root/platform/ixus1000_sd4500/sub/100d/boot.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. _Open
  2. sub_FF872470_my
  3. blink
  4. taskHook
  5. CreateTask_spytask
  6. boot
  7. sub_FF810354_my
  8. sub_FF811198_my
  9. sub_FF815EE0_my
  10. taskcreate_Startup_my
  11. task_Startup_my
  12. JogDial_task_my
  13. init_file_modules_task
  14. sub_FF8966B4_my
  15. sub_FF87538C_my
  16. sub_FF874FB4_my
  17. sub_FF874CD4_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 #include "dryos31.h"
   5 //#include "stdlib.h"
   6 
   7 
   8 extern void task_FileWrite();
   9 
  10 //IXUS 1000 100D
  11 
  12 int fsionotify_compfail = 0;    // count of number of times the file handle was already in the array
  13 int fsionotify_success  = 0;    // count of number of times the code succeeded
  14 
  15 int __attribute__((naked,noinline)) _Open(const char *name, int flags, int mode) {
  16 
  17    asm volatile (
  18                                 "STMFD   SP!, {R4-R8,LR} \n"
  19                                 "MOV     R6, R0 \n"
  20                                 "LDRB    R0, [R0] \n"
  21                                 "MOV     R7, R2 \n"
  22                                 "MOV     R4, R1 \n"
  23                                 "BL      sub_FF874504 \n"
  24                                 "MOV     R8, R0 \n"
  25                                 "MOV     R0, #1 \n"
  26                                 "BIC     R5, R0, R4,LSR#12 \n"
  27                                 "BIC     R4, R4, #0x9000 \n"
  28                                 "MOV     R0, R8 \n"
  29                                 "MOV     R1, #1 \n"
  30                                 "BL      sub_FF875894 \n"
  31                                 "MOV     R2, R7 \n"
  32                                 "MOV     R1, R4 \n"
  33                                 "MOV     R0, R6 \n"
  34                                 "BL      _open \n"
  35                                 "CMP     R5, #0 \n"
  36                                 "MOV     R7, R0 \n"
  37                                 "MOVNE   R0, R7 \n"
  38                                 "MOVNE   R2, R4 \n"
  39                                 "MOVNE   R1, R6 \n"
  40                                 "BLNE    sub_FF872470_my \n"
  41                                 "MOV     R0, R8 \n"
  42                                 "BL      sub_FF87590C \n"
  43                                 "MOV     R0, R7 \n"
  44                                 "LDMFD   SP!, {R4-R8,PC} \n"
  45    );
  46 
  47         return 0; // stop compiler warning
  48 }
  49 
  50 void __attribute__((naked,noinline)) sub_FF872470_my() {
  51 
  52    asm volatile (
  53                                 "STMFD   SP!, {R4-R8,LR} \n"
  54                                 "MOV     R5, R0 \n"
  55                                 "LDR     R0, =0x31B8 \n"
  56                                 "MOV     R7, R1 \n"
  57                                 "LDR     R0, [R0,#4] \n"
  58                                 "MOV     R6, R2 \n"
  59                                 "CMP     R0, #0 \n"
  60                                 "LDMEQFD SP!, {R4-R8,PC} \n"
  61                                 "CMP     R5, #0 \n"
  62                                 "LDMLTFD SP!, {R4-R8,PC} \n"
  63                                 "MOV     R4, #0 \n"
  64                                 "LDR     R2, =0x38EA8 \n"
  65                                 "MOV     R0, #0 \n"
  66 "loc_FF8724A4: \n"
  67                                 "ADD     R1, R0, R0,LSL#1 \n"
  68                                 "LDR     R1, [R2,R1,LSL#5] \n"
  69                                 "CMN     R1, #1 \n"
  70                                 "ADDEQ   R0, R0, R0,LSL#1 \n"
  71                                 "ADDEQ   R4, R2, R0,LSL#5 \n"
  72                                 "BEQ     loc_FF8724CC\n"
  73                                 "CMP     R1, R5 \n"
  74 
  75                                 "BEQ     loc_2 \n"                                              // +    // branch if found entry matching new file handle
  76 
  77                                 "ADDNE   R0, R0, #1 \n"
  78                                 "CMPNE   R0, #0xA \n"
  79                                 "BLT     loc_FF8724A4 \n"
  80 
  81 "loc_FF8724CC: \n"
  82                                 "CMP     R4, #0 \n"
  83                                 "LDREQ   R1, =0x1C9 \n"
  84                                 "LDREQ   R0, =0xFF8723B8 \n"                    //aFsionotify_c
  85                                 "BLEQ    sub_FF81EB78 \n"                               //_DebugAssert
  86 
  87                                 "LDR     R1, =fsionotify_success \n"    // +    // increment counter
  88                                 "LDR     R0, [R1] \n"                                   // +    // of successful calls
  89                                 "ADD     R0, R0, #1 \n"                                 // +
  90                                 "STR     R0, [R1] \n"                                   // +
  91 
  92                                 "MOV     R0, #0 \n"                                             // original code - save handle in array
  93                                 "STR     R0, [R4,#0x58] \n"
  94                                 "STR     R5, [R4] \n"
  95                                 "MOV     R0, R4 \n"
  96                                 "MOV     R1, R7 \n"
  97                                 "STR     R6, [R4,#0x24] \n"
  98                                 "BL      sub_FF872238 \n"
  99                                 "ADD     R1, R4, #0x28 \n"
 100                                 "MOV     R0, R7 \n"
