root/platform/a3000/sub/100b/boot.c

DEFINITIONS

1. taskCreateHook
2. taskCreateHook2
3. boot
4. sub_FFC00358_my
5. sub_FFC0119C_my
6. sub_FFC05E5C_my
7. taskcreate_Startup_my
8. task_Startup_my
9. spytask
10. CreateTask_spytask
11. CreateTask_PhySw
12. init_file_modules_task
13. sub_FFC6CF0C_my
14. sub_FFC52014_my
15. sub_FFC51C3C_my
16. sub_FFC5195C_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 #include "dryos31.h"
   5 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
   6 const char * const new_sa = &_end;
   9 // Forward declarations
  10 void CreateTask_PhySw();
  11 void CreateTask_spytask();
  12 void task_CaptSeqTask_my();
  14 void taskCreateHook(int *p) { 
p-=17;
  16 if (p[0]==(int)0xFFC73674)  p[0]=(int)init_file_modules_task;
  17 if (p[0]==(int)0xFFC5C198)  p[0]=(int)task_CaptSeqTask_my;
  18 if (p[0]==(int)0xFFC94FF8)  p[0]=(int)exp_drv_task;
  19 if (p[0]==(int)0xFFD1381C)  p[0]=(int)movie_record_task;
  20 }
  22 void taskCreateHook2(int *p) { 
p-=17;
  24 if (p[0]==(int)0xFFC73674)  p[0]=(int)init_file_modules_task;
  25 if (p[0]==(int)0xFFC94FF8)  p[0]=(int)exp_drv_task;
  26 }
  29 void __attribute__((naked,noinline)) boot() {
  31     asm volatile (
  32         "LDR     R1, =0xC0410000\n"
  33         "MOV     R0, #0\n"
  34         "STR     R0, [R1]\n"
  35         "MOV     R1, #0x78\n"
  36 "loc_FFC0001C:\n"
  37         "MCR     p15, 0, R1,c1,c0\n"
  38         "MOV     R1, #0\n"
  39         "MCR     p15, 0, R1,c7,c10, 4\n"
  40 "loc_FFC00028:\n"
  41         "MCR     p15, 0, R1,c7,c5\n"
  42         "MCR     p15, 0, R1,c7,c6\n"
  43         "MOV     R0, #0x3D\n"
  44         "MCR     p15, 0, R0,c6,c0\n"
  45         "MOV     R0, #0xC000002F\n"
  46         "MCR     p15, 0, R0,c6,c1\n"
  47         "MOV     R0, #0x31\n"
  48         "MCR     p15, 0, R0,c6,c2\n"
  49         "LDR     R0, =0x10000031\n"
  50         "MCR     p15, 0, R0,c6,c3\n"
  51         "MOV     R0, #0x40000017\n"
  52         "MCR     p15, 0, R0,c6,c4\n"
  53         "LDR     R0, =0xFFC0002B\n"
  54         "MCR     p15, 0, R0,c6,c5\n"
  55         "MOV     R0, #0x34\n"
  56         "MCR     p15, 0, R0,c2,c0\n"
  57         "MOV     R0, #0x34\n"
  58         "MCR     p15, 0, R0,c2,c0, 1\n"
  59         "MOV     R0, #0x34\n"
  60         "MCR     p15, 0, R0,c3,c0\n"
  61         "LDR     R0, =0x3333330\n"
  62         "MCR     p15, 0, R0,c5,c0, 2\n"
  63         "LDR     R0, =0x3333330\n"
  64         "MCR     p15, 0, R0,c5,c0, 3\n"
  65         "MRC     p15, 0, R0,c1,c0\n"
  66         "ORR     R0, R0, #0x1000\n"
  67         "ORR     R0, R0, #4\n"
  68         "ORR     R0, R0, #1\n"
  69         "MCR     p15, 0, R0,c1,c0\n"
  70         "MOV     R1, #0x40000006\n"
  71         "MCR     p15, 0, R1,c9,c1\n"
  72         "MOV     R1, #6\n"
  73         "MCR     p15, 0, R1,c9,c1, 1\n"
  74         "MRC     p15, 0, R1,c1,c0\n"
  75         "ORR     R1, R1, #0x50000\n"
  76         "MCR     p15, 0, R1,c1,c0\n"
  77         "LDR     R2, =0xC0200000\n"
  78         "MOV     R1, #1\n"
  79         "STR     R1, [R2,#0x10C]\n"
  80         "MOV     R1, #0xFF\n"
  81         "STR     R1, [R2,#0xC]\n"
  82         "STR     R1, [R2,#0x1C]\n"
