Remove code to skip the rbeoot patch on 9.0 as it is not needed anymore with A9LH and constitutes a brick risk
This commit is contained in:
parent
ae23a1c84d
commit
efd83e063e
@ -374,14 +374,30 @@ void decryptExeFs(u8 *inbuf)
|
||||
aes(inbuf - 0x200, exeFsOffset, exeFsSize / AES_BLOCK_SIZE, ncchCTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
|
||||
}
|
||||
|
||||
//ARM9Loader replacement
|
||||
//Originally adapted from: https://github.com/Reisyukaku/ReiNand/blob/228c378255ba693133dec6f3368e14d386f2cde7/source/crypto.c#L233
|
||||
void arm9Loader(u8 *arm9Section, u32 mode)
|
||||
/* ARM9Loader replacement
|
||||
Originally adapted from: https://github.com/Reisyukaku/ReiNand/blob/228c378255ba693133dec6f3368e14d386f2cde7/source/crypto.c#L233 */
|
||||
void arm9Loader(u8 *arm9Section)
|
||||
{
|
||||
//Determine the arm9loader version
|
||||
u32 a9lVersion;
|
||||
|
||||
switch(arm9Section[0x53])
|
||||
{
|
||||
case 0xFF:
|
||||
a9lVersion = 0;
|
||||
break;
|
||||
case '1':
|
||||
a9lVersion = 1;
|
||||
break;
|
||||
default:
|
||||
a9lVersion = 2;
|
||||
break;
|
||||
}
|
||||
|
||||
//Firm keys
|
||||
u8 keyY[0x10],
|
||||
arm9BinCTR[0x10],
|
||||
arm9BinSlot = mode ? 0x16 : 0x15;
|
||||
arm9BinSlot = a9lVersion ? 0x16 : 0x15;
|
||||
|
||||
//Setup keys needed for arm9bin decryption
|
||||
memcpy(keyY, arm9Section + 0x10, 0x10);
|
||||
@ -393,13 +409,13 @@ void arm9Loader(u8 *arm9Section, u32 mode)
|
||||
for(u8 *tmp = arm9Section + 0x30; *tmp; tmp++)
|
||||
arm9BinSize = (arm9BinSize << 3) + (arm9BinSize << 1) + *tmp - '0';
|
||||
|
||||
if(mode)
|
||||
if(a9lVersion)
|
||||
{
|
||||
const u8 key1[0x10] = {0x07, 0x29, 0x44, 0x38, 0xF8, 0xC9, 0x75, 0x93, 0xAA, 0x0E, 0x4A, 0xB4, 0xAE, 0x84, 0xC1, 0xD8},
|
||||
key2[0x10] = {0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0};
|
||||
u8 keyX[0x10];
|
||||
|
||||
aes_setkey(0x11, mode == 2 ? key2 : key1, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
|
||||
aes_setkey(0x11, a9lVersion == 2 ? key2 : key1, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
|
||||
aes_use_keyslot(0x11);
|
||||
aes(keyX, arm9Section + 0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
|
||||
aes_setkey(arm9BinSlot, keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
|
||||
@ -413,7 +429,7 @@ void arm9Loader(u8 *arm9Section, u32 mode)
|
||||
aes(arm9Section + 0x800, arm9Section + 0x800, arm9BinSize / AES_BLOCK_SIZE, arm9BinCTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
|
||||
|
||||
//Set >=9.6 KeyXs
|
||||
if(mode == 2)
|
||||
if(a9lVersion == 2)
|
||||
{
|
||||
u8 keyData[0x10] = {0xDD, 0xDA, 0xA4, 0xC6, 0x2C, 0xC4, 0x50, 0xE9, 0xDA, 0xB6, 0x9B, 0x0D, 0x9D, 0x2A, 0x21, 0x98},
|
||||
decKey[0x10];
|
||||
|
@ -107,4 +107,4 @@ void ctrNandInit(void);
|
||||
u32 ctrNandRead(u32 sector, u32 sectorCount, u8 *outbuf);
|
||||
void setRSAMod0DerivedKeys(void);
|
||||
void decryptExeFs(u8 *inbuf);
|
||||
void arm9Loader(u8 *arm9Section, u32 mode);
|
||||
void arm9Loader(u8 *arm9Section);
|
@ -47,6 +47,7 @@ FirmwareSource firmSource;
|
||||
void main(void)
|
||||
{
|
||||
bool isFirmlaunch,
|
||||
isA9lh,
|
||||
updatedSys;
|
||||
|
||||
u32 newConfig,
|
||||
@ -56,7 +57,6 @@ void main(void)
|
||||
FirmwareType firmType;
|
||||
