LowLevel/Luma3DS-3GX
Archived
1
0
Fork 0
Code Issues Pull Requests Releases 2 Wiki Activity

Re-added reboot patch on A9LH, optimizations

Browse Source 
O3DS and N3DS now share the same emuNAND patch, shorter patching patterns, patched_firmware does not keep garbage from larger loaded FIRMs, flags can be empty files
This commit is contained in:
Aurora 2016-02-20 15:29:32 +01:00
parent b4d94da531
commit 38995d3231
10 changed files with 115 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
Makefile
View File

@ -42,13 +42,13 @@ launcher: $(dir_out)/$(name).dat
a9lh: $(dir_out)/arm9loaderhax.bin
.PHONY: emunand
emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin $(dir_out)/rei-n3ds/emunand/emunand90.bin
emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin
.PHONY: emunando3ds
emunando3ds: $(dir_out)/rei-o3ds/emunand/emunand.bin
.PHONY: reboot
reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot2.bin
reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot2.bin $(dir_out)/rei-o3ds/reboot/reboot190.bin
.PHONY: rebootntr
rebootntr: $(dir_out)/ntr-o3ds/reboot/reboot1.bin $(dir_out)/ntr-o3ds/reboot/reboot2.bin
@ -75,26 +75,20 @@ $(dir_out)/3ds/$(name):
@mv $(dir_out)/$(name).3dsx $@
@mv $(dir_out)/$(name).smdh $@
$(dir_out)/rei-n3ds/: $(dir_data)/firmware.bin
$(dir_out)/rei-n3ds/:
@mkdir -p "$(dir_out)/rei-n3ds"
@cp -av $(dir_data)/firmware.bin $@
$(dir_out)/rei-o3ds/: $(dir_data)/firmwareo3ds.bin
$(dir_out)/rei-o3ds/:
@mkdir -p "$(dir_out)/rei-o3ds"
@cp -av $(dir_data)/firmwareo3ds.bin $(dir_out)/rei-o3ds/firmware.bin
$(dir_out)/rei-n3ds/emunand/emunand.bin: $(dir_emu)/emuCode.s
@armips $<
@mkdir -p "$(dir_out)/rei-n3ds/emunand"
@mv emunand.bin $(dir_out)/rei-n3ds/emunand
@cp -av emunand.bin $(dir_out)/rei-n3ds/emunand
$(dir_out)/rei-o3ds/emunand/emunand.bin: $(dir_emu)/emuCodeo3ds.s
@armips $<
$(dir_out)/rei-o3ds/emunand/emunand.bin: emunand.bin
@mkdir -p "$(dir_out)/rei-o3ds/emunand"
@cp -av emunand.bin $(dir_out)/rei-o3ds/emunand
$(dir_out)/rei-n3ds/emunand/emunand90.bin: $(dir_out)/rei-o3ds/emunand/emunand.bin
@mv emunand.bin $(dir_out)/rei-n3ds/emunand/emunand90.bin
@mv emunand.bin $(dir_out)/rei-o3ds/emunand
$(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
@armips $<
@ -104,6 +98,10 @@ $(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
$(dir_out)/rei-o3ds/reboot/reboot2.bin: reboot2.bin
@cp -av reboot2.bin $(dir_out)/rei-o3ds/reboot
$(dir_out)/rei-o3ds/reboot/reboot190.bin: $(dir_reboot)/rebootCode90.s
@armips $<
@mv reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot190.bin
$(dir_out)/ntr-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCodeNtr.s
@armips $<
@mkdir -p "$(dir_out)/ntr-o3ds/reboot"

