diff --git a/patches/reboot.s b/patches/reboot.s index d9a84e3..cedb4af 100644 --- a/patches/reboot.s +++ b/patches/reboot.s @@ -54,10 +54,13 @@ payload_maxsize equ 0x20000 ; Maximum size for the payload (200 KB will do). movne r4, #0 bne read_payload ; Go read the real payload. - add r0, sp, #0x3A8 - 0x70 - ldr r0, [r0, #0x27] + ; Copy the last digits of the wanted firm to the 5th byte of the payload + add r2, sp, #0x3A8 - 0x70 + ldr r0, [r2, #0x27] ldr r1, =payload_addr + 4 - str r0, [r1] ; Copy the last digits of the wanted firm to the 5th byte of the payload. + str r0, [r1] + ldr r0, [r2, #0x2B] + str r0, [r1, #4] ; Set kernel state mov r0, #0 diff --git a/source/firm.c b/source/firm.c index 0c41b1e..4cce1f8 100755 --- a/source/firm.c +++ b/source/firm.c @@ -28,26 +28,22 @@ void main(void) u32 bootType, firmType, nandType, - a9lhInstalled, + a9lhMode, updatedSys, needConfig, newConfig, emuHeader; //Detect the console being used - console = (PDN_MPCORE_CFG == 1) ? 0 : 1; + console = PDN_MPCORE_CFG == 7; //Mount filesystems. CTRNAND will be mounted only if/when needed mountFs(); - //Attempt to read the configuration file const char configPath[] = "/luma/config.bin"; - if(!fileRead(&config, configPath, 4)) needConfig = 1; - else - { - config = 0; - needConfig = 2; - } + + //Attempt to read the configuration file + needConfig = !fileRead(&config, configPath, 4) ? 1 : 2; //Determine if this is a firmlaunch boot if(*(vu8 *)0x23F00005) @@ -57,83 +53,89 @@ void main(void) bootType = 1; //'0' = NATIVE_FIRM, '1' = TWL_FIRM, '2' = AGB_FIRM - firmType = *(vu8 *)0x23F00005 - '0'; + firmType = *(vu8 *)0x23F00009 == '3' ? 3 : *(vu8 *)0x23F00005 - '0'; nandType = BOOTCONFIG(0, 3); firmSource = BOOTCONFIG(2, 1); - a9lhInstalled = BOOTCONFIG(3, 1); - updatedSys = (a9lhInstalled && CONFIG(1)) ? 1 : 0; + a9lhMode = BOOTCONFIG(3, 1); + updatedSys = (a9lhMode && CONFIG(1)) ? 1 : 0; } else { + //Get pressed buttons + u32 pressed = HID_PAD; + + //If no configuration file exists or SELECT is held, load configuration menu + if(needConfig == 2 || (pressed & BUTTON_SELECT)) + configureCFW(configPath); + bootType = 0; firmType = 0; //Determine if booting with A9LH - u32 a9lhBoot = !PDN_SPI_CNT ? 1 : 0; - - //Retrieve the last booted FIRM - u32 previousFirm = CFG_BOOTENV; - - //Get pressed buttons - u32 pressed = HID_PAD; + u32 a9lhBoot = !PDN_SPI_CNT; //Determine if A9LH is installed and the user has an updated sysNAND if(a9lhBoot || CONFIG(2)) { - if(pressed == SAFE_MODE) - error("Using Safe Mode would brick you, or remove A9LH!"); - - a9lhInstalled = 1; - - //Check setting for > 9.2 sysNAND + a9lhMode = 1; updatedSys = CONFIG(1); } else { - a9lhInstalled = 0; + a9lhMode = 0; updatedSys = 0; } - newConfig = a9lhInstalled << 3; + newConfig = a9lhMode << 3; - /* If booting with A9LH, it's a MCU reboot and a previous configuration exists, - try to force boot options */ - if(a9lhBoot && previousFirm && needConfig == 1) + if(a9lhBoot) { - //Always force a sysNAND boot when quitting AGB_FIRM - if(previousFirm == 7) - { - nandType = 0; - firmSource = updatedSys ? 0 : BOOTCONFIG(2, 1); - needConfig = 0; + //Retrieve the last booted FIRM + u32 previousFirm = CFG_BOOTENV; - //Flag to prevent multiple boot options-forcing - newConfig |= 1 << 4; - } - /* Else, force the last used boot options unless a payload button or A/L/R are pressed - or the no-forcing flag is set */ - else if(!(pressed & OVERRIDE_BUTTONS) && !BOOTCONFIG(4, 1)) + //If it's a MCU reboot, try to force boot options + if(previousFirm) { - nandType = BOOTCONFIG(0, 3); - firmSource = BOOTCONFIG(2, 1); - needConfig = 0; + //Always force a sysNAND boot when quitting AGB_FIRM + if(previousFirm == 7) + { + nandType = 0; + firmSource = updatedSys ? 0 : BOOTCONFIG(2, 1); + needConfig--; + + //Flag to prevent multiple boot options-forcing + newConfig |= 1 << 4; + } + + /* Else, force the last used boot options unless a payload button or A/L/R are pressed + or the no-forcing flag is set */ + else if(!