Previous release broke .dat booting from a 9.0 NAND if A9LH was installed

Also, more clean-up

reboot/rebootCode.s

@@ -99,7 +99,7 @@ Memcpy:
 		BX      LR
 	
 FileName:
-	.dcw "sdmc:/rei/patched_firmware.bin"
+	.dcw "sdmc:/rei/patched_firmware_sys.bin"
 	.word 0x0
 
 .pool

source/crypto.c

@@ -5,7 +5,11 @@
 #include <stddef.h>
 #include "memory.h"
 #include "fatfs/sdmmc/sdmmc.h"
-#include "fatfs/ff.h"
+
+//Nand key#2 (0x12C10)
+u8 key2[0x10] = {
+    0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
+};
 
 /****************************************************************
 *                   Crypto Libs
@@ -226,133 +230,6 @@ void aes(void* dst, const void* src, u32 blockCount, void* iv, u32 mode, u32 ivM
 	}
 }
 
-void sha_wait_idle()
-{
-	while(*REG_SHA_CNT & 1);
-}
-
-void sha(void* res, const void* src, u32 size, u32 mode)
-{
-	sha_wait_idle();
-	*REG_SHA_CNT = mode | SHA_CNT_OUTPUT_ENDIAN | SHA_NORMAL_ROUND;
-	
-	const u32* src32	= (const u32*)src;
-	int i;
-	while(size >= 0x40)
-	{
-		sha_wait_idle();
-		for(i = 0; i < 4; ++i)
-		{
-			*REG_SHA_INFIFO = *src32++;
-			*REG_SHA_INFIFO = *src32++;
-			*REG_SHA_INFIFO = *src32++;
-			*REG_SHA_INFIFO = *src32++;
-		}
-
-		size -= 0x40;
-	}
-	
-	sha_wait_idle();
-	memcpy((void*)REG_SHA_INFIFO, src32, size);
-	
-	*REG_SHA_CNT = (*REG_SHA_CNT & ~SHA_NORMAL_ROUND) | SHA_FINAL_ROUND;
-	
-	while(*REG_SHA_CNT & SHA_FINAL_ROUND);
-	sha_wait_idle();
-	
-	u32 hashSize = SHA_256_HASH_SIZE;
-	if(mode == SHA_224_MODE)
-		hashSize = SHA_224_HASH_SIZE;
-	else if(mode == SHA_1_MODE)
-		hashSize = SHA_1_HASH_SIZE;
-
-	memcpy(res, (void*)REG_SHA_HASH, hashSize);
-}
-
-void rsa_wait_idle()
-{
-	while(*REG_RSA_CNT & 1);
-}
-
-void rsa_use_keyslot(u32 keyslot)
-{
-	*REG_RSA_CNT = (*REG_RSA_CNT & ~RSA_CNT_KEYSLOTS) | (keyslot << 4);
-}
-
-void rsa_setkey(u32 keyslot, const void* mod, const void* exp, u32 mode)
-{
-	rsa_wait_idle();
-	*REG_RSA_CNT = (*REG_RSA_CNT & ~RSA_CNT_KEYSLOTS) | (keyslot << 4) | RSA_IO_BE | RSA_IO_NORMAL;
-	
-	u32 size = mode * 4;
-	
-	volatile u32* keyslotCnt = REG_RSA_SLOT0 + (keyslot << 4);
-	keyslotCnt[0] &= ~(RSA_SLOTCNT_KEY_SET | RSA_SLOTCNT_WPROTECT);
-	keyslotCnt[1] = mode;
-	
-	memcpy((void*)REG_RSA_MOD_END - size, mod, size);
-	
-	if(exp == NULL)
-	{
-		size -= 4;
-		while(size)
-		{
-			*REG_RSA_EXPFIFO = 0;
-			size -= 4;
-		}
-		*REG_RSA_EXPFIFO = 0x01000100; // 0x00010001 byteswapped
-	}
-	else
-	{
-		const u32* exp32 = (const u32*)exp;
-		while(size)
-		{
-			*REG_RSA_EXPFIFO = *exp32++;
-			size -= 4;
-		}
-	}
-}
-
-int rsa_iskeyset(u32 keyslot)
-{
-	return *(REG_RSA_SLOT0 + (keyslot << 4)) & 1;
-}
-
-void rsa(void* dst, const void* src, u32 size)
-{
-	u32 keyslot = (*REG_RSA_CNT & RSA_CNT_KEYSLOTS) >> 4;
-	if(rsa_iskeyset(keyslot) == 0)
-		return;
-
-	rsa_wait_idle();
-	*REG_RSA_CNT |= RSA_IO_BE | RSA_IO_NORMAL;
-	
-	// Pad the message with zeroes so that it's a multiple of 8
-	// and write the message with the end aligned with the register
-	u32 padSize = ((size + 7) & ~7) - size;
-	memset((void*)REG_RSA_TXT_END - (size + padSize), 0, padSize);
-	memcpy((void*)REG_RSA_TXT_END - size, src, size);
-	
-	// Start
-	*REG_RSA_CNT |= RSA_CNT_START;
-	
-	rsa_wait_idle();
-	memcpy(dst, (void*)REG_RSA_TXT_END - size, size);
-}
-
-int rsa_verify(const void* data, u32 size, const void* sig, u32 mode)
-{
-	u8 dataHash[SHA_256_HASH_SIZE];
-	sha(dataHash, data, size, SHA_256_MODE);
-	
-	u8 decSig[0x100]; // Way too big, need to request a work area
-	
-	u32 sigSize = mode * 4;
-	rsa(decSig, sig, sigSize);
-	
-	return memcmp(dataHash, decSig + (sigSize - SHA_256_HASH_SIZE), SHA_256_HASH_SIZE) == 0;
-}
-
 /****************************************************************
 *                   Nand/FIRM Crypto stuff
 ****************************************************************/
@@ -375,48 +252,47 @@ void nandFirm0(u8 *outbuf, const u32 size, u8 console){
     aes(outbuf, outbuf, size / AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 }
 
