This commit is contained in:
Aurora 2016-05-27 04:16:49 +02:00
parent 7ea2a0a278
commit 30b3a51309
5 changed files with 32 additions and 30 deletions

View File

@ -476,13 +476,13 @@ void patchCode(u64 progId, u8 *code, u32 size)
case 0x0004013000003702LL: // RO
{
static const u8 sigCheckPattern[] = {
0x30, 0x40, 0x2D, 0xE9, 0x02, 0x50, 0xA0, 0xE1
0x30, 0x40, 0x2D, 0xE9, 0x02
};
static const u8 sha256ChecksPattern1[] = {
0x30, 0x40, 0x2D, 0xE9, 0x24, 0xD0, 0x4D, 0xE2
0x30, 0x40, 0x2D, 0xE9, 0x24
};
static const u8 sha256ChecksPattern2[] = {
0xF8, 0x4F, 0x2D, 0xE9, 0x01, 0x70, 0xA0, 0xE1
0xF8, 0x4F, 0x2D, 0xE9, 0x01
};
static const u8 stub[] = {

View File

@ -22,7 +22,6 @@
#define BUTTON_DOWN (1 << 7)
#define SAFE_MODE (BUTTON_R1 | BUTTON_L1 | BUTTON_A | BUTTON_UP)
#define OVERRIDE_BUTTONS (BUTTON_B ^ 0xFFF)
#define SINGLE_PAYLOAD_BUTTONS (BUTTON_LEFT | BUTTON_RIGHT | BUTTON_UP | BUTTON_DOWN | BUTTON_START | BUTTON_X | BUTTON_Y)
#define L_PAYLOAD_BUTTONS (BUTTON_R1 | BUTTON_A | BUTTON_SELECT)
#define MENU_BUTTONS (BUTTON_LEFT | BUTTON_RIGHT | BUTTON_UP | BUTTON_DOWN | BUTTON_A | BUTTON_START)

View File

@ -64,8 +64,8 @@ static inline void patchNANDRW(u8 *pos, u32 size, u32 branchOffset)
//Look for read/write code
const u8 pattern[] = {0x1E, 0x00, 0xC8, 0x05};
u16 *readOffset = (u16 *)memsearch(pos, pattern, size, 4) - 3;
u16 *writeOffset = (u16 *)memsearch((u8 *)(readOffset + 5), pattern, 0x100, 4) - 3;
u16 *readOffset = (u16 *)memsearch(pos, pattern, size, 4) - 3,
*writeOffset = (u16 *)memsearch((u8 *)(readOffset + 5), pattern, 0x100, 4) - 3;
*readOffset = nandRedir[0];
readOffset[1] = nandRedir[1];
@ -96,8 +96,8 @@ void patchEmuNAND(u8 *arm9Section, u32 arm9SectionSize, u8 *process9Offset, u32
memcpy(emuCodeOffset, emunand, emunand_size);
//Add the data of the found emuNAND
u32 *pos_offset = (u32 *)memsearch(emuCodeOffset, "NAND", emunand_size, 4);
u32 *pos_header = (u32 *)memsearch(emuCodeOffset, "NCSD", emunand_size, 4);
u32 *pos_offset = (u32 *)memsearch(emuCodeOffset, "NAND", emunand_size, 4),
*pos_header = (u32 *)memsearch(emuCodeOffset, "NCSD", emunand_size, 4);
*pos_offset = emuOffset;
*pos_header = emuHeader;

View File

@ -115,29 +115,29 @@ void main(void)
{
nandType = 0;
firmSource = updatedSys ? 0 : BOOTCONFIG(2, 1);
needConfig--;
needConfig = 0;
//Flag to prevent multiple boot options-forcing
newConfig |= 1 << 4;
}
/* Else, force the last used boot options unless a payload button or A/L/R are pressed
/* Else, force the last used boot options unless a button is pressed
or the no-forcing flag is set */
else if(!(pressed & OVERRIDE_BUTTONS) && !BOOTCONFIG(4, 1))
else if(!pressed && !BOOTCONFIG(4, 1))
{
nandType = BOOTCONFIG(0, 3);
firmSource = BOOTCONFIG(2, 1);
needConfig--;
needConfig = 0;
}
}
//If the SAFE MODE combo is held, force a sysNAND boot
else if(pressed == SAFE_MODE)
{
a9lhMode++;
a9lhMode = 2;
nandType = 0;
firmSource = 0;
needConfig--;
needConfig = 0;
}
}
@ -173,7 +173,7 @@ void main(void)
/* If we're booting emuNAND the second emuNAND is set as default and B isn't pressed,
or vice-versa, boot the second emuNAND */
if(nandType && (CONFIG(3) == !(pressed & BUTTON_B))) nandType++;
if(nandType && (CONFIG(3) == !(pressed & BUTTON_B))) nandType = 2;
}
}
@ -290,9 +290,6 @@ static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhMode)
//Apply signature patches
patchSignatureChecks(process9Offset, process9Size);
//Apply anti-anti-DG patches for >= 11.0 firmwares
if(nativeFirmType == 1) patchTitleInstallMinVersionCheck(process9Offset, process9Size);
//Apply emuNAND patches
if(nandType)
{
@ -306,8 +303,14 @@ static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhMode)
//Apply firmlaunch patches, not on 9.0 FIRM as it breaks firmlaunchhax
if(nativeFirmType || a9lhMode == 2) patchFirmlaunches(process9Offset, process9Size, process9MemAddr);
//Does nothing if svcBackdoor is still there
if(nativeFirmType == 1) reimplementSvcBackdoor((u8 *)firm + section[1].offset, section[1].size);
if(nativeFirmType == 1)
{
//Apply anti-anti-DG patches for >= 11.0 firmwares
patchTitleInstallMinVersionCheck(process9Offset, process9Size);
//Does nothing if svcBackdoor is still there
reimplementSvcBackdoor((u8 *)firm + section[1].offset, section[1].size);
}
}
static inline void patchLegacyFirm(u32 firmType)

View File

@ -34,18 +34,9 @@ void patchSignatureChecks(u8 *pos, u32 size)
off2[1] = sigPatch[1];
}
void patchTitleInstallMinVersionCheck(u8 *pos, u32 size)
{
const u8 pattern[] = {0x89, 0x0A, 0x81, 0x42, 0x02, 0xD2};
u8 *off = memsearch(pos, pattern, size, 6);
if(off != NULL) off[5] = 0xE0;
}
void patchFirmlaunches(u8 *pos, u32 size, u32 process9MemAddr)
{
//Look for FIRM reboot code
//Look for firmlaunch code
const u8 pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
u8 *off = memsearch(pos, pattern, size, 4) - 0x10;
@ -121,6 +112,15 @@ void reimplementSvcBackdoor(u8 *pos, u32 size)
}
}
void patchTitleInstallMinVersionCheck(u8 *pos, u32 size)
{
const u8 pattern[] = {0x0A, 0x81, 0x42, 0x02};
u8 *off = memsearch(pos, pattern, size, 4);
if(off != NULL) off[4] = 0xE0;
}
void applyLegacyFirmPatches(u8 *pos, u32 firmType, u32 console)
{
const patchData twlPatches[] = {