Added flag to use a pre-patched FIRM (skips all decrypting and patching)

Original patch by @Fix94

.gitignore

@@ -2,6 +2,7 @@ out
 CakeHax
 CakeBrah
 build
+data
 *.bin
 *.3dsx
 *.smdh

Makefile

@@ -24,7 +24,7 @@ dir_reboot := reboot
 dir_ninjhax := CakeBrah
 
 ASFLAGS := -mlittle-endian -mcpu=arm946e-s -march=armv5te
-CFLAGS := -Wall -Wextra -MMD -MP -marm $(ASFLAGS) -fno-builtin -fshort-wchar -std=c11 -Wno-main
+CFLAGS := -Wall -Wextra -MMD -MP -marm $(ASFLAGS) -fno-builtin -fshort-wchar -std=c11 -Wno-main -O2
 FLAGS := name=$(name).dat dir_out=$(abspath $(dir_out)) ICON=$(abspath icon.png) --no-print-directory
 
 objects_cfw = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
@@ -33,28 +33,19 @@ objects_cfw = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
 
 
 .PHONY: all
-all: launcher emunand emunando3ds reboot reboot2 rebootntr reboot2ntr ninjhax
+all: launcher a9lh emunand reboot ninjhax
 
 .PHONY: launcher
 launcher: $(dir_out)/$(name).dat 
 
-.PHONY: emunand
-emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin
+.PHONY: a9lh
+a9lh: $(dir_out)/arm9loaderhax.bin
 
-.PHONY: emunando3ds
-emunand: $(dir_out)/rei-o3ds/emunand/emunand.bin
+.PHONY: emunand
+emunand: $(dir_out)/rei/emunand/emunand.bin
 
 .PHONY: reboot
-reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin
-
-.PHONY: reboot2
-reboot: $(dir_out)/rei-o3ds/reboot/reboot2.bin
-
-.PHONY: rebootntr
-reboot: $(dir_out)/ntr-o3ds/reboot/reboot1.bin
-
-.PHONY: reboot2ntr
-reboot: $(dir_out)/ntr-o3ds/reboot/reboot2.bin
+reboot: $(dir_out)/rei/reboot/reboot.bin
 
 .PHONY: ninjhax
 ninjhax: $(dir_out)/3ds/$(name)
@@ -65,50 +56,31 @@ clean:
 	@$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean
 	rm -rf $(dir_out) $(dir_build)
 
-.PHONY: $(dir_out)/$(name).dat
-$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
+$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei
 	@$(MAKE) $(FLAGS) -C $(dir_mset) launcher
 	dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144
 
+$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei
+	@cp -av $(dir_build)/main.bin $(dir_out)/arm9loaderhax.bin
+
 $(dir_out)/3ds/$(name):
 	@mkdir -p "$(dir_out)/3ds/$(name)"
 	@$(MAKE) $(FLAGS) -C $(dir_ninjhax)
 	@mv $(dir_out)/$(name).3dsx $@
 	@mv $(dir_out)/$(name).smdh $@
 
-$(dir_out)/rei-n3ds/: $(dir_data)/firmware.bin
-	@mkdir -p "$(dir_out)/rei-n3ds"
-	@cp -av $(dir_data)/firmware.bin $@
+$(dir_out)/rei:
+	@mkdir -p "$(dir_out)/rei"
 
-$(dir_out)/rei-o3ds/: $(dir_data)/firmwareo3ds.bin
-	@mkdir -p "$(dir_out)/rei-o3ds"
-	@cp -av $(dir_data)/firmwareo3ds.bin $(dir_out)/rei-o3ds/firmware.bin
-    
-$(dir_out)/rei-n3ds/emunand/emunand.bin: $(dir_emu)/emuCode.s
+$(dir_out)/rei/emunand/emunand.bin: $(dir_emu)/emuCode.s
 	@armips $<
-	@mkdir -p "$(dir_out)/rei-n3ds/emunand"
-	@mv emunand.bin $(dir_out)/rei-n3ds/emunand
+	@mkdir -p "$(dir_out)/rei/emunand"
+	@mv emunand.bin $(dir_out)/rei/emunand
 
-$(dir_out)/rei-o3ds/emunand/emunand.bin: $(dir_emu)/emuCodeo3ds.s
+$(dir_out)/rei/reboot/reboot.bin: $(dir_reboot)/rebootCode.s
 	@armips $<
-	@mkdir -p "$(dir_out)/rei-o3ds/emunand"
-	@mv emunand.bin $(dir_out)/rei-o3ds/emunand
-
-$(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
-	@armips $<
-	@mkdir -p "$(dir_out)/rei-o3ds/reboot"
-	@mv reboot1.bin $(dir_out)/rei-o3ds/reboot
-
-$(dir_out)/rei-o3ds/reboot/reboot2.bin: $(dir_reboot)/rebootCode.s
-	@mv reboot2.bin $(dir_out)/rei-o3ds/reboot
-
-$(dir_out)/ntr-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCodeNtr.s
-	@armips $<
-	@mkdir -p "$(dir_out)/ntr-o3ds/reboot"
-	@mv reboot1.bin $(dir_out)/ntr-o3ds/reboot
-
-$(dir_out)/ntr-o3ds/reboot/reboot2.bin: $(dir_reboot)/rebootCodeNtr.s
-	@mv reboot2.bin $(dir_out)/ntr-o3ds/reboot
+	@mkdir -p "$(dir_out)/rei/reboot"
+	@mv reboot.bin $(dir_out)/rei/reboot
 
 $(dir_build)/main.bin: $(dir_build)/main.elf
 	$(OC) -S -O binary $< $@

README.md

@@ -15,9 +15,7 @@ See https://github.com/Reisyukaku/ReiNand and http://gbatemp.net/threads/reinand
 
 The FIRMs you need are here:
 
-Latest (10.4): http://www95.zippyshare.com/v/78942FBa/file.html
-
-NTR-compatible (10.2 for N3DS, 9.6 for O3DS): http://www66.zippyshare.com/v/gUbSYGfE/file.html
+http://www99.zippyshare.com/v/kEIiQl0x/file.html
 
