, r3, #0x30000 ; region 4 r/w
|
||||
orr r12, r12, #0x10 ; icacheable region 4
|
||||
orr r1, r1, #0x10 ; write bufferable region 4
|
||||
mcr p15, 0, r0, c2, c0, 0
|
||||
mcr p15, 0, r12, c2, c0, 1
|
||||
mcr p15, 0, r1, c3, c0, 0 ; write bufferable
|
||||
mcr p15, 0, r2, c5, c0, 2 ; daccess
|
||||
mcr p15, 0, r3, c5, c0, 3 ; iaccess
|
||||
mcr p15, 0, r4, c6, c4, 0 ; region 4 (hmmm)
|
||||
|
||||
mrc p15, 0, r0, c2, c0, 0 ; dcacheable
|
||||
mrc p15, 0, r1, c2, c0, 1 ; icacheable
|
||||
mrc p15, 0, r2, c3, c0, 0 ; write bufferable
|
||||
orr r0, r0, #0x20 ; dcacheable region 5
|
||||
orr r1, r1, #0x20 ; icacheable region 5
|
||||
orr r2, r2, #0x20 ; write bufferable region 5
|
||||
mcr p15, 0, r0, c2, c0, 0 ; dcacheable
|
||||
mcr p15, 0, r1, c2, c0, 1 ; icacheable
|
||||
mcr p15, 0, r2, c3, c0, 0 ; write bufferable
|
||||
|
||||
mov r4, #firm_addr
|
||||
add r3, r4, #0x40
|
||||
ldr r0, [r3] ; offset
|
||||
add r0, r0, r4 ; src
|
||||
ldr r1, [r3,#4] ; dst
|
||||
ldr r2, [r3,#8] ; size
|
||||
bl memcpy32
|
||||
add r3, r4, #0x70
|
||||
ldr r0, [r3]
|
||||
add r0, r0, r4 ; src
|
||||
ldr r1, [r3,#4] ; dst
|
||||
ldr r2, [r3,#8] ; size
|
||||
bl memcpy32
|
||||
add r3, r4, #0xA0
|
||||
ldr r0, [r3]
|
||||
add r0, r0, r4 ; src
|
||||
ldr r1, [r3,#4] ; dst
|
||||
ldr r2, [r3,#8] ; size
|
||||
bl memcpy32
|
||||
mov r2, #0
|
||||
mov r1, r2
|
||||
@flush_cache:
|
||||
mov r0, #0
|
||||
mov r3, r2, lsl#30
|
||||
@flush_cache_inner_loop:
|
||||
orr r12, r3, r0, lsl#5
|
||||
mcr p15, 0, r1, c7, c10, 4 ; drain write buffer
|
||||
mcr p15, 0, r12, c7, c14, 2 ; clean and flush dcache entry (index and segment)
|
||||
add r0, r0, #1
|
||||
cmp r0, #0x20
|
||||
bcc @flush_cache_inner_loop
|
||||
add r2, r2, #1
|
||||
cmp r2, #4
|
||||
bcc @flush_cache
|
||||
mcr p15, 0, r1, c7, c10, 4 ; drain write buffer
|
||||
@mpu_enable:
|
||||
ldr r0, =0x42078 ; alt vector select, enable itcm
|
||||
mcr p15, 0, r0, c1, c0, 0
|
||||
mcr p15, 0, r1, c7, c5, 0 ; flush dcache
|
||||
mcr p15, 0, r1, c7, c6, 0 ; flush icache
|
||||
mcr p15, 0, r1, c7, c10, 4 ; drain write buffer
|
||||
mov r0, #firm_addr
|
||||
mov r1, 0X1FFFFFFC
|
||||
ldr r2, [r0,#8] ; arm11 entry
|
||||
str r2, [r1]
|
||||
ldr r0, [r0,#0xC] ; arm9 entry
|
||||
add sp, sp, #0x3C
|
||||
ldmfd sp!, {r4-r11,lr}
|
||||
bx r0
|
||||
.pool
|
||||
memcpy32: ; memcpy32(void *src, void *dst, unsigned int size)
|
||||
mov r12, lr
|
||||
stmfd sp!, {r0-r4}
|
||||
add r2, r2, r0
|
||||
@memcpy_loop:
|
||||
ldr r3, [r0], #4
|
||||
str r3, [r1], #4
|
||||
cmp r0, r2
|
||||
blt @memcpy_loop
|
||||
ldmfd sp!, {r0-r4}
|
||||
mov lr, r12
|
||||
bx lr
|
||||
.pool
|
||||
|
||||
// Kernel Code
|
||||
.align 4
|
||||
KernelCodeStart:
|
||||
memorySetting:
|
||||
MRC p15, 0, R0,c2,c0, 0
|
||||
MRC p15, 0, R12,c2,c0, 1
|
||||
MRC p15, 0, R1,c3,c0, 0
|
||||
MRC p15, 0, R2,c5,c0, 2
|
||||
MRC p15, 0, R3,c5,c0, 3
|
||||
LDR R4, =0x18000035
|
||||
BIC R2, R2, #0xF0000
|
||||