50
emunand/emuCodeo3ds.s
View File

@ -1,50 +0,0 @@
.nds
sdmmc equ 0x434D4453 ;dummy
.create "emunand.bin", 0x0801A4C0
.org 0x0801A4C0
.arm
nand_sd:
; Original code that still needs to be executed.
mov r4, r0
mov r5, r1
mov r7, r2
mov r6, r3
; End.
; If we're already trying to access the SD, return.
ldr r2, [r0, #4]
ldr r1, =sdmmc
cmp r2, r1
beq nand_sd_ret
str r1, [r0, #4] ; Set object to be SD
ldr r2, [r0, #8] ; Get sector to read
cmp r2, #0 ; For GW compatibility, see if we're trying to read the ncsd header (sector 0)
ldr r3, =nand_offset
ldr r3, [r3]
add r2, r3 ; Add the offset to the NAND in the SD.
ldreq r3, =ncsd_header_offset
ldreq r3, [r3]
addeq r2, r3 ; If we're reading the ncsd header, add the offset of that sector.
str r2, [r0, #8] ; Store sector to read
nand_sd_ret:
; Restore registers.
mov r1, r5
mov r2, r7
mov r3, r6
; Return 4 bytes behind where we got called,
; due to the offset of this function being stored there.
mov r0, lr
add r0, #4
bx r0
.pool
nand_offset: .ascii "NAND" ; for rednand this should be 1
ncsd_header_offset: .ascii "NCSD" ; depends on nand manufacturer + emunand type (GW/RED)
.close

59
reboot/rebootCode90.s Normal file
View File

@ -0,0 +1,59 @@
.nds
firm_size equ 0x000E9000
firm_addr equ 0x24000000
fopen equ 0x0805AF20
fread equ 0x0804D828
pxi_wait_recv equ 0x08054FB0
.macro svc, num
.if isArm()
.word 0xEF000000 | num
.else
.if num > 0xFF
.error "bitch you crazu"
.endif
.halfword 0xDF00 | num
.endif
.endmacro
.create "reboot1.bin", 0x080858E0
.org 0x080858E0
.arm
patch005:
ldr r0, =0x2000E000
mov r1, #0x200
mov r2, #0
add r1, r1, r0
@@memset_loop:
str r2, [r0]
add r0, r0, #4
cmp r0, r1
blt @@memset_loop
ldr r0, =0x2000E000
ldr r1, =firm_fname
mov r2, #1
blx fopen
ldr r0, =0x2000E000
ldr r1, =0x2000E100
mov r2, #firm_addr
mov r3, #firm_size
blx fread
ldr r4, =0x44846
blx pxi_wait_recv
cmp r0, r4
bne patch005
mov r2, #0
mov r3, r2
mov r1, r2
mov r0, r2
svc 0x7C
ldr r0, =0x80FF4FC
svc 0x7B
@@inf_loop:
b @@inf_loop
.pool
firm_fname:
.close

14
source/emunand.c
View File

@ -23,8 +23,8 @@ void getEmunandSect(u32 *off, u32 *head){
void getSDMMC(void *pos, u32 *off, u32 size){
//Look for struct code
unsigned char pattern[] = {0x01, 0x21, 0x20, 0x18, 0x20};
*off = (u32)memsearch(pos, pattern, size, 5);
unsigned char pattern[] = {0x21, 0x20, 0x18, 0x20};
*off = (u32)memsearch(pos, pattern, size, 4) - 1;
//Get DCD values
unsigned char buf[4];
@ -42,15 +42,15 @@ void getSDMMC(void *pos, u32 *off, u32 size){
void getEmuRW(void *pos, u32 size, u32 *readOff, u32 *writeOff){
//Look for read/write code
unsigned char pattern[] = {0x04, 0x00, 0x0D, 0x00, 0x17, 0x00, 0x1E, 0x00, 0xC8, 0x05};
unsigned char pattern[] = {0x1E, 0x00, 0xC8, 0x05};
*writeOff = (u32)memsearch(pos, pattern, size, 10);
*readOff = (u32)memsearch((void *)(*writeOff - 0x1000), pattern, 0x1000, 10);
*writeOff = (u32)memsearch(pos, pattern, size, 4) - 6;
*readOff = (u32)memsearch((void *)(*writeOff - 0x1000), pattern, 0x1000, 4) - 6;
}
void getMPU(void *pos, u32 *off, u32 size){
//Look for MPU pattern
unsigned char pattern[] = {0x03, 0x00, 0x24, 0x00, 0x00};
unsigned char pattern[] = {0x03, 0x00, 0x24, 0x00};
*off = (u32)memsearch(pos, pattern, size, 5);
*off = (u32)memsearch(pos, pattern, size, 4);
}