(pressed & OVERRIDE_BUTTONS) && !BOOTCONFIG(4, 1)) + { + nandType = BOOTCONFIG(0, 3); + firmSource = BOOTCONFIG(2, 1); + needConfig--; + } + } + + //If the SAFE MODE combo is held, force a sysNAND boot + else if(pressed == SAFE_MODE) + { + a9lhMode++; + nandType = 0; + firmSource = 0; + needConfig--; } } //Boot options aren't being forced if(needConfig) { - /* If L and R/Select or one of the single payload buttons are pressed and, if not using A9LH, - the Safe Mode combo is not pressed, chainload an external payload */ - if(((pressed & SINGLE_PAYLOAD_BUTTONS) || ((pressed & BUTTON_L1) && (pressed & L_PAYLOAD_BUTTONS))) - && pressed != SAFE_MODE) + /* If L and R/A/Select or one of the single payload buttons are pressed, + chainload an external payload */ + if((pressed & SINGLE_PAYLOAD_BUTTONS) || ((pressed & BUTTON_L1) && (pressed & L_PAYLOAD_BUTTONS))) loadPayload(pressed); - //If no configuration file exists or SELECT is held, load configuration menu - if(needConfig == 2 || (pressed & BUTTON_SELECT)) - configureCFW(configPath); - //If screens are inited or the corresponding option is set, load splash screen if(PDN_GPU_CNT != 1 || CONFIG(7)) loadSplash(); @@ -186,8 +188,18 @@ void main(void) loadFirm(firmType, !firmType && updatedSys == !firmSource); - if(!firmType) patchNativeFirm(nandType, emuHeader, a9lhInstalled); - else patchTwlAgbFirm(firmType); + switch(firmType) + { + case 0: + patchNativeFirm(nandType, emuHeader, a9lhMode); + break; + case 3: + patchSafeFirm(); + break; + default: + patchLegacyFirm(firmType); + break; + } launchFirm(bootType); } @@ -204,16 +216,17 @@ static inline void loadFirm(u32 firmType, u32 externalFirm) doesn't match the console, load FIRM from CTRNAND */ if(!externalFirmLoaded) { - const char *firmFolders[3][2] = {{ "00000002", "20000002" }, + const char *firmFolders[4][2] = {{ "00000002", "20000002" }, { "00000102", "20000102" }, - { "00000202", "20000202" }}; + { "00000202", "20000202" }, + { "00000003", "20000003" }}; firmRead(firm, firmFolders[firmType][console]); decryptExeFs((u8 *)firm); } } -static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhInstalled) +static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhMode) { u8 *arm9Section = (u8 *)firm + section[2].offset; @@ -235,7 +248,7 @@ static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhInstalle nativeFirmType = (memcmp(section[2].hash, firm90Hash, 0x10) == 0) ? 0 : 1; } - if(nativeFirmType || nandType) + if(nativeFirmType || nandType || a9lhMode == 2) { //Find the Process9 NCCH location u8 *proc9Offset = getProc9(arm9Section, section[2].size); @@ -244,16 +257,11 @@ static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhInstalle if(nandType) patchEmuNAND(arm9Section, proc9Offset, emuHeader); //Apply FIRM reboot patches, not on 9.0 FIRM as it breaks firmlaunchhax - if(nativeFirmType) patchReboots(arm9Section, proc9Offset); + if(nativeFirmType || a9lhMode == 2) patchReboots(arm9Section, proc9Offset); } //Apply FIRM0/1 writes patches on sysNAND to protect A9LH - if(a9lhInstalled && !nandType) - { - u16 *writeOffset = getFirmWrite(arm9Section, section[2].size); - *writeOffset = writeBlock[0]; - *(writeOffset + 1) = writeBlock[1]; - } + if(a9lhMode && !nandType) patchFirmWrites(arm9Section, 1); //Apply signature checks patches u32 sigOffset, @@ -340,7 +348,7 @@ static inline void injectLoader(void) } } -static inline void patchTwlAgbFirm(u32 firmType) +static inline void patchLegacyFirm(u32 firmType) { //On N3DS, decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader if(console) @@ -388,6 +396,37 @@ static inline void patchTwlAgbFirm(u32 firmType) } } +static inline void patchSafeFirm(void) +{ + u8 *arm9Section = (u8 *)firm + section[2].offset; + + if(console) + { + //Decrypt ARM9Bin and patch ARM9 entrypoint to skip arm9loader + arm9Loader(arm9Section, 0); + firm->arm9Entry = (u8 *)0x801B01C; + } + + //Apply FIRM0/1 writes patches to protect A9LH + patchFirmWrites(arm9Section, console); +} + +static void patchFirmWrites(u8 *arm9Section, u32 mode) +{ + if(mode) + { + u16 *writeOffset = getFirmWrite(arm9Section, section[2].size); + *writeOffset = writeBlock[0]; + *(writeOffset + 1) = writeBlock[1]; + } + else + { + u16 *writeOffset = getFirmWriteSafe(arm9Section, section[2].size); + *writeOffset = writeBlockSafe[0]; + *(writeOffset + 1) = writeBlockSafe[1]; + } +} + static inline void launchFirm(u32 bootType) { //Copy FIRM sections to respective memory locations diff --git a/source/firm.h b/source/firm.h index 9d8b7b9..3786460 100644 --- a/source/firm.h +++ b/source/firm.h @@ -37,9 +37,11 @@ typedef struct patchData { } patchData; static inline void loadFirm(u32 firmType, u32 externalFirm); -static inline void patchNativeFirm(u32 emuNAND, u32 emuHeader, u32 a9lhSetup); +static inline void patchNativeFirm(u32 nandType, u32 emuHeader, u32 a9lhMode); static inline void patchEmuNAND(u8 *arm9Section, u8 *proc9Offset, u32 emuHeader); static inline void patchReboots(u8 *arm9Section, u8 *proc9Offset); static inline void injectLoader(void); -static inline void patchTwlAgbFirm(u32 firmType); +static inline void patchLegacyFirm(u32 firmType); +static inline void patchSafeFirm(void); +static void patchFirmWrites(u8 *arm9Section, u32 mode); static inline void launchFirm(u32 bootType); \ No newline at end of file diff --git a/source/patches.c b/source/patches.c index 94897c0..2938b49 100644 --- a/source/patches.c +++ b/source/patches.c @@ -13,7 +13,8 @@ const u32 mpuPatch[3] = {0x00360003, 0x00200603, 0x001C0603}; const u16 nandRedir[2] = {0x4C00, 0x47A0}, sigPatch[2] = {0x2000, 0x4770}, - writeBlock[2] = {0x2000, 0x46C0}; + writeBlock[2] = {0x2000, 0x46C0}, + writeBlockSafe[2] = {0x2400, 0xE01D}; /************************************************** * Functions @@ -63,6 +64,14 @@ u16 *getFirmWrite(u8 *pos, u32 size) return (u16 *)memsearch(off - 0x100, pattern, 0x100, 4); } +u16 *getFirmWriteSafe(u8 *pos, u32 size) +{ + //Look for FIRM writing code + const u8 pattern[] = {0x04, 0x1E, 0x1D, 0xDB}; + + return (u16 *)memsearch(pos, pattern, size, 4); +} + void *getLoader(u8 *pos, u32 size, u32 *loaderSize) { u8 *const off = memsearch(pos, "loade", size, 5); diff --git a/source/patches.h b/source/patches.h index 6e48a42..f31c400 100644 --- a/source/patches.h +++ b/source/patches.h @@ -12,7 +12,8 @@ const u32 mpuPatch[3]; const u16 nandRedir[2], sigPatch[2], - writeBlock[2]; + writeBlock[2], + writeBlockSafe[2]; /************************************************** * Functions @@ -22,4 +23,5 @@ void getSigChecks(u8 *pos, u32 size, u32 *off, u32 *off2); void *getReboot(u8 *pos, u32 size); u32 getfOpen(u8 *proc9Offset, void *rebootOffset); u16 *getFirmWrite(u8 *pos, u32 size); +u16 *getFirmWriteSafe(u8 *pos, u32 size); void *getLoader(u8 *pos, u32 size, u32 *loaderSize); \ No newline at end of file diff --git a/source/start.s b/source/start.s index df72b5a..44759a4 100644 --- a/source/start.s +++ b/source/start.s @@ -4,7 +4,7 @@ _start: b start - .word 0 + .word 0, 0 start: @ Change the stack pointer diff --git a/source/utils.c b/source/utils.c index 48aa308..17324d8 100644 --- a/source/utils.c +++ b/source/utils.c @@ -3,8 +3,6 @@ */ #include "utils.h" -#include "screeninit.h" -#include "draw.h" #include "i2c.h" #include "buttons.h" @@ -35,27 +33,8 @@ u32 waitInput(void) return key; } -void mcuShutDown(void) -{ - i2cWriteRegister(I2C_DEV_MCU, 0x20, 1); - while(1); -} - void mcuReboot(void) { i2cWriteRegister(I2C_DEV_MCU, 0x20, 1 << 2); while(1); -} - -void error(const char *message) -{ - initScreens(); - - drawString("An error has occurred:", 10, 10, COLOR_RED); - int posY = drawString(message, 10, 30, COLOR_WHITE); - drawString("Press any button to shutdown", 10, posY + 2 * SPACING_Y, COLOR_WHITE); - - waitInput(); - - mcuShutDown(); } \ No newline at end of file diff --git a/source/utils.h b/source/utils.h index f5691d7..e0417ce 100644 --- a/source/utils.h +++ b/source/utils.h @@ -7,6 +7,4 @@ #include "types.h" u32 waitInput(void); -void mcuShutDown(void); -void mcuReboot(void); -void error(const char *message); \ No newline at end of file +void mcuReboot(void); \ No newline at end of file