Added flag to use a pre-patched FIRM (skips all decrypting and patching)

Original patch by @Fix94

reboot/rebootCode.s

@@ -99,7 +99,7 @@ Memcpy:
 		BX      LR
 	
 FileName:
-	.dcw "sdmc:/rei/patched_firmware.bin"
+	.dcw "sdmc:/rei/patched_firmware_sys.bin"
 	.word 0x0
 
 .pool

source/crypto.c

@@ -7,6 +7,11 @@
 #include "fatfs/sdmmc/sdmmc.h"
 #include "fatfs/ff.h"
 
+//Nand key#2 (0x12C10)
+u8 key2[0x10] = {
+    0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
+};
+
 /****************************************************************
 *                   Crypto Libs
 ****************************************************************/
@@ -375,12 +380,8 @@ void nandFirm0(u8 *outbuf, const u32 size, u8 console){
     aes(outbuf, outbuf, size / AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 }
 
-//Emulates the Arm9loader process
+//Decrypts the N3DS arm9bin
-void arm9loader(void *armHdr, u8 mode){
+void decArm9Bin(void *armHdr, u8 mode){
-    //Nand key#2 (0x12C10)
-    u8 key2[0x10] = {
-        0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
-    };
 
     //Firm keys
     u8 keyX[0x10];
@@ -389,15 +390,15 @@ void arm9loader(void *armHdr, u8 mode){
     u32 slot = mode ? 0x16 : 0x15;
 
     //Setup keys needed for arm9bin decryption
-    memcpy((u8*)keyY, (void *)((uintptr_t)armHdr+0x10), 0x10);
+    memcpy((u8*)keyY, (void *)(armHdr+0x10), 0x10);
-    memcpy((u8*)CTR, (void *)((uintptr_t)armHdr+0x20), 0x10);
+    memcpy((u8*)CTR, (void *)(armHdr+0x20), 0x10);
-    u32 size = atoi((void *)((uintptr_t)armHdr+0x30));
+    u32 size = atoi((void *)(armHdr+0x30));
 
     if(mode){
         //Set 0x11 to key2 for the arm9bin and misc keys
         aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
         aes_use_keyslot(0x11);
-        aes((u8*)keyX, (void *)((uintptr_t)armHdr+0x60), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes((u8*)keyX, (void *)(armHdr+0x60), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
         aes_setkey(slot, (u8*)keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
     }
 
@@ -407,16 +408,18 @@ void arm9loader(void *armHdr, u8 mode){
 
     //Decrypt arm9bin
     aes((void *)(armHdr+0x800), (void *)(armHdr+0x800), size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
+}
+
+//Sets the N3DS 9.6 KeyXs
+void setKeyXs(void *armHdr){
 
-    if(mode){
     //Set keys 0x19..0x1F keyXs
-        u8* decKey = (void *)((uintptr_t)armHdr+0x89824);
+    u8* decKey = (void *)(armHdr+0x89824);
-        aes_use_keyslot(0x11);
-        for(slot = 0x19; slot < 0x20; slot++) {
     aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
-            aes(decKey, (void *)((uintptr_t)armHdr+0x89814), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+    aes_use_keyslot(0x11);
+    for(u32 slot = 0x19; slot < 0x20; slot++){
+        aes(decKey, (void *)(armHdr+0x89814), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
         aes_setkey(slot, (u8*)decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
-            *(u8 *)((void *)((uintptr_t)armHdr+0x89814+0xF)) += 1;
+        *(u8*)(armHdr+0x89814+0xF) += 1;
-        }
     }
 }

source/crypto.h

@@ -132,6 +132,7 @@ int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
 
 //NAND/FIRM stuff
 void nandFirm0(u8 *outbuf, const u32 size, u8 console);
-void arm9loader(void *armHdr, u8 mode);
+void decArm9Bin(void *armHdr, u8 mode);
+void setKeyXs(void *armHdr);
 