BIC R3, R3, #0xF0000
|
||||
ORR R0, R0, #0x10
|
||||
ORR R2, R2, #0x30000
|
||||
ORR R3, R3, #0x30000
|
||||
ORR R12, R12, #0x10
|
||||
ORR R1, R1, #0x10
|
||||
MCR p15, 0, R0,c2,c0, 0
|
||||
MCR p15, 0, R12,c2,c0, 1
|
||||
MCR p15, 0, R1,c3,c0, 0
|
||||
MCR p15, 0, R2,c5,c0, 2
|
||||
MCR p15, 0, R3,c5,c0, 3
|
||||
MCR p15, 0, R4,c6,c4, 0
|
||||
MRC p15, 0, R0,c2,c0, 0
|
||||
MRC p15, 0, R1,c2,c0, 1
|
||||
MRC p15, 0, R2,c3,c0, 0
|
||||
ORR R0, R0, #0x20
|
||||
ORR R1, R1, #0x20
|
||||
ORR R2, R2, #0x20
|
||||
MCR p15, 0, R0,c2,c0, 0
|
||||
MCR p15, 0, R1,c2,c0, 1
|
||||
MCR p15, 0, R2,c3,c0, 0
|
||||
|
||||
copyFirmPartitions:
|
||||
LDR R4, =buffer
|
||||
ADD R3, R4, #0x40
|
||||
LDR R0, [R3]
|
||||
ADD R0, R0, R4
|
||||
LDR R1, [R3,#4]
|
||||
LDR R2, [R3,#8]
|
||||
bl KernelMemcpy
|
||||
|
||||
ADD R3, R4, #0x70
|
||||
LDR R0, [R3]
|
||||
ADD R0, R0, R4
|
||||
LDR R1, [R3,#4]
|
||||
LDR R2, [R3,#8]
|
||||
bl KernelMemcpy
|
||||
|
||||
ADD R3, R4, #0xA0
|
||||
LDR R0, [R3]
|
||||
ADD R0, R0, R4
|
||||
LDR R1, [R3,#4]
|
||||
LDR R2, [R3,#8]
|
||||
bl KernelMemcpy
|
||||
|
||||
ADD R3, R4, #0xD0
|
||||
LDR R0, [R3]
|
||||
CMP R0, #0
|
||||
BEQ invalidateDataCache
|
||||
ADD R0, R0, R4
|
||||
LDR R1, [R3,#4]
|
||||
LDR R2, [R3,#8]
|
||||
bl KernelMemcpy
|
||||
|
||||
invalidateDataCache:
|
||||
MOV R2, #0
|
||||
MOV R1, R2
|
||||
loc_809460C:
|
||||
MOV R0, #0
|
||||
MOV R3, R2,LSL#30
|
||||
loc_8094614:
|
||||
ORR R12, R3, R0,LSL#5
|
||||
MCR p15, 0, R1,c7,c10, 4
|
||||
MCR p15, 0, R12,c7,c14, 2
|
||||
ADD R0, R0, #1
|
||||
CMP R0, #0x20
|
||||
BCC loc_8094614
|
||||
ADD R2, R2, #1
|
||||
CMP R2, #4
|
||||
BCC loc_809460C
|
||||
|
||||
jumpToEntrypoint:
|
||||
MCR p15, 0, R1,c7,c10, 4
|
||||
LDR R0, =0x42078
|
||||
MCR p15, 0, R0,c1,c0, 0
|
||||
MCR p15, 0, R1,c7,c5, 0
|
||||
MCR p15, 0, R1,c7,c6, 0
|
||||
MCR p15, 0, R1,c7,c10, 4
|
||||
LDR R4, =buffer
|
||||
MOV R1, #0x1FFFFFFC
|
||||
LDR R2, [R4,#8]
|
||||
STR R2, [R1]
|
||||
LDR R0, [R4,#0xC]
|
||||
BX R0
|
||||
.pool
|
||||
|
||||
KernelMemcpy:
|
||||
MOV R12, LR
|
||||
STMFD SP!, {R0-R4}
|
||||
ADD R2, R2, R0
|
||||
|
||||
kmemcpyLoop:
|
||||
LDR R3, [R0],#4
|
||||
STR R3, [R1],#4
|
||||
CMP R0, R2
|
||||
BLT kmemcpyLoop
|
||||
LDMFD SP!, {R0-R4}
|
||||
MOV LR, R12
|
||||
BX LR
|
||||
.pool
|
||||
|
||||
KernelCodeEnd:
|
||||
|
||||
.close
|
||||
|
||||
@ -1,48 +0,0 @@
|
||||
.arm.little
|
||||
|
||||
firm_size equ 0x000EB000
|
||||
firm_addr equ 0x24000000
|
||||
fopen equ 0x0805B180
|
||||
fread equ 0x0804D9B0
|
||||
pxi_wait_recv equ 0x08055178
|
||||
|
||||
.create "reboot1.bin", 0x080859C8
|
||||
.org 0x080859C8
|
||||
.arm
|
||||
patch005:
|
||||
ldr r0, =0x2000E000
|
||||
mov r1, #0x200
|
||||
mov r2, #0
|
||||
add r1, r1, r0
|
||||
@@memset_loop:
|
||||
str r2, [r0]
|
||||
add r0, r0, #4
|
||||
cmp r0, r1
|
||||
blt @@memset_loop
|
||||
ldr r0, =0x2000E000
|
||||
ldr r1, =firm_fname
|
||||
mov r2, #1
|
||||
blx fopen
|
||||
