Groundwork

Change the payload loader location
Always set keys 0x18..0x1F
Set arm11 entrypoint correctly
This commit is contained in:
TuxSH 2017-05-17 13:02:01 +02:00
parent e029458b09
commit b9bc41a772
8 changed files with 48 additions and 31 deletions

View File

@ -4,7 +4,7 @@ OUTPUT_ARCH(arm)
ENTRY(_start)
SECTIONS
{
. = 0x24FFFE00;
. = 0x27FFE000;
.text : ALIGN(4) { *(.text.start) *(.text*); . = ALIGN(4); }
.rodata : ALIGN(4) { *(.rodata*); . = ALIGN(4); }

View File

@ -22,6 +22,7 @@
.align 4
.global _start
_start:
ldr sp, =0x27ffe000
b main
.global payloadSize

View File

@ -484,21 +484,26 @@ void kernel9Loader(Arm9Bin *arm9Section)
{
//Determine the kernel9loader version
u32 k9lVersion;
switch(arm9Section->magic[3])
if(arm9Section == NULL)
k9lVersion = 2;
else
{
case 0xFF:
k9lVersion = 0;
break;
case '1':
k9lVersion = 1;
break;
default:
k9lVersion = 2;
break;
switch(arm9Section->magic[3])
{
case 0xFF:
k9lVersion = 0;
break;
case '1':
k9lVersion = 1;
break;
default:
k9lVersion = 2;
break;
}
}
u32 *startOfArm9Bin = (u32 *)((u8 *)arm9Section + 0x800);
bool needToDecrypt = *startOfArm9Bin != 0x47704770 && *startOfArm9Bin != 0xB0862000;
bool needToDecrypt = arm9Section != NULL && *startOfArm9Bin != 0x47704770 && *startOfArm9Bin != 0xB0862000;
//Set 0x11 keyslot
__attribute__((aligned(4))) const u8 key1s[2][AES_BLOCK_SIZE] = {
@ -564,10 +569,6 @@ void kernel9Loader(Arm9Bin *arm9Section)
aes_setkey(slot, decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
}
if(!ISSIGHAX) return;
twlConsoleInfoInit();
if(k9lVersion == 2)
{
aes_setkey(0x11, key1s[ISDEVUNIT ? 1 : 0], AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
@ -575,6 +576,9 @@ void kernel9Loader(Arm9Bin *arm9Section)
aes(decKey, keyBlocks[0], 1, NULL, AES_ECB_DECRYPT_MODE, 0);
aes_setkey(0x18, decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
}
if(ISSIGHAX)
twlConsoleInfoInit();
}
void computePinHash(u8 *outbuf, const u8 *inbuf)

View File

@ -128,6 +128,9 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, u32 emuHeader, boo
//Sets the 7.x NCCH KeyX and the 6.x gamecard save data KeyY on >= 6.0 O3DS FIRMs, if not using A9LH
else if(!ISA9LH && !ISFIRMLAUNCH && firmVersion >= 0x29) set6x7xKeys();
if(!ISN3DS)
kernel9Loader(NULL); //Just set the N3DS 9.6+ keys even on O3DS
//Find the Process9 .code location, size and memory address
u32 process9Size,
process9MemAddr;
@ -227,6 +230,8 @@ u32 patchTwlFirm(u32 firmVersion, bool doUnitinfoPatch)
kernel9Loader((Arm9Bin *)arm9Section);
firm->arm9Entry = (u8 *)0x801301C;
}
else
kernel9Loader(NULL); //Just set the keys
//Find the Process9 .code location, size and memory address
u32 process9Size,
@ -260,6 +265,8 @@ u32 patchAgbFirm(bool doUnitinfoPatch)
kernel9Loader((Arm9Bin *)arm9Section);
firm->arm9Entry = (u8 *)0x801301C;
}
else
kernel9Loader(NULL); //Just set the keys
//Find the Process9 .code location, size and memory address
u32 process9Size,
@ -288,6 +295,8 @@ u32 patch1x2xNativeAndSafeFirm(bool enableExceptionHandlers)
kernel9Loader((Arm9Bin *)arm9Section);
firm->arm9Entry = (u8 *)0x801B01C;
}
else
kernel9Loader(NULL); //Just set the keys
//Find the Process9 .code location, size and memory address
u32 process9Size,
@ -381,17 +390,13 @@ void launchFirm(FirmwareType firmType, bool loadFromStorage)
for(; sectionNum < 4 && firm->section[sectionNum].size != 0; sectionNum++)
memcpy(firm->section[sectionNum].address, (u8 *)firm + firm->section[sectionNum].offset, firm->section[sectionNum].size);
//Determine the ARM11 entry to use
vu32 *arm11;
if(ISFIRMLAUNCH) arm11 = (vu32 *)0x1FFFFFFC;
else
{
deinitScreens();
arm11 = (vu32 *)BRAHMA_ARM11_ENTRY;
}
if(!ISFIRMLAUNCH) deinitScreens();
//Set ARM11 kernel entrypoint
*arm11 = (u32)firm->arm11Entry;
if(ISFIRMLAUNCH | ISSIGHAX)
ARM11_CORE0_MAILBOX_ENTRYPOINT = (u32)firm->arm11Entry;
else
BRAHMA_ARM11_ENTRYPOINT = (u32)firm->arm11Entry;
//Ensure that all memory transfers have completed and that the caches have been flushed
flushEntireDCache();