 101                                 "LDMFD   SP!, {R4-R8,LR} \n"
 102                                 "B       sub_FF8381C4 \n"
 103 
 104 "loc_2: \n"                                                                                             // +    // Handle case when new file handle returned from _open is already in array
 105                                 "LDR     R1, =fsionotify_compfail \n"   // +    // increment counter then return rather than throw exception
 106                                 "LDR     R0, [R1] \n"                                   // +    // equivalent to calling _open rather than _Open
 107                                 "ADD     R0, R0, #1 \n"                                 // +
 108                                 "STR     R0, [R1] \n"                                   // +
 109                                 "LDMFD   SP!, {R4-R8,PC} \n"                    // +
 110    );
 111 }
 112 
 113 #define LED_PR 0xC0220138   // -> ASM1989 08.24.2010 found at  FF91E080  in sx200 was FF8E73D0
 114     void __attribute__((naked,noinline)) blink()
 115 {
 116         volatile long *p=(void*)LED_PR;
 117         int i;
 118     int cnt =10;
 119         for(;cnt>0;cnt--){
 120                 p[0]=0x46;
 121 
 122                 for(i=0;i<0x200000;i++){
 123                         asm ("nop\n");
 124                         asm ("nop\n");
 125                 }
 126                 p[0]=0x44;
 127                 for(i=0;i<0x200000;i++){
 128                         asm ("nop\n");
 129                         asm ("nop\n");
 130                 }
 131         }
 132         shutdown();
 133 }
 134 
 135 
 136 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
 137 
 138 void JogDial_task_my(void);
 139 
 140 const char * const new_sa = &_end;
 141 
 142 void taskHook(context_t **context) {
 143 
 144 task_t *tcb=(task_t*)((char*)context-offsetof(task_t, context));
 145 
 146 if(!_strcmp(tcb->name, "PhySw"))           tcb->entry = (void*)mykbd_task;  //JHARP - Verified name - Sept 5, 2010
 147 if(!_strcmp(tcb->name, "CaptSeqTask"))     tcb->entry = (void*)capt_seq_task; //JHARP - Verified name - Sept 5, 2010
 148 if(!_strcmp(tcb->name, "InitFileModules")) tcb->entry = (void*)init_file_modules_task; //JHARP - Verified name - Sept 5, 2010
 149 //if(!_strcmp(tcb->name, "MovieRecord"))     tcb->entry = (void*)movie_record_task; //JHARP - Verified name - Sept 5, 2010
 150 if(!_strcmp(tcb->name, "ExpDrvTask"))      tcb->entry = (void*)exp_drv_task; //JHARP - Verified name - Sept 5, 2010
 151 if(!_strcmp(tcb->name, "RotarySw"))        tcb->entry = (void*)JogDial_task_my; //JHARP - Must verify the code in use - Sept 5, 2010
 152     if(tcb->entry == (void*)task_FileWrite)         tcb->entry = (void*)filewritetask;
 153 
 154 }
 155 
 156 void CreateTask_spytask() {
 157         _CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);
 158 };
 159 
 160 
 161 void __attribute__((naked,noinline)) boot() {
 162                
 163     asm volatile (
 164                                  //"B             sub_FF81000C\n" // work
 165                  "LDR R1, =0xC0410000\n"
 166                                   "MOV R0, #0\n"
 167                                   "STR R0, [R1]\n"
 168                                   "MOV R1, #0x78\n"
 169                                   "MCR p15, 0, R1,c1,c0\n"                      // control reg
 170                                   "MOV R1, #0\n"
 171                                   "MCR p15, 0, R1,c7,c10, 4\n"          // drain write buffer
 172                                   "MCR p15, 0, R1,c7,c5\n"                      // flush instruction cache
 173                                   "MCR p15, 0, R1,c7,c6\n"                      // flush data cache
 174                                   "MOV R0, #0x3D\n"                                     // size 2GB base 0x00000000
 175                                   "MCR p15, 0, R0,c6,c0\n"
 176                                   "MOV R0, #0xC000002F\n"                       // size 16M base 0xc0000000
 177                                   "MCR p15, 0, R0,c6,c1\n"
 178                                   "MOV R0, #0x35\n"                                  // size 128M base 0x00000000 (s90 is 64M)
 179                                   "MCR p15, 0, R0,c6,c2\n"
 180                                   "MOV R0, #0x40000035\n"                       // size 128M base 0x40000000 (s90 is 64M)
 181                                   "MCR p15, 0, R0,c6,c3\n"
 182                                   "MOV R0, #0x80000017\n"                       // size  4k base 0x80000000
 183                                   "MCR p15, 0, R0,c6,c4\n"
 184                                   "LDR R0, =0xFF80002D\n"                       // size  8M base 0xff800000
 185                                   "MCR p15, 0, R0,c6,c5\n"
 186                                   "MOV R0, #0x34\n"
 187                                   "MCR p15, 0, R0,c2,c0\n"
 188                                   "MOV R0, #0x34\n"
 189                                   "MCR p15, 0, R0,c2,c0, 1\n"
 190                                   "MOV R0, #0x34\n"
 191                                   "MCR p15, 0, R0,c3,c0\n"
 192                                   "LDR R0, =0x3333330\n"
 193                                   "MCR p15, 0, R0,c5,c0, 2\n"
 194                                   "LDR R0, =0x3333330\n"
 195                                   "MCR p15, 0, R0,c5,c0, 3\n"
 196                                   "MRC p15, 0, R0,c1,c0\n"
 197                                   "ORR R0, R0, #0x1000\n"
 198                                   "ORR R0, R0, #4\n"
 199                                   "ORR R0, R0, #1\n"
 200                                   "MCR p15, 0, R0,c1,c0\n"