ldr r0, =0x2000E000
|
||||
ldr r1, =0x2000E100
|
||||
mov r2, #firm_addr
|
||||
mov r3, #firm_size
|
||||
blx fread
|
||||
|
||||
ldr r4, =0x44846
|
||||
blx pxi_wait_recv
|
||||
cmp r0, r4
|
||||
bne patch005
|
||||
mov r2, #0
|
||||
mov r3, r2
|
||||
mov r1, r2
|
||||
mov r0, r2
|
||||
swi 0x7C
|
||||
ldr r0, =0x80FF4FC
|
||||
swi 0x7B
|
||||
|
||||
@@inf_loop:
|
||||
b @@inf_loop
|
||||
.pool
|
||||
firm_fname:
|
||||
.close
|
||||
@ -131,7 +131,6 @@ void rsa_use_keyslot(u32 keyslot);
|
||||
int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
|
||||
|
||||
//NAND/FIRM stuff
|
||||
void getNandCTR(u8 *buf, u8 console);
|
||||
void nandFirm0(u8 *outbuf, const u32 size, u8 console);
|
||||
void arm9loader(void *armHdr, u8 mode);
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@ void clearScreen(void){
|
||||
}
|
||||
|
||||
void loadSplash(void){
|
||||
//Check that it's a no-LCD-init boot via PDN_GPU_CNT
|
||||
//Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
|
||||
if (*((u8*)0x10141200) == 0x1) return;
|
||||
clearScreen();
|
||||
if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;
|
||||
|
||||
@ -12,5 +12,4 @@ struct fb {
|
||||
u8 *bottom;
|
||||
};
|
||||
|
||||
void clearScreen(void);
|
||||
void loadSplash(void);
|
||||
@ -13,6 +13,7 @@
|
||||
|
||||
firmHeader *firmLocation = (firmHeader *)0x24000000;
|
||||
firmSectionHeader *section;
|
||||
vu32 *arm11Entry = (vu32*)0x1FFFFFF8;
|
||||
u32 firmSize = 0;
|
||||
u8 mode = 1,
|
||||
console = 1,
|
||||
@ -20,13 +21,14 @@ u8 mode = 1,
|
||||
updatedSys = 0;
|
||||
u16 pressed;
|
||||
|
||||
//Load firm into FCRAM
|
||||
u8 loadFirm(void){
|
||||
void setupCFW(void){
|
||||
|
||||
//Detect the console being used
|
||||
if(PDN_MPCORE_CFG == 1) console = 0;
|
||||
|
||||
//Get pressed buttons
|
||||
pressed = HID_PAD;
|
||||
|
||||
//Determine if A9LH is installed via PDN_SPI_CNT and an user flag
|
||||
if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){
|
||||
a9lhSetup = 1;
|
||||
@ -34,17 +36,20 @@ u8 loadFirm(void){
|
||||
if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
|
||||
}
|
||||
|
||||
section = firmLocation->section;
|
||||
|
||||
/* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
|
||||
is not pressed, boot 9.0 FIRM */
|
||||
if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
|
||||
}
|
||||
|
||||
//If not using an A9LH setup, do so by decrypting FIRM0
|
||||
//Load firm into FCRAM
|
||||
u8 loadFirm(void){
|
||||
|
||||
//If not using an A9LH setup, load 9.0 FIRM from NAND
|
||||
if(!a9lhSetup && !mode){
|
||||
//Read FIRM from NAND and write to FCRAM
|
||||
firmSize = console ? 0xF2000 : 0xE9000;
|
||||
nandFirm0((u8*)firmLocation, firmSize, console);
|
||||
//Check for correct decryption
|
||||
if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1;
|
||||
}
|
||||
//Load FIRM from SD
|
||||
@ -56,6 +61,10 @@ u8 loadFirm(void){
|
||||
if (!firmSize) return 1;
|
||||