  83         "STR     R1, [R2,#0x2C]\n"
  84         "STR     R1, [R2,#0x3C]\n"
  85         "STR     R1, [R2,#0x4C]\n"
  86         "STR     R1, [R2,#0x5C]\n"
  87         "STR     R1, [R2,#0x6C]\n"
  88         "STR     R1, [R2,#0x7C]\n"
  89         "STR     R1, [R2,#0x8C]\n"
  90         "STR     R1, [R2,#0x9C]\n"
  91         "STR     R1, [R2,#0xAC]\n"
  92         "STR     R1, [R2,#0xBC]\n"
  93         "STR     R1, [R2,#0xCC]\n"
  94         "STR     R1, [R2,#0xDC]\n"
  95         "STR     R1, [R2,#0xEC]\n"
  96         "STR     R1, [R2,#0xFC]\n"
  97         "LDR     R1, =0xC0400008\n"
  98         "LDR     R2, =0x430005\n"
  99         "STR     R2, [R1]\n"
 100         "MOV     R1, #1\n"
 101         "LDR     R2, =0xC0243100\n"
 102         "STR     R2, [R1]\n"
 103         "LDR     R2, =0xC0242010\n"
 104         "LDR     R1, [R2]\n"
 105         "ORR     R1, R1, #1\n"
 106         "STR     R1, [R2]\n"
 107         "LDR     R0, =0xFFF03608\n"
 108         "LDR     R1, =0x1900\n"
 109         "LDR     R3, =0xB294\n"
 110 "loc_FFC0013C:\n"
 111         "CMP     R1, R3\n"
 112         "LDRCC   R2, [R0],#4\n"
 113         "STRCC   R2, [R1],#4\n"
 114         "BCC     loc_FFC0013C\n"
 115         "LDR     R1, =0x133D38\n"
 116         "MOV     R2, #0\n"
 117 "loc_FFC00154:\n"
 118         "CMP     R3, R1\n"
 119         "STRCC   R2, [R3],#4\n"
 120         "BCC     loc_FFC00154\n"
 121 //        "B       loc_FFC00358\n"
 122                 "B       sub_FFC00358_my\n" // ---------------->
 123     );
 124 };
 126 void __attribute__((naked,noinline)) sub_FFC00358_my() {
 127     *(int*)0x1930=(int)taskCreateHook; 
 128     *(int*)0x1934=(int)taskCreateHook2; 
 129     *(int*)0x1938=(int)taskCreateHook;          
 131     /* Power ON/OFF detection */
 132         *(int*)(0x21B4)= (*(int*)0xC02200A8)&1 ? 0x200000 : 0x100000; // replacement  for correct power-on.
 134                 asm volatile (  
 135 "loc_FFC00358:\n"
 136         "LDR     R0, =0xFFC003D0\n"
 137         "MOV     R1, #0\n"
 138         "LDR     R3, =0xFFC00408\n"
 139 "loc_FFC00364:\n"
 140         "CMP     R0, R3\n"
 141         "LDRCC   R2, [R0],#4\n"
 142         "STRCC   R2, [R1],#4\n"
 143         "BCC     loc_FFC00364\n"
 144         "LDR     R0, =0xFFC00408\n"
 145         "MOV     R1, #0x4B0\n"
 146         "LDR     R3, =0xFFC0061C\n"
 147 "loc_FFC00380:\n"
 148         "CMP     R0, R3\n"
 149         "LDRCC   R2, [R0],#4\n"
 150         "STRCC   R2, [R1],#4\n"
 151         "BCC     loc_FFC00380\n"
 152         "MOV     R0, #0xD2\n"
 153         "MSR     CPSR_cxsf, R0\n"
 154         "MOV     SP, #0x1000\n"
 155         "MOV     R0, #0xD3\n"
 156         "MSR     CPSR_cxsf, R0\n"
 157         "MOV     SP, #0x1000\n"
 158         "LDR     R0, =0x6C4\n"
 159         "LDR     R2, =0xEEEEEEEE\n"
 160         "MOV     R3, #0x1000\n"
 161 "loc_FFC003B4:\n"
 162         "CMP     R0, R3\n"
 163         "STRCC   R2, [R0],#4\n"
 164         "BCC     loc_FFC003B4\n"
 165         //"BL      sub_FFC0119C\n"
 166         "BL      sub_FFC0119C_my\n"
 167 /*
 168 "loc_FFC003C4:\n"
 169         "ANDEQ   R0, R0, R4,ASR#13\n"
 170 "loc_FFC003C8:\n"
 171         "ANDEQ   R0, R0, R0,ROR R6\n"