 **Credits:**
  

emunand/emuCodeo3ds.s

@@ -1,50 +0,0 @@
-.nds
-
-sdmmc equ 0x434D4453	;dummy
-
-.create "emunand.bin", 0x0801A4C0
-.org 0x0801A4C0
-.arm
-nand_sd:
-    ; Original code that still needs to be executed.
-    mov r4, r0
-    mov r5, r1
-    mov r7, r2
-    mov r6, r3
-    ; End.
-
-    ; If we're already trying to access the SD, return.
-    ldr r2, [r0, #4]
-    ldr r1, =sdmmc
-    cmp r2, r1
-    beq nand_sd_ret
-
-    str r1, [r0, #4]  ; Set object to be SD
-    ldr r2, [r0, #8]  ; Get sector to read
-    cmp r2, #0  ; For GW compatibility, see if we're trying to read the ncsd header (sector 0)
-
-    ldr r3, =nand_offset
-    ldr r3, [r3]
-    add r2, r3  ; Add the offset to the NAND in the SD.
-
-    ldreq r3, =ncsd_header_offset
-    ldreq r3, [r3]
-    addeq r2, r3  ; If we're reading the ncsd header, add the offset of that sector.
-
-    str r2, [r0, #8]  ; Store sector to read
-
-    nand_sd_ret:
-        ; Restore registers.
-        mov r1, r5
-        mov r2, r7
-        mov r3, r6
-
-        ; Return 4 bytes behind where we got called,
-        ;   due to the offset of this function being stored there.
-        mov r0, lr
-        add r0, #4
-        bx r0
-.pool
-nand_offset:		.ascii "NAND"       ; for rednand this should be 1
-ncsd_header_offset:	.ascii "NCSD"       ; depends on nand manufacturer + emunand type (GW/RED)
-.close

reboot/rebootCode.s

@@ -1,159 +1,221 @@
 .nds
+.create "reboot.bin", 0
 
-firm_size equ 0x000EA000
-firm_addr equ 0x24000000
-fopen equ 0x08059D10
-fread equ 0x0804CC54
-pxi_wait_recv equ 0x08054134
+byteswritten equ 0x2000E000
+externalFirm equ 0x2000A000
+kernelCode equ 0x080F0000
+buffer equ 0x24000000
+fileOpen equ 0x4E45504F ;dummy
 
-.macro svc, num
-	.if isArm()
-		.word 0xEF000000 | num
-	.else
-		.if num > 0xFF
-			.error "bitch you crazu"
-		.endif
-		.halfword 0xDF00 | num
-	.endif
-.endmacro
-
-.create "reboot1.bin", 0x080849DC
-.org 0x080849DC
 .arm
-patch005:
-	ldr r0, =0x2000E000
-	mov r1, #0x200
-	mov r2, #0
-	add r1, r1, r0
-@@memset_loop:
-	str r2, [r0]
-	add r0, r0, #4
-	cmp r0, r1
-	blt @@memset_loop
-	ldr r0, =0x2000E000
-	ldr r1, =firm_fname
-	mov r2, #1
-	blx fopen
-	ldr r0, =0x2000E000
-	ldr r1, =0x2000E100
-	mov r2, #firm_addr
-	mov r3, #firm_size
-	blx fread
+//Code jumps here right after the sprintf call
+process9Reboot:
+	doPxi:
+        ldr r4, =0x44846
+		ldr r0, =0x10008000
+		readPxiLoop1:
+			ldrh r1, [r0,#4]
+			.word 0xE1B01B81	//lsls r1, r1, #0x17
+			bmi readPxiLoop1
+			ldr r0, [r0,#0xC]		
+        cmp r0, r4
+        bne doPxi
 	
-	ldr r4, =0x44846
-	blx pxi_wait_recv
-	cmp r0, r4
-	bne patch005
-	mov r2, #0
-	mov r3, r2
-	mov r1, r2
-	mov r0, r2
-	svc 0x7C
-	ldr r0, =0x80FF4FC
-	svc 0x7B
+	GetFirmPath:
+		add r0, sp, #0x3A8-0x70+0x24
+		ldr r1, [r0], #4
+		ldr r2, =0x00300030
+		cmp r1, r2
+		ldreq r1, [r0], #4
+		ldreq r2, =0x002F0032
+		cmpeq r1, r2
+		
+	OpenFirm:
+		ldreq r1, =(FileName - OpenFirm - 12)
+		addeq r1, pc
+		addne r1, sp, #0x3A8-0x70
+		ldr r0, =externalFirm
+		moveq r2, #1
+		movne r2, #0
+		str r2, [r0]
+		mov r2, #1
+		add r0, r7, #8
+		ldr r6, =fileOpen
+		blx r6
+	
+    SeekFirm:
+		ldr r0, =externalFirm
+		ldr r0, [r0]
+		cmp r0, #1
+		moveq r0, r7
+        ldreq r1, =byteswritten
+        ldreq r2, =buffer
+        ldreq r3, =0x0
+		ldreq r6, [sp,#0x3A8-0x198]
+		ldreq r6, [r6,#0x28]	//fread function stored here
+		blxeq r6
+		
+	ReadFirm:
+		mov r0, r7
+        ldr r1, =byteswritten
+        ldr r2, =buffer
+        ldr r3, =0x200000
+		ldr r6, [sp,#0x3A8-0x198]
+		ldr r6, [r6,#0x28]	//fread function stored here
+		blx r6
+
+    KernelSetState:
+        mov r2, #0
+        mov r3, r2
+        mov r1, r2
+        mov r0, r2
+        .word 0xEF00007C    //SVC 0x7C
+
+    GoToReboot:
+        ldr r0, =(KernelCodeStart - GoToReboot - 12)
+		add r0, pc
+		ldr r1, =kernelCode
+		ldr r2, =0x300
+		bl Memcpy
+		
+		ldr r0, =kernelCode
+        .word 0xEF00007B    //SVC 0x7B
+
+    InfiniteLoop:
+        b InfiniteLoop
+
+Memcpy:
+	MOV     R12, LR
+	STMFD   SP!, {R0-R4}
+	ADD     R2, R2, R0
+
+	memcpyLoop:
+		LDR     R3, [R0],#4
+		STR     R3, [R1],#4
+		CMP     R0, R2
+		BLT     memcpyLoop
+		LDMFD   SP!, {R0-R4}
+		MOV     LR, R12
+		BX      LR
+	
+FileName:
+	.dcw "sdmc:/rei/patched_firmware_sys.bin"
+	.word 0x0
 
