Fix CakeBrah error displaying the .dat file

Makefile

@@ -34,8 +34,8 @@ objects = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
           $(patsubst $(dir_source)/%.c, $(dir_build)/%.o, \
           $(call rwildcard, $(dir_source), *.s *.c)))
 
-bundled = $(dir_build)/reboot.bin.o $(dir_build)/emunand.bin.o $(dir_build)/svcGetCFWInfo.bin.o $(dir_build)/injector.bin.o \
-          $(dir_build)/loader.bin.o $(dir_build)/k11modules.bin.o $(dir_build)/arm9_exceptions.bin.o $(dir_build)/arm11_exceptions.bin.o
+bundled = $(dir_build)/reboot.bin.o $(dir_build)/emunand.bin.o $(dir_build)/svcGetCFWInfo.bin.o $(dir_build)/k11modules.bin.o \
+          $(dir_build)/injector.bin.o $(dir_build)/loader.bin.o $(dir_build)/arm9_exceptions.bin.o $(dir_build)/arm11_exceptions.bin.o
 
 define bin2o
 	bin2s $< | $(AS) -o $(@)
@@ -58,7 +58,7 @@ haxloader: a9lh
 
 .PHONY: clean
 clean:
-	@$(MAKE) $(FLAGS) -C $(dir_haxloader) clean
+	@$(MAKE) -C $(dir_haxloader) clean
 	@$(MAKE) -C $(dir_loader) clean
 	@$(MAKE) -C $(dir_arm9_exceptions) clean
 	@$(MAKE) -C $(dir_arm11_exceptions) clean	

haxloader/Makefile

@@ -12,6 +12,7 @@ LD := arm-none-eabi-ld
 OC := arm-none-eabi-objcopy
 
 dir_source := source
+dir_diffs := diffs
 dir_cakebrah := CakeBrah
 dir_cakehax := CakeHax
 dir_cakesrop := CakesROP
@@ -22,34 +23,37 @@ ASFLAGS := -mcpu=arm946e-s
 CFLAGS := -Wall -Wextra -MMD -MP -marm $(ASFLAGS) -fno-builtin -fshort-wchar -std=c11 -Wno-main -O2 -flto -ffast-math
 LDFLAGS := -nostartfiles
 FLAGS := name=$(name).dat dir_out=$(abspath $(dir_out)) ICON=$(abspath icon.png) APP_DESCRIPTION="Noob-friendly 3DS CFW." APP_AUTHOR="Aurora Wright/TuxSH" --no-print-directory
-ROPFLAGS := DATNAME=$(name).dat DISPNAME=$(name)
+ROPFLAGS := DATNAME=$(name).dat DISPNAME=$(name) GRAPHICS=../graphics/
 
 objects = $(patsubst $(dir_source)/%.s, $(dir_build)/%.o, \
           $(patsubst $(dir_source)/%.c, $(dir_build)/%.o, \
           $(call rwildcard, $(dir_source), *.s *.c)))
 
 .PHONY: all
-all: $(dir_out)/$(name).dat $(dir_out)/hax/3ds/$(name) $(dir_out)/menuhax/boot.3dsx $(dir_out)/mset/$(name).nds
+all: $(dir_out)/hax/3ds/$(name) $(dir_out)/menuhax/boot.3dsx $(dir_out)/mset-spider/$(name).dat $(dir_out)/mset/$(name).nds
 
 .PHONY: clean
 clean:
+	@cd $(dir_cakebrah); git reset --hard
 	@$(MAKE) $(FLAGS) -C $(dir_cakebrah) clean
 	@$(MAKE) $(FLAGS) -C $(dir_cakehax) clean
 	@$(MAKE) $(ROPFLAGS) -C $(dir_cakesrop) clean
 	@rm -rf $(dir_build)
 
-$(dir_out)/$(name).dat: $(dir_build)/main.bin
+$(dir_out)/mset-spider/$(name).dat: $(dir_build)/main.bin
+	@mkdir -p "$(@D)"
 	@$(MAKE) $(FLAGS) -C $(dir_cakehax) launcher
-	@dd if=$(dir_build)/main.bin of=$@ bs=512 seek=144
+	@dd if=$(dir_build)/main.bin of=$(dir_out)/$(name).dat bs=512 seek=144
+	@mv $(dir_out)/$(name).dat $@
 