34
source/firm.c
View File

@ -28,10 +28,10 @@ u8 loadFirm(u8 a9lhBoot){
//Get pressed buttons
pressed = HID_PAD;
//Determine if A9LH is installed
if(a9lhBoot || fileSize("/rei/installeda9lh")){
if(a9lhBoot || fileExists("/rei/installeda9lh")){
a9lhSetup = 1;
//Check flag for > 9.2 SysNAND
if(fileSize("/rei/updatedsysnand")) updatedSys = 1;
if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
}
section = firmLocation->section;
@ -39,7 +39,7 @@ u8 loadFirm(u8 a9lhBoot){
/* If L and R are pressed on a 9.0/2 SysNAND, or L on an updated
SysNAND, boot 9.0 FIRM */
if((!updatedSys & ((pressed & BUTTON_L1R1) == BUTTON_L1R1)) |
(updatedSys & (pressed == BUTTON_L1))) mode = 0;
(updatedSys & (pressed & BUTTON_L1))) mode = 0;
//If not using an A9LH setup, do so by decrypting FIRM0
if(!a9lhSetup && !mode){
@ -77,15 +77,14 @@ u8 loadEmu(void){
//Read emunand code from SD
char path[] = "/rei/emunand/emunand.bin";
char path2[] = "/rei/emunand/emunand90.bin";
char *pathPtr = ((!mode) & console) ? path2 : path;
u32 size = fileSize(pathPtr);
u32 size = fileSize(path);
if (!size) return 1;
if(!console | !mode) nandRedir[5] = 0xA4;
//Find offset for emuNAND code from the offset in nandRedir
u8 *emuCodeTmp = &nandRedir[4];
emuCodeOffset = *(u32*)emuCodeTmp - (u32)section[2].address +
section[2].offset + (u32)firmLocation;
fileRead((u8*)emuCodeOffset, pathPtr, size);
fileRead((u8*)emuCodeOffset, path, size);
//Find and patch emunand related offsets
u32 *pos_sdmmc = memsearch((u32*)emuCodeOffset, "SDMC", size, 4);
@ -98,6 +97,11 @@ u8 loadEmu(void){
*pos_sdmmc = sdmmcOffset;
*pos_offset = emuOffset;
*pos_header = emuHeader;
//Patch emuNAND code in memory for O3DS and 9.0 N3DS
if(!console | !mode){
u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
memcpy((u8*)pos_instr, emuInstr, sizeof(emuInstr));
}
//Add emunand hooks
memcpy((u8*)emuRead, nandRedir, sizeof(nandRedir));
@ -114,8 +118,8 @@ u8 patchFirm(void){
/* If L is pressed on a 9.0/9.2 SysNAND, or L+R on a > 9.2 SysNAND,
or the 9.0 FIRM is loaded on a > 9.2 SysNAND, boot emuNAND */
if((updatedSys & (!mode | (pressed == BUTTON_L1R1))) |
((!updatedSys) & mode & !(pressed & BUTTON_L1))){
if((updatedSys & ((!mode) | (((pressed & BUTTON_L1R1) == BUTTON_L1R1) &
(pressed != SAFEMODE)))) | ((!updatedSys) & mode & !(pressed & BUTTON_L1))){
if (loadEmu()) return 1;
}
else if (a9lhSetup){
@ -133,18 +137,20 @@ u8 patchFirm(void){
memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
//Apply FIRM reboot patch. Not needed with A9LH and N3DS
if(!console && !a9lhSetup && mode &&
((fileSize("/rei/reversereboot") > 0) == (pressed & BUTTON_A))){
//Apply FIRM reboot patch. Not needed on N3DS
if((!console) & mode & (pressed != SAFEMODE) &
!(fileExists("/rei/reversereboot") ^ (pressed & BUTTON_A))){
u32 rebootOffset = 0,
rebootOffset2 = 0;
//Read reboot code from SD and write patched FIRM path in memory
char path[] = "/rei/reboot/reboot1.bin";
u32 size = fileSize(path);
char path2[] = "/rei/reboot/reboot190.bin";
char *pathPtr = mode ? path : path2;
u32 size = fileSize(pathPtr);
if (!size) return 1;
getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2);
fileRead((u8*)rebootOffset, path, size);
fileRead((u8*)rebootOffset, pathPtr, size);
memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2);
path[18] = '2';