-@@inf_loop:
-	b @@inf_loop
-.pool
-firm_fname:
-.close
-
-.create "reboot2.bin", 0x080933CC
-.org 0x080933CC
-.arm
-	stmfd sp!, {r4-r11,lr}
-	sub sp, sp, #0x3C
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r12, c2, c0, 1	; icacheable
-	mrc p15, 0, r1, c3, c0, 0	; write bufferable
-	mrc p15, 0, r2, c5, c0, 2	; daccess
-	mrc p15, 0, r3, c5, c0, 3	; iaccess
-	ldr r4, =0x18000035			; 0x18000000 128M
-	bic r2, r2, #0xF0000		; unprotect region 4
-	bic r3, r3, #0xF0000		; unprotect region 4
-	orr r0, r0, #0x10			; dcacheable region 4
-	orr r2, r2, #0x30000		; region 4 r/w
-	orr r3, r3, #0x30000		; region 4 r/w
-	orr r12, r12, #0x10			; icacheable region 4
-	orr r1, r1, #0x10			; write bufferable region 4
-	mcr p15, 0, r0, c2, c0, 0
-	mcr p15, 0, r12, c2, c0, 1
-	mcr p15, 0, r1, c3, c0, 0	; write bufferable
-	mcr p15, 0, r2, c5, c0, 2	; daccess
-	mcr p15, 0, r3, c5, c0, 3	; iaccess
-	mcr p15, 0, r4, c6, c4, 0	; region 4 (hmmm)
-
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r1, c2, c0, 1	; icacheable
-	mrc p15, 0, r2, c3, c0, 0	; write bufferable
-	orr r0, r0, #0x20			; dcacheable region 5
-	orr r1, r1, #0x20			; icacheable region 5
-	orr r2, r2, #0x20			; write bufferable region 5
-	mcr p15, 0, r0, c2, c0, 0	; dcacheable
-	mcr p15, 0, r1, c2, c0, 1	; icacheable
-	mcr p15, 0, r2, c3, c0, 0	; write bufferable
-
-	mov r4, #firm_addr
-	add r3, r4, #0x40
-	ldr r0, [r3]				; offset
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0x70
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0xA0
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	mov r2, #0
-	mov r1, r2
-@flush_cache:
-	mov r0, #0
-	mov r3, r2, lsl#30
-@flush_cache_inner_loop:
-	orr r12, r3, r0, lsl#5
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mcr p15, 0, r12, c7, c14, 2	; clean and flush dcache entry (index and segment)
-	add r0, r0, #1
-	cmp r0, #0x20
-	bcc @flush_cache_inner_loop
-	add r2, r2, #1
-	cmp r2, #4
-	bcc @flush_cache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-@mpu_enable:
-	ldr r0, =0x42078			; alt vector select, enable itcm
-	mcr p15, 0, r0, c1, c0, 0
-	mcr p15, 0, r1, c7, c5, 0	; flush dcache
-	mcr p15, 0, r1, c7, c6, 0	; flush icache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mov r0, #firm_addr
-	mov r1, 0X1FFFFFFC
-	ldr r2, [r0,#8]				; arm11 entry
-	str r2, [r1]
-	ldr r0, [r0,#0xC]			; arm9 entry
-	add sp, sp, #0x3C
-	ldmfd sp!, {r4-r11,lr}
-	bx r0
-.pool
-memcpy32: ; memcpy32(void *src, void *dst, unsigned int size)
-	mov r12, lr
-	stmfd sp!, {r0-r4}
-	add r2, r2, r0
-@memcpy_loop:
-	ldr r3, [r0], #4
-	str r3, [r1], #4
-	cmp r0, r2
-	blt @memcpy_loop
-	ldmfd sp!, {r0-r4}
-	mov lr, r12
-	bx lr
 .pool
+
+// Kernel Code
+.align 4
+KernelCodeStart:
+	memorySetting:
+		MRC     p15, 0, R0,c2,c0, 0
+        MRC     p15, 0, R12,c2,c0, 1
+        MRC     p15, 0, R1,c3,c0, 0
+        MRC     p15, 0, R2,c5,c0, 2
+        MRC     p15, 0, R3,c5,c0, 3
+        LDR     R4, =0x18000035
+        BIC     R2, R2, #0xF0000
+        BIC     R3, R3, #0xF0000
+        ORR     R0, R0, #0x10
+        ORR     R2, R2, #0x30000
+        ORR     R3, R3, #0x30000
+        ORR     R12, R12, #0x10
+        ORR     R1, R1, #0x10
+        MCR     p15, 0, R0,c2,c0, 0
+        MCR     p15, 0, R12,c2,c0, 1
+        MCR     p15, 0, R1,c3,c0, 0
+        MCR     p15, 0, R2,c5,c0, 2
+        MCR     p15, 0, R3,c5,c0, 3
+        MCR     p15, 0, R4,c6,c4, 0
+        MRC     p15, 0, R0,c2,c0, 0
+        MRC     p15, 0, R1,c2,c0, 1
+        MRC     p15, 0, R2,c3,c0, 0
+        ORR     R0, R0, #0x20
+        ORR     R1, R1, #0x20
+        ORR     R2, R2, #0x20
+        MCR     p15, 0, R0,c2,c0, 0
+        MCR     p15, 0, R1,c2,c0, 1
+        MCR     p15, 0, R2,c3,c0, 0
+
+    copyFirmPartitions:
+        LDR     R4, =buffer
+        ADD     R3, R4, #0x40
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8] 
+		bl KernelMemcpy
+		
+        ADD     R3, R4, #0x70
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+			
+        ADD     R3, R4, #0xA0
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+			
+		ADD     R3, R4, #0xD0
+        LDR     R0, [R3]
+		CMP		R0, #0
+		BEQ		invalidateDataCache
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+		
+    invalidateDataCache:
+        MOV     R2, #0
+        MOV     R1, R2
+        loc_809460C:
+        MOV     R0, #0
+        MOV     R3, R2,LSL#30
+        loc_8094614:
+        ORR     R12, R3, R0,LSL#5
+        MCR     p15, 0, R1,c7,c10, 4
+        MCR     p15, 0, R12,c7,c14, 2
+        ADD     R0, R0, #1
+        CMP     R0, #0x20
+        BCC     loc_8094614
+        ADD     R2, R2, #1
+        CMP     R2, #4
+        BCC     loc_809460C
+
+    jumpToEntrypoint:
+        MCR     p15, 0, R1,c7,c10, 4
+        LDR     R0, =0x42078
+        MCR     p15, 0, R0,c1,c0, 0
+        MCR     p15, 0, R1,c7,c5, 0
+        MCR     p15, 0, R1,c7,c6, 0
+        MCR     p15, 0, R1,c7,c10, 4
+		LDR     R4, =buffer
+        MOV     R1, #0x1FFFFFFC
+		LDR     R2, [R4,#8]
+		STR     R2, [R1]
+		LDR     R0, [R4,#0xC]
+		BX      R0
+.pool
+
+KernelMemcpy:
+	MOV     R12, LR
+	STMFD   SP!, {R0-R4}
+	ADD     R2, R2, R0
+
+	kmemcpyLoop:
+		LDR     R3, [R0],#4
+		STR     R3, [R1],#4
+		CMP     R0, R2
+		BLT     kmemcpyLoop
+		LDMFD   SP!, {R0-R4}
+		MOV     LR, R12
+		BX      LR
+.pool
+
+KernelCodeEnd:
+
 .close