 $(dir_out)/hax/3ds/$(name):
 	@mkdir -p "$@"
-	@$(MAKE) $(FLAGS) -C $(dir_cakebrah)
+	@cd $(dir_cakebrah); patch -p1 < ../$(dir_diffs)/1.diff; $(MAKE) $(FLAGS); git reset --hard
 	@mv $(dir_out)/$(name).3dsx $(dir_out)/$(name).smdh $@
 
-$(dir_out)/menuhax/boot.3dsx: $(dir_out)/hax/3ds/$(name)
+$(dir_out)/menuhax/boot.3dsx:
 	@mkdir -p "$(@D)"
-	@cd $(dir_cakebrah); patch -p1 < ../menuhax.diff; $(MAKE) $(FLAGS); git reset --hard
+	@cd $(dir_cakebrah); patch -p1 < ../$(dir_diffs)/1.diff; patch -p1 < ../$(dir_diffs)/2.diff; $(MAKE) $(FLAGS); git reset --hard
 	@mv $(dir_out)/$(name).3dsx $@
 	@rm $(dir_out)/$(name).smdh
 

haxloader/diffs/1.diff

@@ -0,0 +1,123 @@
+diff -uNr a/include/brahma.h b/include/brahma.h
+--- a/include/brahma.h	2016-09-26 16:05:36.363067000 +0200
++++ b/include/brahma.h	2016-09-26 21:35:14.800519000 +0200
+@@ -4,7 +4,7 @@
+ 
+ u32 brahma_init (void);
+ u32 brahma_exit (void);
+-s32 load_arm9_payload_offset (char *filename, u32 offset, u32 max_psize);
++s32 load_arm9_payload_offset (void);
+ s32 load_arm9_payload_from_mem (u8* data, u32 dsize);
+ void redirect_codeflow (u32 *dst_addr, u32 *src_addr);
+ s32 map_arm9_payload (void);
+@@ -13,8 +13,6 @@
+ s32 get_exploit_data (struct exploit_data *data);
+ s32 firm_reboot ();
+ 
+-#define load_arm9_payload(filename) load_arm9_payload_offset(filename, 0, 0)
+-
+ #define BRAHMA_NETWORK_PORT 80
+ 
+ #define ARM_JUMPOUT 0xE51FF004 // LDR PC, [PC, -#04]
+diff -uNr a/source/brahma.c b/source/brahma.c
+--- a/source/brahma.c	2016-09-26 16:05:36.363067000 +0200
++++ b/source/brahma.c	2016-09-26 21:37:58.660516468 +0200
+@@ -179,39 +179,54 @@
+ 	return g_ext_arm9_loaded;
+ }
+ 
+-/* reads ARM9 payload from a given path.
+-   filename: full path of payload
+-   offset: offset of the payload in the file
+-   max_psize: the maximum size of the payload that should be loaded (if 0, ARM9_MAX_PAYLOAD_SIZE. Should be smaller than ARM9_MAX_PAYLOAD_SIZE)
++/* reads Luma payload
+    returns: 0 on failure, 1 on success */
+-s32 load_arm9_payload_offset (char *filename, u32 offset, u32 max_psize) {
++s32 load_arm9_payload_offset (void) {
+ 	s32 result = 0;
+ 	u32 fsize = 0;
+ 	u32 psize = 0;
++	bool use_default = true;
++	FILE *f;
+ 
+-	if (max_psize == 0 || max_psize > ARM9_PAYLOAD_MAX_SIZE)
