From efd83e063e0b31e47a2778cc0fca5af201f80255 Mon Sep 17 00:00:00 2001 From: Aurora Date: Mon, 18 Jul 2016 15:32:32 +0200 Subject: [PATCH] Remove code to skip the rbeoot patch on 9.0 as it is not needed anymore with A9LH and constitutes a brick risk --- source/crypto.c | 30 +++++++++++++++++----- source/crypto.h | 2 +- source/firm.c | 68 ++++++++++++++----------------------------------- source/firm.h | 9 +------ source/screen.c | 4 +-- source/screen.h | 2 +- 6 files changed, 47 insertions(+), 68 deletions(-) diff --git a/source/crypto.c b/source/crypto.c index 885bbc1..589fbc8 100755 --- a/source/crypto.c +++ b/source/crypto.c @@ -374,14 +374,30 @@ void decryptExeFs(u8 *inbuf) aes(inbuf - 0x200, exeFsOffset, exeFsSize / AES_BLOCK_SIZE, ncchCTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL); } -//ARM9Loader replacement -//Originally adapted from: https://github.com/Reisyukaku/ReiNand/blob/228c378255ba693133dec6f3368e14d386f2cde7/source/crypto.c#L233 -void arm9Loader(u8 *arm9Section, u32 mode) +/* ARM9Loader replacement + Originally adapted from: https://github.com/Reisyukaku/ReiNand/blob/228c378255ba693133dec6f3368e14d386f2cde7/source/crypto.c#L233 */ +void arm9Loader(u8 *arm9Section) { + //Determine the arm9loader version + u32 a9lVersion; + + switch(arm9Section[0x53]) + { + case 0xFF: + a9lVersion = 0; + break; + case '1': + a9lVersion = 1; + break; + default: + a9lVersion = 2; + break; + } + //Firm keys u8 keyY[0x10], arm9BinCTR[0x10], - arm9BinSlot = mode ? 0x16 : 0x15; + arm9BinSlot = a9lVersion ? 0x16 : 0x15; //Setup keys needed for arm9bin decryption memcpy(keyY, arm9Section + 0x10, 0x10); @@ -393,13 +409,13 @@ void arm9Loader(u8 *arm9Section, u32 mode) for(u8 *tmp = arm9Section + 0x30; *tmp; tmp++) arm9BinSize = (arm9BinSize << 3) + (arm9BinSize << 1) + *tmp - '0'; - if(mode) + if(a9lVersion) { const u8 key1[0x10] = {0x07, 0x29, 0x44, 0x38, 0xF8, 0xC9, 0x75, 0x93, 0xAA, 0x0E, 0x4A, 0xB4, 0xAE, 0x84, 0xC1, 0xD8}, key2[0x10] = {0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0}; u8 keyX[0x10]; - aes_setkey(0x11, mode == 2 ? key2 : key1, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL); + aes_setkey(0x11, a9lVersion == 2 ? key2 : key1, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL); aes_use_keyslot(0x11); aes(keyX, arm9Section + 0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0); aes_setkey(arm9BinSlot, keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL); @@ -413,7 +429,7 @@ void arm9Loader(u8 *arm9Section, u32 mode) aes(arm9Section + 0x800, arm9Section + 0x800, arm9BinSize / AES_BLOCK_SIZE, arm9BinCTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL); //Set >=9.6 KeyXs - if(mode == 2) + if(a9lVersion == 2) { u8 keyData[0x10] = {0xDD, 0xDA, 0xA4, 0xC6, 0x2C, 0xC4, 0x50, 0xE9, 0xDA, 0xB6, 0x9B, 0x0D, 0x9D, 0x2A, 0x21, 0x98}, decKey[0x10]; diff --git a/source/crypto.h b/source/crypto.h index 8866821..8872b0b 100755 --- a/source/crypto.h +++ b/source/crypto.h @@ -107,4 +107,4 @@ void ctrNandInit(void); u32 ctrNandRead(u32 sector, u32 sectorCount, u8 *outbuf); void setRSAMod0DerivedKeys(void); void