-//Emulates the Arm9loader process
-void arm9loader(void *armHdr, u8 mode){
-    //Nand key#2 (0x12C10)
-    u8 key2[0x10] = {
-        0x42, 0x3F, 0x81, 0x7A, 0x23, 0x52, 0x58, 0x31, 0x6E, 0x75, 0x8E, 0x3A, 0x39, 0x43, 0x2E, 0xD0
-    };
+//Decrypts the N3DS arm9bin
+void decArm9Bin(void *armHdr, u8 mode){
 
     //Firm keys
     u8 keyX[0x10];
     u8 keyY[0x10];
     u8 CTR[0x10];
-    u32 slot = mode ? 0x16 : 0x15;
-    
+    u8 slot = mode ? 0x16 : 0x15;
+
     //Setup keys needed for arm9bin decryption
-    memcpy((u8*)keyY, (void *)((uintptr_t)armHdr+0x10), 0x10);
-    memcpy((u8*)CTR, (void *)((uintptr_t)armHdr+0x20), 0x10);
-    u32 size = atoi((void *)((uintptr_t)armHdr+0x30));
+    memcpy(keyY, armHdr+0x10, 0x10);
+    memcpy(CTR, armHdr+0x20, 0x10);
+    u32 size = atoi(armHdr+0x30);
 
     if(mode){
         //Set 0x11 to key2 for the arm9bin and misc keys
-        aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
+        aes_setkey(0x11, key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
         aes_use_keyslot(0x11);
-        aes((u8*)keyX, (void *)((uintptr_t)armHdr+0x60), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
-        aes_setkey(slot, (u8*)keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+        aes(keyX, armHdr+0x60, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes_setkey(slot, keyX, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
     }
 
-    aes_setkey(slot, (u8*)keyY, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
-    aes_setiv((u8*)CTR, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_setkey(slot, keyY, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_setiv(CTR, AES_INPUT_BE | AES_INPUT_NORMAL);
     aes_use_keyslot(slot);
-    
-    //Decrypt arm9bin
-    aes((void *)(armHdr+0x800), (void *)(armHdr+0x800), size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
 