+-		max_psize = ARM9_PAYLOAD_MAX_SIZE;
++	FILE *p = fopen("/luma/path.txt", "r");
+ 
+-	if (!filename)
+-		return result;
++	if (p) {
++		fseek(p , 0, SEEK_END);
++		psize = ftell(p);
++		if (psize > 5 && psize < 58) {
++			char path[psize + 1];
++
++			fseek(p, 0, SEEK_SET);
++			u32 bytes_read = fread(path, 1, psize, p);
++
++			if (bytes_read == psize) {
++				if (path[psize - 1] == 0xA) psize--;
++				if (path[psize - 1] == 0xD) psize--;
++				if (psize > 5 && psize < 56 && path[0] == '/' && memcmp(&path[psize - 4], ".bin", 4)) {
++					path[psize] = 0;
++					f = fopen(path, "rb");
++					if (f) use_default = false;
++				}
++			}
++		}
++	fclose(p);
++	}
++
++	if (use_default) f = fopen("/arm9loaderhax.bin", "rb");
+ 
+-	FILE *f = fopen(filename, "rb");
+ 	if (f) {
+-		fseek(f , 0, SEEK_END);
++		fseek(f, 0, SEEK_END);
+ 		fsize = ftell(f);
+ 
+-		if (offset < fsize) {
+-			psize = fsize - offset;
+-			if (psize > max_psize)
+-				psize = max_psize;
+-
+-			g_ext_arm9_size = psize;
+-
+-			fseek(f, offset, SEEK_SET);
+-			if (psize >= 8) {
+-				u32 bytes_read = fread(g_ext_arm9_buf, 1, psize, f);
+-				result = (g_ext_arm9_loaded = (bytes_read == psize));
+-			}
++		if (fsize > ARM9_PAYLOAD_MAX_SIZE)
++			fsize = ARM9_PAYLOAD_MAX_SIZE;
++
++		g_ext_arm9_size = fsize;
++
++		fseek(f, 0, SEEK_SET);
++		if (fsize >= 8) {
++			u32 bytes_read = fread(g_ext_arm9_buf, 1, fsize, f);
++			result = (g_ext_arm9_loaded = (bytes_read == fsize));
+ 		}
+ 		fclose(f);
+ 	}
+diff -uNr a/source/main.c b/source/main.c
+--- a/source/main.c	2016-09-26 16:05:36.363067000 +0200
++++ b/source/main.c	2016-09-26 21:40:35.202513018 +0200
+@@ -10,7 +10,7 @@
+ 
+ int main (void) {
+     if (brahma_init()) {
+-        if (load_arm9_payload_offset("/" LAUNCHER_PATH, 0x12000, 0x10000) != 1)
++        if (load_arm9_payload_offset() != 1)
+             goto error;
+         firm_reboot();
+         brahma_exit();
+@@ -22,7 +22,7 @@
+ error:
+     gfxInitDefault();
+     consoleInit(GFX_BOTTOM, NULL);
+-    printf("An error occurred while loading the payload.\nMake sure your launcher is located at:\n/" LAUNCHER_PATH);
++    printf("An error occurred while loading the payload.");
+     wait_any_key();
+ 
+     gfxExit();