 #endif /*__CRYPTO_H*/

source/firm.c

@@ -17,9 +17,12 @@ firmSectionHeader *section;
 u32 firmSize = 0;
 u8  mode = 1,
     console = 1,
+    emuNAND = 0,
     a9lhSetup = 0,
-    updatedSys = 0;
+    updatedSys = 0,
+    usePatchedFirm = 0;
 u16 pressed;
+char *firmPathPatched = NULL;
 
 void setupCFW(void){
 
@@ -39,13 +42,28 @@ void setupCFW(void){
     /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
        is not pressed, boot 9.0 FIRM */
     if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+
+    /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
+       or R is pressed on a > 9.2 SysNAND, boot emuNAND */
+    if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
+       (!updatedSys && mode && !(pressed & BUTTON_R1))) emuNAND = 1;
+
+    if(mode) firmPathPatched = emuNAND ? "/rei/patched_firmware_emu.bin" :
+                                         "/rei/patched_firmware_sys.bin";
+
+    //Skip decrypting and patching FIRM
+    if(fileExists("/rei/usepatchedfw")){
+        //Only needed with this flag
+        if(!mode) firmPathPatched = "/rei/patched_firmware90.bin";
+        if (fileExists(firmPathPatched)) usePatchedFirm = 1;
+    }
 }
 
 //Load firm into FCRAM
 u8 loadFirm(void){
 
-    //If not using an A9LH setup, load 9.0 FIRM from NAND
+    //If not using an A9LH setup or the patched FIRM, load 9.0 FIRM from NAND
-    if(!a9lhSetup && !mode){
+    if(!usePatchedFirm && !a9lhSetup && !mode){
         //Read FIRM from NAND and write to FCRAM
         firmSize = console ? 0xF2000 : 0xE9000;
         nandFirm0((u8*)firmLocation, firmSize, console);
@@ -54,12 +72,11 @@ u8 loadFirm(void){
     }
     //Load FIRM from SD
     else{
-        char firmPath[] = "/rei/firmware.bin";
+        char *path = usePatchedFirm ? firmPathPatched :
-        char firmPath2[] = "/rei/firmware90.bin";
+                                      (mode ? "/rei/firmware.bin" : "/rei/firmware90.bin");
-        char *pathPtr = mode ? firmPath : firmPath2;
+        firmSize = fileSize(path);
-        firmSize = fileSize(pathPtr);
         if (!firmSize) return 1;
-        fileRead((u8*)firmLocation, pathPtr, firmSize);
+        fileRead((u8*)firmLocation, path, firmSize);
     }
 
     section = firmLocation->section;
@@ -67,7 +84,8 @@ u8 loadFirm(void){
     //Check that the loaded FIRM matches the console
     if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
 
-    if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
+    if(console && !usePatchedFirm)
+        decArm9Bin((u8*)firmLocation + section[2].offset, mode);
 
     return 0;
 }
@@ -124,11 +142,9 @@ u8 loadEmu(void){
 
 //Patches
 u8 patchFirm(void){
+    if(usePatchedFirm) return 0;
 
-    /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
+    if(emuNAND){
-       or R is pressed on a > 9.2 SysNAND, boot emuNAND */
-    if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
-       (!updatedSys && mode && !(pressed & BUTTON_R1))){
         if (loadEmu()) return 1;
     }
     else if (a9lhSetup){
@@ -152,13 +168,13 @@ u8 patchFirm(void){
         *arm9 = 0x801B01C;
     }
 
-    //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
     if(mode){
+        //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
         u32 rebootOffset = 0,
             fOpenOffset = 0;
 
         //Read reboot code from SD
-        char path[] = "/rei/reboot/reboot.bin";
+        char *path = "/rei/reboot/reboot.bin";
         u32 size = fileSize(path);
         if (!size) return 1;
         getReboot(firmLocation, firmSize, &rebootOffset);
@@ -169,15 +185,24 @@ u8 patchFirm(void){
         getfOpen(firmLocation, firmSize, &fOpenOffset);
         *pos_fopen = fOpenOffset;
 
-        //Write patched FIRM to SD
+        //Patch path for emuNAND-patched FIRM
-        if(fileWrite((u8*)firmLocation, "/rei/patched_firmware.bin", firmSize) != 0) return 1;
+        if(emuNAND){
+            u32 *pos_path = memsearch((u32*)rebootOffset, L"sys", size, 6);
+            memcpy((u8*)pos_path, L"emu", 6);
         }
+    }
+
+    //Write patched FIRM to SD if needed
+    if(firmPathPatched)
+        if(fileWrite((u8*)firmLocation, firmPathPatched, firmSize) != 0) return 1;
 
     return 0;
 }
 
 void launchFirm(void){
 
+    if(console && mode) setKeyXs((u8*)firmLocation + section[2].offset);
+
     //Copy firm partitions to respective memory locations
     memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
     memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);