reboot/rebootCodeNtr.s

@@ -1,159 +0,0 @@
-.nds
-
-firm_size equ 0x000EB000
-firm_addr equ 0x24000000
-fopen equ 0x0805B180
-fread equ 0x0804D9B0
-pxi_wait_recv equ 0x08055178
-
-.macro svc, num
-	.if isArm()
-		.word 0xEF000000 | num
-	.else
-		.if num > 0xFF
-			.error "bitch you crazu"
-		.endif
-		.halfword 0xDF00 | num
-	.endif
-.endmacro
-
-.create "reboot1.bin", 0x080859C8
-.org 0x080859C8
-.arm
-patch005:
-	ldr r0, =0x2000E000
-	mov r1, #0x200
-	mov r2, #0
-	add r1, r1, r0
-@@memset_loop:
-	str r2, [r0]
-	add r0, r0, #4
-	cmp r0, r1
-	blt @@memset_loop
-	ldr r0, =0x2000E000
-	ldr r1, =firm_fname
-	mov r2, #1
-	blx fopen
-	ldr r0, =0x2000E000
-	ldr r1, =0x2000E100
-	mov r2, #firm_addr
-	mov r3, #firm_size
-	blx fread
-
-	ldr r4, =0x44846
-	blx pxi_wait_recv
-	cmp r0, r4
-	bne patch005
-	mov r2, #0
-	mov r3, r2
-	mov r1, r2
-	mov r0, r2
-	svc 0x7C
-	ldr r0, =0x80FF4FC
-	svc 0x7B
-
-@@inf_loop:
-	b @@inf_loop
-.pool
-firm_fname:
-.close
-
-.create "reboot2.bin", 0x08094454
-.org 0x08094454
-.arm
-	stmfd sp!, {r4-r11,lr}
-	sub sp, sp, #0x3C
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r12, c2, c0, 1	; icacheable
-	mrc p15, 0, r1, c3, c0, 0	; write bufferable
-	mrc p15, 0, r2, c5, c0, 2	; daccess
-	mrc p15, 0, r3, c5, c0, 3	; iaccess
-	ldr r4, =0x18000035			; 0x18000000 128M
-	bic r2, r2, #0xF0000		; unprotect region 4
-	bic r3, r3, #0xF0000		; unprotect region 4
-	orr r0, r0, #0x10			; dcacheable region 4
-	orr r2, r2, #0x30000		; region 4 r/w
-	orr r3, r3, #0x30000		; region 4 r/w
-	orr r12, r12, #0x10			; icacheable region 4
-	orr r1, r1, #0x10			; write bufferable region 4
-	mcr p15, 0, r0, c2, c0, 0
-	mcr p15, 0, r12, c2, c0, 1
-	mcr p15, 0, r1, c3, c0, 0	; write bufferable
-	mcr p15, 0, r2, c5, c0, 2	; daccess
-	mcr p15, 0, r3, c5, c0, 3	; iaccess
-	mcr p15, 0, r4, c6, c4, 0	; region 4 (hmmm)
-
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r1, c2, c0, 1	; icacheable
-	mrc p15, 0, r2, c3, c0, 0	; write bufferable
-	orr r0, r0, #0x20			; dcacheable region 5
-	orr r1, r1, #0x20			; icacheable region 5
-	orr r2, r2, #0x20			; write bufferable region 5
-	mcr p15, 0, r0, c2, c0, 0	; dcacheable
-	mcr p15, 0, r1, c2, c0, 1	; icacheable
-	mcr p15, 0, r2, c3, c0, 0	; write bufferable
-
-	mov r4, #firm_addr
-	add r3, r4, #0x40
-	ldr r0, [r3]				; offset
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0x70
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0xA0
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	mov r2, #0
-	mov r1, r2
-@flush_cache:
-	mov r0, #0
-	mov r3, r2, lsl#30
-@flush_cache_inner_loop:
-	orr r12, r3, r0, lsl#5
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mcr p15, 0, r12, c7, c14, 2	; clean and flush dcache entry (index and segment)
-	add r0, r0, #1
-	cmp r0, #0x20
-	bcc @flush_cache_inner_loop
-	add r2, r2, #1
-	cmp r2, #4
-	bcc @flush_cache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-@mpu_enable:
-	ldr r0, =0x42078			; alt vector select, enable itcm
-	mcr p15, 0, r0, c1, c0, 0
-	mcr p15, 0, r1, c7, c5, 0	; flush dcache
-	mcr p15, 0, r1, c7, c6, 0	; flush icache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mov r0, #firm_addr
-	mov r1, 0X1FFFFFFC
-	ldr r2, [r0,#8]				; arm11 entry
-	str r2, [r1]
-	ldr r0, [r0,#0xC]			; arm9 entry
-	add sp, sp, #0x3C
-	ldmfd sp!, {r4-r11,lr}
-	bx r0
-.pool
-memcpy32: ; memcpy32(void *src, void *dst, unsigned int size)
-	mov r12, lr
-	stmfd sp!, {r0-r4}
-	add r2, r2, r0
-@memcpy_loop:
-	ldr r3, [r0], #4
-	str r3, [r1], #4
-	cmp r0, r2
-	blt @memcpy_loop
-	ldmfd sp!, {r0-r4}
-	mov lr, r12
-	bx lr
-.pool
-.close

source/crypto.c

@@ -7,6 +7,11 @@
 #include "fatfs/sdmmc/sdmmc.h"
 #include "fatfs/ff.h"
 
+//Nand key#2 (0x12C10)
+u8 key2[0x10] = {
+    0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
+};
+
 /****************************************************************
 *                   Crypto Libs
 ****************************************************************/
@@ -375,12 +380,8 @@ void nandFirm0(u8 *outbuf, const u32 size, u8 console){
     aes(outbuf, outbuf, size / AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 }
 
-//Emulates the Arm9loader process
-void arm9loader(void *armHdr, u8 mode){
-    //Nand key#2 (0x12C10)
-    u8 key2[0x10] = {
-        0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
-    };
+//Decrypts the N3DS arm9bin
+void decArm9Bin(void *armHdr, u8 mode){
 
     //Firm keys
     u8 keyX[0x10];
@@ -389,15 +390,15 @@ void arm9loader(void *armHdr, u8 mode){
     u32 slot = mode ? 0x16 : 0x15;
 
     //Setup keys needed for arm9bin decryption
-    memcpy((u8*)keyY, (void *)((uintptr_t)armHdr+0x10), 0x10);
-    memcpy((u8*)CTR, (void *)((uintptr_t)armHdr+0x20), 0x10);
-    u32 size = atoi((void *)((uintptr_t)armHdr+0x30));
+    memcpy((u8*)keyY, (void *)(armHdr+0x10), 0x10);
+    memcpy((u8*)CTR, (void *)(armHdr+0x20), 0x10);
+    u32 size = atoi((void *)(armHdr+0x30));
 
     if(mode){
         //Set 0x11 to key2 for the arm9bin and misc keys
         aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
         aes_use_keyslot(0x11);
-        aes((u8*)keyX, (void *)((uintptr_t)armHdr+0x60), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes((u8*)keyX, (void *)(armHdr+0x60), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
         aes_setkey(slot, (u8*)keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
     }
 
@@ -407,16 +408,18 @@ void arm9loader(void *armHdr, u8 mode){
 
     //Decrypt arm9bin
     aes((void *)(armHdr+0x800), (void *)(armHdr+0x800), size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
+}
 