fileRead((u8*)firmLocation, pathPtr, firmSize);
|
||||
}
|
||||
|
||||
section = firmLocation->section;
|
||||
|
||||
//Check that the loaded FIRM matches the console
|
||||
if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
|
||||
|
||||
if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
|
||||
@ -96,6 +105,7 @@ u8 loadEmu(void){
|
||||
*pos_sdmmc = sdmmcOffset;
|
||||
*pos_offset = emuOffset;
|
||||
*pos_header = emuHeader;
|
||||
|
||||
//Patch emuNAND code in memory for O3DS and 9.0 N3DS
|
||||
if(!console || !mode){
|
||||
u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
|
||||
@ -121,82 +131,69 @@ u8 patchFirm(void){
|
||||
(!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){
|
||||
if (loadEmu()) return 1;
|
||||
}
|
||||
else if(a9lhSetup){
|
||||
else if (a9lhSetup){
|
||||
//Patch FIRM partitions writes on SysNAND to protect A9LH
|
||||
u32 writeOffset = 0;
|
||||
getFIRMWrite(firmLocation, firmSize, &writeOffset);
|
||||
memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock));
|
||||
}
|
||||
|
||||
//Disable signature checks
|
||||
u32 sigOffset = 0,
|
||||
sigOffset2 = 0;
|
||||
|
||||
//Disable signature checks
|
||||
getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
|
||||
memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
|
||||
memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
|
||||
|
||||
//Apply FIRM reboot patch. Not needed on N3DS
|
||||
if(!console && mode && pressed != SAFEMODE &&
|
||||
fileExists("/rei/reversereboot") == (pressed & BUTTON_A)){
|
||||
//Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
|
||||
if(mode){
|
||||
u32 rebootOffset = 0,
|
||||
rebootOffset2 = 0;
|
||||
fOpenOffset = 0;
|
||||
|
||||
//Read reboot code from SD and write patched FIRM path in memory
|
||||
char path[] = "/rei/reboot/reboot1.bin";
|
||||
//Read reboot code from SD
|
||||
char path[] = "/rei/reboot/reboot.bin";
|
||||
u32 size = fileSize(path);
|
||||
if (!size) return 1;
|
||||
getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2);
|
||||
getReboot(firmLocation, firmSize, &rebootOffset);
|
||||
fileRead((u8*)rebootOffset, path, size);
|
||||
memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
|
||||
memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2);
|
||||
path[18] = '2';
|
||||
size = fileSize(path);
|
||||
if (!size) return 1;
|
||||
fileRead((u8*)rebootOffset2, path, size);
|
||||
|
||||
//Calculate the fOpen offset and put it in the right location
|
||||
u32 *pos_fopen = memsearch((u32*)rebootOffset, "OPEN", size, 4);
|
||||
getfOpen(firmLocation, firmSize, &fOpenOffset);
|
||||
*pos_fopen = fOpenOffset;
|
||||
|
||||
//Write patched FIRM to SD
|
||||
if (fileWrite((u8*)firmLocation, PATCHED_FIRM_PATH, firmSize) != 0) return 1;
|
||||
if(fileWrite((u8*)firmLocation, "/rei/patched_firmware.bin", firmSize) != 0) return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
//De-initialize the screens, fixes N3DS 3D
|
||||