 172 "loc_FFC003CC:\n"
 173         "ANDEQ   R0, R0, R4,ROR R6\n"
 174 "loc_FFC003D0:\n"
 175         "NOP\n"
 176         "LDR     PC, =0xFFC0061C\n"
 177 */
 178   );                            
 179 };
 182 void __attribute__((naked,noinline)) sub_FFC0119C_my() { 
 183         asm volatile (
 184         "STR     LR, [SP,#-4]!\n"
 185         "SUB     SP, SP, #0x74\n"
 186         "MOV     R0, SP\n"
 187         "MOV     R1, #0x74\n"
 188         "BL      sub_FFE8D778\n"
 189         "MOV     R0, #0x53000\n"
 190         "STR     R0, [SP,#4]\n"
 191 #if defined(CHDK_NOT_IN_CANON_HEAP)
 192         "LDR     R0, =0x133D38\n"
 193 #else
 194                  "LDR     R0, =new_sa\n"        // +
 195                  "LDR     R0, [R0]\n"           // +    
 196 #endif
 197         "LDR     R2, =0x279C00\n"
 198         "LDR     R1, =0x2724A8\n"
 199         "STR     R0, [SP,#8]\n"
 200         "SUB     R0, R1, R0\n"
 201         "ADD     R3, SP, #0xC\n"
 202         "STR     R2, [SP]\n"
 203         "STMIA   R3, {R0-R2}\n"
 204         "MOV     R0, #0x22\n"
 205         "STR     R0, [SP,#0x18]\n"
 206         "MOV     R0, #0x68\n"
 207         "STR     R0, [SP,#0x1C]\n"
 208         "LDR     R0, =0x19B\n"
 209         //"LDR     R1, =sub_FFC05E5C\n"
 210                 "LDR     R1, =sub_FFC05E5C_my\n"
 211         "LDR     PC, =0xffc011f0\n" // jump back to fw
 212 /*
 213         "STR     R0, [SP,#0x20]\n"
 214         "MOV     R0, #0x96\n"
 215         "STR     R0, [SP,#0x24]\n"
 216         "MOV     R0, #0x78\n"
 217         "STR     R0, [SP,#0x28]\n"
 218         "MOV     R0, #0x64\n"
 219         "STR     R0, [SP,#0x2C]\n"
 220         "MOV     R0, #0\n"
 221         "STR     R0, [SP,#0x30]\n"
 222         "STR     R0, [SP,#0x34]\n"
 223         "MOV     R0, #0x10\n"
 224         "STR     R0, [SP,#0x5C]\n"
 225         "MOV     R0, #0x800\n"
 226         "STR     R0, [SP,#0x60]\n"
 227         "MOV     R0, #0xA0\n"
 228         "STR     R0, [SP,#0x64]\n"
 229         "MOV     R0, #0x280\n"
 230         "STR     R0, [SP,#0x68]\n"
 231         "MOV     R0, SP\n"
 232         "MOV     R2, #0\n"
 233         "BL      sub_FFC03408\n"
 234         "ADD     SP, SP, #0x74\n"
 235         "LDR     PC, [SP],#4\n"
 236 */
 237         );
 238 }; 
 240 void __attribute__((naked,noinline)) sub_FFC05E5C_my() {
 241         asm volatile (
 242         "STMFD   SP!, {R4,LR}\n"
 243         "BL      sub_FFC00B24\n"
 244         "BL      sub_FFC0A838\n"
 245         "CMP     R0, #0\n"
 246         "LDRLT   R0, =0xFFC05F70\n"
 247         "BLLT    sub_FFC05F50\n"
 248         "BL      sub_FFC05A98\n"
 249         "CMP     R0, #0\n"
 250         "LDRLT   R0, =0xFFC05F78\n"
 251         "BLLT    sub_FFC05F50\n"
 252         "LDR     R0, =0xFFC05F88\n"
 253         "BL      sub_FFC05B80\n"
 254         "CMP     R0, #0\n"
 255         "LDRLT   R0, =0xFFC05F90\n"
 256         "BLLT    sub_FFC05F50\n"
 257         "LDR     R0, =0xFFC05F88\n"
 258         "BL      sub_FFC03BF4\n"
 259         "CMP     R0, #0\n"
 260         "LDRLT   R0, =0xFFC05FA4\n"
 261         "BLLT    sub_FFC05F50\n"
 262         "BL      sub_FFC0A230\n"
 263         "CMP     R0, #0\n"
 264         "LDRLT   R0, =0xFFC05FB0\n"