 201                                   "MOV R1, #0x80000006\n"
 202                                   "MCR p15, 0, R1,c9,c1\n"
 203                                   "MOV R1, #6\n"
 204                                   "MCR p15, 0, R1,c9,c1, 1\n"
 205                                   "MRC p15, 0, R1,c1,c0\n"
 206                                   "ORR R1, R1, #0x50000\n"
 207                                   "MCR p15, 0, R1,c1,c0\n"
 208                                   "LDR R2, =0xC0200000\n"
 209                                   "MOV R1, #1\n"
 210                                   "STR R1, [R2,#0x10C]\n"
 211                                   "MOV R1, #0xFF\n"
 212                                   "STR R1, [R2,#0xC]\n"
 213                                   "STR R1, [R2,#0x1C]\n"
 214                                   "STR R1, [R2,#0x2C]\n"
 215                                   "STR R1, [R2,#0x3C]\n"
 216                                   "STR R1, [R2,#0x4C]\n"
 217                                   "STR R1, [R2,#0x5C]\n"
 218                                   "STR R1, [R2,#0x6C]\n"
 219                                   "STR R1, [R2,#0x7C]\n"
 220                                   "STR R1, [R2,#0x8C]\n"
 221                                   "STR R1, [R2,#0x9C]\n"
 222                                   "STR R1, [R2,#0xAC]\n"
 223                                   "STR R1, [R2,#0xBC]\n"
 224                                   "STR R1, [R2,#0xCC]\n"
 225                                   "STR R1, [R2,#0xDC]\n"
 226                                   "STR R1, [R2,#0xEC]\n"
 227                                   "STR R1, [R2,#0xFC]\n"
 228                                   "LDR R1, =0xC0400008\n"
 229                                   "LDR R2, =0x430005\n"
 230                                   "STR R2, [R1]\n"
 231                                   "MOV R1, #1\n"
 232                                   "LDR R2, =0xC0243100\n"
 233                                   "STR R2, [R1]\n"
 234                                   "LDR R2, =0xC0242010\n"
 235                                   "LDR R1, [R2]\n"
 236                                   "ORR R1, R1, #1\n"
 237                                   "STR R1, [R2]\n"
 238                                   "LDR R0, =0xFFC56CC8\n"
 239                                   "LDR R1, =0x1900\n"
 240                                   "LDR R3, =0x10720\n"
 241 "loc_FF81013C:\n"
 242 
 243                                   "CMP R1, R3\n"
 244                                   "LDRCC R2, [R0],#4\n"
 245                                   "STRCC R2, [R1],#4\n"
 246                                   "BCC loc_FF81013C\n"
 247                                   "LDR R1, =0x172BF8\n"
 248                                   "MOV R2, #0\n"
 249 "loc_FF810154:\n"
 250                                   "CMP R3, R1\n"
 251                                   "STRCC R2, [R3],#4\n"
 252                                   "BCC loc_FF810154\n"
 253                                   "B sub_FF810354_my\n"
 254                             //---------->
 255       );
 256 }
 257 
 258 
 259 void __attribute__((naked,noinline)) sub_FF810354_my() { // ASM1989 -> In sx200 was:  sub_FF8101A0_my
 260 
 261    *(int*)0x1938=(int)taskHook;   //was 1934 in sx200 if 1938 hangs
 262    *(int*)0x193C=(int)taskHook;
 263 
 264 
 265         if ((*(int*) 0xC022010C) & 1)                                   // look at play switch
 266                 *(int*)(0x254C) = 0x400000;                                     // start in play mode
 267         else
 268                 *(int*)(0x254C) = 0x200000;                                     // start in rec mode
 269 
 270    asm volatile (
 271              "LDR R0, =0xFF8103CC\n"
 272                  "MOV R1, #0\n"
 273                  "LDR R3, =0xFF810404\n"
 274 "loc_FF810360:\n"
 275                  "CMP R0, R3\n"
 276                  "LDRCC R2, [R0],#4\n"
 277                  "STRCC R2, [R1],#4\n"
 278                  "BCC loc_FF810360\n"
 279                  "LDR R0, =0xFF810404\n"
 280                  "MOV R1, #0x4B0\n"
 281                  "LDR R3, =0xFF810618\n"
 282 "loc_FF81037C:\n"
 283                  "CMP R0, R3\n"
 284                  "LDRCC R2, [R0],#4\n"
 285                  "STRCC R2, [R1],#4\n"
 286                  "BCC loc_FF81037C\n"
 287                  "MOV R0, #0xD2\n"
 288                  "MSR CPSR_cxsf, R0\n"
 289                  "MOV SP, #0x1000\n"
 290                  "MOV R0, #0xD3\n"
 291                  "MSR CPSR_cxsf, R0\n"
 292                  "MOV SP, #0x1000\n"
 293                  "LDR R0, =0x6C4\n"
 294                  "LDR R2, =0xEEEEEEEE\n"
 295                  "MOV R3, #0x1000\n"
 296 "loc_FF8103B0:\n"
 297                  "CMP R0, R3\n"
 298                  "STRCC R2, [R0],#4\n"
 299                  "BCC loc_FF8103B0\n"
 300                  "BL sub_FF811198_my\n"
 301                                                         //------------>
 302 
 303 
 304 
 305 "loc_FF8103C0:\n"
 306                  "ANDEQ R0, R0, R4,ASR#13\n"
 307 "loc_FF8103C4:\n"
 308                 "ANDEQ R0, R0, R0,ROR R6\n"
 309 "loc_FF8103C8:\n"
 310                 "ANDEQ R0, R0, R4,ROR R6\n"
 311 "loc_FF8103CC:\n"
 312          "NOP\n"
 313          "LDR PC, =0xFF810618\n"
 314      );
 315 }
 316 
 317 void __attribute__((naked,noinline)) sub_FF811198_my() {
 318      asm volatile (
 319                  "STR     LR, [SP,#-4]!\n"
 320                  "SUB     SP, SP, #0x74\n"
 321                  "MOV     R0, SP\n"
 322                  "MOV     R1, #0x74\n"
 323                  "BL      sub_FFB8754C\n"