void __attribute__((naked)) deinitScreen(void)
|
||||
{
|
||||
*arm11Entry = 0;
|
||||
|
||||
*(vu32*)0x10202A44 = 0;
|
||||
*(vu32*)0x10202244 = 0;
|
||||
*(vu32*)0x1020200C = 0;
|
||||
*(vu32*)0x10202014 = 0;
|
||||
|
||||
while (!*arm11Entry);
|
||||
((void (*)())*arm11Entry)();
|
||||
}
|
||||
|
||||
//Firmlaunchhax
|
||||
void launchFirm(void){
|
||||
|
||||
//Set MPU
|
||||
__asm__ (
|
||||
"msr cpsr_c, #0xDF\n\t" //Set system mode, disable interrupts
|
||||
"ldr r0, =0x10000035\n\t" //Memory area 0x10000000-0x18000000, enabled, 128MB
|
||||
"ldr r4, =0x18000035\n\t" //Memory area 0x18000000-0x20000000, enabled, 128MB
|
||||
"mcr p15, 0, r0, c6, c3, 0\n\t" //Set memory area 3 (0x10000000-0x18000000)
|
||||
"mcr p15, 0, r4, c6, c4, 0\n\t" //Set memory area 4 (0x18000000-0x20000000)
|
||||
"mrc p15, 0, r0, c2, c0, 0\n\t" //read data cacheable bit
|
||||
"mrc p15, 0, r4, c2, c0, 1\n\t" //read inst cacheable bit
|
||||
"mrc p15, 0, r1, c3, c0, 0\n\t" //read data writeable
|
||||
"mrc p15, 0, r2, c5, c0, 2\n\t" //read data access permission
|
||||
"mrc p15, 0, r3, c5, c0, 3\n\t" //read inst access permission
|
||||
"orr r0, r0, #0x30\n\t"
|
||||
"orr r4, r4, #0x30\n\t"
|
||||
"orr r1, r1, #0x30\n\t"
|
||||
"bic r2, r2, #0xF0000\n\t"
|
||||
"bic r3, r3, #0xF0000\n\t"
|
||||
"orr r2, r2, #0x30000\n\t"
|
||||
"orr r3, r3, #0x30000\n\t"
|
||||
"mcr p15, 0, r0, c2, c0, 0\n\t" //write data cacheable bit
|
||||
"mcr p15, 0, r4, c2, c0, 1\n\t" //write inst cacheable bit
|
||||
"mcr p15, 0, r1, c3, c0, 0\n\t" //write data writeable
|
||||
"mcr p15, 0, r2, c5, c0, 2\n\t" //write data access permission
|
||||
"mcr p15, 0, r3, c5, c0, 3\n\t" //write inst access permission
|
||||
::: "r0", "r1", "r2", "r3", "r4"
|
||||
);
|
||||
|
||||
//Copy firm partitions to respective memory locations
|
||||
memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
|
||||
memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
|
||||
memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
|
||||
*(u32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry;
|
||||
*arm11Entry = (u32)deinitScreen;
|
||||
while (*arm11Entry);
|
||||
*arm11Entry = (u32)firmLocation->arm11Entry;
|
||||
|
||||
//Final jump to arm9 binary
|
||||
console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();
|
||||
|
||||
@ -14,10 +14,9 @@
|
||||
#define BUTTON_L1 (1 << 9)
|
||||
#define BUTTON_A 1
|
||||
#define SAFEMODE (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6))
|
||||
#define PATCHED_FIRM_PATH "/rei/patched_firmware.bin"
|
||||
|
||||
void setupCFW(void);
|
||||
u8 loadFirm(void);
|
||||
u8 loadEmu(void);
|
||||
u8 patchFirm(void);
|
||||
void launchFirm(void);
|
||||
|
||||
|
||||
@ -13,6 +13,7 @@
|
||||
u8 main(){
|
||||
mountSD();
|
||||
loadSplash();
|
||||
setupCFW();
|
||||
if (loadFirm()) return 1;
|
||||
if (patchFirm()) return 1;
|
||||
launchFirm();
|
||||
|
||||
@ -43,13 +43,21 @@ void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