-    if(mode){
-        //Set keys 0x19..0x1F keyXs
-        u8* decKey = (void *)((uintptr_t)armHdr+0x89824);
-        aes_use_keyslot(0x11);
-        for(slot = 0x19; slot < 0x20; slot++) {
-            aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
-            aes(decKey, (void *)((uintptr_t)armHdr+0x89814), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
-            aes_setkey(slot, (u8*)decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
-            *(u8 *)((void *)((uintptr_t)armHdr+0x89814+0xF)) += 1;
-        }
+//Sets the N3DS 9.6 KeyXs
+void setKeyXs(void *armHdr){
+
+    //Set keys 0x19..0x1F keyXs
+    u8* decKey = (void *)(armHdr+0x89824);
+    aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_use_keyslot(0x11);
+    for(u32 slot = 0x19; slot < 0x20; slot++){
+        aes(decKey, (void *)(armHdr+0x89814), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes_setkey(slot, (u8*)decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+        *(u8*)(armHdr+0x89814+0xF) += 1;
     }
 }

source/crypto.h

@@ -131,8 +131,8 @@ void rsa_use_keyslot(u32 keyslot);
 int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
 
 //NAND/FIRM stuff
-void getNandCTR(u8 *buf, u8 console);
 void nandFirm0(u8 *outbuf, const u32 size, u8 console);
-void arm9loader(void *armHdr, u8 mode);
+void decArm9Bin(void *armHdr, u8 mode);
+void setKeyXs(void *armHdr);
 
 #endif /*__CRYPTO_H*/

source/draw.c

@@ -7,17 +7,38 @@
 #include "draw.h"
 #include "fs.h"
 #include "memory.h"
+#include "types.h"
 
-static struct fb* fb = (struct fb*) 0x23FFFE00;
+static struct fb *fb = (struct fb *)0x23FFFE00;
+
+void shutdownLCD(void){
+
+    vu32 *arm11 = (vu32*)0x1FFFFFF8;
+
+    //Clear ARM11 entry offset
+    *arm11 = 0;
+
+    //Shutdown LCDs
+    *(vu32*)0x10202A44 = 0;
+    *(vu32*)0x10202244 = 0;
+    *(vu32*)0x10202014 = 0;
+    
+    //Wait for the ARM11 entrypoint to be set
+    while (!*arm11);
+    //Jump to it
+    ((void (*)())*arm11)();
+}
 
 void clearScreen(void){
-    memset(fb->top_left, 0, 0x38400);
-    memset(fb->top_right, 0, 0x38400);
+    memset(fb->top_left, 0, 0x46500);
+    memset(fb->top_right, 0, 0x46500);
     memset(fb->bottom, 0, 0x38400);
 }
 
 void loadSplash(void){
+    //Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
+    if (*((u8*)0x10141200) == 0x1) return;
     clearScreen();
     if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;
-    unsigned i,t; for(t=220;t>0;t--){for(i=0xFFFF;i>0;i--);}; //Ghetto sleep func
+    u64 i = 0xFFFFFF; while(--i) __asm("mov r0, r0"); //Less Ghetto sleep func
 }

source/draw.h

@@ -12,5 +12,5 @@ struct fb {
     u8 *bottom;
 };
 
-void clearScreen(void);
 void loadSplash(void);
+void shutdownLCD(void);

source/emunand.c

@@ -23,14 +23,14 @@ void getEmunandSect(u32 *off, u32 *head){
 
 void getSDMMC(void *pos, u32 *off, u32 size){
     //Look for struct code
-    unsigned char pattern[] = {0x01, 0x21, 0x20, 0x18, 0x20, 0x30};
-    *off = (u32)memsearch(pos, pattern, size, 6);
+    unsigned char pattern[] = {0x21, 0x20, 0x18, 0x20};
+    *off = (u32)memsearch(pos, pattern, size, 4) - 1;
     
     //Get DCD values
     unsigned char buf[4];
     int p;
-    u32 addr = 0;
-    u32 additive = 0;
+    u32 addr = 0,
+        additive = 0;
     memcpy((void*)buf, (void*)(*off+0x0A), 4);
     for (p = 0; p < 4; p++) addr |= ((u32) buf[p]) << (8 * p);
     memcpy((void*)buf, (void*)(*off+0x0E), 4);
@@ -42,23 +42,15 @@ void getSDMMC(void *pos, u32 *off, u32 size){
 
 void getEmuRW(void *pos, u32 size, u32 *readOff, u32 *writeOff){
     //Look for read/write code
-    unsigned char pattern[] = {0x04, 0x00, 0x0D, 0x00, 0x17, 0x00, 0x1E, 0x00, 0xC8, 0x05};
+    unsigned char pattern[] = {0x1E, 0x00, 0xC8, 0x05};
 
-    *writeOff = (u32)memsearch(pos, pattern, size, 10);
-    *readOff = (u32)memsearch((void *)(*writeOff - 0x1000), pattern, 0x1000, 10);
+    *writeOff = (u32)memsearch(pos, pattern, size, 4) - 6;
+    *readOff = (u32)memsearch((void *)(*writeOff - 0x1000), pattern, 0x1000, 4) - 6;
 }
 
 void getMPU(void *pos, u32 *off, u32 size){
-    //Look for MPU code
-    unsigned char pattern[] = {0x03, 0x00, 0x24, 0x00, 0x00, 0x00, 0x10};
+    //Look for MPU pattern
+    unsigned char pattern[] = {0x03, 0x00, 0x24, 0x00};
 
-    *off = (u32)memsearch(pos, pattern, size, 7);
-}
-
-void getEmuCode(void *pos, u32 *off, u32 size){
-    void *proc9 = memsearch(pos, "Process9", size, 8);
-    unsigned char pattern[] = {0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF};
-
-    //We're looking for the last spot before Process9
-    *off = (u32)memsearch(pos, pattern, size - (size - (u32)(proc9 - pos)), 6) + 0xF;
+    *off = (u32)memsearch(pos, pattern, size, 4);
 }

source/emunand.h

@@ -15,6 +15,5 @@ void getEmunandSect(u32 *off, u32 *head);
 void getSDMMC(void *pos, u32 *off, u32 size);
 void getEmuRW(void *pos, u32 size, u32 *readOff, u32 *writeOff);
 void getMPU(void *pos, u32 *off, u32 size);
-void getEmuCode(void *pos, u32 *off, u32 size);
 
