Added forcing of boot options on A9LH

Always prevents losing AGB_FIRM saves, forces the last used options on a MCU reboot (can be overridden with A)

Makefile

@@ -33,7 +33,7 @@ objects_cfw = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
 
 
 .PHONY: all
-all: launcher a9lh emunand emunando3ds reboot rebootntr ninjhax
+all: launcher a9lh emunand reboot ninjhax
 
 .PHONY: launcher
 launcher: $(dir_out)/$(name).dat 
@@ -42,16 +42,10 @@ launcher: $(dir_out)/$(name).dat
 a9lh: $(dir_out)/arm9loaderhax.bin
 
 .PHONY: emunand
-emunand: $(dir_out)/rei-n3ds/emunand/emunand.bin
+emunand: $(dir_out)/rei/emunand/emunand.bin
-
-.PHONY: emunando3ds
-emunando3ds: $(dir_out)/rei-o3ds/emunand/emunand.bin
 
 .PHONY: reboot
-reboot: $(dir_out)/rei-o3ds/reboot/reboot1.bin $(dir_out)/rei-o3ds/reboot/reboot2.bin
+reboot: $(dir_out)/rei/reboot/reboot.bin
-
-.PHONY: rebootntr
-rebootntr: $(dir_out)/ntr-o3ds/reboot/reboot1.bin $(dir_out)/ntr-o3ds/reboot/reboot2.bin
 
 .PHONY: ninjhax
 ninjhax: $(dir_out)/3ds/$(name)
@@ -62,11 +56,11 @@ clean:
 	@$(MAKE) $(FLAGS) -C $(dir_ninjhax) clean
 	rm -rf $(dir_out) $(dir_build)
 
-$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
+$(dir_out)/$(name).dat: $(dir_build)/main.bin $(dir_out)/rei
 	@$(MAKE) $(FLAGS) -C $(dir_mset) launcher
 	dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144
 
-$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei-n3ds/ $(dir_out)/rei-o3ds/
+$(dir_out)/arm9loaderhax.bin: $(dir_build)/main.bin $(dir_out)/rei
 	@cp -av $(dir_build)/main.bin $(dir_out)/arm9loaderhax.bin
 
 $(dir_out)/3ds/$(name):
@@ -75,36 +69,18 @@ $(dir_out)/3ds/$(name):
 	@mv $(dir_out)/$(name).3dsx $@
 	@mv $(dir_out)/$(name).smdh $@
 
-$(dir_out)/rei-n3ds/:
+$(dir_out)/rei:
-	@mkdir -p "$(dir_out)/rei-n3ds"
+	@mkdir -p "$(dir_out)/rei"
 
-$(dir_out)/rei-o3ds/:
+$(dir_out)/rei/emunand/emunand.bin: $(dir_emu)/emuCode.s
-	@mkdir -p "$(dir_out)/rei-o3ds"
-    
-$(dir_out)/rei-n3ds/emunand/emunand.bin: $(dir_emu)/emuCode.s
 	@armips $<
-	@mkdir -p "$(dir_out)/rei-n3ds/emunand"
+	@mkdir -p "$(dir_out)/rei/emunand"
-	@cp -av emunand.bin $(dir_out)/rei-n3ds/emunand
+	@mv emunand.bin $(dir_out)/rei/emunand
 
-$(dir_out)/rei-o3ds/emunand/emunand.bin: emunand.bin
+$(dir_out)/rei/reboot/reboot.bin: $(dir_reboot)/rebootCode.s
-	@mkdir -p "$(dir_out)/rei-o3ds/emunand"
-	@mv emunand.bin $(dir_out)/rei-o3ds/emunand
-
-$(dir_out)/rei-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCode.s
 	@armips $<
-	@mkdir -p "$(dir_out)/rei-o3ds/reboot"
+	@mkdir -p "$(dir_out)/rei/reboot"
-	@mv reboot1.bin $(dir_out)/rei-o3ds/reboot
+	@mv reboot.bin $(dir_out)/rei/reboot
-
-$(dir_out)/rei-o3ds/reboot/reboot2.bin: reboot2.bin
-	@cp -av reboot2.bin $(dir_out)/rei-o3ds/reboot
-
-$(dir_out)/ntr-o3ds/reboot/reboot1.bin: $(dir_reboot)/rebootCodeNtr.s
-	@armips $<
-	@mkdir -p "$(dir_out)/ntr-o3ds/reboot"
-	@mv reboot1.bin $(dir_out)/ntr-o3ds/reboot
-
-$(dir_out)/ntr-o3ds/reboot/reboot2.bin: reboot2.bin
-	@mv reboot2.bin $(dir_out)/ntr-o3ds/reboot
 
 $(dir_build)/main.bin: $(dir_build)/main.elf
 	$(OC) -S -O binary $< $@

reboot/rebootCode.s

@@ -1,159 +1,221 @@
 .nds
+.create "reboot.bin", 0
 
-firm_size equ 0x000EA000
+byteswritten equ 0x2000E000
-firm_addr equ 0x24000000
+externalFirm equ 0x2000A000
-fopen equ 0x08059D10
+kernelCode equ 0x080F0000
-fread equ 0x0804CC54
+buffer equ 0x24000000
-pxi_wait_recv equ 0x08054134
+fileOpen equ 0x4E45504F ;dummy
 
-.macro svc, num
-	.if isArm()
-		.word 0xEF000000 | num
-	.else
-		.if num > 0xFF
-			.error "bitch you crazu"
-		.endif
-		.halfword 0xDF00 | num
-	.endif
-.endmacro
-
-.create "reboot1.bin", 0x080849DC
-.org 0x080849DC
 .arm
-patch005:
+//Code jumps here right after the sprintf call
-	ldr r0, =0x2000E000
+process9Reboot:
-	mov r1, #0x200
+	doPxi:
-	mov r2, #0
+        ldr r4, =0x44846
-	add r1, r1, r0
+		ldr r0, =0x10008000
-@@memset_loop:
+		readPxiLoop1:
-	str r2, [r0]
+			ldrh r1, [r0,#4]
-	add r0, r0, #4
+			.word 0xE1B01B81	//lsls r1, r1, #0x17
-	cmp r0, r1
+			bmi readPxiLoop1
-	blt @@memset_loop
+			ldr r0, [r0,#0xC]		
-	ldr r0, =0x2000E000
+        cmp r0, r4
-	ldr r1, =firm_fname
+        bne doPxi
-	mov r2, #1
+	
-	blx fopen
+	GetFirmPath:
-	ldr r0, =0x2000E000
+		add r0, sp, #0x3A8-0x70+0x24
-	ldr r1, =0x2000E100
+		ldr r1, [r0], #4
-	mov r2, #firm_addr
+		ldr r2, =0x00300030
-	mov r3, #firm_size
+		cmp r1, r2
-	blx fread
+		ldreq r1, [r0], #4
+		ldreq r2, =0x002F0032
+		cmpeq r1, r2
+		
+	OpenFirm:
+		ldreq r1, =(FileName - OpenFirm - 12)
+		addeq r1, pc
+		addne r1, sp, #0x3A8-0x70
+		ldr r0, =externalFirm
+		moveq r2, #1
+		movne r2, #0
+		str r2, [r0]
+		mov r2, #1
+		add r0, r7, #8
+		ldr r6, =fileOpen
+		blx r6
+	
+    SeekFirm:
+		ldr r0, =externalFirm
+		ldr r0, [r0]
+		cmp r0, #1
+		moveq r0, r7
+        ldreq r1, =byteswritten
+        ldreq r2, =buffer
+        ldreq r3, =0x0
+		ldreq r6, [sp,#0x3A8-0x198]
+		ldreq r6, [r6,#0x28]	//fread function stored here
+		blxeq r6
+		
+	ReadFirm:
+		mov r0, r7
+        ldr r1, =byteswritten
+        ldr r2, =buffer
+        ldr r3, =0x200000
+		ldr r6, [sp,#0x3A8-0x198]
+		ldr r6, [r6,#0x28]	//fread function stored here
+		blx r6
 