View File

@ -119,7 +119,7 @@ void fileDelete(const char *path)
void loadPayload(u32 pressed, const char *payloadPath)
{
u32 *loaderAddress = (u32 *)0x24FFFE00;
u8 *payloadAddress = (u8 *)0x24F00000;
u8 *payloadAddress = (u8 *)0x27FFE000;
u32 payloadSize = 0,
maxPayloadSize = (u32)((u8 *)loaderAddress - payloadAddress);

View File

@ -164,7 +164,11 @@ void main(void)
pressed = HID_PAD;
}
else if(((pressed & SINGLE_PAYLOAD_BUTTONS) && !(pressed & (BUTTON_L1 | BUTTON_R1 | BUTTON_A))) ||
((pressed & L_PAYLOAD_BUTTONS) && (pressed & BUTTON_L1))) loadPayload(pressed, NULL);
((pressed & L_PAYLOAD_BUTTONS) && (pressed & BUTTON_L1)))
{
kernel9Loader(NULL);
loadPayload(pressed, NULL);
}
if(splashMode == 2) loadSplash();

View File

@ -42,7 +42,8 @@
#include "i2c.h"
#include "utils.h"
vu32 *arm11Entry = (vu32 *)BRAHMA_ARM11_ENTRY;
static vu32 *arm11Entry;
static const u32 brightness[4] = {0x5F, 0x4C, 0x39, 0x26};
void __attribute__((naked)) arm11Stub(void)
@ -56,6 +57,7 @@ static void invokeArm11Function(void (*func)())
if(!hasCopiedStub)
{
arm11Entry = (vu32 *)((ISFIRMLAUNCH | ISSIGHAX) ? 0x1FFFFFFC : 0x1FFFFFF8);
memcpy((void *)ARM11_STUB_ADDRESS, arm11Stub, 0x2C);
hasCopiedStub = true;
}

View File

@ -47,7 +47,8 @@ typedef volatile s64 vs64;
#include "3dsheaders.h"
#define BRAHMA_ARM11_ENTRY 0x1FFFFFF8
#define BRAHMA_ARM11_ENTRYPOINT *(vu32 *)0x1FFFFFF8
#define ARM11_CORE0_MAILBOX_ENTRYPOINT *(vu32 *)0x1FFFFFFC
#define CFG_SYSPROT9 (*(vu8 *)0x10000000)
#define CFG_BOOTENV (*(vu32 *)0x10010000)
@ -61,7 +62,7 @@ typedef volatile s64 vs64;
#define ISN3DS (PDN_MPCORE_CFG == 7)
#define ISDEVUNIT (CFG_UNITINFO != 0)
#define ISA9LH (!PDN_SPI_CNT)
#define ISSIGHAX (!(CFG_SYSPROT9 & 2))
#define ISSIGHAX (!PDN_SPI_CNT && !(CFG_SYSPROT9 & 2))
#define ISFIRMLAUNCH (launchedFirmTidLow[5] != 0)
typedef struct __attribute__((packed))