FirmwareSource nandType;
|
||||
ConfigurationStatus needConfig;
|
||||
A9LHMode a9lhMode;
|
||||
|
||||
//Detect the console being used
|
||||
isN3DS = PDN_MPCORE_CFG == 7;
|
||||
@ -81,8 +81,8 @@ void main(void)
|
||||
|
||||
nandType = (FirmwareSource)BOOTCONFIG(0, 3);
|
||||
firmSource = (FirmwareSource)BOOTCONFIG(2, 1);
|
||||
a9lhMode = (A9LHMode)BOOTCONFIG(3, 1);
|
||||
updatedSys = a9lhMode != NO_A9LH && CONFIG(1);
|
||||
isA9lh = BOOTCONFIG(3, 1) != 0;
|
||||
updatedSys = isA9lh && CONFIG(1);
|
||||
}
|
||||
else
|
||||
{
|
||||
@ -98,16 +98,16 @@ void main(void)
|
||||
//Determine if A9LH is installed and the user has an updated sysNAND
|
||||
if(a9lhBoot || CONFIG(2))
|
||||
{
|
||||
a9lhMode = A9LH_WITH_NFIRM_FIRMPROT;
|
||||
isA9lh = true;
|
||||
updatedSys = CONFIG(1);
|
||||
}
|
||||
else
|
||||
{
|
||||
a9lhMode = NO_A9LH;
|
||||
isA9lh = false;
|
||||
updatedSys = false;
|
||||
}
|
||||
|
||||
newConfig = (u32)a9lhMode << 3;
|
||||
newConfig = (u32)isA9lh << 3;
|
||||
|
||||
//If it's a MCU reboot, try to force boot options
|
||||
if(a9lhBoot && CFG_BOOTENV)
|
||||
@ -149,9 +149,8 @@ void main(void)
|
||||
pressed = HID_PAD;
|
||||
}
|
||||
|
||||
if(needConfig != DONT_CONFIGURE && pressed == SAFE_MODE)
|
||||
if(a9lhBoot && !CFG_BOOTENV && pressed == SAFE_MODE)
|
||||
{
|
||||
a9lhMode = A9LH_WITH_SFIRM_FIRMPROT;
|
||||
nandType = FIRMWARE_SYSNAND;
|
||||
firmSource = FIRMWARE_SYSNAND;
|
||||
needConfig = DONT_CONFIGURE;
|
||||
@ -224,7 +223,7 @@ void main(void)
|
||||
switch(firmType)
|
||||
{
|
||||
case NATIVE_FIRM:
|
||||
patchNativeFirm(nandType, emuHeader, a9lhMode);
|
||||
patchNativeFirm(nandType, emuHeader, isA9lh);
|
||||
break;
|
||||
case SAFE_FIRM:
|
||||
patchSafeFirm();
|
||||
@ -265,45 +264,19 @@ static inline void loadFirm(FirmwareType firmType, bool externalFirm)
|
||||
}
|
||||
}
|
||||
|
||||
static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, A9LHMode a9lhMode)
|
||||
static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, bool isA9lh)
|
||||
{
|
||||
u8 *arm9Section = (u8 *)firm + section[2].offset;
|
||||
|
||||
bool is90Firm;
|
||||
|
||||
if(isN3DS)
|
||||
{
|
||||
u32 a9lVersion;
|
||||
|
||||
//Determine the NATIVE_FIRM/arm9loader version
|
||||
switch(arm9Section[0x53])
|
||||
{
|
||||
case 0xFF:
|
||||
a9lVersion = 0;
|
||||
break;
|
||||
case '1':
|
||||
a9lVersion = 1;
|
||||
break;
|
||||
default:
|
||||
a9lVersion = 2;
|
||||
break;
|
||||
}
|
||||
|
||||
//Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
|
||||
arm9Loader(arm9Section, a9lVersion);
|
||||
arm9Loader(arm9Section);
|
||||
firm->arm9Entry = (u8 *)0x801B01C;
|
||||
is90Firm = a9lVersion == 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
//Determine if we're booting the 9.0 FIRM
|
||||
u8 firm90Hash[0x10] = {0x27, 0x2D, 0xFE, 0xEB, 0xAF, 0x3F, 0x6B, 0x3B, 0xF5, 0xDE, 0x4C, 0x41, 0xDE, 0x95, 0x27, 0x6A};
|
||||
is90Firm = memcmp(section[2].hash, firm90Hash, 0x10) == 0;
|
||||
}
|
||||
|
||||
//Sets the 7.x NCCH KeyX and the 6.x gamecard save data KeyY
|
||||
if(a9lhMode == NO_A9LH)
|
||||
setRSAMod0DerivedKeys();
|
||||
else if(!isA9lh) setRSAMod0DerivedKeys();
|
||||
|
||||
//Find the Process9 .code location, size and memory address
|
||||
u32 process9Size,