-	ldr r4, =0x44846
+    KernelSetState:
-	blx pxi_wait_recv
+        mov r2, #0
-	cmp r0, r4
+        mov r3, r2
-	bne patch005
+        mov r1, r2
-	mov r2, #0
+        mov r0, r2
-	mov r3, r2
+        .word 0xEF00007C    //SVC 0x7C
-	mov r1, r2
+
-	mov r0, r2
+    GoToReboot:
-	svc 0x7C
+        ldr r0, =(KernelCodeStart - GoToReboot - 12)
-	ldr r0, =0x80FF4FC
+		add r0, pc
-	svc 0x7B
+		ldr r1, =kernelCode
+		ldr r2, =0x300
+		bl Memcpy
+		
+		ldr r0, =kernelCode
+        .word 0xEF00007B    //SVC 0x7B
+
+    InfiniteLoop:
+        b InfiniteLoop
+
+Memcpy:
+	MOV     R12, LR
+	STMFD   SP!, {R0-R4}
+	ADD     R2, R2, R0
+
+	memcpyLoop:
+		LDR     R3, [R0],#4
+		STR     R3, [R1],#4
+		CMP     R0, R2
+		BLT     memcpyLoop
+		LDMFD   SP!, {R0-R4}
+		MOV     LR, R12
+		BX      LR
+	
+FileName:
+	.dcw "sdmc:/rei/patched_firmware_sys.bin"
+	.word 0x0
 
-@@inf_loop:
-	b @@inf_loop
-.pool
-firm_fname:
-.close
-
-.create "reboot2.bin", 0x080933CC
-.org 0x080933CC
-.arm
-	stmfd sp!, {r4-r11,lr}
-	sub sp, sp, #0x3C
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r12, c2, c0, 1	; icacheable
-	mrc p15, 0, r1, c3, c0, 0	; write bufferable
-	mrc p15, 0, r2, c5, c0, 2	; daccess
-	mrc p15, 0, r3, c5, c0, 3	; iaccess
-	ldr r4, =0x18000035			; 0x18000000 128M
-	bic r2, r2, #0xF0000		; unprotect region 4
-	bic r3, r3, #0xF0000		; unprotect region 4
-	orr r0, r0, #0x10			; dcacheable region 4
-	orr r2, r2, #0x30000		; region 4 r/w
-	orr r3, r3, #0x30000		; region 4 r/w
-	orr r12, r12, #0x10			; icacheable region 4
-	orr r1, r1, #0x10			; write bufferable region 4
-	mcr p15, 0, r0, c2, c0, 0
-	mcr p15, 0, r12, c2, c0, 1
-	mcr p15, 0, r1, c3, c0, 0	; write bufferable
-	mcr p15, 0, r2, c5, c0, 2	; daccess
-	mcr p15, 0, r3, c5, c0, 3	; iaccess
-	mcr p15, 0, r4, c6, c4, 0	; region 4 (hmmm)
-
-	mrc p15, 0, r0, c2, c0, 0	; dcacheable
-	mrc p15, 0, r1, c2, c0, 1	; icacheable
-	mrc p15, 0, r2, c3, c0, 0	; write bufferable
-	orr r0, r0, #0x20			; dcacheable region 5
-	orr r1, r1, #0x20			; icacheable region 5
-	orr r2, r2, #0x20			; write bufferable region 5
-	mcr p15, 0, r0, c2, c0, 0	; dcacheable
-	mcr p15, 0, r1, c2, c0, 1	; icacheable
-	mcr p15, 0, r2, c3, c0, 0	; write bufferable
-
-	mov r4, #firm_addr
-	add r3, r4, #0x40
-	ldr r0, [r3]				; offset
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0x70
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	add r3, r4, #0xA0
-	ldr r0, [r3]
-	add r0, r0, r4				; src
-	ldr r1, [r3,#4]				; dst
-	ldr r2, [r3,#8]				; size
-	bl memcpy32
-	mov r2, #0
-	mov r1, r2
-@flush_cache:
-	mov r0, #0
-	mov r3, r2, lsl#30
-@flush_cache_inner_loop:
-	orr r12, r3, r0, lsl#5
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mcr p15, 0, r12, c7, c14, 2	; clean and flush dcache entry (index and segment)
-	add r0, r0, #1
-	cmp r0, #0x20
-	bcc @flush_cache_inner_loop
-	add r2, r2, #1
-	cmp r2, #4
-	bcc @flush_cache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-@mpu_enable:
-	ldr r0, =0x42078			; alt vector select, enable itcm
-	mcr p15, 0, r0, c1, c0, 0
-	mcr p15, 0, r1, c7, c5, 0	; flush dcache
-	mcr p15, 0, r1, c7, c6, 0	; flush icache
-	mcr p15, 0, r1, c7, c10, 4	; drain write buffer
-	mov r0, #firm_addr
-	mov r1, 0X1FFFFFFC
-	ldr r2, [r0,#8]				; arm11 entry
-	str r2, [r1]
-	ldr r0, [r0,#0xC]			; arm9 entry
-	add sp, sp, #0x3C
-	ldmfd sp!, {r4-r11,lr}
-	bx r0
-.pool
-memcpy32: ; memcpy32(void *src, void *dst, unsigned int size)
-	mov r12, lr
-	stmfd sp!, {r0-r4}
-	add r2, r2, r0
-@memcpy_loop:
-	ldr r3, [r0], #4
-	str r3, [r1], #4
-	cmp r0, r2
-	blt @memcpy_loop
-	ldmfd sp!, {r0-r4}
-	mov lr, r12
-	bx lr
 .pool
+
+// Kernel Code
+.align 4
+KernelCodeStart:
+	memorySetting:
+		MRC     p15, 0, R0,c2,c0, 0
+        MRC     p15, 0, R12,c2,c0, 1
+        MRC     p15, 0, R1,c3,c0, 0
+        MRC     p15, 0, R2,c5,c0, 2
+        MRC     p15, 0, R3,c5,c0, 3
+        LDR     R4, =0x18000035
+        BIC     R2, R2, #0xF0000
+        BIC     R3, R3, #0xF0000
+        ORR     R0, R0, #0x10
+        ORR     R2, R2, #0x30000
+        ORR     R3, R3, #0x30000
+        ORR     R12, R12, #0x10
+        ORR     R1, R1, #0x10
+        MCR     p15, 0, R0,c2,c0, 0
+        MCR     p15, 0, R12,c2,c0, 1
+        MCR     p15, 0, R1,c3,c0, 0
+        MCR     p15, 0, R2,c5,c0, 2
+        MCR     p15, 0, R3,c5,c0, 3
+        MCR     p15, 0, R4,c6,c4, 0
+        MRC     p15, 0, R0,c2,c0, 0
+        MRC     p15, 0, R1,c2,c0, 1
+        MRC     p15, 0, R2,c3,c0, 0
+        ORR     R0, R0, #0x20
+        ORR     R1, R1, #0x20
+        ORR     R2, R2, #0x20
+        MCR     p15, 0, R0,c2,c0, 0
+        MCR     p15, 0, R1,c2,c0, 1
+        MCR     p15, 0, R2,c3,c0, 0
+
+    copyFirmPartitions:
+        LDR     R4, =buffer
+        ADD     R3, R4, #0x40
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8] 
+		bl KernelMemcpy
+		
+        ADD     R3, R4, #0x70
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+			
+        ADD     R3, R4, #0xA0
+        LDR     R0, [R3]
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+			
+		ADD     R3, R4, #0xD0
+        LDR     R0, [R3]
+		CMP		R0, #0
+		BEQ		invalidateDataCache
+        ADD     R0, R0, R4
+        LDR     R1, [R3,#4]
+        LDR     R2, [R3,#8]
+        bl KernelMemcpy
+		
+    invalidateDataCache:
+        MOV     R2, #0
+        MOV     R1, R2
+        loc_809460C:
+        MOV     R0, #0
+        MOV     R3, R2,LSL#30
+        loc_8094614:
+        ORR     R12, R3, R0,LSL#5
+        MCR     p15, 0, R1,c7,c10, 4
+        MCR     p15, 0, R12,c7,c14, 2
+        ADD     R0, R0, #1
+        CMP     R0, #0x20
+        BCC     loc_8094614
+        ADD     R2, R2, #1
+        CMP     R2, #4
+        BCC     loc_809460C
+
+    jumpToEntrypoint:
+        MCR     p15, 0, R1,c7,c10, 4
+        LDR     R0, =0x42078
+        MCR     p15, 0, R0,c1,c0, 0
+        MCR     p15, 0, R1,c7,c5, 0
+        MCR     p15, 0, R1,c7,c6, 0
+        MCR     p15, 0, R1,c7,c10, 4
+		LDR     R4, =buffer
+        MOV     R1, #0x1FFFFFFC
+		LDR     R2, [R4,#8]
+		STR     R2, [R1]
+		LDR     R0, [R4,#0xC]
+		BX      R0
+.pool
+
+KernelMemcpy:
+	MOV     R12, LR
+	STMFD   SP!, {R0-R4}
+	ADD     R2, R2, R0
+
+	kmemcpyLoop:
+		LDR     R3, [R0],#4
+		STR     R3, [R1],#4
+		CMP     R0, R2
+		BLT     kmemcpyLoop
+		LDMFD   SP!, {R0-R4}
+		MOV     LR, R12
+		BX      LR
+.pool
+
+KernelCodeEnd:
+
 .close