 265         "BLLT    sub_FFC05F50\n"
 266         "BL      sub_FFC01680\n"
 267         "CMP     R0, #0\n"
 268         "LDRLT   R0, =0xFFC05FBC\n"
 269         "BLLT    sub_FFC05F50\n"
 270         "LDMFD   SP!, {R4,LR}\n"
 271         //"B       sub_FFC105BC\n"
 272                 "B       taskcreate_Startup_my\n" //----------> 
 273         );
 274 }; 
 278 void __attribute__((naked,noinline)) taskcreate_Startup_my() { 
 279         asm volatile (  
 281         "STMFD   SP!, {R3,LR}\n"
 282         "BL      sub_FFC23A78\n"
 283         "BL      sub_FFC2AF84\n"
 284         "CMP     R0, #0\n"
 285         "BNE     loc_FFC105F8\n"
 286         "BL      sub_FFC2526C\n"
 287         "CMP     R0, #0\n"
 288         "BEQ     loc_FFC105F8\n"
 289         "BL      sub_FFC23A74\n"
 290         "CMP     R0, #0\n"
 291         "BNE     loc_FFC105F8\n"
 292         "LDR     R1, =0xC0220000\n"
 293         "MOV     R0, #0x44\n"
 294         "STR     R0, [R1,#0x48]\n"
 295 "loc_FFC105F4:\n"
 296         "B       loc_FFC105F4\n"
 297 "loc_FFC105F8:\n"
 298         //"BL      sub_FFC23A80\n" // removed, see boot() function              
 299         "BL      sub_FFC23A7C\n"
 300         "BL      sub_FFC293A8\n"
 301         "LDR     R1, =0x2CE000\n"
 302         "MOV     R0, #0\n"
 303         "BL      sub_FFC295F0\n"
 304         "BL      sub_FFC2959C    \n"
 305         "MOV     R3, #0\n"
 306         "STR     R3, [SP]\n"
 307         //"ADR     R3, sub_FFC10560\n"
 308         "LDR     R3, =task_Startup_my\n" //+ ----------->               
 309         "MOV     R2, #0\n"
 310         "MOV     R1, #0x19\n"
 311         "LDR     R0, =0xFFC10640\n"
 312         "BL      sub_FFC0F110    \n"
 313         "MOV     R0, #0\n"
 314         "LDMFD   SP!, {R12,PC}\n"
 315  );
 316 }; 
 318 void __attribute__((naked,noinline)) task_Startup_my() { 
 319         asm volatile (
 320         "STMFD   SP!, {R4,LR}\n"
 321         "BL      sub_FFC06228\n"
 322         "BL      sub_FFC24B7C\n"
 323         "BL      sub_FFC23414\n"
 324         "BL      sub_FFC2AFC4\n"
 325         "BL      sub_FFC2B1B0\n"
 326         //"BL      sub_FFC2B058\n" // Skip starting diskboot.bin again
 327         "BL      sub_FFC2B34C\n"
 328         "BL      sub_FFC2B1E0\n"
 329         "BL      sub_FFC28840\n"
 330         "BL      sub_FFC2B350\n"
 331                 //"BL      sub_FFC23968\n"
 332         );               
CreateTask_PhySw(); // +
CreateTask_spytask();  // +
 335     asm volatile (                      
 336         "BL      sub_FFC26EA8\n"
 337         "BL      sub_FFC2B368\n"
 338         "BL      sub_FFC222BC\n"
 339         "BL      sub_FFC22E6C    \n"
 340         "BL      sub_FFC2AD5C\n"
 341         "BL      sub_FFC233C8\n"
 342         "BL      sub_FFC22E08\n"
 343         "BL      sub_FFC2BDCC\n"
 344         "BL      sub_FFC22DE0\n"
 345         "LDMFD   SP!, {R4,LR}\n"
 346         "B       sub_FFC06128    \n"
 347         );
 348 }; 
 350 void spytask(long ua, long ub, long uc, long ud, long ue, long uf)
 351 {
 352     (void)ua; (void)ub; (void)uc; (void)ud; (void)ue; (void)uf;
core_spytask();
 354 }
 355 void CreateTask_spytask() { 