-    if(mode){
-        //Set keys 0x19..0x1F keyXs
-        u8* decKey = (void *)((uintptr_t)armHdr+0x89824);
-        aes_use_keyslot(0x11);
-        for(slot = 0x19; slot < 0x20; slot++) {
-            aes_setkey(0x11, (u8*)key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
-            aes(decKey, (void *)((uintptr_t)armHdr+0x89814), 1, NULL, AES_ECB_DECRYPT_MODE, 0);
-            aes_setkey(slot, (u8*)decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
-            *(u8 *)((void *)((uintptr_t)armHdr+0x89814+0xF)) += 1;
-        }
+    //Decrypt arm9bin
+    aes(armHdr+0x800, armHdr+0x800, size/AES_BLOCK_SIZE, CTR, AES_CTR_MODE, AES_INPUT_BE | AES_INPUT_NORMAL);
+}
+
+//Sets the N3DS 9.6 KeyXs
+void setKeyXs(void *armHdr){
+
+    //Set keys 0x19..0x1F keyXs
+    void *keyData = armHdr+0x89814;
+    void *decKey = keyData+0x10;
+    aes_setkey(0x11, key2, AES_KEYNORMAL, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_use_keyslot(0x11);
+    for(u8 slot = 0x19; slot < 0x20; slot++){
+        aes(decKey, keyData, 1, NULL, AES_ECB_DECRYPT_MODE, 0);
+        aes_setkey(slot, decKey, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+        *(u8*)(keyData+0xF) += 1;
     }
 }

source/crypto.h

@@ -6,16 +6,6 @@
 #include <stdint.h>
 #include "types.h"
 
-#define FIRM_TYPE_ARM9          0
-#define FIRM_TYPE_ARM11         1
-
-#define MEDIA_UNITS             0x200
-
-#define NCCH_MAGIC              (0x4843434E)
-#define NCSD_MAGIC              (0x4453434E)
-#define FIRM_MAGIC              (0x4D524946)
-#define ARM9BIN_MAGIC           (0x47704770)
-
 /**************************AES****************************/
 #define REG_AESCNT				((volatile u32*)0x10009000)
 #define REG_AESBLKCNT			((volatile u32*)0x10009004)
@@ -52,8 +42,6 @@
 #define AES_INPUT_NORMAL		(AES_CNT_INPUT_ORDER)
 #define AES_INPUT_REVERSED		0
 
-#define AES_TEMP_KEYSLOT		0x11
-
 #define AES_BLOCK_SIZE			0x10
 
 #define AES_KEYCNT_WRITE		(1 << 0x7)
@@ -61,77 +49,9 @@
 #define AES_KEYX				1
 #define AES_KEYY				2
 