|
||||
*off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
|
||||
}
|
||||
|
||||
void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
|
||||
void getReboot(void *pos, u32 size, u32 *off){
|
||||
//Look for FIRM reboot code
|
||||
unsigned char pattern[] = {0x8D, 0xE5, 0x00, 0xC0, 0x91};
|
||||
unsigned char pattern2[] = {0xF0, 0x4F, 0x2D, 0xE9, 0x3C};
|
||||
unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
|
||||
|
||||
*off = (u32)memsearch(pos, pattern, size, 5) + 2;
|
||||
*off2 = (u32)memsearch(pos, pattern2, size, 5);
|
||||
*off = (u32)memsearch(pos, pattern, size, 4) - 0x10;
|
||||
}
|
||||
|
||||
void getfOpen(void *pos, u32 size, u32 *off){
|
||||
//Calculate fOpen
|
||||
u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
|
||||
u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
|
||||
|
||||
unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
|
||||
|
||||
*off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;
|
||||
}
|
||||
|
||||
void getFIRMWrite(void *pos, u32 size, u32 *off){
|
||||
|
||||
@ -22,7 +22,8 @@ u8 emuInstr[5];
|
||||
* Functions
|
||||
**************************************************/
|
||||
void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
|
||||
void getReboot(void *pos, u32 size, u32 *off, u32 *off2);
|
||||
void getReboot(void *pos, u32 size, u32 *off);
|
||||
void getfOpen(void *pos, u32 size, u32 *off);
|
||||
void getFIRMWrite(void *pos, u32 size, u32 *off);
|
||||
|
||||
#endif
|
||||
@ -5,39 +5,49 @@ _start:
|
||||
@ Change the stack pointer
|
||||
mov sp, #0x27000000
|
||||
|
||||
@ Give read/write access to all the memory regions
|
||||
ldr r5, =0x33333333
|
||||
mcr p15, 0, r5, c5, c0, 2 @ write data access
|
||||
mcr p15, 0, r5, c5, c0, 3 @ write instruction access
|
||||
|
||||
@ Sets MPU permissions and cache settings
|
||||
ldr r0, =0xFFFF001D @ ffff0000 32k
|
||||
ldr r1, =0x01FF801D @ 01ff8000 32k
|
||||
ldr r2, =0x08000027 @ 08000000 1M
|
||||
ldr r3, =0x10000021 @ 10000000 128k
|
||||
ldr r4, =0x10100025 @ 10100000 512k
|
||||
ldr r5, =0x20000035 @ 20000000 128M
|
||||
ldr r6, =0x2800801B @ 28008000 16k
|
||||
ldr r7, =0x1800002D @ 18000000 8M
|
||||
ldr r8, =0x33333336
|
||||
ldr r9, =0x60600666
|
||||
mov r10, #0x25
|
||||
mov r11, #0x25
|
||||
mov r12, #0x25
|
||||
mcr p15, 0, r0, c6, c0, 0
|
||||
mcr p15, 0, r1, c6, c1, 0
|
||||
mcr p15, 0, r2, c6, c2, 0
|
||||
mcr p15, 0, r3, c6, c3, 0
|
||||
mcr p15, 0, r4, c6, c4, 0
|
||||
mcr p15, 0, r5, c6, c5, 0
|
||||
mcr p15, 0, r6, c6, c6, 0
|
||||
mcr p15, 0, r7, c6, c7, 0
|
||||
mcr p15, 0, r8, c5, c0, 2 @ Enable data r/w for all regions
|
||||
mcr p15, 0, r9, c5, c0, 3 @ Enable inst read for 0, 1, 2, 5, 7
|
||||
mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5
|
||||
mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5
|
||||
mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5
|
||||
ldr r0, =0xFFFF001D @ ffff0000 32k