 324                  //v4 stuff all copied from s95 its the same in principle
 325 /*
 326                  "              MOV     R0, #0x53000 \n"
 327                                  "              STR     R0, [SP,#4] \n"
 328 
 329                                  //"            LDR     R0, =0x172BF8 \n"           // old code
 330                                  "              LDR     R0, =new_sa \n"                                 // chdk patched
 331                                  "              LDR R0, [R0] \n"                    // chdk patched
 332 
 333                                  "              LDR     R1, =0x379C00 \n"
 334                                  "              STR     R0, [SP,#8] \n"
 335                                  "              RSB     R0, R0, #0x1F80 \n"
 336                                  "              ADD     R0, R0, #0x370000 \n"
 337                                  "              STR     R0, [SP,#0x0c] \n"
 338                                  "              LDR     R0, =0x371F80 \n"
 339                                  "              STR     R1, [SP,#0] \n"
 340                                  "              STRD    R0, [SP,#0x10] \n"
 341                                  "              MOV     R0, #0x22 \n"
 342                                  "              STR     R0, [SP,#0x18] \n"
 343                                  "              MOV     R0, #0x68 \n"
 344                                  "              STR     R0, [SP,#0x1c] \n"
 345                                  "              LDR     R0, =0x19B \n"
 346 
 347 */
 348 
 349 
 350 
 351                  //v3 stuff
 352 
 353                  "MOV     R0, #0x53000\n"
 354                  "STR     R0, [SP,#4]\n"
 355 #if defined(CHDK_NOT_IN_CANON_HEAP) // use original heap offset if CHDK is loaded in high memory
 356 "    LDR     R0, =0x172BF8 \n"
 357 #else
 358 "    LDR     R0, =new_sa\n"   // otherwise use patched value
 359 "    LDR     R0, [R0]\n"      // 
 360 #endif
 361                  //"LDR     R0, =0x172BF8\n"
 362                  "LDR     R1, =0x379C00\n"
 363                  "STR     R0, [SP,#8]\n"
 364                  //"SUB     R0, R1, R0\n"
 365                  "RSB     R0, R0, #0x1F80\n"   // new in this cam
 366                  "ADD     R0, R0, #0x370000\n" // new in this cam
 367                  "STR     R0, [SP,#0x0c]\n"  //changed
 368                  "LDR     R0, =0x371F80\n"// new in this cam
 369                                 //copied from s95
 370                                 "STR    R1, [SP,#0] \n"
 371                                 "STRD   R0, [SP,#0x10] \n"
 372                                 "MOV    R0, #0x22 \n"
 373                                 "STR    R0, [SP,#0x18] \n"
 374                                 "MOV    R0, #0x68 \n"
 375                                 "STR    R0, [SP,#0x1c] \n"
 376                                 "LDR    R0, =0x19B \n"
 377 
 378 
 379 
 380 
 381                 "LDR     R1, =sub_FF815EE0_my\n"  // chdk patched
 382 
 383                           //"LDR     R1, =0xFF815EE0\n"    // old code
 384 
 385 
 386                                                                                         //------------>
 387 
 388 
 389 
 390                  "STR     R0, [SP,#0x20]\n"
 391                  "MOV     R0, #0x96\n"
 392                  "STR     R0, [SP,#0x24]\n"
 393                  "MOV     R0, #0x78\n"
 394                  "STR     R0, [SP,#0x28]\n"
 395                  "MOV     R0, #0x64\n"
 396                  "STR     R0, [SP,#0x2C]\n"
 397                  "MOV     R0, #0\n"
 398                  "STR     R0, [SP,#0x30]\n"
 399                  "STR     R0, [SP,#0x34]\n"
 400                  "MOV     R0, #0x10\n"
 401                  "STR     R0, [SP,#0x5C]\n"
 402                  "MOV     R0, #0x800\n"
 403                  "STR     R0, [SP,#0x60]\n"
 404                  "MOV     R0, #0xA0\n"
 405                  "STR     R0, [SP,#0x64]\n"
 406                  "MOV     R0, #0x280\n"
 407                  "STR     R0, [SP,#0x68]\n"
 408                  "MOV     R0, SP\n"
 409                  "MOV     R2, #0\n"
 410 /*
 411 //copied from s95 // not work
 412 "               MOV     R0, #0x96 \n"
 413 "               STR     R0, [SP,#0x24] \n"
 414 "               STR     R0, [SP,#0x28] \n"
 415 "               MOV     R0, #0x64 \n"
 416 "               STR     R0, [SP,#0x2c] \n"
 417 "               MOV     R0, #0 \n"
 418 "               STR     R0, [SP,#0x30] \n"
 419 "               STR     R0, [SP,#0x34] \n"
 420 "               MOV     R0, #0x10 \n"
 421 "               STR     R0, [SP,#0x5c] \n"
 422 "               MOV     R0, #0x800 \n"
 423 "               STR     R0, [SP,#0x60] \n"
 424 "               MOV     R0, #0xA0 \n"
 425 "               STR     R0, [SP,#0x64] \n"
 426 "               MOV     R0, #0x280 \n"
 427 "               STR     R0, [SP,#0x68] \n"
 428 "               MOV     R0, SP \n"
 429 "               MOV     R2, #0 \n"
 430 */
 431                  "BL      sub_FF8134B8\n"
 432                  "ADD     SP, SP, #0x74\n"
 433                  "LDR     PC, [SP],#4\n"
 434      );
 435 }
 436 
 437 //Almost till here maybe checked
 438 
 439 void __attribute__((naked,noinline)) sub_FF815EE0_my() {
 440 
 441      //v4 testing full s95 code
 442 /*
 443         asm volatile (
 444          "              STMFD   SP!, {R4,LR} \n"
 445          "              BL      sub_FF810B20 \n"
 446          "              BL      sub_FF81A33C \n"                                // dmSetup
 447          "              CMP     R0, #0 \n"
 448 
 449          //"            ADRLT   R0, aDmsetup \n"                        // "dmSetup"