reboot/rebootCodeNtr.s

@@ -1,59 +0,0 @@
-.nds
-
-firm_size equ 0x000EB000
-firm_addr equ 0x24000000
-fopen equ 0x0805B180
-fread equ 0x0804D9B0
-pxi_wait_recv equ 0x08055178
-
-.macro svc, num
-	.if isArm()
-		.word 0xEF000000 | num
-	.else
-		.if num > 0xFF
-			.error "bitch you crazu"
-		.endif
-		.halfword 0xDF00 | num
-	.endif
-.endmacro
-
-.create "reboot1.bin", 0x080859C8
-.org 0x080859C8
-.arm
-patch005:
-	ldr r0, =0x2000E000
-	mov r1, #0x200
-	mov r2, #0
-	add r1, r1, r0
-@@memset_loop:
-	str r2, [r0]
-	add r0, r0, #4
-	cmp r0, r1
-	blt @@memset_loop
-	ldr r0, =0x2000E000
-	ldr r1, =firm_fname
-	mov r2, #1
-	blx fopen
-	ldr r0, =0x2000E000
-	ldr r1, =0x2000E100
-	mov r2, #firm_addr
-	mov r3, #firm_size
-	blx fread
-
-	ldr r4, =0x44846
-	blx pxi_wait_recv
-	cmp r0, r4
-	bne patch005
-	mov r2, #0
-	mov r3, r2
-	mov r1, r2
-	mov r0, r2
-	svc 0x7C
-	ldr r0, =0x80FF4FC
-	svc 0x7B
-
-@@inf_loop:
-	b @@inf_loop
-.pool
-firm_fname:
-.close

source/crypto.c

@@ -5,7 +5,11 @@
 #include <stddef.h>
 #include "memory.h"
 #include "fatfs/sdmmc/sdmmc.h"
-#include "fatfs/ff.h"
+
+//Nand key#2 (0x12C10)
+u8 key2[0x10] = {
+    0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
+};
 
 /****************************************************************
 *                   Crypto Libs
@@ -226,133 +230,6 @@ void aes(void* dst, const void* src, u32 blockCount, void* iv, u32 mode, u32 ivM
 	}
 }
 