haxloader/diffs/2.diff

@@ -7,5 +7,5 @@ diff -uNr a/source/main.c b/source/main.c
  int main (void) {
 +    svcSleepThread(2500 * 1000000ULL);
      if (brahma_init()) {
-         if (load_arm9_payload_offset("/" LAUNCHER_PATH, 0x12000, 0x10000) != 1)
+         if (load_arm9_payload_offset() != 1)
              goto error;

haxloader/graphics/drunkenlogo.grit

@@ -0,0 +1,11 @@
+-W3
+# disable alpha and set opaque bit for all pixels
+-gT!
+
+# use lz77 compression
+-gzl
+
+# 16 bit bitmap
+-gB16
+
+-gb

haxloader/source/main.c

@@ -41,7 +41,7 @@ void main(void)
         {
             u32 pathSize = f_size(&pathFile);
 
-            if(pathSize > 5 && pathSize < 40)
+            if(pathSize > 5 && pathSize < 58)
             {
                 char path[pathSize + 1];
                 unsigned int read;
@@ -49,7 +49,7 @@ void main(void)
                 if(path[pathSize - 1] == 0xA) pathSize--;
                 if(path[pathSize - 1] == 0xD) pathSize--;
 
-                if(pathSize > 5 && pathSize < 38 && path[0] == '/' && memcmp(&path[pathSize - 4], ".bin", 4) == 0)
+                if(pathSize > 5 && pathSize < 56 && path[0] == '/' && memcmp(&path[pathSize - 4], ".bin", 4) == 0)
                 {
                     path[pathSize] = 0;
                     foundPayload = f_open(&payload, path, FA_READ) == FR_OK;

patches/reboot.s

@@ -72,7 +72,7 @@ bytes_read: .word 0
 fopen: .ascii "OPEN"
 .pool
 fname: .dcw "sdmc:/arm9loaderhax.bin"
-       .word 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+       .word 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
 
 .align 4
     kernelcode_start:

source/config.c

@@ -92,7 +92,7 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
 
                                           "Enable splash screen support.\n\n"
                                           "\t* 'Before payloads' displays it\n"
-                                          "before booting payloads.\n"
+                                          "before booting payloads\n"
                                           "(intended for splashes that display\n"
                                           "button hints).\n\n"
                                           "\t* 'After payloads' displays it\n"
@@ -103,7 +103,9 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
                                           "Luma3DS boots.\n\n"
                                           "4, 6 or 8 digits can be selected.\n\n"
                                           "The ABXY buttons and the directional\n"
-                                          "pad buttons can be used as keys.",
+                                          "pad buttons can be used as keys.\n\n"
+                                          "A message can also be displayed\n"
+                                          "(refer to the wiki for instructions).",
 
                                           "Select the New 3DS CPU mode.\n\n"
                                           "It will be always enabled.\n\n"
@@ -144,7 +146,8 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
 
                                           "Enable loading FIRMs and\n"
                                           "system modules from the SD card.\n\n"
-                                          "This isn't needed in most cases.",
+                                          "This isn't needed in most cases.\n\n"
+                                          "Refer to the wiki for instructions.",
 
                                           "Use a custom path for the\n"
                                           "Luma3DS payload.\n\n"
@@ -158,12 +161,13 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
                                           "out-of-region games work.\n\n"
                                           "Refer to the wiki for instructions.",
 
-                                          "Enable showing the current NAND:\n\n"
+                                          "Enable showing the current NAND/FIRM:\n\n"
                                           "\t* Sys  = SysNAND\n"
                                           "\t* Emu  = EmuNAND 1\n"
                                           "\t* EmuX = EmuNAND X\n"
                                           "\t* SysE = SysNAND with EmuNAND 1 FIRM\n"
                                           "\t* SyEX = SysNAND with EmuNAND X FIRM\n"
+                                          "\t* EmuS = EmuNAND 1 with SysNAND FIRM\n"
                                           "\t* EmXS = EmuNAND X with SysNAND FIRM\n\n"
                                           "or an user-defined custom string in\n"
                                           "System Settings.\n\n"

source/crypto.c

@@ -349,19 +349,16 @@ u32 ctrNandRead(u32 sector, u32 sectorCount, u8 *outbuf)
 
 void set6x7xKeys(void)
 {
-    if(!isDevUnit)
-    {
-        const u8 __attribute__((aligned(4))) keyX0x25[AES_BLOCK_SIZE] = {0xCE, 0xE7, 0xD8, 0xAB, 0x30, 0xC0, 0x0D, 0xAE, 0x85, 0x0E, 0xF5, 0xE3, 0x82, 0xAC, 0x5A, 0xF3};
-        const u8 __attribute__((aligned(4))) keyY0x2F[AES_BLOCK_SIZE] = {0xC3, 0x69, 0xBA, 0xA2, 0x1E, 0x18, 0x8A, 0x88, 0xA9, 0xAA, 0x94, 0xE5, 0x50, 0x6A, 0x9F, 0x16};
+    const u8 __attribute__((aligned(4))) keyX0x25[AES_BLOCK_SIZE] = {0xCE, 0xE7, 0xD8, 0xAB, 0x30, 0xC0, 0x0D, 0xAE, 0x85, 0x0E, 0xF5, 0xE3, 0x82, 0xAC, 0x5A, 0xF3};
+    const u8 __attribute__((aligned(4))) keyY0x2F[AES_BLOCK_SIZE] = {0xC3, 0x69, 0xBA, 0xA2, 0x1E, 0x18, 0x8A, 0x88, 0xA9, 0xAA, 0x94, 0xE5, 0x50, 0x6A, 0x9F, 0x16};
 