 450          "              LDRLT   r0, =0xFF815FF4 \n"
 451 
 452          "              BLLT    sub_FF815FD4 \n"                        // err_init_task
 453 
 454          "              BL      sub_FF815B1C \n"
 455          "              CMP     R0, #0 \n"
 456 
 457          //"            ADRLT   R0, aTermdriverinit \n"         // "termDriverInit"
 458          "              LDRLT   R0, =0xFF815FFC \n"
 459 
 460          "              BLLT    sub_FF815FD4 \n"                        // err_init_task
 461 
 462          //"            ADR     R0, a_term \n"                                  // "/_term"
 463          "              LDR     R0, =0xFF81600C \n"
 464 
 465          "              BL      sub_FF815C04 \n"                                // termDeviceCreate
 466          "              CMP     R0, #0 \n"
 467 
 468          //"            ADRLT   R0, aTermdevicecrea \n"         // "termDeviceCreate"
 469          "              LDRLT   R0, =0xFF816014 \n"
 470 
 471          "              BLLT    sub_FF815FD4 \n"                        // err_init_task
 472 
 473          //"            ADR     R0, a_term \n"                                  // "/_term"
 474          "              LDR     R0, =0xFF81600C \n"
 475 
 476          "              BL      sub_FF813CA4 \n"
 477          "              CMP     R0, #0 \n"
 478 
 479          //"            ADRLT   R0, aStdiosetup \n"                     // "stdioSetup"
 480          "              LDRLT   R0, =0xFF816028 \n"
 481 
 482          "              BLLT    sub_FF815FD4 \n"                        // err_init_task
 483          "              BL      sub_FF819CC4 \n"
 484          "              CMP     R0, #0 \n"
 485 
 486          //"            ADRLT   R0, aStdlibsetup \n"            // "stdlibSetup"
 487          "              LDRLT   R0, =0xFF816034 \n"
 488 
 489          "              BLLT    sub_FF815FD4 \n"                        // err_init_task
 490          "              BL      sub_FF81167C \n"
 491          "              CMP     R0, #0 \n"
 492 
 493          //"            ADRLT   R0, aArmlib_setup \n"           // "armlib_setup"
 494          "              LDRLT   R0, =0xFF816040 \n"
 495 
 496          "              BLLT    sub_FF815FD4 \n"                        // err_init_task
 497 
 498          "              LDMFD   SP!, {R4,LR} \n"
 499 
 500          //"            B       sub_FF81FB54 \n"                                // taskcreate_Startup
 501          "              B       taskcreate_Startup_my \n"               // patched
 502 
 503          "              MOV     R0, #0 \n"
 504          "              LDMFD   SP!, {R3-R5,PC} \n"
 505         );
 506 */
 507 
 508      //v3
 509 
 510      asm volatile (
 511                  "STMFD   SP!, {R4,LR}\n"
 512                  "BL      sub_FF810B20\n"
 513                  "BL      sub_FF81A33C\n"       // BL      dmSetup
 514                  "CMP     R0, #0\n"
 515                  "LDRLT   R0, =0xFF815FF4\n"    //Mising ; "dmSetup"
 516                  "BLLT    sub_FF815FD4\n"                //Mising err_init_task
 517                  "BL      sub_FF815B1C\n"
 518                  "CMP     R0, #0\n"
 519                  "LDRLT   R0, =0xFF815FFC\n"    // "termDriverInit"
 520                  "BLLT    sub_FF815FD4\n"          // err_init_task
 521                  "LDR     R0, =0xFF81600C\n"   //  "/_term"
 522                  "BL      sub_FF815C04\n"          // termDeviceCreate
 523                  "CMP     R0, #0\n"
 524                  "LDRLT   R0, =0xFF816014\n"   //  "termDeviceCreate"
 525                  "BLLT    sub_FF815FD4\n"       // err_init_task
 526                  "LDR     R0, =0xFF81600C\n"   //  "/_term"
 527                  "BL      sub_FF813CA4\n"
 528                  "CMP     R0, #0\n"
 529                  "LDRLT   R0, =0xFF816028\n"    // "stdioSetup"
 530                  "BLLT    sub_FF815FD4\n"       // err_init_task
 531                  "BL      sub_FF819CC4\n"
 532                  "CMP     R0, #0\n"
 533                  "LDRLT   R0, =0xFF816034\n"    //"stdlibSetup"
 534                  "BLLT    sub_FF815FD4\n"       // err_init_task
 535                  "BL      sub_FF81167C\n"
 536                  "CMP     R0, #0\n"
 537                  "LDRLT   R0, =0xFF816040\n"    // "armlib_setup"
 538                  "BLLT    sub_FF815FD4\n"       // err_init_task
 539                  "LDMFD   SP!, {R4,LR}\n"
 540                  "B       taskcreate_Startup_my\n" // ASM1989 -> at FF81FBA8
 541                                                                         //---------->
 542 //copied from s95
 543 "               MOV     R0, #0 \n"
 544 "               LDMFD   SP!, {R3-R5,PC} \n"
 545 
 546         );
 547 };
 548 
 549 
 550 // ASM1989 -> Here starts the diferences with SX200
 551 
 552 void __attribute__((naked,noinline)) taskcreate_Startup_my() {
 553      asm volatile (
 554 
 555                  "STMFD   SP!, {R3-R5,LR}\n"
 556                  "BL      sub_FF8348CC\n"   //j_nullsub_267
 557                  "BL      sub_FF83D1D4\n"
 558                  "CMP     R0, #0\n"
 559 
 560                 "BNE     loc_FF81FBFC\n"
 561 
 562 
 563                  "BL      sub_FF8370E8\n"
 564                  "CMP     R0, #0\n"
 565                 "BEQ     loc_FF81FBFC\n"
 566 
 567 
 568                  "LDR     R4, =0xC0220000\n"
 569 
 570 
 571 
 572                  "LDR     R0, [R4,#0x120]\n"
 573                  "TST     R0, #1\n"
 574                                  "MOVEQ   R0, #0x12C\n"
 575 
 576 
 577 
 578 
 579                                 "BLEQ    sub_FF83B574\n"   //ASM1989 ->  eventproc_export_SleepTask
 580 
 581 
 582 
 583                                 "BL      sub_FF8348C8\n"