-void sha_wait_idle()
-{
-	while(*REG_SHA_CNT & 1);
-}
-
-void sha(void* res, const void* src, u32 size, u32 mode)
-{
-	sha_wait_idle();
-	*REG_SHA_CNT = mode | SHA_CNT_OUTPUT_ENDIAN | SHA_NORMAL_ROUND;
-	
-	const u32* src32	= (const u32*)src;
-	int i;
-	while(size >= 0x40)
-	{
-		sha_wait_idle();
-		for(i = 0; i < 4; ++i)
-		{
-			*REG_SHA_INFIFO = *src32++;
-			*REG_SHA_INFIFO = *src32++;
-			*REG_SHA_INFIFO = *src32++;
-			*REG_SHA_INFIFO = *src32++;
-		}
-
-		size -= 0x40;
-	}
-	
-	sha_wait_idle();
-	memcpy((void*)REG_SHA_INFIFO, src32, size);
-	
-	*REG_SHA_CNT = (*REG_SHA_CNT & ~SHA_NORMAL_ROUND) | SHA_FINAL_ROUND;
-	
-	while(*REG_SHA_CNT & SHA_FINAL_ROUND);
-	sha_wait_idle();
-	
-	u32 hashSize = SHA_256_HASH_SIZE;
-	if(mode == SHA_224_MODE)
-		hashSize = SHA_224_HASH_SIZE;
-	else if(mode == SHA_1_MODE)
-		hashSize = SHA_1_HASH_SIZE;
-
-	memcpy(res, (void*)REG_SHA_HASH, hashSize);
-}
-
-void rsa_wait_idle()
-{
-	while(*REG_RSA_CNT & 1);
-}
-
-void rsa_use_keyslot(u32 keyslot)
-{
-	*REG_RSA_CNT = (*REG_RSA_CNT & ~RSA_CNT_KEYSLOTS) | (keyslot << 4);
-}
-
-void rsa_setkey(u32 keyslot, const void* mod, const void* exp, u32 mode)
-{
-	rsa_wait_idle();
-	*REG_RSA_CNT = (*REG_RSA_CNT & ~RSA_CNT_KEYSLOTS) | (keyslot << 4) | RSA_IO_BE | RSA_IO_NORMAL;
-	
-	u32 size = mode * 4;
-	
-	volatile u32* keyslotCnt = REG_RSA_SLOT0 + (keyslot << 4);
-	keyslotCnt[0] &= ~(RSA_SLOTCNT_KEY_SET | RSA_SLOTCNT_WPROTECT);
-	keyslotCnt[1] = mode;
-	
-	memcpy((void*)REG_RSA_MOD_END - size, mod, size);
-	
-	if(exp == NULL)
-	{
-		size -= 4;
-		while(size)
-		{
-			*REG_RSA_EXPFIFO = 0;
-			size -= 4;
-		}
-		*REG_RSA_EXPFIFO = 0x01000100; // 0x00010001 byteswapped
-	}
-	else
-	{
-		const u32* exp32 = (const u32*)exp;
-		while(size)
-		{
-			*REG_RSA_EXPFIFO = *exp32++;
-			size -= 4;
-		}
-	}
-}
-
-int rsa_iskeyset(u32 keyslot)
-{
-	return *(REG_RSA_SLOT0 + (keyslot << 4)) & 1;
-}
-
-void rsa(void* dst, const void* src, u32 size)
-{
-	u32 keyslot = (*REG_RSA_CNT & RSA_CNT_KEYSLOTS) >> 4;
-	if(rsa_iskeyset(keyslot) == 0)
-		return;
-
-	rsa_wait_idle();
-	*REG_RSA_CNT |= RSA_IO_BE | RSA_IO_NORMAL;
-	
-	// Pad the message with zeroes so that it's a multiple of 8
-	// and write the message with the end aligned with the register
-	u32 padSize = ((size + 7) & ~7) - size;
-	memset((void*)REG_RSA_TXT_END - (size + padSize), 0, padSize);
-	memcpy((void*)REG_RSA_TXT_END - size, src, size);
-	
-	// Start
-	*REG_RSA_CNT |= RSA_CNT_START;
-	
-	rsa_wait_idle();
-	memcpy(dst, (void*)REG_RSA_TXT_END - size, size);
-}
-
-int rsa_verify(const void* data, u32 size, const void* sig, u32 mode)
-{
-	u8 dataHash[SHA_256_HASH_SIZE];
-	sha(dataHash, data, size, SHA_256_MODE);
-	
-	u8 decSig[0x100]; // Way too big, need to request a work area
-	
-	u32 sigSize = mode * 4;
-	rsa(decSig, sig, sigSize);
-	
-	return memcmp(dataHash, decSig + (sigSize - SHA_256_HASH_SIZE), SHA_256_HASH_SIZE) == 0;
-}
-
 /****************************************************************
 *                   Nand/FIRM Crypto stuff
 ****************************************************************/
@@ -375,48 +252,47 @@ void nandFirm0(u8 *outbuf, const u32 size, u8 console){
     aes(outbuf, outbuf, size / AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 }
 
-//Emulates the Arm9loader process
+//Decrypts the N3DS arm9bin
-void arm9loader(void *armHdr, u8 mode){
+void decArm9Bin(void *armHdr, u8 mode){
-    //Nand key#2 (0x12C10)
-    u8 key2[0x10] = {
-        0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
-    };
 
     //Firm keys
     u8 keyX[0x10];
     u8 keyY[0x10];
     u8 CTR[0x10];
-    u32 slot = mode ? 0x16 : 0x15;
+    u8 slot = mode ? 0x16 : 0x15;
-    
+
     //Setup keys needed for arm9bin decryption
-    memcpy((u8*)keyY, (void *)((uintptr_t)armHdr+0x10), 0x10);
+    memcpy(keyY, armHdr+0x10, 0x10);
-    memcpy((u8*)CTR, (void *)((uintptr_t)armHdr+0x20), 0x10);
+    memcpy(CTR, armHdr+0x20, 0x10);
-    u32 size = atoi((void *)((uintptr_t)armHdr+0x30));
+    u32 size = atoi(armHdr+0x30);
 
     if(mode){
         //Set 0x11 to key2 for the arm9bin and misc keys
-        aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
+        aes_setkey(0x11, key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
         aes_use_keyslot(0x11);
-        aes((u8*)keyX, (void *)((uintptr_t)armHdr+0x60), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes(keyX, armHdr+0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
-        aes_setkey(slot, (u8*)keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+        aes_setkey(slot, keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
     }
 
-    aes_setkey(slot, (u8*)keyY, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_setkey(slot, keyY, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
-    aes_setiv((u8*)CTR, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_setiv(CTR, AES_INPUT_BE | AES_INPUT_NORMAL);
     aes_use_keyslot(slot);
-    
-    //Decrypt arm9bin
-    aes((void *)(armHdr+0x800), (void *)(armHdr+0x800), size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 
-    if(mode){
+    //Decrypt arm9bin
-        //Set keys 0x19..0x1F keyXs
+    aes(armHdr+0x800, armHdr+0x800, size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
-        u8* decKey = (void *)((uintptr_t)armHdr+0x89824);
+}
-        aes_use_keyslot(0x11);
+
-        for(slot = 0x19; slot < 0x20; slot++) {
+//Sets the N3DS 9.6 KeyXs
-            aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
+void setKeyXs(void *armHdr){
-            aes(decKey, (void *)((uintptr_t)armHdr+0x89814), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+
-            aes_setkey(slot, (u8*)decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+    //Set keys 0x19..0x1F keyXs
-            *(u8 *)((void *)((uintptr_t)armHdr+0x89814+0xF)) += 1;
+    void *keyData = armHdr+0x89814;
-        }
+    void *decKey = keyData+0x10;
+    aes_setkey(0x11, key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_use_keyslot(0x11);
+    for(u8 slot = 0x19; slot < 0x20; slot++){
+        aes(decKey, keyData, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes_setkey(slot, decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+        *(u8*)(keyData+0xF) += 1;
     }
 }

source/crypto.h

@@ -6,16 +6,6 @@
 #include <stdint.h>
 #include "types.h"
 