 #endif

source/firm.c

@@ -10,39 +10,82 @@
 #include "fs.h"
 #include "emunand.h"
 #include "crypto.h"
+#include "draw.h"
 
 firmHeader *firmLocation = (firmHeader *)0x24000000;
 firmSectionHeader *section;
 u32 firmSize = 0;
 u8  mode = 1,
-    console = 1;
+    console = 1,
+    emuNAND = 0,
+    a9lhSetup = 0,
+    updatedSys = 0,
+    usePatchedFirm = 0;
 u16 pressed;
+char *firmPathPatched = NULL;
+
+void setupCFW(void){
+
+    //Detect the console being used
+    if(PDN_MPCORE_CFG == 1) console = 0;
+
+    //Get pressed buttons
+    pressed = HID_PAD;
+
+    //Determine if A9LH is installed via PDN_SPI_CNT and an user flag
+    if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){
+        a9lhSetup = 1;
+        //Check flag for > 9.2 SysNAND
+        if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
+    }
+
+    /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
+       is not pressed, boot 9.0 FIRM */
+    if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+
+    /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
+       or R is pressed on a > 9.2 SysNAND, boot emuNAND */
+    if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
+       (!updatedSys && mode && !(pressed & BUTTON_R1))) emuNAND = 1;
+
+    if(mode) firmPathPatched = emuNAND ? "/rei/patched_firmware_emu.bin" :
+                                         "/rei/patched_firmware_sys.bin";
+
+    //Skip decrypting and patching FIRM
+    if(fileExists("/rei/usepatchedfw")){
+        //Only needed with this flag
+        if(!mode) firmPathPatched = "/rei/patched_firmware90.bin";
+        if (fileExists(firmPathPatched)) usePatchedFirm = 1;
+    }
+}
 
 //Load firm into FCRAM
 u8 loadFirm(void){
 
-    if(PDN_MPCORE_CFG == 1) console = 0;
-    pressed = HID_PAD;
-    section = firmLocation->section;
-
-    //If L and R are pressed, boot SysNAND with the NAND FIRM
-    if((pressed & BUTTON_L1R1) == BUTTON_L1R1){
-        mode = 0;
+    //If not using an A9LH setup or the patched FIRM, load 9.0 FIRM from NAND
+    if(!usePatchedFirm && !a9lhSetup && !mode){
         //Read FIRM from NAND and write to FCRAM
-        firmSize = console ? 0xF2C00 : 0xE9000;
+        firmSize = console ? 0xF2000 : 0xE9000;
         nandFirm0((u8*)firmLocation, firmSize, console);
+        //Check for correct decryption
         if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1;
     }
-    //Load FIRM from SDCard
+    //Load FIRM from SD
     else{
-        const char firmPath[] = "/rei/firmware.bin";
-        firmSize = fileSize(firmPath);
+        char *path = usePatchedFirm ? firmPathPatched :
+                                      (mode ? "/rei/firmware.bin" : "/rei/firmware90.bin");
+        firmSize = fileSize(path);
         if (!firmSize) return 1;
-        fileRead((u8*)firmLocation, firmPath, firmSize);
-        if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
+        fileRead((u8*)firmLocation, path, firmSize);
     }
 
-    if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
+    section = firmLocation->section;
+
+    //Check that the loaded FIRM matches the console
+    if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
+
+    if(console && !usePatchedFirm)
+        decArm9Bin((u8*)firmLocation + section[2].offset, mode);
 
     return 0;
 }
@@ -51,18 +94,22 @@ u8 loadFirm(void){
 u8 loadEmu(void){
 
     u32 emuOffset = 0,
-    emuHeader = 0,
-    emuRead = 0,
-    emuWrite = 0,
-    sdmmcOffset = 0,
-    mpuOffset = 0,
-    emuCodeOffset = 0;
+        emuHeader = 0,
+        emuRead = 0,
+        emuWrite = 0,
+        sdmmcOffset = 0,
+        mpuOffset = 0,
+        emuCodeOffset = 0;
 
     //Read emunand code from SD
-    getEmuCode(firmLocation, &emuCodeOffset, firmSize);
-    const char path[] = "/rei/emunand/emunand.bin";
+    char path[] = "/rei/emunand/emunand.bin";
     u32 size = fileSize(path);
     if (!size) return 1;
+    if(!console || !mode) nandRedir[5] = 0xA4;
+    //Find offset for emuNAND code from the offset in nandRedir
+    u8 *emuCodeTmp = &nandRedir[4];
+    emuCodeOffset = *(u32*)emuCodeTmp - (u32)section[2].address +
+                    section[2].offset + (u32)firmLocation;
     fileRead((u8*)emuCodeOffset, path, size);
 
     //Find and patch emunand related offsets
@@ -77,8 +124,13 @@ u8 loadEmu(void){
     *pos_offset = emuOffset;
     *pos_header = emuHeader;
 
+    //Patch emuNAND code in memory for O3DS and 9.0 N3DS
+    if(!console || !mode){
+        u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
+        memcpy((u8*)pos_instr, emuInstr, sizeof(emuInstr));
+    }
+
     //Add emunand hooks
-    if(!console) nandRedir[5] = 0xA4;
     memcpy((u8*)emuRead, nandRedir, sizeof(nandRedir));
     memcpy((u8*)emuWrite, nandRedir, sizeof(nandRedir));
 
@@ -90,75 +142,80 @@ u8 loadEmu(void){
 
 //Patches
 u8 patchFirm(void){
+    if(usePatchedFirm) return 0;
 
-    //If L is pressed, boot SysNAND with the SDCard FIRM
-    if(mode && !(pressed & BUTTON_L1)) if (loadEmu()) return 1;
+    if(emuNAND){
+        if (loadEmu()) return 1;
+    }
+    else if (a9lhSetup){
+        //Patch FIRM partitions writes on SysNAND to protect A9LH
+        u32 writeOffset = 0;
+        getFIRMWrite(firmLocation, firmSize, &writeOffset);
+        memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock));
+    }
 
     //Disable signature checks
     u32 sigOffset = 0,
-    sigOffset2 = 0;
+        sigOffset2 = 0;
+
     getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
     memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
     memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
 
-    //Apply reboot patch and write patched FIRM
-    if(!console && mode &&
-       ((fileSize("/rei/reversereboot") > 0) == (pressed & BUTTON_A))){
+    //Patch ARM9 entrypoint on N3DS to skip arm9loader
+    if(console){
+        u32 *arm9 = (u32*)&firmLocation->arm9Entry;
+        *arm9 = 0x801B01C;
+    }
+
+    if(mode){
+        //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
         u32 rebootOffset = 0,
-        rebootOffset2 = 0;
-        getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2);
-        char path[] = "/rei/reboot/reboot1.bin";
+            fOpenOffset = 0;
+
+        //Read reboot code from SD
+        char *path = "/rei/reboot/reboot.bin";
         u32 size = fileSize(path);
         if (!size) return 1;
+        getReboot(firmLocation, firmSize, &rebootOffset);
         fileRead((u8*)rebootOffset, path, size);
-        memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
-        memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2);
-        path[18] = '2';
-        size = fileSize(path);
-        if (!size) return 1;
-        fileRead((u8*)rebootOffset2, path, size);
-        if (fileWrite((u8*)firmLocation, PATCHED_FIRM_PATH, firmSize) != 0) return 1;
+
+        //Calculate the fOpen offset and put it in the right location
+        u32 *pos_fopen = memsearch((u32*)rebootOffset, "OPEN", size, 4);
+        getfOpen(firmLocation, firmSize, &fOpenOffset);
+        *pos_fopen = fOpenOffset;
+
+        //Patch path for emuNAND-patched FIRM
+        if(emuNAND){
+            u32 *pos_path = memsearch((u32*)rebootOffset, L"sys", size, 6);
+            memcpy((u8*)pos_path, L"emu", 6);
+        }
     }
 