 584                                 "CMP     R0, #0\n"
 585                                 "BNE     loc_FF81FBFC\n"
 586                                 "BL      sub_FF833F34\n"
 587                                 "MOV     R0, #0x44\n"
 588                                 "STR     R0, [R4,#0x1C]\n"
 589                                 "BL      sub_FF834120\n"
 590 "loc_FF81FBF8:\n"
 591                                 "B       loc_FF81FBF8\n"
 592 
 593 
 594 "loc_FF81FBFC:\n"
 595                                 //"BL      sub_FF8348D4\n" // ASM1989 -> -- replaced for power button startup
 596 
 597                                 "BL      sub_FF8348D0\n"//ASM1989 ->  j_nullsub_268
 598                                 "BL      sub_FF83B3EC\n"
 599 
 600                                 "LDR     R1, =0x3CE000\n"
 601                                 "MOV     R0, #0\n"
 602 
 603                                 "BL      sub_FF83B834\n"
 604                                 "BL      sub_FF83B5E0\n"
 605                                 "MOV     R3, #0\n"
 606 
 607                                 "STR     R3, [SP]\n"
 608                                 "LDR     R3, =task_Startup_my\n" //  ASM1989 -> original is FF81FAF0  task_Startup   // LDR instead of ADR
 609                 //---------------->
 610 
 611                                 "MOV     R2, #0\n"
 612                                 "MOV     R1, #0x19\n"
 613                                 "LDR     R0, =0xFF81FC60\n"  //aStartup  // LDR instead of ADR
 614 
 615 
 616                                 "BL      sub_FF81E8A0\n"  //eventproc_export_CreateTask
 617                                 "MOV     R0, #0\n"
 618                                 "LDMFD   SP!, {R3-R5,PC}\n"
 619 
 620 
 621 
 622 
 623      );
 624 }
 625 
 626 // TESTING S95 Code style
 627 
 628 
 629 void __attribute__((naked,noinline)) task_Startup_my() {
 630      asm volatile (
 631 
 632                  "STMFD SP!, {R4,LR}\n"
 633                                  "BL sub_FF816594\n"  // taskcreate_ClockSave
 634                                  "BL sub_FF835A30\n"
 635                                  "BL sub_FF833B3C\n"
 636                                  "BL sub_FF83D218\n"    //j_nullsub_271
 637                                  "BL sub_FF83D404\n"
 638 //                               "BL sub_FF83D2AC\n" // start diskboot.bin
 639                                  "BL sub_FF83D5AC\n"
 640                                  "BL sub_FF81648C\n"
 641                                  "BL sub_FF836754\n"
 642                                  "LDR R1, =0x7C007C00\n"
 643                                  "LDR R0, =0xC0F1800C\n"
 644                                  "BL sub_FF835A3C\n"
 645                                  "LDR R0, =0xC0F18010\n"
 646                                  "MOV R1, #0\n"
 647                                  "BL sub_FF835A3C\n"
 648                                  "LDR R0, =0xC0F18018\n"
 649                                  "MOV R1, #0\n"
 650                                  "BL sub_FF835A3C\n"
 651                                  "LDR R0, =0xC0F1801C\n"
 652                                  "MOV R1, #0x1000\n"
 653                                  "BL sub_FF835A3C\n"
 654                                  "LDR R0, =0xC0F18020\n"
 655                                  "MOV R1, #8\n"
 656                                  "BL sub_FF835A3C\n"
 657                                  "LDR R0, =0xC022D06C\n"
 658                                  "MOV R1, #0xE000000\n"
 659                                  "BL sub_FF835A3C\n"
 660                                  "BL sub_FF8164CC\n"
 661                                  "BL sub_FF8324F4\n"
 662                                  "BL sub_FF83D434\n"
 663                                  "BL sub_FF83AB90\n"
 664                                  "BL sub_FF83D5B0\n"
 665 
 666               "BL      CreateTask_spytask\n"    // +
 667                                                                 //---------------->
 668                  "BL sub_FF834788\n"    //taskcreate_PhySw
 669 );
 670 
 671 //                      CreateTask_PhySw();                                     // our keyboard task
 672 
 673 //                      CreateTask_spytask();                           // chdk initialization
 674 
 675 
 676         //                       "BL      CreateTask_spytask\n"    // +
 677                                                                     //---------------->
 678 
 679 
 680    asm volatile (
 681                                  "BL sub_FF838CF0\n"
 682                                  "BL sub_FF83D5C8\n"
 683                                  "BL sub_FF8318F8\n"  //nullsub_2
 684                                  "BL sub_FF8334A0\n"
 685                                  "BL sub_FF83CF9C\n"  //taskcreate_Bye
 686                                  "BL sub_FF833AF0\n"
 687                                  "BL sub_FF83343C\n"
 688                                  "BL sub_FF832528\n"
 689                                  "BL sub_FF83E1D0\n"
 690                                  "BL sub_FF8333F8\n"
 691                                  "LDMFD SP!, {R4,LR}\n"
 692 //                               "BL blink\n"
 693                                  "B sub_FF8166B4\n"
 694      );
 695 }
 696 
 697 
 698 /*
 699 void __attribute__((naked,noinline)) CreateTask_PhySw() {
 700     asm volatile (
 701 "               STMFD   SP!, {R3-R5,LR} \n"
 702 "               LDR     R4, =0x1C34 \n"
 703 "               LDR     R0, [R4,#0x10] \n"
 704 "               CMP     R0, #0 \n"
 705 "               BNE     loc_FF8347BC \n"