-/**************************SHA****************************/
-#define REG_SHA_CNT				((volatile u32*)0x1000A000)
-#define REG_SHA_BLKCNT			((volatile u32*)0x1000A004)
-#define REG_SHA_HASH			((volatile u32*)0x1000A040)
-#define REG_SHA_INFIFO			((volatile u32*)0x1000A080)
-
-#define SHA_CNT_STATE			0x00000003
-#define SHA_CNT_UNK2			0x00000004
-#define SHA_CNT_OUTPUT_ENDIAN	0x00000008
-#define SHA_CNT_MODE			0x00000030
-#define SHA_CNT_ENABLE			0x00010000
-#define SHA_CNT_ACTIVE			0x00020000
-
-#define SHA_HASH_READY			0x00000000
-#define SHA_NORMAL_ROUND		0x00000001
-#define SHA_FINAL_ROUND			0x00000002
-
-#define SHA_OUTPUT_BE			SHA_CNT_OUTPUT_ENDIAN
-#define SHA_OUTPUT_LE			0
-
-#define SHA_256_MODE			0
-#define SHA_224_MODE			0x00000010
-#define SHA_1_MODE				0x00000020
-
-#define SHA_256_HASH_SIZE		(256 / 8)
-#define SHA_224_HASH_SIZE		(224 / 8)
-#define SHA_1_HASH_SIZE			(160 / 8)
-
-/**************************RSA****************************/
-#define REG_RSA_CNT				((volatile u32*)0x1000B000)
-#define REG_RSA_SLOT0			((volatile u32*)0x1000B100)
-#define REG_RSA_SLOT1			((volatile u32*)0x1000B110)
-#define REG_RSA_SLOT2			((volatile u32*)0x1000B120)
-#define REG_RSA_SLOT3			((volatile u32*)0x1000B130)
-#define REG_RSA_EXPFIFO			((volatile u32*)0x1000B200)
-#define REG_RSA_MOD_END			((volatile u32*)0x1000B500)
-#define REG_RSA_TXT_END			((volatile u32*)0x1000B900)
-
-#define RSA_CNT_START			0x00000001
-#define RSA_CNT_KEYSLOTS		0x000000F0
-#define RSA_CNT_IO_ENDIAN		0x00000100
-#define RSA_CNT_IO_ORDER		0x00000200
-
-#define RSA_SLOTCNT_KEY_SET		0x00000001
-#define RSA_SLOTCNT_WPROTECT	0x00000002 // Write protect
-
-#define RSA_IO_BE				RSA_CNT_IO_ENDIAN
-#define RSA_IO_LE				0
-#define RSA_IO_NORMAL			RSA_CNT_IO_ORDER
-#define RSA_IO_REVERSED			0
-
-#define RSA_TEMP_KEYSLOT		0
-
-#define RSA_1024_MODE			0x20
-#define RSA_2048_MODE			0x40
-
-//Crypto Libs
-void aes_setkey(u8 keyslot, const void* key, u32 keyType, u32 mode);
-void aes_use_keyslot(u8 keyslot);
-void aes(void* dst, const void* src, u32 blockCount, void* iv, u32 mode, u32 ivMode);
-void aes_setiv(const void* iv, u32 mode);
-void aes_advctr(void* ctr, u32 val, u32 mode);
-void aes_change_ctrmode(void* ctr, u32 fromMode, u32 toMode);
-void aes_batch(void* dst, const void* src, u32 blockCount);
-void sha(void* res, const void* src, u32 size, u32 mode);
-void rsa_setkey(u32 keyslot, const void* mod, const void* exp, u32 mode);
-void rsa_use_keyslot(u32 keyslot);
-int rsa_verify(const void* data, u32 size, const void* sig, u32 mode);
-
 //NAND/FIRM stuff
 void nandFirm0(u8 *outbuf, const u32 size, u8 console);
-void arm9loader(void *armHdr, u8 mode);
+void decArm9Bin(void *armHdr, u8 mode);
+void setKeyXs(void *armHdr);
 
 #endif /*__CRYPTO_H*/

source/draw.c

@@ -7,19 +7,38 @@
 #include "draw.h"
 #include "fs.h"
 #include "memory.h"
+#include "types.h"
 
-static struct fb* fb = (struct fb*) 0x23FFFE00;
+static struct fb *fb = (struct fb *)0x23FFFE00;
+
+void shutdownLCD(void){
+
+    vu32 *arm11 = (vu32*)0x1FFFFFF8;
+
+    //Clear ARM11 entry offset
+    *arm11 = 0;
+
+    //Shutdown LCDs
+    *(vu32*)0x10202A44 = 0;
+    *(vu32*)0x10202244 = 0;
+    *(vu32*)0x10202014 = 0;
+    
+    //Wait for the ARM11 entrypoint to be set
+    while (!*arm11);
+    //Jump to it
+    ((void (*)())*arm11)();
+}
 
 void clearScreen(void){
-    memset(fb->top_left, 0, 0x38400);
-    memset(fb->top_right, 0, 0x38400);
+    memset(fb->top_left, 0, 0x46500);
+    memset(fb->top_right, 0, 0x46500);
     memset(fb->bottom, 0, 0x38400);
 }
 
 void loadSplash(void){
     //Check if it's a no-screen-init A9LH boot via PDN_GPU_CNT
-    if (*((u8*)0x10141200) == 0x1) return;
+    if (*(u8*)0x10141200 == 0x1) return;
     clearScreen();
     if(fileRead(fb->top_left, "/rei/splash.bin", 0x46500) != 0) return;
-    unsigned i,t; for(t=220;t>0;t--){for(i=0xFFFF;i>0;i--);}; //Ghetto sleep func
+    u64 i = 0xFFFFFF; while(--i) __asm("mov r0, r0"); //Less Ghetto sleep func
 }

source/draw.h

@@ -12,4 +12,5 @@ struct fb {
     u8 *bottom;
 };
 
