LowLevel/Luma3DS-3GX
Archived
1
0
Fork 0
Code Issues Pull Requests Releases 2 Wiki Activity

Code refactoring, added support for SAFE_MODE FIRM on A9LH (you can update safely from it now). Thanks to delebile for the O3DS SAFE_MODE FIRM FIRM0/1 protection!

Browse Source
This commit is contained in:
Aurora 2016-05-03 01:17:22 +02:00
parent 95d06c115a
commit fef48a449a
8 changed files with 131 additions and 99 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
patches/reboot.s
View File

@ -54,10 +54,13 @@ payload_maxsize equ 0x20000 ; Maximum size for the payload (200 KB will do).
movne r4, #0
bne read_payload ; Go read the real payload.
add r0, sp, #0x3A8 - 0x70
ldr r0, [r0, #0x27]
; Copy the last digits of the wanted firm to the 5th byte of the payload
add r2, sp, #0x3A8 - 0x70
ldr r0, [r2, #0x27]
ldr r1, =payload_addr + 4
str r0, [r1] ; Copy the last digits of the wanted firm to the 5th byte of the payload.
str r0, [r1]
ldr r0, [r2, #0x2B]
str r0, [r1, #4]
; Set kernel state
mov r0, #0

173
source/firm.c
View File

@ -28,26 +28,22 @@ void main(void)
u32 bootType,
firmType,
nandType,
a9lhInstalled,
a9lhMode,
updatedSys,
needConfig,
newConfig,
emuHeader;
//Detect the console being used
console = (PDN_MPCORE_CFG == 1) ? 0 : 1;
console = PDN_MPCORE_CFG == 7;
//Mount filesystems. CTRNAND will be mounted only if/when needed
mountFs();
//Attempt to read the configuration file
const char configPath[] = "/luma/config.bin";
if(!fileRead(&config, configPath, 4)) needConfig = 1;
else
{
config = 0;
needConfig = 2;
}
//Attempt to read the configuration file
needConfig = !fileRead(&config, configPath, 4) ? 1 : 2;
//Determine if this is a firmlaunch boot
if(*(vu8 *)0x23F00005)
@ -57,83 +53,89 @@ void main(void)
bootType = 1;
//'0' = NATIVE_FIRM, '1' = TWL_FIRM, '2' = AGB_FIRM
firmType = *(vu8 *)0x23F00005 - '0';
firmType = *(vu8 *)0x23F00009 == '3' ? 3 : *(vu8 *)0x23F00005 - '0';
nandType = BOOTCONFIG(0, 3);
firmSource = BOOTCONFIG(2, 1);
a9lhInstalled = BOOTCONFIG(3, 1);
updatedSys = (a9lhInstalled && CONFIG(1)) ? 1 : 0;
a9lhMode = BOOTCONFIG(3, 1);
updatedSys = (a9lhMode && CONFIG(1)) ? 1 : 0;
}
else
{
//Get pressed buttons
u32 pressed = HID_PAD;
//If no configuration file exists or SELECT is held, load configuration menu
if(needConfig == 2 || (pressed & BUTTON_SELECT))
configureCFW(configPath);
bootType = 0;
firmType = 0;
//Determine if booting with A9LH
u32 a9lhBoot = !PDN_SPI_CNT ? 1 : 0;
//Retrieve the last booted FIRM
u32 previousFirm = CFG_BOOTENV;
//Get pressed buttons
u32 pressed = HID_PAD;
u32 a9lhBoot = !PDN_SPI_CNT;
//Determine if A9LH is installed and the user has an updated sysNAND
if(a9lhBoot || CONFIG(2))
{
if(pressed == SAFE_MODE)
error("Using Safe Mode would brick you, or remove A9LH!");
a9lhInstalled = 1;
//Check setting for > 9.2 sysNAND
a9lhMode = 1;
updatedSys = CONFIG(1);
}
else
{
a9lhInstalled = 0;
a9lhMode = 0;
updatedSys = 0;
}
newConfig = a9lhInstalled << 3;
newConfig = a9lhMode << 3;
/* If booting with A9LH, it's a MCU reboot and a previous configuration exists,
try to force boot options */
if(a9lhBoot && previousFirm && needConfig == 1)
if(a9lhBoot)
{
//Always force a sysNAND boot when quitting AGB_FIRM
if(previousFirm == 7)
{
nandType = 0;
firmSource = updatedSys ? 0 : BOOTCONFIG(2, 1);
needConfig = 0;
//Retrieve the last booted FIRM
u32 previousFirm = CFG_BOOTENV;
//Flag to prevent multiple boot options-forcing
newConfig |= 1 << 4;
}
/* Else, force the last used boot options unless a payload button or A/L/R are pressed
or the no-forcing flag is set */
else if(!(pressed & OVERRIDE_BUTTONS) && !BOOTCONFIG(4, 1))
//If it's a MCU reboot, try to force boot options
if(previousFirm)
{
nandType = BOOTCONFIG(0, 3);
firmSource = BOOTCONFIG(2, 1);
needConfig = 0;
//Always force a sysNAND boot when quitting AGB_FIRM
if(previousFirm == 7)
{
nandType = 0;
firmSource = updatedSys ? 0 : BOOTCONFIG(2, 1);
needConfig--;
//Flag to prevent multiple boot options-forcing
newConfig |= 1 << 4;
}
/* Else, force the last used boot options unless a payload button or A/L/R are pressed
or the no-forcing flag is set */
else if(!(pressed & OVERRIDE_BUTTONS) && !BOOTCONFIG(4, 1))
{
nandType = BOOTCONFIG(0, 3);