-        aes_setkey(0x25, keyX0x25, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
-        aes_setkey(0x2F, keyY0x2F, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_setkey(0x25, keyX0x25, AES_KEYX, AES_INPUT_BE | AES_INPUT_NORMAL);
+    aes_setkey(0x2F, keyY0x2F, AES_KEYY, AES_INPUT_BE | AES_INPUT_NORMAL);
 
-        /* [3dbrew] The first 0x10-bytes are checked by the v6.0/v7.0 NATIVE_FIRM keyinit function, 
-                    when non-zero it clears this block and continues to do the key generation.
-                    Otherwise when this block was already all-zero, it immediately returns. */
-        memset32((void *)0x01FFCD00, 0, 0x10);
-    }
+    /* [3dbrew] The first 0x10-bytes are checked by the v6.0/v7.0 NATIVE_FIRM keyinit function, 
+        when non-zero it clears this block and continues to do the key generation.
+        Otherwise when this block was already all-zero, it immediately returns. */
+    memset32((void *)0x01FFCD00, 0, 0x10);
 }
 
 void decryptExeFs(u8 *inbuf)
@@ -382,8 +379,8 @@ void decryptExeFs(u8 *inbuf)
 void decryptNusFirm(const u8 *inbuf, u8 *outbuf, u32 ncchSize)
 {
     const u8 keyY0x3D[AES_BLOCK_SIZE] = {0x0C, 0x76, 0x72, 0x30, 0xF0, 0x99, 0x8F, 0x1C, 0x46, 0x82, 0x82, 0x02, 0xFA, 0xAC, 0xBE, 0x4C};
-    u8 __attribute__((aligned(4))) cetkIv[AES_BLOCK_SIZE] = {0};
     u8 __attribute__((aligned(4))) titleKey[AES_BLOCK_SIZE];
+    u8 __attribute__((aligned(4))) cetkIv[AES_BLOCK_SIZE] = {0};
     memcpy(titleKey, inbuf + 0x1BF, sizeof(titleKey));
     memcpy(cetkIv, inbuf + 0x1DC, 8);
 
@@ -485,7 +482,7 @@ void computePinHash(u8 *outbuf, const u8 *inbuf)
     u8 __attribute__((aligned(4))) cid[AES_BLOCK_SIZE];
     u8 __attribute__((aligned(4))) cipherText[AES_BLOCK_SIZE];
 
-    if(!didShaHashBackup)
+    if(isA9lh && !didShaHashBackup)
     {
         memcpy(shaHashBackup, (void *)REG_SHA_HASH, sizeof(shaHashBackup));
         didShaHashBackup = true;

source/crypto.h

@@ -102,7 +102,7 @@
 #define SHA_1_HASH_SIZE     (160 / 8)
 
 extern u32 emuOffset;
-extern bool isN3DS, isDevUnit;
+extern bool isN3DS, isDevUnit, isA9lh;
 extern FirmwareSource firmSource;
 
 void ctrNandInit(void);

source/firm.c

@@ -45,13 +45,13 @@ static const firmSectionHeader *section;
 u32 emuOffset;
 bool isN3DS,
      isDevUnit,
+     isA9lh,
      isFirmlaunch;
 CfgData configData;
 FirmwareSource firmSource;
 
 void main(void)
 {
-    bool isA9lh;
     u32 configTemp,
         emuHeader;
     FirmwareType firmType;
@@ -253,7 +253,7 @@ void main(void)
     switch(firmType)
     {
         case NATIVE_FIRM:
-            patchNativeFirm(firmVersion, nandType, emuHeader, isA9lh, devMode);
+            patchNativeFirm(firmVersion, nandType, emuHeader, devMode);
             break;
         case SAFE_FIRM:
         case NATIVE_FIRM1X2X:
@@ -338,7 +338,7 @@ static inline u32 loadFirm(FirmwareType *firmType, FirmwareSource firmSource, bo
     return firmVersion;
 }
 