-#define FIRM_TYPE_ARM9          0
-#define FIRM_TYPE_ARM11         1
-
-#define MEDIA_UNITS             0x200
-
-#define NCCH_MAGIC              (0x4843434E)
-#define NCSD_MAGIC              (0x4453434E)
-#define FIRM_MAGIC              (0x4D524946)
-#define ARM9BIN_MAGIC           (0x47704770)
-
 /**************************AES****************************/
 #define REG_AESCNT				((volatile u32*)0x10009000)
 #define REG_AESBLKCNT			((volatile u32*)0x10009004)
@@ -52,8 +42,6 @@
 #define AES_INPUT_NORMAL		(AES_CNT_INPUT_ORDER)
 #define AES_INPUT_REVERSED		0
 
-#define AES_TEMP_KEYSLOT		0x11
-
 #define AES_BLOCK_SIZE			0x10
 
 #define AES_KEYCNT_WRITE		(1 << 0x7)
@@ -61,78 +49,9 @@
 #define AES_KEYX				1
 #define AES_KEYY				2
 
-/**************************SHA****************************/
-#define REG_SHA_CNT				((volatile u32*)0x1000A000)
-#define REG_SHA_BLKCNT			((volatile u32*)0x1000A004)
-#define REG_SHA_HASH			((volatile u32*)0x1000A040)
-#define REG_SHA_INFIFO			((volatile u32*)0x1000A080)
-
-#define SHA_CNT_STATE			0x00000003
-#define SHA_CNT_UNK2			0x00000004
-#define SHA_CNT_OUTPUT_ENDIAN	0x00000008
-#define SHA_CNT_MODE			0x00000030
-#define SHA_CNT_ENABLE			0x00010000
-#define SHA_CNT_ACTIVE			0x00020000
-
-#define SHA_HASH_READY			0x00000000
-#define SHA_NORMAL_ROUND		0x00000001
-#define SHA_FINAL_ROUND			0x00000002
-
-#define SHA_OUTPUT_BE			SHA_CNT_OUTPUT_ENDIAN
-#define SHA_OUTPUT_LE			0
-
-#define SHA_256_MODE			0
-#define SHA_224_MODE			0x00000010
-#define SHA_1_MODE				0x00000020
-
-#define SHA_256_HASH_SIZE		(256 / 8)
-#define SHA_224_HASH_SIZE		(224 / 8)
-#define SHA_1_HASH_SIZE			(160 / 8)
-
-/**************************RSA****************************/
-#define REG_RSA_CNT				((volatile u32*)0x1000B000)
-#define REG_RSA_SLOT0			((volatile u32*)0x1000B100)
-#define REG_RSA_SLOT1			((volatile u32*)0x1000B110)
-#define REG_RSA_SLOT2			((volatile u32*)0x1000B120)
-#define REG_RSA_SLOT3			((volatile u32*)0x1000B130)
-#define REG_RSA_EXPFIFO			((volatile u32*)0x1000B200)
-#define REG_RSA_MOD_END			((volatile u32*)0x1000B500)
-#define REG_RSA_TXT_END			((volatile u32*)0x1000B900)
-
-#define RSA_CNT_START			0x00000001
-#define RSA_CNT_KEYSLOTS		0x000000F0
-#define RSA_CNT_IO_ENDIAN		0x00000100
-#define RSA_CNT_IO_ORDER		0x00000200
-
-#define RSA_SLOTCNT_KEY_SET		0x00000001
-#define RSA_SLOTCNT_WPROTECT	0x00000002 // Write protect
-
-#define RSA_IO_BE				RSA_CNT_IO_ENDIAN
-#define RSA_IO_LE				0
-#define RSA_IO_NORMAL			RSA_CNT_IO_ORDER
-#define RSA_IO_REVERSED			0
-
-#define RSA_TEMP_KEYSLOT		0
-
-#define RSA_1024_MODE			0x20
-#define RSA_2048_MODE			0x40
-
-//Crypto Libs
-void aes_setkey(u8 keyslot, const void* key, u32 keyType, u32 mode);
-void aes_use_keyslot(u8 keyslot);
-void aes(void* dst, const void* src, u32 blockCount, void* iv, u32 mode, u32 ivMode);
-void aes_setiv(const void* iv, u32 mode);
-void aes_advctr(void* ctr, u32 val, u32 mode);
-void aes_change_ctrmode(void* ctr, u32 fromMode, u32 toMode);
-void aes_batch(void* dst, const void* src, u32 blockCount);
-void sha(void* res, const void* src, u32 size, u32 mode);
-void rsa_setkey(u32 keyslot, const void* mod, const void* exp, u32 mode);
-void rsa_use_keyslot(u32 keyslot);
-int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
-
 //NAND/FIRM stuff
-void getNandCTR(u8 *buf, u8 console);
 void nandFirm0(u8 *outbuf, const u32 size, u8 console);
-void arm9loader(void *armHdr, u8 mode);
+void decArm9Bin(void *armHdr, u8 mode);
+void setKeyXs(void *armHdr);
 
 #endif /*__CRYPTO_H*/

source/draw.c

@@ -7,17 +7,38 @@
 #include "draw.h"
 #include "fs.h"
 #include "memory.h"
+#include "types.h"
 
-static struct fb* fb = (struct fb*) 0x23FFFE00;
+static struct fb *fb = (struct fb *)0x23FFFE00;
+
+void shutdownLCD(void){
+
+    vu32 *arm11 = (vu32*)0x1FFFFFF8;
+
+    //Clear ARM11 entry offset
+    *arm11 = 0;
+
+    //Shutdown LCDs
+    *(vu32*)0x10202A44 = 0;
+    *(vu32*)0x10202244 = 0;
+    *(vu32*)0x10202014 = 0;
+    
+    //Wait for the ARM11 entrypoint to be set
+    while (!*arm11);
+    //Jump to it
+    ((void (*)())*arm11)();
+}
 
 void clearScreen(void){
-    memset(fb->top_left, 0, 0x38400);
+    memset(fb->top_left, 0, 0x46500);
-    memset(fb->top_right, 0, 0x38400);
+    memset(fb->top_right, 0, 0x46500);
     memset(fb->bottom, 0, 0x38400);
 }
 
 void loadSplash(void){
+    //Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
+    if (*(u8*)0x10141200 == 0x1) return;
     clearScreen();
     if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;
-    unsigned i,t; for(t=220;t>0;t--){for(i=0xFFFF;i>0;i--);}; //Ghetto sleep func
+    u64 i = 0xFFFFFF; while(--i) __asm("mov r0, r0"); //Less Ghetto sleep func
 }

source/draw.h

@@ -12,5 +12,5 @@ struct fb {
     u8 *bottom;
 };
 
-void clearScreen(void);
+void loadSplash(void);
-void loadSplash(void);
+void shutdownLCD(void);

source/firm.c

@@ -10,55 +10,111 @@
 #include "fs.h"
 #include "emunand.h"
 #include "crypto.h"
+#include "draw.h"
 
 firmHeader *firmLocation = (firmHeader *)0x24000000;
 firmSectionHeader *section;
 u32 firmSize = 0;
 u8  mode = 1,
     console = 1,
+    emuNAND = 0,
     a9lhSetup = 0,
-    updatedSys = 0;
+    updatedSys = 0,
+    usePatchedFirm = 0;
 u16 pressed;
+char *firmPathPatched = NULL;
 