1
source/firm.h
View File

@ -13,6 +13,7 @@
#define BUTTON_L1R1 (3 << 8)
#define BUTTON_L1 (1 << 9)
#define BUTTON_A 1
#define SAFEMODE (BUTTON_L1R1 | BUTTON_A | (1 << 6))
#define PATCHED_FIRM_PATH "/rei/patched_firmware.bin"
u8 loadFirm(u8 a9lh);

11
source/fs.c
View File

@ -63,6 +63,7 @@ int fileWrite(const u8 *buffer, const char *path, u32 size){
FIL fp;
unsigned int br = 0;
f_unlink(path);
if(f_open(&fp, path, FA_WRITE | FA_OPEN_ALWAYS) == FR_OK){
fr = f_write(&fp, buffer, size, &br);
f_close(&fp);
@ -84,3 +85,13 @@ int fileSize(const char* path){
f_close(&fp);
return size;
}
int fileExists(const char* path){
FRESULT fr;
FIL fp;
int exists = 1;
fr = f_open(&fp, path, FA_READ);
if (fr != FR_OK)exists = 0;
f_close(&fp);
return exists;
}

1
source/fs.h
View File

@ -13,5 +13,6 @@ int fileReadOffset(u8 *dest, const char *path, u32 size, u32 offset);
int fileRead(u8 *dest, const char *path, u32 size);
int fileWrite(const u8 *buffer, const char *path, u32 size);
int fileSize(const char* path);
int fileExists(const char* path);
#endif

7
source/patches.c
View File

@ -28,6 +28,7 @@ u8 nandRedir[0x08] = {0x00, 0x4C, 0xA0, 0x47, 0xC0, 0xA5, 0x01, 0x08}; //Bran
u8 sigPat1[2] = {0x00, 0x20};
u8 sigPat2[4] = {0x00, 0x20, 0x70, 0x47};
u8 FIRMblock[4] = {0x00, 0x20, 0xC0, 0x46};
u8 emuInstr[5] = {0xA5, 0x01, 0x08, 0x30, 0xA5};
/**************************************************
* Functions
@ -36,10 +37,10 @@ u8 FIRMblock[4] = {0x00, 0x20, 0xC0, 0x46};
void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
//Look for signature checks
unsigned char pattern[] = {0xC0, 0x1C, 0x76, 0xE7};
unsigned char pattern2[] = {0x70, 0xB5, 0x22, 0x4D, 0x0C};
unsigned char pattern2[] = {0xB5, 0x22, 0x4D, 0x0C};
*off = (u32)memsearch(pos, pattern, size, 4);
*off2 = (u32)memsearch(pos, pattern2, size, 5);
*off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
}
void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
@ -53,7 +54,7 @@ void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
void getFIRMWrite(void *pos, u32 size, u32 *off){
//Look for FIRM writing code
void *firmwrite = memsearch(pos, "exe:/", size, 5);
void *firmwrite = memsearch(pos, "exe:", size, 4);
unsigned char pattern[] = {0x00, 0x28, 0x01, 0xDA};
*off = (u32)memsearch(firmwrite - 0x100, pattern, 0x100, 4);

1
source/patches.h
View File

@ -16,6 +16,7 @@ u8 nandRedir[0x08];
u8 sigPat1[2];
u8 sigPat2[4];
u8 FIRMblock[4];
u8 emuInstr[5];
/**************************************************
* Functions