-void loadSplash(void);
+void loadSplash(void);
+void shutdownLCD(void);

source/firm.c

@@ -10,42 +10,93 @@
 #include "fs.h"
 #include "emunand.h"
 #include "crypto.h"
+#include "draw.h"
 
 firmHeader *firmLocation = (firmHeader *)0x24000000;
 firmSectionHeader *section;
-vu32 *arm11Entry = (vu32*)0x1FFFFFF8;
 u32 firmSize = 0;
 u8  mode = 1,
     console = 1,
+    emuNAND = 0,
     a9lhSetup = 0,
-    updatedSys = 0;
+    updatedSys = 0,
+    usePatchedFirm = 0;
 u16 pressed;
+char *firmPathPatched = NULL;
 
 void setupCFW(void){
 
+    //Determine if booting with A9LH via PDN_SPI_CNT
+    u8 a9lhBoot = (*(u8*)0x101401C0 == 0x0) ? 1 : 0;
+    //Retrieve the last booted FIRM via CFG_BOOTENV
+    u8 previousFirm = *(u8*)0x10010000;
+    u8 overrideConfig = 0;
+    char lastConfigPath[] = "rei/lastbootcfg";
+
     //Detect the console being used
     if(PDN_MPCORE_CFG == 1) console = 0;
 
     //Get pressed buttons
     pressed = HID_PAD;
 
-    //Determine if A9LH is installed via PDN_SPI_CNT and an user flag
-    if((*((u8*)0x101401C0) == 0x0) || fileExists("/rei/installeda9lh")){
+    //Determine if A9LH is installed
+    if(a9lhBoot || fileExists("/rei/installeda9lh")){
         a9lhSetup = 1;
         //Check flag for > 9.2 SysNAND
         if(fileExists("/rei/updatedsysnand")) updatedSys = 1;
     }
 
-    /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
-       is not pressed, boot 9.0 FIRM */
-    if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+    //If booting with A9LH and it's a MCU reboot, try to force boot options
+    if(a9lhBoot && previousFirm && fileExists(lastConfigPath)){
+        u8 tempConfig;
+        fileRead((u8*)&tempConfig, lastConfigPath, 1);
+
+        //Always force a sysNAND boot when quitting AGB_FIRM
+        if(previousFirm == 0x7) {
+            if(!updatedSys) mode = tempConfig & 0x1;
+            overrideConfig = 1;
+        //Else, force the last used boot options unless A is pressed
+        } else if(!(pressed & BUTTON_A)) {
+            mode = tempConfig & 0x1;
+            emuNAND = (tempConfig >> 1) & 0x1;
+            overrideConfig = 1;
+        }
+    }
+
+    if(!overrideConfig){
+
+        /* If L is pressed, and on an updated SysNAND setup the SAFE MODE combo
+           is not pressed, boot 9.0 FIRM */
+        if((pressed & BUTTON_L1) && !(updatedSys && pressed == SAFEMODE)) mode = 0;
+
+        /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
+           or R is pressed on a > 9.2 SysNAND, boot emuNAND */
+        if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
+           (!updatedSys && mode && !(pressed & BUTTON_R1))) emuNAND = 1;
+
+        //Write the current boot options on A9LH
+        if(a9lhBoot){
+            u8 tempConfig = (mode | (emuNAND << 1)) & 0x3;
+            fileWrite((u8*)&tempConfig, lastConfigPath, 1);
+        }
+    }
+
+    if(mode) firmPathPatched = emuNAND ? "/rei/patched_firmware_emu.bin" :
+                                         "/rei/patched_firmware_sys.bin";
+
+    //Skip decrypting and patching FIRM
+    if(fileExists("/rei/usepatchedfw")){
+        //Only needed with this flag
+        if(!mode) firmPathPatched = "/rei/patched_firmware90.bin";
+        if(fileExists(firmPathPatched)) usePatchedFirm = 1;
+    }
 }
 