-//Load firm into FCRAM
+void setupCFW(void){
-u8 loadFirm(u8 a9lhBoot){
+
+    u8 overrideConfig = 0;
 
     //Detect the console being used
     if(PDN_MPCORE_CFG == 1) console = 0;
+
     //Get pressed buttons
     pressed = HID_PAD;
-    //Determine if A9LH is installed
+
-    if(a9lhBoot || fileExists("/rei/installeda9lh")){
+    //Determine if A9LH is installed via PDN_SPI_CNT and an user flag
+    if((*(u8*)0x101401C0 == 0x0) || fileExists("/rei/installeda9lh")){
         a9lhSetup = 1;
         //Check flag for > 9.2 SysNAND
         if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
     }
 
-    section = firmLocation->section;
+    //If using A9LH and it's a MCU reboot, try to force boot options
+    if(a9lhSetup && *(u8*)0x10010000 && fileExists("rei/lastbootcfg")){
+        u8 tempConfig;
+        fileRead((u8*)&tempConfig, "rei/lastbootcfg", 1);
 
-    /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
+        //Always force a sysNAND boot when quitting AGB_FIRM
-       is not pressed, boot 9.0 FIRM */
+        if(*(u8*)0x10010000 == 0x7) {
-    if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+            mode = updatedSys ? 1 : (tempConfig & 0x1);
+            emuNAND = 0;
+            overrideConfig = 1;
+        //Else, force the last boot options unless A is pressed
+        } else if(!(pressed & BUTTON_A)) {
+            mode = tempConfig & 0x1;
+            emuNAND = (tempConfig >> 1) & 0x1;
+            overrideConfig = 1;
+        }
+    }
 
-    //If not using an A9LH setup, do so by decrypting FIRM0
+    if(!overrideConfig){
-    if(!a9lhSetup && !mode){
+
+        /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
+           is not pressed, boot 9.0 FIRM */
+        if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+
+        /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
+           or R is pressed on a > 9.2 SysNAND, boot emuNAND */
+        if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
+           (!updatedSys && mode && !(pressed & BUTTON_R1))) emuNAND = 1;
+
+        //Write the current boot options on A9LH
+        if(a9lhSetup){
+            u8 tempConfig = (mode | (emuNAND << 1)) & 0x3;
+            fileWrite((u8*)&tempConfig, "rei/lastbootcfg", 1);
+        }
+    }
+
+    if(mode) firmPathPatched = emuNAND ? "/rei/patched_firmware_emu.bin" :
+                                         "/rei/patched_firmware_sys.bin";
+
+    //Skip decrypting and patching FIRM
+    if(fileExists("/rei/usepatchedfw")){
+        //Only needed with this flag
+        if(!mode) firmPathPatched = "/rei/patched_firmware90.bin";
+        if (fileExists(firmPathPatched)) usePatchedFirm = 1;
+    }
+}
+
+//Load firm into FCRAM
+u8 loadFirm(void){
+
+    //If not using an A9LH setup or the patched FIRM, load 9.0 FIRM from NAND
+    if(!usePatchedFirm && !a9lhSetup && !mode){
         //Read FIRM from NAND and write to FCRAM
         firmSize = console ? 0xF2000 : 0xE9000;
         nandFirm0((u8*)firmLocation, firmSize, console);
+        //Check for correct decryption
         if(memcmp((u8*)firmLocation, "FIRM", 4) != 0) return 1;
     }
     //Load FIRM from SD
     else{
-        char firmPath[] = "/rei/firmware.bin";
+        char *path = usePatchedFirm ? firmPathPatched :
-        char firmPath2[] = "/rei/firmware90.bin";
+                                      (mode ? "/rei/firmware.bin" : "/rei/firmware90.bin");
-        char *pathPtr = mode ? firmPath : firmPath2;
+        firmSize = fileSize(path);
-        firmSize = fileSize(pathPtr);
         if (!firmSize) return 1;
-        fileRead((u8*)firmLocation, pathPtr, firmSize);
+        fileRead((u8*)firmLocation, path, firmSize);
     }
+
+    section = firmLocation->section;
+
+    //Check that the loaded FIRM matches the console
     if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
 
-    if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
+    if(console && !usePatchedFirm)
+        decArm9Bin((u8*)firmLocation + section[2].offset, mode);
 
     return 0;
 }
@@ -96,6 +152,7 @@ u8 loadEmu(void){
     *pos_sdmmc = sdmmcOffset;
     *pos_offset = emuOffset;
     *pos_header = emuHeader;
+
     //Patch emuNAND code in memory for O3DS and 9.0 N3DS
     if(!console || !mode){
         u32 *pos_instr = memsearch((u32*)emuCodeOffset, "\xA6\x01\x08\x30", size, 4);
@@ -115,89 +172,82 @@ u8 loadEmu(void){
 //Patches
 u8 patchFirm(void){
 
-    /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
+    //Skip patching
-       or R is pressed on a > 9.2 SysNAND, boot emuNAND */
+    if(usePatchedFirm) return 0;
-    if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
+
-       (!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){
+    //Apply emuNAND patches
+    if(emuNAND){
         if (loadEmu()) return 1;
     }
-    else if(a9lhSetup){
+    else if (a9lhSetup){
         //Patch FIRM partitions writes on SysNAND to protect A9LH
         u32 writeOffset = 0;
         getFIRMWrite(firmLocation, firmSize, &writeOffset);
         memcpy((u8*)writeOffset, FIRMblock, sizeof(FIRMblock));
     }
 
+    //Disable signature checks
     u32 sigOffset = 0,
         sigOffset2 = 0;
 
-    //Disable signature checks
     getSignatures(firmLocation, firmSize, &sigOffset, &sigOffset2);
     memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
     memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
 
-    //Apply FIRM reboot patch. Not needed on N3DS
+    //Patch ARM9 entrypoint on N3DS to skip arm9loader
-    if(!console && mode && pressed != SAFEMODE &&
+    if(console){
-       fileExists("/rei/reversereboot") == (pressed & BUTTON_A)){
+        u32 *arm9 = (u32*)&firmLocation->arm9Entry;
-        u32 rebootOffset = 0,
+        *arm9 = 0x801B01C;
-            rebootOffset2 = 0;
+    }
 