|
||||
@ -321,19 +294,16 @@ static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, A9LHM
|
||||
}
|
||||
|
||||
//Apply FIRM0/1 writes patches on sysNAND to protect A9LH
|
||||
else if(a9lhMode != NO_A9LH) patchFirmWrites(process9Offset, process9Size);
|
||||
else if(isA9lh) patchFirmWrites(process9Offset, process9Size);
|
||||
|
||||
//Apply firmlaunch patches, not on 9.0 FIRM as it breaks firmlaunchhax
|
||||
if(!is90Firm || a9lhMode == A9LH_WITH_SFIRM_FIRMPROT) patchFirmlaunches(process9Offset, process9Size, process9MemAddr);
|
||||
patchFirmlaunches(process9Offset, process9Size, process9MemAddr);
|
||||
|
||||
if(!is90Firm)
|
||||
{
|
||||
//Apply anti-anti-DG patches for >= 11.0 firmwares
|
||||
patchTitleInstallMinVersionCheck(process9Offset, process9Size);
|
||||
//Apply anti-anti-DG patches for >= 11.0 firmwares
|
||||
patchTitleInstallMinVersionCheck(process9Offset, process9Size);
|
||||
|
||||
//Does nothing if svcBackdoor is still there
|
||||
reimplementSvcBackdoor((u8 *)firm + section[1].offset, section[1].size);
|
||||
}
|
||||
//Does nothing if svcBackdoor is still there
|
||||
reimplementSvcBackdoor((u8 *)firm + section[1].offset, section[1].size);
|
||||
}
|
||||
|
||||
static inline void patchLegacyFirm(FirmwareType firmType)
|
||||
@ -341,7 +311,7 @@ static inline void patchLegacyFirm(FirmwareType firmType)
|
||||
//On N3DS, decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
|
||||
if(isN3DS)
|
||||
{
|
||||
arm9Loader((u8 *)firm + section[3].offset, 0);
|
||||
arm9Loader((u8 *)firm + section[3].offset);
|
||||
firm->arm9Entry = (u8 *)0x801301C;
|
||||
}
|
||||
|
||||
@ -355,7 +325,7 @@ static inline void patchSafeFirm(void)
|
||||
if(isN3DS)
|
||||
{
|
||||
//Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
|
||||
arm9Loader(arm9Section, 0);
|
||||
arm9Loader(arm9Section);
|
||||
firm->arm9Entry = (u8 *)0x801B01C;
|
||||
|
||||
patchFirmWrites(arm9Section, section[2].size);
|
||||
|
@ -53,15 +53,8 @@ typedef enum ConfigurationStatus
|
||||
CREATE_CONFIGURATION = 2
|
||||
} ConfigurationStatus;
|
||||
|
||||
typedef enum A9LHMode
|
||||
{
|
||||
NO_A9LH = 0,
|
||||
A9LH_WITH_NFIRM_FIRMPROT = 1,
|
||||
A9LH_WITH_SFIRM_FIRMPROT = 2
|
||||
} A9LHMode;
|
||||
|
||||
static inline void loadFirm(FirmwareType firmType, bool externalFirm);
|
||||
static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, A9LHMode a9lhMode);
|
||||
static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, bool isA9lh);
|
||||
static inline void patchLegacyFirm(FirmwareType firmType);
|
||||
static inline void patchSafeFirm(void);
|
||||
static inline void copySection0AndInjectLoader(void);
|
||||
|
@ -141,9 +141,9 @@ void clearScreens(void)
|
||||
invokeArm11Function(ARM11);
|
||||
}
|
||||
|
||||
u32 initScreens(void)
|
||||
bool initScreens(void)
|
||||
{
|
||||
u32 needToInit = PDN_GPU_CNT == 1;
|
||||
bool needToInit = PDN_GPU_CNT == 1;
|
||||
|
||||
void __attribute__((naked)) ARM11(void)
|
||||
{
|
||||
|
@ -42,4 +42,4 @@ static volatile struct fb {
|
||||
void deinitScreens(void);
|
||||
void updateBrightness(u32 brightnessIndex);
|
||||
void clearScreens(void);
|
||||
u32 initScreens(void);
|
||||
bool initScreens(void);
|
Reference in New Issue
Block a user