 //Load firm into FCRAM
 u8 loadFirm(void){
 
-    //If not using an A9LH setup, load 9.0 FIRM from NAND
-    if(!a9lhSetup && !mode){
+    //If not using an A9LH setup or the patched FIRM, load 9.0 FIRM from NAND
+    if(!usePatchedFirm && !a9lhSetup && !mode){
         //Read FIRM from NAND and write to FCRAM
         firmSize = console ? 0xF2000 : 0xE9000;
         nandFirm0((u8*)firmLocation, firmSize, console);
@@ -54,12 +105,11 @@ u8 loadFirm(void){
     }
     //Load FIRM from SD
     else{
-        char firmPath[] = "/rei/firmware.bin";
-        char firmPath2[] = "/rei/firmware90.bin";
-        char *pathPtr = mode ? firmPath : firmPath2;
-        firmSize = fileSize(pathPtr);
+        char *path = usePatchedFirm ? firmPathPatched :
+                                      (mode ? "/rei/firmware.bin" : "/rei/firmware90.bin");
+        firmSize = fileSize(path);
         if (!firmSize) return 1;
-        fileRead((u8*)firmLocation, pathPtr, firmSize);
+        fileRead((u8*)firmLocation, path, firmSize);
     }
 
     section = firmLocation->section;
@@ -67,7 +117,8 @@ u8 loadFirm(void){
     //Check that the loaded FIRM matches the console
     if((((u32)section[2].address >> 8) & 0xFF) != (console ? 0x60 : 0x68)) return 1;
 
-    if(console) arm9loader((u8*)firmLocation + section[2].offset, mode);
+    if(console && !usePatchedFirm)
+        decArm9Bin((u8*)firmLocation + section[2].offset, mode);
 
     return 0;
 }
@@ -125,10 +176,11 @@ u8 loadEmu(void){
 //Patches
 u8 patchFirm(void){
 
-    /* If L or R aren't pressed on a 9.0/9.2 SysNAND, or the 9.0 FIRM is selected
-       or R is pressed on a > 9.2 SysNAND, boot emuNAND */
-    if((updatedSys && (!mode || ((pressed & BUTTON_R1) && pressed != SAFEMODE))) ||
-       (!updatedSys && mode && !(pressed & (BUTTON_L1 | BUTTON_R1)))){
+    //Skip patching
+    if(usePatchedFirm) return 0;
+
+    //Apply emuNAND patches
+    if(emuNAND){
         if (loadEmu()) return 1;
     }
     else if (a9lhSetup){
@@ -146,6 +198,12 @@ u8 patchFirm(void){
     memcpy((u8*)sigOffset, sigPat1, sizeof(sigPat1));
     memcpy((u8*)sigOffset2, sigPat2, sizeof(sigPat2));
 
+    //Patch ARM9 entrypoint on N3DS to skip arm9loader
+    if(console){
+        u32 *arm9 = (u32*)&firmLocation->arm9Entry;
+        *arm9 = 0x801B01C;
+    }
+
     //Patch FIRM reboots, not on 9.0 FIRM as it breaks firmlaunchhax
     if(mode){
         u32 rebootOffset = 0,
@@ -163,38 +221,37 @@ u8 patchFirm(void){
         getfOpen(firmLocation, firmSize, &fOpenOffset);
         *pos_fopen = fOpenOffset;
 
-        //Write patched FIRM to SD
-        if(fileWrite((u8*)firmLocation, "/rei/patched_firmware.bin", firmSize) != 0) return 1;
+        //Patch path for emuNAND-patched FIRM
+        if(emuNAND){
+            u32 *pos_path = memsearch((u32*)rebootOffset, L"sy", size, 4);
+            memcpy((u8*)pos_path, L"emu", 5);
+        }
     }
 
+    //Write patched FIRM to SD if needed
+    if(firmPathPatched)
+        if(fileWrite((u8*)firmLocation, firmPathPatched, firmSize) != 0) return 1;
+
     return 0;
 }
 
-//De-initialize the screens, fixes N3DS 3D
-void __attribute__((naked)) deinitScreen(void)
-{
-    *arm11Entry = 0;
-
-    *(vu32*)0x10202A44 = 0;
-    *(vu32*)0x10202244 = 0;
-    *(vu32*)0x1020200C = 0;
-    *(vu32*)0x10202014 = 0;
-
-    while (!*arm11Entry);
-    ((void (*)())*arm11Entry)();
-}
-
-//Firmlaunchhax
 void launchFirm(void){
 