+    //Write patched FIRM to SD if needed
+    if(firmPathPatched)
+        if(fileWrite((u8*)firmLocation, firmPathPatched, firmSize) != 0) return 1;
+
     return 0;
 }
 
-//Firmlaunchhax
 void launchFirm(void){
 
-    //Set MPU
-    __asm__ (
-        "msr cpsr_c, #0xDF\n\t"         //Set system mode, disable interrupts
-        "ldr r0, =0x10000035\n\t"       //Memory area 0x10000000-0x18000000, enabled, 128MB
-        "ldr r4, =0x18000035\n\t"       //Memory area 0x18000000-0x20000000, enabled, 128MB
-        "mcr p15, 0, r0, c6, c3, 0\n\t" //Set memory area 3 (0x10000000-0x18000000)
-        "mcr p15, 0, r4, c6, c4, 0\n\t" //Set memory area 4 (0x18000000-0x20000000)
-        "mrc p15, 0, r0, c2, c0, 0\n\t" //read data cacheable bit
-        "mrc p15, 0, r4, c2, c0, 1\n\t" //read inst cacheable bit
-        "mrc p15, 0, r1, c3, c0, 0\n\t" //read data writeable
-        "mrc p15, 0, r2, c5, c0, 2\n\t" //read data access permission
-        "mrc p15, 0, r3, c5, c0, 3\n\t" //read inst access permission
-        "orr r0, r0, #0x30\n\t"
-        "orr r4, r4, #0x30\n\t"
-        "orr r1, r1, #0x30\n\t"
-        "bic r2, r2, #0xF0000\n\t"
-        "bic r3, r3, #0xF0000\n\t"
-        "orr r2, r2, #0x30000\n\t"
-        "orr r3, r3, #0x30000\n\t"
-        "mcr p15, 0, r0, c2, c0, 0\n\t" //write data cacheable bit
-        "mcr p15, 0, r4, c2, c0, 1\n\t" //write inst cacheable bit
-        "mcr p15, 0, r1, c3, c0, 0\n\t" //write data writeable
-        "mcr p15, 0, r2, c5, c0, 2\n\t" //write data access permission
-        "mcr p15, 0, r3, c5, c0, 3\n\t" //write inst access permission
-        ::: "r0", "r1", "r2", "r3", "r4"
-    );
+    if(console && mode) setKeyXs((u8*)firmLocation + section[2].offset);
 
     //Copy firm partitions to respective memory locations
     memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
     memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
     memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
-    *(u32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry;
+
+    //Run ARM11 screen stuff
+    vu32 *arm11 = (vu32*)0x1FFFFFF8;
+    *arm11 = (u32)shutdownLCD;
+    while (*arm11);
+    
+    //Set ARM11 kernel
+    *arm11 = (u32)firmLocation->arm11Entry;
     
     //Final jump to arm9 binary
-    console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();
+    ((void (*)())firmLocation->arm9Entry)();
 }

source/firm.h

@@ -10,13 +10,12 @@
 
 #define PDN_MPCORE_CFG     (*(u8*)0x10140FFC)
 #define HID_PAD            ((~*(u16*)0x10146000) & 0xFFF)
-#define BUTTON_L1R1        (3 << 8)
+#define BUTTON_R1          (1 << 8)
 #define BUTTON_L1          (1 << 9)
-#define BUTTON_A           1
-#define PATCHED_FIRM_PATH  "/rei/patched_firmware.bin"
+#define SAFEMODE           (BUTTON_L1 | BUTTON_R1 | 1 | (1 << 6))
 
+void setupCFW(void);
 u8 loadFirm(void);
-u8 loadEmu(void);
 u8 patchFirm(void);
 void launchFirm(void);
 

source/fs.c

@@ -59,10 +59,11 @@ int fileRead(u8 *dest, const char *path, u32 size){
 }
 
 int fileWrite(const u8 *buffer, const char *path, u32 size){
-    FRESULT fr;
+    FRESULT fr = 1;
     FIL fp;
     unsigned int br = 0;
 
+    f_unlink(path);
     if(f_open(&fp, path, FA_WRITE | FA_OPEN_ALWAYS) == FR_OK){
         fr = f_write(&fp, buffer, size, &br);
         f_close(&fp);
@@ -84,3 +85,13 @@ int fileSize(const char* path){
 		f_close(&fp);
 	return size;
 }
+
+int fileExists(const char* path){
+    FRESULT fr;
+    FIL fp;
+    int exists = 1;
+    fr = f_open(&fp, path, FA_READ);
+    if (fr != FR_OK)exists = 0;
+    f_close(&fp);
+    return exists;
+}

source/fs.h

@@ -13,5 +13,6 @@ int fileReadOffset(u8 *dest, const char *path, u32 size, u32 offset);
 int fileRead(u8 *dest, const char *path, u32 size);
 int fileWrite(const u8 *buffer, const char *path, u32 size);
 int fileSize(const char* path);
+int fileExists(const char* path);
 
 #endif

source/main.c

@@ -13,6 +13,7 @@
 u8 main(){
     mountSD();
     loadSplash();
+    setupCFW();
     if (loadFirm()) return 1;
     if (patchFirm()) return 1;
     launchFirm();

source/patches.c

@@ -27,6 +27,8 @@ u8 nandRedir[0x08] = {0x00, 0x4C, 0xA0, 0x47, 0xC0, 0xA5, 0x01, 0x08};    //Bran
 */
 u8 sigPat1[2] = {0x00, 0x20};
 u8 sigPat2[4] = {0x00, 0x20, 0x70, 0x47};
+u8 FIRMblock[4] = {0x00, 0x20, 0xC0, 0x46};
+u8 emuInstr[5] = {0xA5, 0x01, 0x08, 0x30, 0xA5};
 
 /**************************************************
 *                   Functions
@@ -34,18 +36,34 @@ u8 sigPat2[4] = {0x00, 0x20, 0x70, 0x47};
 
 void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
     //Look for signature checks
-    unsigned char pattern[] = {0xC0, 0x1C, 0x76, 0xE7, 0x20};
-    unsigned char pattern2[] = {0x70, 0xB5, 0x22, 0x4D, 0x0C};
+    unsigned char pattern[] = {0xC0, 0x1C, 0x76, 0xE7};
+    unsigned char pattern2[] = {0xB5, 0x22, 0x4D, 0x0C};
 