_CreateTask("SpyTask", 0x19, 0x2000, spytask, 0);
 357 };
 359 void __attribute__((naked,noinline)) CreateTask_PhySw() {
 360         asm volatile ( 
 361         "STMFD   SP!, {R3-R5,LR}\n"
 362         "LDR     R4, =0x1BE4\n"
 363         "LDR     R0, [R4,#0x10]\n"
 364         "CMP     R0, #0\n"
 365         "BNE     loc_FFC2399C\n"
 366         "MOV     R3, #0\n"
 367         "STR     R3, [SP]\n"
 368         //"LDR     R3, =0xFFC23934\n"
 369         //"MOV     R2, #0x800\n"
 370         "LDR     R3, =mykbd_task\n"  // task_phySw
 371             "MOV     R2, #0x2000\n"             // greater Stacksize
 372         "MOV     R1, #0x17\n"
 373         "LDR     R0, =0xFFC23B70 \n"
 374         "BL      sub_FFC0F3E8    \n"
 375         "STR     R0, [R4,#0x10]\n"
 376 "loc_FFC2399C:\n"
 377         "BL      sub_FFC6AA14\n"
 378         "BL      sub_FFC251E4\n"
 379         "CMP     R0, #0\n"
 380         "LDREQ   R1, =0x2EEE0\n"
 381         "LDMEQFD SP!, {R3-R5,LR}\n"
 382         "BEQ     sub_FFC6A99C\n"
 383         "LDMFD   SP!, {R3-R5,PC}\n"
 384         "CMP     R0, #3\n"
 385         );
 386 };
 388 void __attribute__((naked,noinline)) init_file_modules_task() { 
 389   asm volatile (
 390         "STMFD   SP!, {R4-R6,LR}\n"
 391         "BL      sub_FFC6CEE0\n"
 392         "LDR     R5, =0x5006\n"
 393         "MOVS    R4, R0\n"
 394         "MOVNE   R1, #0\n"
 395         "MOVNE   R0, R5\n"
 396         "BLNE    sub_FFC6F79C\n"
 397         // "BL      sub_FFC6CF0C\n"
 398         "BL      sub_FFC6CF0C_my\n"
 399                 "BL      core_spytask_can_start\n"      // +            
 400         "CMP     R4, #0\n"
 401         "MOVEQ   R0, R5\n"
 402         "LDMEQFD SP!, {R4-R6,LR}\n"
 403         "MOVEQ   R1, #0\n"
 404         "BEQ     sub_FFC6F79C\n"
 405         "LDMFD   SP!, {R4-R6,PC}\n"
 406  );
 407 }; 
 409 void __attribute__((naked,noinline)) sub_FFC6CF0C_my() { 
 410  asm volatile (
 411         "STMFD   SP!, {R4,LR}\n"
 412         "MOV     R0, #3\n"
 413         //"BL      sub_FFC52014    \n"
 414                 "BL      sub_FFC52014_my\n"
 415         "LDR     PC,=0xffc6cf18\n" // jump back to fw
 416 /*
 417         "BL      sub_FFCFE2E8\n"
 418         "LDR     R4, =0x2B70\n"
 419         "LDR     R0, [R4,#4]\n"
 420         "CMP     R0, #0\n"
 421         "BNE     loc_FFC6CF44\n"
 422         "BL      sub_FFC5125C\n"
 423         "BL      sub_FFCF48B8\n"
 424         "BL      sub_FFC5125C\n"
 425         "BL      sub_FFC4DCD4\n"
 426         "BL      sub_FFC5115C\n"
 427         "BL      sub_FFCF494C\n"
 428 "loc_FFC6CF44:\n"
 429         "MOV     R0, #1\n"
 430         "STR     R0, [R4]\n"
 431         "LDMFD   SP!, {R4,PC}\n"
 432 */
 433  );
 434 }; 
 437 void __attribute__((naked,noinline)) sub_FFC52014_my() {
 438  asm volatile (
 439          "STMFD   SP!, {R4-R8,LR}\n"
 440         "MOV     R8, R0\n"
 441         "BL      sub_FFC51F94    \n"
 442         "LDR     R1, =0x33688\n"
 443         "MOV     R6, R0\n"
 444         "ADD     R4, R1, R0,LSL#7\n"
 445         "LDR     R0, [R4,#0x6C]\n"
 446         "CMP     R0, #4\n"
 447         "LDREQ   R1, =0x817\n"
 448         "LDREQ   R0, =0xFFC51AD4\n"
 449         "BLEQ    sub_FFC0F5E8\n"
