Fix reboot patch for 5.x/6.x
This commit is contained in:
parent
94f0d873df
commit
a5c6b908b6
@ -5,10 +5,14 @@ payload_maxsize equ 0x10000 ; Maximum size for the payload (maximum that CakeB
|
|||||||
|
|
||||||
.create "build/reboot.bin", 0
|
.create "build/reboot.bin", 0
|
||||||
.arm
|
.arm
|
||||||
; Interesting registers and locations to keep in mind, set before this code is ran:
|
; Interesting registers and locations to keep in mind, set just before this code is ran:
|
||||||
; - sp + 0x3A8 - 0x70: FIRM path in exefs.
|
; - r1: FIRM path in exefs.
|
||||||
; - r7 (which is sp + 0x3A8 - 0x198): Reserved space for file handle
|
; - r7: pointer to file object
|
||||||
; - *(sp + 0x3A8 - 0x198) + 0x28: fread function.
|
; - *r7: vtable
|
||||||
|
; - *(vtable + 0x28): fread function
|
||||||
|
; - *(r7 + 8): file handle
|
||||||
|
|
||||||
|
mov r8, r1
|
||||||
|
|
||||||
pxi_wait_recv:
|
pxi_wait_recv:
|
||||||
ldr r2, =0x44846
|
ldr r2, =0x44846
|
||||||
@ -47,7 +51,7 @@ payload_maxsize equ 0x10000 ; Maximum size for the payload (maximum that CakeB
|
|||||||
cmp r4, #0
|
cmp r4, #0
|
||||||
movne r3, #0x12000 ; Skip the first 0x12000 bytes.
|
movne r3, #0x12000 ; Skip the first 0x12000 bytes.
|
||||||
moveq r3, payload_maxsize
|
moveq r3, payload_maxsize
|
||||||
ldr r6, [sp, #0x3A8-0x198]
|
ldr r6, [r7]
|
||||||
ldr r6, [r6, #0x28]
|
ldr r6, [r6, #0x28]
|
||||||
blx r6
|
blx r6
|
||||||
cmp r4, #0
|
cmp r4, #0
|
||||||
@ -55,8 +59,7 @@ payload_maxsize equ 0x10000 ; Maximum size for the payload (maximum that CakeB
|
|||||||
bne read_payload ; Go read the real payload.
|
bne read_payload ; Go read the real payload.
|
||||||
|
|
||||||
; Copy the low TID (in UTF-16) of the wanted firm to the 5th byte of the payload
|
; Copy the low TID (in UTF-16) of the wanted firm to the 5th byte of the payload
|
||||||
add r0, sp, #0x3A8 - 0x70
|
add r0, r8, 0x1A
|
||||||
add r0, 0x1A
|
|
||||||
add r1, r0, #0x10
|
add r1, r0, #0x10
|
||||||
ldr r2, =payload_addr + 4
|
ldr r2, =payload_addr + 4
|
||||||
copy_TID_low:
|
copy_TID_low:
|
||||||
@ -75,7 +78,7 @@ payload_maxsize equ 0x10000 ; Maximum size for the payload (maximum that CakeB
|
|||||||
goto_reboot:
|
goto_reboot:
|
||||||
; Jump to reboot code
|
; Jump to reboot code
|
||||||
ldr r0, =(kernelcode_start - goto_reboot - 12)
|
ldr r0, =(kernelcode_start - goto_reboot - 12)
|
||||||
add r0, pc
|
add r0, pc ; pc is two instructions ahead of the instruction being executed (12 = 2*4 + 4)
|
||||||
swi 0x7B
|
swi 0x7B
|
||||||
|
|
||||||
die:
|
die:
|
||||||
|
Reference in New Issue
Block a user