+    if(console && mode) setKeyXs((u8*)firmLocation + section[2].offset);
+
     //Copy firm partitions to respective memory locations
     memcpy(section[0].address, (u8*)firmLocation + section[0].offset, section[0].size);
     memcpy(section[1].address, (u8*)firmLocation + section[1].offset, section[1].size);
     memcpy(section[2].address, (u8*)firmLocation + section[2].offset, section[2].size);
-    *arm11Entry = (u32)deinitScreen;
-    while (*arm11Entry);
-    *arm11Entry = (u32)firmLocation->arm11Entry;
+
+    //Run ARM11 screen stuff
+    vu32 *arm11 = (vu32*)0x1FFFFFF8;
+    *arm11 = (u32)shutdownLCD;
+    while (*arm11);
+    
+    //Set ARM11 kernel
+    *arm11 = (u32)firmLocation->arm11Entry;
     
     //Final jump to arm9 binary
-    console ? ((void (*)())0x801B01C)() : ((void (*)())firmLocation->arm9Entry)();
+    ((void (*)())firmLocation->arm9Entry)();
 }

source/firm.h

@@ -12,7 +12,8 @@
 #define HID_PAD            ((~*(u16*)0x10146000) & 0xFFF)
 #define BUTTON_R1          (1 << 8)
 #define BUTTON_L1          (1 << 9)
-#define SAFEMODE           (BUTTON_L1 | BUTTON_R1 | 1 | (1 << 6))
+#define BUTTON_A           1
+#define SAFEMODE           (BUTTON_L1 | BUTTON_R1 | BUTTON_A | (1 << 6))
 
 void setupCFW(void);
 u8 loadFirm(void);

source/fs.c

@@ -18,16 +18,6 @@ int mountSD()
     return 0;
 }
 
-int unmountSD()
-{
-    if (f_mount(NULL, "0:", 1) != FR_OK) {
-        //printF("Failed to mount SD card!");
-        return 1;
-    }
-    //printF("Unmounted SD card");
-    return 0;
-}
-
 int fileReadOffset(u8 *dest, const char *path, u32 size, u32 offset){
     FRESULT fr;
     FIL fp;

source/fs.h

@@ -8,7 +8,6 @@
 #include "types.h"
 
 int mountSD();
-int unmountSD();
 int fileReadOffset(u8 *dest, const char *path, u32 size, u32 offset);
 int fileRead(u8 *dest, const char *path, u32 size);
 int fileWrite(const u8 *buffer, const char *path, u32 size);

source/memory.c

@@ -5,10 +5,6 @@
 */
 #include "memory.h"
 
-void memcpy32(u32 *dest, u32 *src, u32 size){
-    for (u32 i = 0; i < size; i++) dest[i] = src[i];
-}
-
 void memcpy(void *dest, const void *src, u32 size){
     char *destc = (char *)dest;
     const char *srcc = (const char *)src;

source/memory.h

@@ -9,7 +9,6 @@
 #include "types.h"
 
 void memcpy(void *dest, const void *src, u32 size);
-void memcpy32(u32 *dest, u32 *src, u32 size);
 void memset(void *dest, int filler, u32 size);
 int memcmp(const void *buf1, const void *buf2, u32 size);
 void *memsearch(void *start_pos, void *search, u32 size, u32 size_search);

source/patches.c

@@ -54,7 +54,6 @@ void getfOpen(void *pos, u32 size, u32 *off){
     //Calculate fOpen
     u32 p9addr = *(u32*)(memsearch(pos, "ess9", size, 4) + 0xC);
     u32 p9off = (u32)(memsearch(pos, "code", size, 4) + 0x1FF);
-
     unsigned char pattern[] = {0xB0, 0x04, 0x98, 0x0D};
 
     *off = (u32)memsearch(pos, pattern, size, 4) - 2 - p9off + p9addr;

source/types.h

@@ -13,8 +13,11 @@
 typedef uint8_t u8;
 typedef uint16_t u16;
 typedef uint32_t u32;
-typedef volatile u32 vu32;
 typedef uint64_t u64;
+typedef volatile uint8_t vu8;
+typedef volatile uint16_t vu16;
+typedef volatile uint32_t vu32;
+typedef volatile uint64_t vu64;
 
 //FIRM Header layout
 typedef struct firmSectionHeader {