-    *off = (u32)memsearch(pos, pattern, size, 5);
-    *off2 = (u32)memsearch(pos, pattern2, size, 5);
+    *off = (u32)memsearch(pos, pattern, size, 4);
+    *off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
 }
 
-void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
+void getReboot(void *pos, u32 size, u32 *off){
     //Look for FIRM reboot code
-    unsigned char pattern[] = {0x8D, 0xE5, 0x00, 0xC0, 0x91, 0xE5};
-    unsigned char pattern2[] = {0xF0, 0x4F, 0x2D, 0xE9, 0x3C};
+    unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
 
-    *off = (u32)memsearch(pos, pattern, size, 6) + 2;
-    *off2 = (u32)memsearch(pos, pattern2, size, 5);
+    *off = (u32)memsearch(pos, pattern, size, 4) - 0x10;
+}
+
+void getfOpen(void *pos, u32 size, u32 *off){
+    //Calculate fOpen
+    u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
+    u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
+
+    unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
+
+    *off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;
+}
+
+void getFIRMWrite(void *pos, u32 size, u32 *off){
+    //Look for FIRM writing code
+    void *firmwrite = memsearch(pos, "exe:", size, 4);
+    unsigned char pattern[] = {0x00, 0x28, 0x01, 0xDA};
+
+    *off = (u32)memsearch(firmwrite - 0x100, pattern, 0x100, 4);
 }

source/patches.h

@@ -15,11 +15,15 @@ u8 mpu[0x2C];
 u8 nandRedir[0x08];
 u8 sigPat1[2];
 u8 sigPat2[4];
+u8 FIRMblock[4];
+u8 emuInstr[5];
 
 /**************************************************
 *                   Functions
 **************************************************/
 void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
-void getReboot(void *pos, u32 size, u32 *off, u32 *off2);
+void getReboot(void *pos, u32 size, u32 *off);
+void getfOpen(void *pos, u32 size, u32 *off);
+void getFIRMWrite(void *pos, u32 size, u32 *off);
 
 #endif

source/start.s

@@ -5,39 +5,49 @@ _start:
     @ Change the stack pointer
     mov sp, #0x27000000
 
+    @ Give read/write access to all the memory regions
+    ldr r5, =0x33333333
+    mcr p15, 0, r5, c5, c0, 2 @ write data access
+    mcr p15, 0, r5, c5, c0, 3 @ write instruction access
+
     @ Sets MPU permissions and cache settings
-    ldr r0, =0xFFFF001D			@ ffff0000 32k
-	ldr r1, =0x01FF801D			@ 01ff8000 32k
-	ldr r2, =0x08000027			@ 08000000 1M
-	ldr r3, =0x10000021			@ 10000000 128k
-	ldr r4, =0x10100025			@ 10100000 512k
-	ldr r5, =0x20000035			@ 20000000 128M
-	ldr r6, =0x2800801B			@ 28008000 16k
-	ldr r7, =0x1800002D			@ 18000000 8M
-	ldr r8, =0x33333336
-	ldr r9, =0x60600666
-	mov r10, #0x25
-	mov r11, #0x25
-	mov r12, #0x25
-	mcr p15, 0, r0, c6, c0, 0
-	mcr p15, 0, r1, c6, c1, 0
-	mcr p15, 0, r2, c6, c2, 0
-	mcr p15, 0, r3, c6, c3, 0
-	mcr p15, 0, r4, c6, c4, 0
-	mcr p15, 0, r5, c6, c5, 0
-	mcr p15, 0, r6, c6, c6, 0
-	mcr p15, 0, r7, c6, c7, 0
-	mcr p15, 0, r8, c5, c0, 2	@ Enable data r/w for all regions
-	mcr p15, 0, r9, c5, c0, 3	@ Enable inst read for 0, 1, 2, 5, 7
-	mcr p15, 0, r10, c3, c0, 0	@ Write bufferable 0, 2, 5
-	mcr p15, 0, r11, c2, c0, 0	@ Data cacheable 0, 2, 5
-	mcr p15, 0, r12, c2, c0, 1	@ Inst cacheable 0, 2, 5
+    ldr r0, =0xFFFF001D	@ ffff0000 32k
+    ldr r1, =0x01FF801D	@ 01ff8000 32k
+    ldr r2, =0x08000027	@ 08000000 1M
+    ldr r3, =0x10000021	@ 10000000 128k
+    ldr r4, =0x10100025	@ 10100000 512k
+    ldr r5, =0x20000035	@ 20000000 128M
+    ldr r6, =0x1FF00027	@ 1FF00000 1M
+    ldr r7, =0x1800002D	@ 18000000 8M
+    mov r10, #0x25
+    mov r11, #0x25
+    mov r12, #0x25
+    mcr p15, 0, r0, c6, c0, 0
+    mcr p15, 0, r1, c6, c1, 0
+    mcr p15, 0, r2, c6, c2, 0
+    mcr p15, 0, r3, c6, c3, 0
+    mcr p15, 0, r4, c6, c4, 0
+    mcr p15, 0, r5, c6, c5, 0
+    mcr p15, 0, r6, c6, c6, 0
+    mcr p15, 0, r7, c6, c7, 0
+    mcr p15, 0, r10, c3, c0, 0	@ Write bufferable 0, 2, 5
+    mcr p15, 0, r11, c2, c0, 0	@ Data cacheable 0, 2, 5
+    mcr p15, 0, r12, c2, c0, 1	@ Inst cacheable 0, 2, 5
 
-    @ Enables all the settings we specified above
-	ldr r0, =0x5307D
-	mcr p15, 0, r0, c1, c0, 0	@ cp15 ctl register enable mpu, enable cache and use alt vector table
+    @ Enable caches
+    mrc p15, 0, r4, c1, c0, 0  @ read control register
+    orr r4, r4, #(1<<12)       @ - instruction cache enable
+    orr r4, r4, #(1<<2)        @ - data cache enable
+    orr r4, r4, #(1<<0)        @ - mpu enable
+    mcr p15, 0, r4, c1, c0, 0  @ write control register
 
-    @ Undocumented: Fixes mounting of SDMC
+    @ Flush caches
+    mov r5, #0
+    mcr p15, 0, r5, c7, c5, 0  @ flush I-cache
+    mcr p15, 0, r5, c7, c6, 0  @ flush D-cache
+    mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
+
+    @ Fixes mounting of SDMC
 	ldr r0, =0x10000020
 	mov r1, #0x340
 	str r1, [r0]

source/types.h

@@ -14,6 +14,10 @@ typedef uint8_t u8;
 typedef uint16_t u16;
 typedef uint32_t u32;
 typedef uint64_t u64;
+typedef volatile uint8_t vu8;
+typedef volatile uint16_t vu16;
+typedef volatile uint32_t vu32;
+typedef volatile uint64_t vu64;
 
 //FIRM Header layout
 typedef struct firmSectionHeader {