 706 "               MOV     R3, #0 \n"
 707 "               STR     R3, [SP] \n"
 708 
 709 //"             ADR     R3, task_PhySw \n"
 710 //"             LDR R3, =sub_FF834754 \n"
 711 //"             MOV     R2, #0x800 \n"
 712 
 713 "               LDR     R3, =mykbd_task \n"                             // PhySw Task patch
 714 "               MOV     R2, #0x2000 \n"                                 // larger stack
 715 
 716 "               MOV     R1, #0x17 \n"
 717 
 718 //"             ADR     R0, aPhysw \n"
 719 "               LDR     R0, =0xFF8349DC \n"                             // "PhySw"
 720 
 721 "               BL      sub_FF83B634 \n"                                // KernelCreateTask
 722 "               STR     R0, [R4,#0x10] \n"
 723 "loc_FF8347BC: \n"
 724 "               BL      sub_FF863968 \n"
 725 "               BL      sub_FF8941DC \n"
 726 "               BL      sub_FF837060 \n"                        //IsFactoryMode
 727 "               CMP     R0, #0 \n"
 728 "               LDREQ   R1, =0x34414 \n"
 729 "               LDMEQFD SP!, {R3-R5,LR} \n"
 730 "               BEQ     sub_FF894164 \n"                                // eventproc_export_OpLog.Start
 731 "               LDMFD   SP!, {R3-R5,PC} \n"
 732         );
 733 }
 734 */
 735 
 736 
 737 /*----------------------------------------------------------------------
 738         JogDial_task_my()
 739 
 740         Patched jog dial task  at FF86363C
 741 -----------------------------------------------------------------------*/
 742 void __attribute__((naked,noinline)) JogDial_task_my() {
 743         asm volatile (
 744 "               STMFD   SP!, {R4-R11,LR} \n"
 745 "               SUB     SP, SP, #0x1C \n"
 746 "               BL      sub_FF863A68 \n"
 747 "               LDR     R1, =0x2560 \n"
 748 "               LDR     R6, =0xFFB8D5F0 \n"
 749 "               MOV     R0, #0 \n"
 750 "               ADD     R3, SP, #0x10 \n"
 751 "               ADD     R12, SP, #0x14 \n"
 752 "               ADD     R10, SP, #0x08 \n"
 753 "               MOV     R2, #0 \n"
 754 "               ADD     R9, SP, #0xC \n"
 755 
 756 "loc_FF863668: \n"
 757 "               ADD     R12, SP, #0x14 \n"
 758 "               ADD     LR, R12, R0,LSL#1 \n"
 759 "               MOV     R2, #0 \n"
 760 "               ADD     R3, SP, #0x10 \n"
 761 "               STRH    R2, [LR] \n"
 762 "               ADD     LR, R3, R0,LSL#1 \n"
 763 "               STRH    R2, [LR] \n"
 764 "               STR     R2, [R9,R0,LSL#2] \n"
 765 "               STR     R2, [R10,R0,LSL#2] \n"
 766 "               ADD     R0, R0, #1 \n"
 767 "               CMP     R0, #2 \n"
 768 "               BLT     loc_FF863668 \n"
 769 
 770 "loc_FF863698: \n"
 771 "               LDR     R0, =0x2560 \n"
 772 "               MOV     R2, #0 \n"
 773 "               LDR     R0, [R0,#0xC] \n"
 774 "               MOV     R1, SP \n"
 775 "               BL      sub_FF83AE20 \n"
 776 "               CMP     R0, #0 \n"
 777 "               LDRNE   R1, =0x262 \n"
 778 
 779 //"             ADRNE   R0, 0xFF8638F8 \n"                      // "RotaryEncoder.c"
 780 "               LDRNE   R0, =0xFF8638F8 \n"                     // "RotaryEncoder.c"
 781 
 782 "               BLNE    sub_FF81EB78 \n"                        // DebugAssert
 783 
 784 //------------------  begin added code ---------------
 785 "labelA:\n"
 786                 "LDR     R0, =jogdial_stopped\n"
 787                 "LDR     R0, [R0]\n"
 788                 "CMP     R0, #1\n"
 789                 "BNE     labelB\n"                                      // continue on if jogdial_stopped = 0
 790                 "MOV     R0, #40\n"
 791                 "BL      _SleepTask\n"                          // jogdial_stopped=1 -- give time back to OS and suspend jogdial task
 792                 "B       labelA\n"
 793 "labelB:\n"
 794 //------------------  end added code -----------------
 795 
 796 "               LDR     R0, [SP] \n"
 797 "               AND     R4, R0, #0xFF \n"
 798 "               AND     R0, R0, #0xFF00 \n"
 799 "               CMP     R0, #0x100 \n"
 800 "               BEQ     loc_FF863708 \n"
 801 "               CMP     R0, #0x200 \n"
 802 "               BEQ     loc_FF863740 \n"
 803 "               CMP     R0, #0x300 \n"
 804 "               BEQ     loc_FF863938 \n"
 805 "               CMP     R0, #0x400 \n"
 806 "               BNE     loc_FF863698 \n"
 807 "               CMP     R4, #0 \n"
 808 "               LDRNE   R1, =0x2ED \n"
 809 
 810 //"             ADRNE   R0, 0xFF8638F8 \n"                      // "RotaryEncoder.c"
 811 "               LDRNE   R0, =0xFF8638F8 \n"                     // "RotaryEncoder.c"
 812 
 813 "               BLNE    sub_FF81EB78 \n"                        // DebugAssert
 814 "               RSB     R0, R4, R4,LSL#3 \n"
 815 "               LDR     R0, [R6,R0,LSL#2] \n"
 816 
 817 "loc_FF863700: \n"
 818 "               BL      sub_FF863A40 \n"
 819 "               B       loc_FF863698 \n"
 820 
 821 "loc_FF863708: \n"
 822 "               LDR     R7, =0x2570 \n"
 823 "               LDR     R0, [R7,R4,LSL#2] \n"
 824 "               BL      sub_FF83BDB8 \n"
 825 
 826 //"             ADR     R2, 0xFF863588 \n"
 827 "               LDR     R2, =0xFF863588 \n"
 828 
 829 "               ADD     R1, R2, #0 \n"
 830 "               ORR     R3, R4, #0x200 \n"
 831 "               MOV     R0, #0x28 \n"
 832 "               BL      sub_FF83BCD4 \n"
 833 "               TST     R0, #1 \n"
 834 "               CMPNE   R0, #0x15 \n"
 835 "               STR     R0, [R10,R4,LSL#2] \n"
 836 "               BEQ     loc_FF863698 \n"
 837 "               MOV     R1, #0x274 \n"
 838 "               B       loc_FF8638E4 \n"