 450         "MOV     R1, R8\n"
 451         "MOV     R0, R6\n"
 452         "BL      sub_FFC5184C    \n"
 453         "LDR     R0, [R4,#0x38]\n"
 454         "BL      sub_FFC526B4\n"
 455         "CMP     R0, #0\n"
 456         "STREQ   R0, [R4,#0x6C]\n"
 457         "MOV     R0, R6\n"
 458         "BL      sub_FFC518DC\n"
 459         "MOV     R0, R6\n"
 460         //"BL      sub_FFC51C3C\n"
 461                 "BL      sub_FFC51C3C_my\n" //------------->            
 462         "LDR     PC, =0xffc5206c\n" // jump back to firmware
 463 /*
 464         "MOV     R5, R0\n"
 465         "MOV     R0, R6\n"
 466         "BL      sub_FFC51E6C    \n"
 467         "LDR     R6, [R4,#0x3C]\n"
 468         "AND     R7, R5, R0\n"
 469         "CMP     R6, #0\n"
 470         "LDR     R1, [R4,#0x38]\n"
 471         "MOVEQ   R0, #0x80000001\n"
 472         "MOV     R5, #0\n"
 473         "BEQ     loc_FFC520C4\n"
 474         "MOV     R0, R1\n"
 475         "BL      sub_FFC513C4\n"
 476         "CMP     R0, #0\n"
 477         "MOVNE   R5, #4\n"
 478         "CMP     R6, #5\n"
 479         "ORRNE   R0, R5, #1\n"
 480         "BICEQ   R0, R5, #1\n"
 481         "CMP     R7, #0\n"
 482         "BICEQ   R0, R0, #2\n"
 483         "ORREQ   R0, R0, #0x80000000\n"
 484         "BICNE   R0, R0, #0x80000000\n"
 485         "ORRNE   R0, R0, #2\n"
 486 "loc_FFC520C4:\n"
 487         "CMP     R8, #7\n"
 488         "STR     R0, [R4,#0x40]\n"
 489         "LDMNEFD SP!, {R4-R8,PC}\n"
 490         "MOV     R0, R8\n"
 491         "BL      sub_FFC51FE4\n"
 492         "CMP     R0, #0\n"
 493         "LDMEQFD SP!, {R4-R8,LR}\n"
 494         "LDREQ   R0, =0xFFC52110\n"
 495         "BEQ     sub_FFC01780\n"
 496         "LDMFD   SP!, {R4-R8,PC}\n"
 497 */
 498  );
 499 }; 
 501 void __attribute__((naked,noinline)) sub_FFC51C3C_my() {
 503  asm volatile (
 504         "STMFD   SP!, {R4-R6,LR}\n"
 505         "MOV     R5, R0\n"
 506         "LDR     R0, =0x33688\n"
 507         "ADD     R4, R0, R5,LSL#7\n"
 508         "LDR     R0, [R4,#0x6C]\n"
 509         "TST     R0, #2\n"
 510         "MOVNE   R0, #1\n"
 511         "LDMNEFD SP!, {R4-R6,PC}\n"
 512         "LDR     R0, [R4,#0x38]\n"
 513         "MOV     R1, R5\n"
 514         //"BL      sub_FFC5195C    \n"
 515         "BL      sub_FFC5195C_my\n" // ------------------>              
 516         "LDR     PC,=0xffc51c68\n" // jump back to fw
 517 /*
 518         "CMP     R0, #0\n"
 519         "LDRNE   R0, [R4,#0x38]\n"
 520         "MOVNE   R1, R5\n"
 521         "BLNE    sub_FFC51AF8    \n"
 522         "LDR     R2, =0x33708\n"
 523         "ADD     R1, R5, R5,LSL#4\n"
 524         "LDR     R1, [R2,R1,LSL#2]\n"
 525         "CMP     R1, #4\n"
 526         "BEQ     loc_FFC51C9C\n"
 527         "CMP     R0, #0\n"
 528         "LDMEQFD SP!, {R4-R6,PC}\n"
 529         "MOV     R0, R5\n"
 530         "BL      sub_FFC51454\n"
 531 "loc_FFC51C9C:\n"
 532         "CMP     R0, #0\n"
 533         "LDRNE   R1, [R4,#0x6C]\n"
 534         "ORRNE   R1, R1, #2\n"
 535         "STRNE   R1, [R4,#0x6C]\n"
 536         "LDMFD   SP!, {R4-R6,PC}\n"
 537 */
 538  );
 539 };
 542 void __attribute__((naked,noinline)) sub_FFC5195C_my() {