firmSource = BOOTCONFIG(2, 1);
needConfig--;
}
}
//If the SAFE MODE combo is held, force a sysNAND boot
else if(pressed == SAFE_MODE)
{
a9lhMode++;
nandType = 0;
firmSource = 0;
needConfig--;
}
}
//Boot options aren't being forced
if(needConfig)
{
/* If L and R/Select or one of the single payload buttons are pressed and, if not using A9LH,
the Safe Mode combo is not pressed, chainload an external payload */
if(((pressed & SINGLE_PAYLOAD_BUTTONS) || ((pressed & BUTTON_L1) && (pressed & L_PAYLOAD_BUTTONS)))
&& pressed != SAFE_MODE)
/* If L and R/A/Select or one of the single payload buttons are pressed,
chainload an external payload */
if((pressed & SINGLE_PAYLOAD_BUTTONS) || ((pressed & BUTTON_L1) && (pressed & L_PAYLOAD_BUTTONS)))
loadPayload(pressed);
//If no configuration file exists or SELECT is held, load configuration menu
if(needConfig == 2 || (pressed & BUTTON_SELECT))
configureCFW(configPath);
//If screens are inited or the corresponding option is set, load splash screen
if(PDN_GPU_CNT != 1 || CONFIG(7)) loadSplash();
@ -186,8 +188,18 @@ void main(void)
loadFirm(firmType, !firmType && updatedSys == !firmSource);
if(!firmType) patchNativeFirm(nandType, emuHeader, a9lhInstalled);
else patchTwlAgbFirm(firmType);
switch(firmType)
{
case 0:
patchNativeFirm(nandType, emuHeader, a9lhMode);
break;
case 3:
patchSafeFirm();
break;
default:
patchLegacyFirm(firmType);
break;
}
launchFirm(bootType);
}
@ -204,16 +216,17 @@ static inline void loadFirm(u32 firmType, u32 externalFirm)
doesn't match the console, load FIRM from CTRNAND */
if(!externalFirmLoaded)
{
const char *firmFolders[3][2] = {{ "00000002", "20000002" },
const char *firmFolders[4][2] = {{ "00000002", "20000002" },
{ "00000102", "20000102" },
{ "00000202", "20000202" }};
{ "00000202", "20000202" },
{ "00000003", "20000003" }};
firmRead(firm, firmFolders[firmType][console]);
decryptExeFs((u8 *)firm);
}
}
static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhInstalled)
static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhMode)
{
u8 *arm9Section = (u8 *)firm + section[2].offset;
@ -235,7 +248,7 @@ static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhInstalle
nativeFirmType = (memcmp(section[2].hash, firm90Hash, 0x10) == 0) ? 0 : 1;
}
if(nativeFirmType || nandType)
if(nativeFirmType || nandType || a9lhMode == 2)
{
//Find the Process9 NCCH location
u8 *proc9Offset = getProc9(arm9Section, section[2].size);
@ -244,16 +257,11 @@ static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhInstalle
if(nandType) patchEmuNAND(arm9Section, proc9Offset, emuHeader);
//Apply FIRM reboot patches, not on 9.0 FIRM as it breaks firmlaunchhax
if(nativeFirmType) patchReboots(arm9Section, proc9Offset);
if(nativeFirmType || a9lhMode == 2) patchReboots(arm9Section, proc9Offset);
}
//Apply FIRM0/1 writes patches on sysNAND to protect A9LH
if(a9lhInstalled && !nandType)
{
u16 *writeOffset = getFirmWrite(arm9Section, section[2].size);
*writeOffset = writeBlock[0];
*(writeOffset + 1) = writeBlock[1];
}
if(a9lhMode && !nandType) patchFirmWrites(arm9Section, 1);
//Apply signature checks patches
u32 sigOffset,
@ -340,7 +348,7 @@ static inline void injectLoader(void)
}
}
static inline void patchTwlAgbFirm(u32 firmType)
static inline void patchLegacyFirm(u32 firmType)
{
//On N3DS, decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
if(console)
@ -388,6 +396,37 @@ static inline void patchTwlAgbFirm(u32 firmType)
}
}
static inline void patchSafeFirm(void)
{
u8 *arm9Section = (u8 *)firm + section[2].offset;
if(console)
{
//Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader
arm9Loader(arm9Section, 0);
firm->arm9Entry = (u8 *)0x801B01C;
}
//Apply FIRM0/1 writes patches to protect A9LH
patchFirmWrites(arm9Section, console);
}
static void patchFirmWrites(u8 *arm9Section, u32 mode)
{
if(mode)
{
u16 *writeOffset = getFirmWrite(arm9Section, section[2].size);
*writeOffset = writeBlock[0];
*(writeOffset + 1) = writeBlock[1];
}
else
{
u16 *writeOffset = getFirmWriteSafe(arm9Section, section[2].size);
*writeOffset = writeBlockSafe[0];
*(writeOffset + 1) = writeBlockSafe[1];
}
}
static inline void launchFirm(u32 bootType)
{
//Copy FIRM sections to respective memory locations