-        //Read reboot code from SD and write patched FIRM path in memory
+    //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
-        char path[] = "/rei/reboot/reboot1.bin";
+    if(mode){
+        u32 rebootOffset = 0,
+            fOpenOffset = 0;
+
+        //Read reboot code from SD
+        char *path = "/rei/reboot/reboot.bin";
         u32 size = fileSize(path);
         if (!size) return 1;
-        getReboot(firmLocation, firmSize, &rebootOffset, &rebootOffset2);
+        getReboot(firmLocation, firmSize, &rebootOffset);
         fileRead((u8*)rebootOffset, path, size);
-        memcpy((u8*)rebootOffset + size, L"sdmc:", 10);
-        memcpy((u8*)rebootOffset + size + 10, L"" PATCHED_FIRM_PATH, sizeof(PATCHED_FIRM_PATH) * 2);
-        path[18] = '2';
-        size = fileSize(path);
-        if (!size) return 1;
-        fileRead((u8*)rebootOffset2, path, size);
 
-        //Write patched FIRM to SD
+        //Calculate the fOpen offset and put it in the right location
-        if (fileWrite((u8*)firmLocation, PATCHED_FIRM_PATH, firmSize) != 0) return 1;
+        u32 *pos_fopen = memsearch((u32*)rebootOffset, "OPEN", size, 4);
+        getfOpen(firmLocation, firmSize, &fOpenOffset);
+        *pos_fopen = fOpenOffset;
+
+        //Patch path for emuNAND-patched FIRM
+        if(emuNAND){
+            u32 *pos_path = memsearch((u32*)rebootOffset, L"sy", size, 4);
+            memcpy((u8*)pos_path, L"emu", 5);
+        }
     }
 
+    //Write patched FIRM to SD if needed
+    if(firmPathPatched)
+        if(fileWrite((u8*)firmLocation, firmPathPatched, firmSize) != 0) return 1;
+
     return 0;
 }
 
-//Firmlaunchhax
 void launchFirm(void){
 
-    //Set MPU
+    if(console && mode) setKeyXs((u8*)firmLocation + section[2].offset);
-    __asm__ (
+
-        "msr cpsr_c, #0xDF\n\t"         //Set system mode, disable interrupts
-        "ldr r0, =0x10000035\n\t"       //Memory area 0x10000000-0x18000000, enabled, 128MB
-        "ldr r4, =0x18000035\n\t"       //Memory area 0x18000000-0x20000000, enabled, 128MB
-        "mcr p15, 0, r0, c6, c3, 0\n\t" //Set memory area 3 (0x10000000-0x18000000)
-        "mcr p15, 0, r4, c6, c4, 0\n\t" //Set memory area 4 (0x18000000-0x20000000)
-        "mrc p15, 0, r0, c2, c0, 0\n\t" //read data cacheable bit
-        "mrc p15, 0, r4, c2, c0, 1\n\t" //read inst cacheable bit
-        "mrc p15, 0, r1, c3, c0, 0\n\t" //read data writeable
-        "mrc p15, 0, r2, c5, c0, 2\n\t" //read data access permission
-        "mrc p15, 0, r3, c5, c0, 3\n\t" //read inst access permission
-        "orr r0, r0, #0x30\n\t"
-        "orr r4, r4, #0x30\n\t"
-        "orr r1, r1, #0x30\n\t"
-        "bic r2, r2, #0xF0000\n\t"
-        "bic r3, r3, #0xF0000\n\t"
-        "orr r2, r2, #0x30000\n\t"
-        "orr r3, r3, #0x30000\n\t"
-        "mcr p15, 0, r0, c2, c0, 0\n\t" //write data cacheable bit
-        "mcr p15, 0, r4, c2, c0, 1\n\t" //write inst cacheable bit
-        "mcr p15, 0, r1, c3, c0, 0\n\t" //write data writeable
-        "mcr p15, 0, r2, c5, c0, 2\n\t" //write data access permission
-        "mcr p15, 0, r3, c5, c0, 3\n\t" //write inst access permission
-        ::: "r0", "r1", "r2", "r3", "r4"
-    );
-    
     //Copy firm partitions to respective memory locations
     memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
     memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
     memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
-    *(u32 *)0x1FFFFFF8 = (u32)firmLocation->arm11Entry;
+
+    //Run ARM11 screen stuff
+    vu32 *arm11 = (vu32*)0x1FFFFFF8;
+    *arm11 = (u32)shutdownLCD;
+    while (*arm11);
+    
+    //Set ARM11 kernel
+    *arm11 = (u32)firmLocation->arm11Entry;
     
     //Final jump to arm9 binary
-    console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();
+    ((void (*)())firmLocation->arm9Entry)();
 }

source/firm.h

@@ -14,10 +14,9 @@
 #define BUTTON_L1          (1 << 9)
 #define BUTTON_A           1
 #define SAFEMODE           (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6))
-#define PATCHED_FIRM_PATH  "/rei/patched_firmware.bin"
 
-u8 loadFirm(u8 a9lhBoot);
+void setupCFW(void);
-u8 loadEmu(void);
+u8 loadFirm(void);
 u8 patchFirm(void);
 void launchFirm(void);
 

source/main.c

@@ -10,14 +10,11 @@
 #include "firm.h"
 #include "draw.h"
 
-u8 a9lhBoot = 0;
-
 u8 main(){
     mountSD();
-    //Detect an A9LH boot checking PDN_GPU_CNT register
+    loadSplash();
-    if (*((u8*)0x10141200) == 0x1) a9lhBoot = 1;
+    setupCFW();
-    else loadSplash();
+    if (loadFirm()) return 1;
-    if (loadFirm(a9lhBoot)) return 1;
     if (patchFirm()) return 1;
     launchFirm();
     return 0;

source/memory.c

@@ -5,10 +5,6 @@
 */
 #include "memory.h"
 
-void memcpy32(u32 *dest, u32 *src, u32 size){
-    for (u32 i = 0; i < size; i++) dest[i] = src[i];
-}
-
 void memcpy(void *dest, const void *src, u32 size){
     char *destc = (char *)dest;
     const char *srcc = (const char *)src;

source/memory.h

@@ -9,7 +9,6 @@
 #include "types.h"
 
 void memcpy(void *dest, const void *src, u32 size);
-void memcpy32(u32 *dest, u32 *src, u32 size);
 void memset(void *dest, int filler, u32 size);
 int memcmp(const void *buf1, const void *buf2, u32 size);
 void *memsearch(void *start_pos, void *search, u32 size, u32 size_search);

source/patches.c

@@ -43,13 +43,20 @@ void getSignatures(void *pos, u32 size, u32 *off, u32 *off2){
     *off2 = (u32)memsearch(pos, pattern2, size, 4) - 1;
 }
 
-void getReboot(void *pos, u32 size, u32 *off, u32 *off2){
+void getReboot(void *pos, u32 size, u32 *off){
     //Look for FIRM reboot code
-    unsigned char pattern[] = {0x8D, 0xE5, 0x00, 0xC0, 0x91};
+    unsigned char pattern[] = {0xDE, 0x1F, 0x8D, 0xE2};
-    unsigned char pattern2[] = {0xF0, 0x4F, 0x2D, 0xE9, 0x3C};
 