decryptExeFs(u8 *inbuf); -void arm9Loader(u8 *arm9Section, u32 mode); \ No newline at end of file +void arm9Loader(u8 *arm9Section); \ No newline at end of file diff --git a/source/firm.c b/source/firm.c index b6274a0..7b089a2 100755 --- a/source/firm.c +++ b/source/firm.c @@ -47,6 +47,7 @@ FirmwareSource firmSource; void main(void) { bool isFirmlaunch, + isA9lh, updatedSys; u32 newConfig, @@ -56,7 +57,6 @@ void main(void) FirmwareType firmType; FirmwareSource nandType; ConfigurationStatus needConfig; - A9LHMode a9lhMode; //Detect the console being used isN3DS = PDN_MPCORE_CFG == 7; @@ -81,8 +81,8 @@ void main(void) nandType = (FirmwareSource)BOOTCONFIG(0, 3); firmSource = (FirmwareSource)BOOTCONFIG(2, 1); - a9lhMode = (A9LHMode)BOOTCONFIG(3, 1); - updatedSys = a9lhMode != NO_A9LH && CONFIG(1); + isA9lh = BOOTCONFIG(3, 1) != 0; + updatedSys = isA9lh && CONFIG(1); } else { @@ -98,16 +98,16 @@ void main(void) //Determine if A9LH is installed and the user has an updated sysNAND if(a9lhBoot || CONFIG(2)) { - a9lhMode = A9LH_WITH_NFIRM_FIRMPROT; + isA9lh = true; updatedSys = CONFIG(1); } else { - a9lhMode = NO_A9LH; + isA9lh = false; updatedSys = false; } - newConfig = (u32)a9lhMode << 3; + newConfig = (u32)isA9lh << 3; //If it's a MCU reboot, try to force boot options if(a9lhBoot && CFG_BOOTENV) @@ -149,9 +149,8 @@ void main(void) pressed = HID_PAD; } - if(needConfig != DONT_CONFIGURE && pressed == SAFE_MODE) + if(a9lhBoot && !CFG_BOOTENV && pressed == SAFE_MODE) { - a9lhMode = A9LH_WITH_SFIRM_FIRMPROT; nandType = FIRMWARE_SYSNAND; firmSource = FIRMWARE_SYSNAND; needConfig = DONT_CONFIGURE; @@ -224,7 +223,7 @@ void main(void) switch(firmType) { case NATIVE_FIRM: - patchNativeFirm(nandType, emuHeader, a9lhMode); + patchNativeFirm(nandType, emuHeader, isA9lh); break; case SAFE_FIRM: patchSafeFirm(); @@ -265,45 +264,19 @@ static inline void loadFirm(FirmwareType firmType, bool externalFirm) } } -static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, A9LHMode a9lhMode) +static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, bool isA9lh) { u8 *arm9Section = (u8 *)firm + section[2].offset; - bool is90Firm; - if(isN3DS) { - u32 a9lVersion; - - //Determine the NATIVE_FIRM/arm9loader version - switch(arm9Section[0x53]) - { - case 0xFF: - a9lVersion = 0; - break; - case '1': - a9lVersion = 1; - break; - default: - a9lVersion = 2; - break; - } - //Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader - arm9Loader(arm9Section, a9lVersion); + arm9Loader(arm9Section); firm->arm9Entry = (u8 *)0x801B01C; - is90Firm = a9lVersion == 0; - } - else - { - //Determine if we're booting the 9.0 FIRM - u8 firm90Hash[0x10] = {0x27, 0x2D, 0xFE, 0xEB, 0xAF, 0x3F, 0x6B, 0x3B, 0xF5, 0xDE, 0x4C, 0x41, 0xDE, 0x95, 0x27, 0x6A}; - is90Firm = memcmp(section[2].hash, firm90Hash, 0x10) == 0; } //Sets the 7.x NCCH KeyX and the 6.x gamecard save data KeyY - if(a9lhMode == NO_A9LH) - setRSAMod0DerivedKeys(); + else if(!isA9lh) setRSAMod0DerivedKeys(); //Find the Process9 .code location, size and memory address u32 process9Size, @@ -321,19 +294,16 @@ static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, A9LHM } //Apply FIRM0/1 writes patches on sysNAND to protect A9LH - else if(a9lhMode != NO_A9LH) patchFirmWrites(process9Offset, process9Size); + else if(isA9lh) patchFirmWrites(process9Offset, process9Size); //Apply firmlaunch patches, not on 9.0 FIRM as it breaks firmlaunchhax - if(!is90Firm || a9lhMode == A9LH_WITH_SFIRM_FIRMPROT) patchFirmlaunches(process9Offset, process9Size, process9MemAddr); + patchFirmlaunches(process9Offset, process9Size, process9MemAddr); - if(!is90Firm) - { - //Apply anti-anti-DG patches for >= 11.0 firmwares - patchTitleInstallMinVersionCheck(process9Offset, process9Size); + //Apply anti-anti-DG patches for >= 11.0 firmwares + patchTitleInstallMinVersionCheck(process9Offset, process9Size); - //Does nothing if svcBackdoor is still there - reimplementSvcBackdoor((u8 *)firm + section[1].offset, section[1].size); - } + //Does nothing if svcBackdoor is still there + reimplementSvcBackdoor((u8 *)firm + section[1].offset, section[1].size); } static inline void patchLegacyFirm(FirmwareType firmType) @@ -341,7 +311,7 @@ static inline void patchLegacyFirm(FirmwareType firmType) //On N3DS, decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader if(isN3DS) { - arm9Loader((u8 *)firm + section[3].offset, 0); + arm9Loader((u8 *)firm + section[3].offset); firm->arm9Entry = (u8 *)0x801301C; } @@ -355,7 +325,7 @@ static inline void patchSafeFirm(void) if(isN3DS) { //Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader - arm9Loader(arm9Section, 0); + arm9Loader(arm9Section); firm->arm9Entry = (u8 *)0x801B01C; patchFirmWrites(arm9Section, section[2].size); diff --git a/source/firm.h b/source/firm.h index 02a2d29..235b69d 100644 --- a/source/firm.h +++ b/source/firm.h @@ -53,15 +53,8 @@ typedef enum ConfigurationStatus CREATE_CONFIGURATION = 2 } ConfigurationStatus; -typedef enum A9LHMode -{ - NO_A9LH = 0, - A9LH_WITH_NFIRM_FIRMPROT = 1, - A9LH_WITH_SFIRM_FIRMPROT = 2 -} A9LHMode; - static inline void loadFirm(FirmwareType firmType, bool externalFirm); -static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, A9LHMode a9lhMode); +static inline void patchNativeFirm(FirmwareSource nandType, u32 emuHeader, bool isA9lh); static inline void patchLegacyFirm(FirmwareType firmType); static inline void patchSafeFirm(void); static inline void copySection0AndInjectLoader(void); diff --git a/source/screen.c b/source/screen.c index ef73a4d..f2db4d4 100644 --- a/source/screen.c +++ b/source/screen.c @@ -141,9 +141,9 @@ void clearScreens(void) invokeArm11Function(ARM11); } -u32 initScreens(void) +bool initScreens(void) { - u32 needToInit = PDN_GPU_CNT == 1; + bool needToInit = PDN_GPU_CNT == 1; void __attribute__((naked)) ARM11(void) { diff --git a/source/screen.h b/source/screen.h index 4954f63..08e59f7 100644 --- a/source/screen.h +++ b/source/screen.h @@ -42,4 +42,4 @@ static volatile struct fb { void deinitScreens(void); void updateBrightness(u32 brightnessIndex); void clearScreens(void); -u32 initScreens(void); \ No newline at end of file +bool initScreens(void); \ No newline at end of file