 543  asm volatile ( 
 544         "STMFD   SP!, {R4-R10,LR}\n"
 545         "MOV     R9, R0\n"
 546         "LDR     R0, =0x33688\n"
 547         "MOV     R8, #0\n"
 548         "ADD     R5, R0, R1,LSL#7\n"
 549         "LDR     R0, [R5,#0x3C]\n"
 550         "MOV     R7, #0\n"
 551         "CMP     R0, #7\n"
 552         "MOV     R6, #0\n"
 553         "ADDLS   PC, PC, R0,LSL#2\n"
 554         "B       loc_FFC51AB4\n"
 555 "loc_FFC51988:\n"
 556         "B       loc_FFC519C0\n"
 557 "loc_FFC5198C:\n"
 558         "B       loc_FFC519A8\n"
 559 "loc_FFC51990:\n"
 560         "B       loc_FFC519A8\n"
 561 "loc_FFC51994:\n"
 562         "B       loc_FFC519A8\n"
 563 "loc_FFC51998:\n"
 564         "B       loc_FFC519A8\n"
 565 "loc_FFC5199C:\n"
 566         "B       loc_FFC51AAC\n"
 567 "loc_FFC519A0:\n"
 568         "B       loc_FFC519A8\n"
 569 "loc_FFC519A4:\n"
 570         "B       loc_FFC519A8\n"
 571 "loc_FFC519A8:\n"
 572         "MOV     R2, #0\n"
 573         "MOV     R1, #0x200\n"
 574         "MOV     R0, #2\n"
 575         "BL      sub_FFC6710C\n"
 576         "MOVS    R4, R0\n"
 577         "BNE     loc_FFC519C8\n"
 578 "loc_FFC519C0:\n"
 579         "MOV     R0, #0\n"
 580         "LDMFD   SP!, {R4-R10,PC}\n"
 581 "loc_FFC519C8:\n"
 582         "LDR     R12, [R5,#0x50]\n"
 583         "MOV     R3, R4\n"
 584         "MOV     R2, #1\n"
 585         "MOV     R1, #0\n"
 586         "MOV     R0, R9\n"
 587         "BLX     R12\n"
 588         "CMP     R0, #1\n"
 589         "BNE     loc_FFC519F4\n"
 590         "MOV     R0, #2\n"
 591         "BL      sub_FFC67258    \n"
 592         "B       loc_FFC519C0\n"
 593 "loc_FFC519F4:\n"
 594         "LDR     R1, [R5,#0x64]\n"
 595         "MOV     R0, R9\n"
 596         "BLX     R1\n"
 598                "MOV   R1, R4\n"           //  pointer to MBR in R1
 599 //                              "BL    mbr_read_dryos\n"   //  total sectors count in R0 before and after call
 601                 // Start of DataGhost's FAT32 autodetection code
 602                 // Policy: If there is a partition which has type W95 FAT32, use the first one of those for image storage
 603                 // According to the code below, we can use R1, R2, R3 and R12.
 604                 // LR wasn't really used anywhere but for storing a part of the partition signature. This is the only thing
 605                 // that won't work with an offset, but since we can load from LR+offset into LR, we can use this to do that :)
 606                 "MOV     R12, R4\n"                    // Copy the MBR start address so we have something to work with
 607                 "MOV     LR, R4\n"                     // Save old offset for MBR signature
 608                 "MOV     R1, #1\n"                     // Note the current partition number
 609                 "B       dg_sd_fat32_enter\n"          // We actually need to check the first partition as well, no increments yet!
 610            "dg_sd_fat32:\n"
 611                 "CMP     R1, #4\n"                     // Did we already see the 4th partition?
 612                 "BEQ     dg_sd_fat32_end\n"            // Yes, break. We didn't find anything, so don't change anything.