|
||||
ldr r1, =0x01FF801D @ 01ff8000 32k
|
||||
ldr r2, =0x08000027 @ 08000000 1M
|
||||
ldr r3, =0x10000021 @ 10000000 128k
|
||||
ldr r4, =0x10100025 @ 10100000 512k
|
||||
ldr r5, =0x20000035 @ 20000000 128M
|
||||
ldr r6, =0x1FF00027 @ 1FF00000 1M
|
||||
ldr r7, =0x1800002D @ 18000000 8M
|
||||
mov r10, #0x25
|
||||
mov r11, #0x25
|
||||
mov r12, #0x25
|
||||
mcr p15, 0, r0, c6, c0, 0
|
||||
mcr p15, 0, r1, c6, c1, 0
|
||||
mcr p15, 0, r2, c6, c2, 0
|
||||
mcr p15, 0, r3, c6, c3, 0
|
||||
mcr p15, 0, r4, c6, c4, 0
|
||||
mcr p15, 0, r5, c6, c5, 0
|
||||
mcr p15, 0, r6, c6, c6, 0
|
||||
mcr p15, 0, r7, c6, c7, 0
|
||||
mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5
|
||||
mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5
|
||||
mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5
|
||||
|
||||
@ Enables all the settings we specified above
|
||||
ldr r0, =0x5307D
|
||||
mcr p15, 0, r0, c1, c0, 0 @ cp15 ctl register enable mpu, enable cache and use alt vector table
|
||||
@ Enable caches
|
||||
mrc p15, 0, r4, c1, c0, 0 @ read control register
|
||||
orr r4, r4, #(1<<12) @ - instruction cache enable
|
||||
orr r4, r4, #(1<<2) @ - data cache enable
|
||||
orr r4, r4, #(1<<0) @ - mpu enable
|
||||
mcr p15, 0, r4, c1, c0, 0 @ write control register
|
||||
|
||||
@ Undocumented: Fixes mounting of SDMC
|
||||
@ Flush caches
|
||||
mov r5, #0
|
||||
mcr p15, 0, r5, c7, c5, 0 @ flush I-cache
|
||||
mcr p15, 0, r5, c7, c6, 0 @ flush D-cache
|
||||
mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
|
||||
|
||||
@ Fixes mounting of SDMC
|
||||
ldr r0, =0x10000020
|
||||
mov r1, #0x340
|
||||
str r1, [r0]
|
||||
|
||||
@ -1,34 +0,0 @@
|
||||
.section .text.start
|
||||
.align 4
|
||||
.global _start
|
||||
_start:
|
||||
@ Change the stack pointer
|
||||
mov sp, #0x27000000
|
||||
|
||||
@ Give read/write access to all the memory regions
|
||||
ldr r5, =0x33333333
|
||||
mcr p15, 0, r5, c5, c0, 2 @ write data access
|
||||
mcr p15, 0, r5, c5, c0, 3 @ write instruction access
|
||||
|
||||
@ Enable caches
|
||||
mrc p15, 0, r4, c1, c0, 0 @ read control register
|
||||
orr r4, r4, #(1<<12) @ - instruction cache enable
|
||||
orr r4, r4, #(1<<2) @ - data cache enable
|
||||
orr r4, r4, #(1<<0) @ - mpu enable
|
||||
mcr p15, 0, r4, c1, c0, 0 @ write control register
|
||||
|
||||
@ Flush caches
|
||||
mov r5, #0
|
||||
mcr p15, 0, r5, c7, c5, 0 @ flush I-cache
|
||||
mcr p15, 0, r5, c7, c6, 0 @ flush D-cache
|
||||
mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
|
||||
|
||||
@ Fixes mounting of SDMC
|
||||
ldr r0, =0x10000020
|
||||
mov r1, #0x340
|
||||
str r1, [r0]
|
||||
|
||||
bl main
|
||||
|
||||
.die:
|
||||
b .die
|
||||
@ -13,6 +13,7 @@
|
||||
typedef uint8_t u8;
|
||||
typedef uint16_t u16;
|
||||
typedef uint32_t u32;
|
||||
typedef volatile u32 vu32;
|
||||
typedef uint64_t u64;
|
||||
|
||||
//FIRM Header layout
|
||||
|
||||
Reference in New Issue
Block a user