-static inline void patchNativeFirm(u32 firmVersion, FirmwareSource nandType, u32 emuHeader, bool isA9lh, u32 devMode)
+static inline void patchNativeFirm(u32 firmVersion, FirmwareSource nandType, u32 emuHeader, u32 devMode)
 {
     u8 *arm9Section = (u8 *)firm + section[2].offset,
        *arm11Section1 = (u8 *)firm + section[1].offset;
@@ -350,8 +350,8 @@ static inline void patchNativeFirm(u32 firmVersion, FirmwareSource nandType, u32
         firm->arm9Entry = (u8 *)0x801B01C;
     }
 
-    //Sets the 7.x NCCH KeyX and the 6.x gamecard save data KeyY on >= 6.0 O3DS FIRMs, if not using A9LH
-    else if(!isA9lh && firmVersion >= 0x29) set6x7xKeys();
+    //Sets the 7.x NCCH KeyX and the 6.x gamecard save data KeyY on >= 6.0 O3DS FIRMs, if not using A9LH or a dev unit
+    else if(!isA9lh && firmVersion >= 0x29 && !isDevUnit) set6x7xKeys();
 
     //Find the Process9 .code location, size and memory address
     u32 process9Size,

source/firm.h

@@ -48,7 +48,7 @@ typedef struct firmHeader {
 } firmHeader;
  
 static inline u32 loadFirm(FirmwareType *firmType, FirmwareSource firmSource, bool loadFromSd);
-static inline void patchNativeFirm(u32 firmVersion, FirmwareSource nandType, u32 emuHeader, bool isA9lh, u32 devMode);
+static inline void patchNativeFirm(u32 firmVersion, FirmwareSource nandType, u32 emuHeader, u32 devMode);
 static inline void patchLegacyFirm(FirmwareType firmType, u32 firmVersion, u32 devMode);
 static inline void patch1x2xNativeAndSafeFirm(u32 devMode);
 static inline void copySection0AndInjectSystemModules(FirmwareType firmType, bool loadFromSd);

source/fs.c

@@ -139,7 +139,7 @@ void loadPayload(u32 pressed)
         {
             loaderAddress[1] = payloadSize;
 
-            restoreShaHashBackup();
+            if(isA9lh) restoreShaHashBackup();
             initScreens();
 
             flushDCacheRange(loaderAddress, loader_bin_size);
@@ -203,10 +203,15 @@ void findDumpFile(const char *path, char *fileName)
 {
     DIR dir;
     FILINFO info;
+    FRESULT result;
     u32 n = 0;
 
-    while(f_findfirst(&dir, &info, path, fileName) == FR_OK && info.fname[0] != 0)
+    while(true)
     {
+        result = f_findfirst(&dir, &info, path, fileName);
+
+        if(result != FR_OK || !info.fname[0]) break;
+
         u32 i = 18,
             tmp = ++n;
 
@@ -217,5 +222,5 @@ void findDumpFile(const char *path, char *fileName)
         }
     }
 
-    f_closedir(&dir);
+    if(result == FR_OK) f_closedir(&dir);
 }

source/fs.h

@@ -26,7 +26,7 @@
 
 #define PATTERN(a) a "_*.bin"
 
-extern bool isN3DS;
+extern bool isN3DS, isA9lh;
 
 void mountFs(void);
 u32 fileRead(void *dest, const char *path, u32 maxSize);

source/patches.c

@@ -97,14 +97,14 @@ void patchFirmlaunches(u8 *pos, u32 size, u32 process9MemAddr)
 
         u32 pathSize = getFileSize(pathPath);
 
-        if(pathSize > 5 && pathSize < 40)
+        if(pathSize > 5 && pathSize < 58)
         {
             u8 path[pathSize];
             fileRead(path, pathPath, 0);
             if(path[pathSize - 1] == 0xA) pathSize--;
             if(path[pathSize - 1] == 0xD) pathSize--;
 
-            if(pathSize > 5 && pathSize < 38 && path[0] == '/' && memcmp(&path[pathSize - 4], ".bin", 4) == 0)
+            if(pathSize > 5 && pathSize < 56 && path[0] == '/' && memcmp(&path[pathSize - 4], ".bin", 4) == 0)
             {
                 u16 finalPath[pathSize + 1];
                 for(u32 i = 0; i < pathSize; i++)