 613                 "ADD     R12, R12, #0x10\n"            // Second partition
 614                 "ADD     R1, R1, #1\n"                 // Second partition for the loop
 615            "dg_sd_fat32_enter:\n"
 616                 "LDRB    R2, [R12, #0x1BE]\n"          // Partition status
 617                 "LDRB    R3, [R12, #0x1C2]\n"          // Partition type (FAT32 = 0xB)
 618                 "CMP     R3, #0xB\n"                   // Is this a FAT32 partition?
 619                 "CMPNE   R3, #0xC\n"                   // Not 0xB, is it 0xC (FAT32 LBA) then?
 620                 "BNE     dg_sd_fat32\n"                // No, it isn't.
 621                 "CMP     R2, #0x00\n"                  // It is, check the validity of the partition type
 622                 "CMPNE   R2, #0x80\n"
 623                 "BNE     dg_sd_fat32\n"                // Invalid, go to next partition
 624                                                        // This partition is valid, it's the first one, bingo!
 625                 "MOV     R4, R12\n"                    // Move the new MBR offset for the partition detection.
 627            "dg_sd_fat32_end:\n"
 628                 // End of DataGhost's FAT32 autodetection code    
 630         "LDRB    R1, [R4,#0x1C9]\n"
 631         "LDRB    R3, [R4,#0x1C8]\n"
 632         "LDRB    R12, [R4,#0x1CC]\n"
 633         "MOV     R1, R1,LSL#24\n"
 634         "ORR     R1, R1, R3,LSL#16\n"
 635         "LDRB    R3, [R4,#0x1C7]\n"
 636         "LDRB    R2, [R4,#0x1BE]\n"
 637         //"LDRB    LR, [R4,#0x1FF]\n" // replaced, see below            
 638         "ORR     R1, R1, R3,LSL#8\n"
 639         "LDRB    R3, [R4,#0x1C6]\n"
 640         "CMP     R2, #0\n"
 641         "CMPNE   R2, #0x80\n"
 642         "ORR     R1, R1, R3\n"
 643         "LDRB    R3, [R4,#0x1CD]\n"
 644         "MOV     R3, R3,LSL#24\n"
 645         "ORR     R3, R3, R12,LSL#16\n"
 646         "LDRB    R12, [R4,#0x1CB]\n"
 647         "ORR     R3, R3, R12,LSL#8\n"
 648         "LDRB    R12, [R4,#0x1CA]\n"
 649         "ORR     R3, R3, R12\n"
 650         //"LDRB    R12, [R4,#0x1FE]\n" // replaced, see below
 651         "LDRB    R12, [LR,#0x1FE]\n"        // New! First MBR signature byte (0x55)
 652         "LDRB    LR, [LR,#0x1FF]\n"         //      Last MBR signature byte (0xAA)      
 653         "BNE     loc_FFC51A80\n"
 654         "CMP     R0, R1\n"
 655         "BCC     loc_FFC51A80\n"
 656         "ADD     R2, R1, R3\n"
 657         "CMP     R2, R0\n"
 658         "CMPLS   R12, #0x55\n"
 659         "CMPEQ   LR, #0xAA\n"
 660         "MOVEQ   R7, R1\n"
 661         "MOVEQ   R6, R3\n"
 662         "MOVEQ   R4, #1\n"
 663         "BEQ     loc_FFC51A84\n"
 664 "loc_FFC51A80:\n"
 665         "MOV     R4, R8\n"
 666 "loc_FFC51A84:\n"
 667         "MOV     R0, #2\n"
 668         "BL      sub_FFC67258    \n"
 669         "CMP     R4, #0\n"
 670         "BNE     loc_FFC51AC0\n"
 671         "LDR     R1, [R5,#0x64]\n"
 672         "MOV     R7, #0\n"
 673         "MOV     R0, R9\n"
 674         "BLX     R1\n"
 675         "MOV     R6, R0\n"
 676         "B       loc_FFC51AC0\n"
 677 "loc_FFC51AAC:\n"
 678         "MOV     R6, #0x40\n"
 679         "B       loc_FFC51AC0\n"
 680 "loc_FFC51AB4:\n"
 681         "LDR     R1, =0x572\n"
 682         "LDR     R0, =0xFFC51AD4\n"
 683         "BL      sub_FFC0F5E8\n"
 684 "loc_FFC51AC0:\n"
 685         "STR     R7, [R5,#0x44]!\n"
 686         "STMIB   R5, {R6,R8}\n"
 687         "MOV     R0, #1\n"
 688         "LDMFD   SP!, {R4-R10,PC}\n"
 689  );
 690 };