-    *off = (u32)memsearch(pos, pattern, size, 5) + 2;
+    *off = (u32)memsearch(pos, pattern, size, 4) - 0x10;
-    *off2 = (u32)memsearch(pos, pattern2, size, 5);
+}
+
+void getfOpen(void *pos, u32 size, u32 *off){
+    //Calculate fOpen
+    u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
+    u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
+    unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
+
+    *off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;
 }
 
 void getFIRMWrite(void *pos, u32 size, u32 *off){

source/patches.h

@@ -22,7 +22,8 @@ u8 emuInstr[5];
 *                   Functions
 **************************************************/
 void getSignatures(void *pos, u32 size, u32 *off, u32 *off2);
-void getReboot(void *pos, u32 size, u32 *off, u32 *off2);
+void getReboot(void *pos, u32 size, u32 *off);
+void getfOpen(void *pos, u32 size, u32 *off);
 void getFIRMWrite(void *pos, u32 size, u32 *off);
 
 #endif

source/start.s

@@ -5,39 +5,49 @@ _start:
     @ Change the stack pointer
     mov sp, #0x27000000
 
+    @ Give read/write access to all the memory regions
+    ldr r5, =0x33333333
+    mcr p15, 0, r5, c5, c0, 2 @ write data access
+    mcr p15, 0, r5, c5, c0, 3 @ write instruction access
+
     @ Sets MPU permissions and cache settings
-    ldr r0, =0xFFFF001D			@ ffff0000 32k
+    ldr r0, =0xFFFF001D	@ ffff0000 32k
-	ldr r1, =0x01FF801D			@ 01ff8000 32k
+    ldr r1, =0x01FF801D	@ 01ff8000 32k
-	ldr r2, =0x08000027			@ 08000000 1M
+    ldr r2, =0x08000027	@ 08000000 1M
-	ldr r3, =0x10000021			@ 10000000 128k
+    ldr r3, =0x10000021	@ 10000000 128k
-	ldr r4, =0x10100025			@ 10100000 512k
+    ldr r4, =0x10100025	@ 10100000 512k
-	ldr r5, =0x20000035			@ 20000000 128M
+    ldr r5, =0x20000035	@ 20000000 128M
-	ldr r6, =0x2800801B			@ 28008000 16k
+    ldr r6, =0x1FF00027	@ 1FF00000 1M
-	ldr r7, =0x1800002D			@ 18000000 8M
+    ldr r7, =0x1800002D	@ 18000000 8M
-	ldr r8, =0x33333336
+    mov r10, #0x25
-	ldr r9, =0x60600666
+    mov r11, #0x25
-	mov r10, #0x25
+    mov r12, #0x25
-	mov r11, #0x25
+    mcr p15, 0, r0, c6, c0, 0
-	mov r12, #0x25
+    mcr p15, 0, r1, c6, c1, 0
-	mcr p15, 0, r0, c6, c0, 0
+    mcr p15, 0, r2, c6, c2, 0
-	mcr p15, 0, r1, c6, c1, 0
+    mcr p15, 0, r3, c6, c3, 0
-	mcr p15, 0, r2, c6, c2, 0
+    mcr p15, 0, r4, c6, c4, 0
-	mcr p15, 0, r3, c6, c3, 0
+    mcr p15, 0, r5, c6, c5, 0
-	mcr p15, 0, r4, c6, c4, 0
+    mcr p15, 0, r6, c6, c6, 0
-	mcr p15, 0, r5, c6, c5, 0
+    mcr p15, 0, r7, c6, c7, 0
-	mcr p15, 0, r6, c6, c6, 0
+    mcr p15, 0, r10, c3, c0, 0	@ Write bufferable 0, 2, 5
-	mcr p15, 0, r7, c6, c7, 0
+    mcr p15, 0, r11, c2, c0, 0	@ Data cacheable 0, 2, 5
-	mcr p15, 0, r8, c5, c0, 2	@ Enable data r/w for all regions
+    mcr p15, 0, r12, c2, c0, 1	@ Inst cacheable 0, 2, 5
-	mcr p15, 0, r9, c5, c0, 3	@ Enable inst read for 0, 1, 2, 5, 7
-	mcr p15, 0, r10, c3, c0, 0	@ Write bufferable 0, 2, 5
-	mcr p15, 0, r11, c2, c0, 0	@ Data cacheable 0, 2, 5
-	mcr p15, 0, r12, c2, c0, 1	@ Inst cacheable 0, 2, 5
 
-    @ Enables all the settings we specified above
+    @ Enable caches
-	ldr r0, =0x5307D
+    mrc p15, 0, r4, c1, c0, 0  @ read control register
-	mcr p15, 0, r0, c1, c0, 0	@ cp15 ctl register enable mpu, enable cache and use alt vector table
+    orr r4, r4, #(1<<12)       @ - instruction cache enable
+    orr r4, r4, #(1<<2)        @ - data cache enable
+    orr r4, r4, #(1<<0)        @ - mpu enable
+    mcr p15, 0, r4, c1, c0, 0  @ write control register
 
-    @ Undocumented: Fixes mounting of SDMC
+    @ Flush caches
+    mov r5, #0
+    mcr p15, 0, r5, c7, c5, 0  @ flush I-cache
+    mcr p15, 0, r5, c7, c6, 0  @ flush D-cache
+    mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
+
+    @ Fixes mounting of SDMC
 	ldr r0, =0x10000020
 	mov r1, #0x340
 	str r1, [r0]

source/start.s.a9lh

@@ -1,34 +0,0 @@
-.section .text.start
-.align 4
-.global _start
-_start:
-    @ Change the stack pointer
-    mov sp, #0x27000000
-
-    @ Give read/write access to all the memory regions
-    ldr r5, =0x33333333
-    mcr p15, 0, r5, c5, c0, 2 @ write data access
-    mcr p15, 0, r5, c5, c0, 3 @ write instruction access
-    
-    @ Enable caches
-    mrc p15, 0, r4, c1, c0, 0  @ read control register
-    orr r4, r4, #(1<<12)       @ - instruction cache enable
-    orr r4, r4, #(1<<2)        @ - data cache enable
-    orr r4, r4, #(1<<0)        @ - mpu enable
-    mcr p15, 0, r4, c1, c0, 0  @ write control register
-    
-    @ Flush caches
-    mov r5, #0
-    mcr p15, 0, r5, c7, c5, 0  @ flush I-cache
-    mcr p15, 0, r5, c7, c6, 0  @ flush D-cache
-    mcr p15, 0, r5, c7, c10, 4 @ drain write buffer
-
-    @ Fixes mounting of SDMC
-	ldr r0, =0x10000020
-	mov r1, #0x340
-	str r1, [r0]
-
-    bl main
-
-.die:
-    b .die

source/types.h

@@ -14,6 +14,10 @@ typedef uint8_t u8;
 typedef uint16_t u16;
 typedef uint32_t u32;
 typedef uint64_t u64;
+typedef volatile uint8_t vu8;
+typedef volatile uint16_t vu16;
+typedef volatile uint32_t vu32;
+typedef volatile uint64_t vu64;
 
 //FIRM Header layout
 typedef struct firmSectionHeader {