6
source/firm.h
View File

@ -37,9 +37,11 @@ typedef struct patchData {
} patchData;
static inline void loadFirm(u32 firmType, u32 externalFirm);
static inline void patchNativeFirm(u32 emuNAND, u32 emuHeader, u32 a9lhSetup);
static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhMode);
static inline void patchEmuNAND(u8 *arm9Section, u8 *proc9Offset, u32 emuHeader);
static inline void patchReboots(u8 *arm9Section, u8 *proc9Offset);
static inline void injectLoader(void);
static inline void patchTwlAgbFirm(u32 firmType);
static inline void patchLegacyFirm(u32 firmType);
static inline void patchSafeFirm(void);
static void patchFirmWrites(u8 *arm9Section, u32 mode);
static inline void launchFirm(u32 bootType);

11
source/patches.c
View File

@ -13,7 +13,8 @@ const u32 mpuPatch[3] = {0x00360003, 0x00200603, 0x001C0603};
const u16 nandRedir[2] = {0x4C00, 0x47A0},
sigPatch[2] = {0x2000, 0x4770},
writeBlock[2] = {0x2000, 0x46C0};
writeBlock[2] = {0x2000, 0x46C0},
writeBlockSafe[2] = {0x2400, 0xE01D};
/**************************************************
* Functions
@ -63,6 +64,14 @@ u16 *getFirmWrite(u8 *pos, u32 size)
return (u16 *)memsearch(off - 0x100, pattern, 0x100, 4);
}
u16 *getFirmWriteSafe(u8 *pos, u32 size)
{
//Look for FIRM writing code
const u8 pattern[] = {0x04, 0x1E, 0x1D, 0xDB};
return (u16 *)memsearch(pos, pattern, size, 4);
}
void *getLoader(u8 *pos, u32 size, u32 *loaderSize)
{
u8 *const off = memsearch(pos, "loade", size, 5);

4
source/patches.h
View File

@ -12,7 +12,8 @@
const u32 mpuPatch[3];
const u16 nandRedir[2],
sigPatch[2],
writeBlock[2];
writeBlock[2],
writeBlockSafe[2];
/**************************************************
* Functions
@ -22,4 +23,5 @@ void getSigChecks(u8 *pos, u32 size, u32 *off, u32 *off2);
void *getReboot(u8 *pos, u32 size);
u32 getfOpen(u8 *proc9Offset, void *rebootOffset);
u16 *getFirmWrite(u8 *pos, u32 size);
u16 *getFirmWriteSafe(u8 *pos, u32 size);
void *getLoader(u8 *pos, u32 size, u32 *loaderSize);

2
source/start.s
View File

@ -4,7 +4,7 @@
_start:
b start
.word 0
.word 0, 0
start:
@ Change the stack pointer

21
source/utils.c
View File

@ -3,8 +3,6 @@
*/
#include "utils.h"
#include "screeninit.h"
#include "draw.h"
#include "i2c.h"
#include "buttons.h"
@ -35,27 +33,8 @@ u32 waitInput(void)
return key;
}
void mcuShutDown(void)
{
i2cWriteRegister(I2C_DEV_MCU, 0x20, 1);
while(1);
}
void mcuReboot(void)
{
i2cWriteRegister(I2C_DEV_MCU, 0x20, 1 << 2);
while(1);
}
void error(const char *message)
{
initScreens();
drawString("An error has occurred:", 10, 10, COLOR_RED);
int posY = drawString(message, 10, 30, COLOR_WHITE);
drawString("Press any button to shutdown", 10, posY + 2 * SPACING_Y, COLOR_WHITE);
waitInput();
mcuShutDown();
}

4
source/utils.h
View File

@ -7,6 +7,4 @@
#include "types.h"
u32 waitInput(void);
void mcuShutDown(void);
void mcuReboot(void);
void error(const char *message);
void mcuReboot(void);