 839 
 840 "loc_FF863740: \n"
 841 "               RSB     R5, R4, R4,LSL#3 \n"
 842 "               LDR     R0, [R6,R5,LSL#2] \n"
 843 "               LDR     R1, =0xC0240104 \n"
 844 "               LDR     R0, [R1,R0,LSL#8] \n"
 845 "               MOV     R2, R0,ASR#16 \n"
 846 "               ADD     R0, SP, #0x14 \n"
 847 "               ADD     R0, R0, R4,LSL#1 \n"
 848 "               STR     R0, [SP,#0x18] \n"
 849 "               STRH    R2, [R0] \n"
 850 "               ADD     R0, SP, #0x10 \n"
 851 "               ADD     R11, R0, R4,LSL#1 \n"
 852 "               LDRSH   R3, [R11] \n"
 853 "               SUB     R0, R2, R3 \n"
 854 "               CMP     R0, #0 \n"
 855 "               BNE     loc_FF8637C0 \n"
 856 "               LDR     R0, [R9,R4,LSL#2] \n"
 857 "               CMP     R0, #0 \n"
 858 "               BEQ     loc_FF8638A0 \n"
 859 "               LDR     R7, =0x2570 \n"
 860 "               LDR     R0, [R7,R4,LSL#2] \n"
 861 "               BL      sub_FF83BDB8 \n"
 862 
 863 //"             ADR     R2, 0xFF863594 \n"
 864 "               LDR     R2, =0xFF863594 \n"
 865 
 866 "               ADD     R1, R2, #0 \n"
 867 "               ORR     R3, R4, #0x300 \n"
 868 "               MOV     R0, #0x1F4 \n"
 869 "               BL      sub_FF83BCD4 \n"
 870 "               TST     R0, #1 \n"
 871 "               CMPNE   R0, #0x15 \n"
 872 "               STR     R0, [R7,R4,LSL#2] \n"
 873 "               BEQ     loc_FF8638A0 \n"
 874 "               LDR     R1, =0x28D \n"
 875 "               B       loc_FF863898 \n"
 876 
 877 "loc_FF8637C0: \n"
 878 "               MOV     R1, R0 \n"
 879 "               RSBLT   R0, R0, #0 \n"
 880 "               MOVLE   R7, #0 \n"
 881 "               MOVGT   R7, #1 \n"
 882 "               CMP     R0, #0xFF \n"
 883 "               BLS     loc_FF863800 \n"
 884 "               CMP     R1, #0 \n"
 885 "               RSBLE   R0, R3, #0xFF \n"
 886 "               ADDLE   R0, R0, #0x7F00 \n"
 887 "               ADDLE   R0, R0, R2 \n"
 888 "               RSBGT   R0, R2, #0xFF \n"
 889 "               ADDGT   R0, R0, #0x7F00 \n"
 890 "               ADDGT   R0, R0, R3 \n"
 891 "               ADD     R0, R0, #0x8000 \n"
 892 "               ADD     R0, R0, #1 \n"
 893 "               EOR     R7, R7, #1 \n"
 894 
 895 "loc_FF863800: \n"
 896 "               STR     R0, [SP,#0x04] \n"
 897 "               LDR     R0, [R9,R4,LSL#2] \n"
 898 "               CMP     R0, #0 \n"
 899 "               ADDEQ   R0, R6, R5,LSL#2 \n"
 900 "               LDREQ   R0, [R0,#8] \n"
 901 "               BEQ     loc_FF863838 \n"
 902 "               ADD     R8, R6, R5,LSL#2 \n"
 903 "               ADD     R1, R8, R7,LSL#2 \n"
 904 "               LDR     R1, [R1,#0x10] \n"
 905 "               CMP     R1, R0 \n"
 906 "               BEQ     loc_FF86383C \n"
 907 "               LDR     R0, [R8,#0xC] \n"
 908 "               BL      sub_FF89C2E4 \n"
 909 "               LDR     R0, [R8,#8] \n"
 910 
 911 "loc_FF863838: \n"
 912 "               BL      sub_FF89C2E4 \n"
 913 
 914 "loc_FF86383C: \n"
 915 "               ADD     R0, R6, R5,LSL#2 \n"
 916 "               ADD     R7, R0, R7,LSL#2 \n"
 917 "               LDR     R0, [R7,#0x10] \n"
 918 "               LDR     R1, [SP,#0x04] \n"
 919 "               BL      sub_FF89C20C \n"
 920 "               LDR     R0, [R7,#0x10] \n"
 921 "               LDR     R7, =0x2570 \n"
 922 "               STR     R0, [R9,R4,LSL#2] \n"
 923 "               LDR     R0, [SP,#0x18] \n"
 924 "               LDRH    R0, [R0] \n"
 925 "               STRH    R0, [R11] \n"
 926 "               LDR     R0, [R7,R4,LSL#2] \n"
 927 "               BL      sub_FF83BDB8 \n"
 928 
 929 //"             ADR     R2, 0xFF863594 \n"
 930 "               LDR     R2, =0xFF863594 \n"
 931 
 932 "               ADD     R1, R2, #0 \n"
 933 "               ORR     R3, R4, #0x300 \n"
 934 "               MOV     R0, #0x1F4 \n"
 935 "               BL      sub_FF83BCD4 \n"
 936 "               TST     R0, #1 \n"
 937 "               CMPNE   R0, #0x15 \n"
 938 "               STR     R0, [R7,R4,LSL#2] \n"
 939 "               BEQ     loc_FF8638A0 \n"
 940 "               LDR     R1, =0x2CF \n"
 941 
 942 "loc_FF863898: \n"
 943 //"             ADR     R0, 0xFF8638F8 \n"                      // "RotaryEncoder.c"
 944 "               LDR     R0, =0xFF8638F8 \n"                     // "RotaryEncoder.c"
 945 
 946 "               BL      sub_FF81EB78 \n"                        // DebugAssert
 947 
 948 "loc_FF8638A0: \n"
 949 "               ADD     R0, R6, R5,LSL#2 \n"
 950 "               LDR     R0, [R0,#0x18] \n"
 951 "               CMP     R0, #1 \n"
 952 "               BNE     loc_FF863930 \n"
 953 "               LDR     R0, =0x2560 \n"
 954 "               LDR     R0, [R0,#0x14] \n"
 955 "               CMP     R0, #0 \n"
 956 "               BEQ     loc_FF863930 \n"
 957 
 958 //"             ADR     R2, 0xFF863588 \n"
 959 "               LDR     R2, =0xFF863588 \n"
 960 
 961 "               ADD     R1, R2, #0 \n"
 962 "               ORR     R3, R4, #0x400 \n"
 963 "               BL      sub_FF83BCD4 \n"
 964 "               TST     R0, #1 \n"
 965 "               CMPNE   R0, #0x15 \n"
 966 "               STR     R0, [R10,R4,LSL#2] \n"
 967 "               BEQ     loc_FF863698 \n"
 968 "               LDR     R1, =0x2D6 \n"
 969 
 970 "loc_FF8638E4: \n"
 971 //"             ADR     R0, 0xFF8638F8 \n"                      // "RotaryEncoder.c"
 972 "               LDR     R0, =0xFF8638F8 \n"                     // "RotaryEncoder.c"
 973 
 974 "               BL      sub_FF81EB78 \n"                        // DebugAssert
 975 "               B       loc_FF863698 \n"
 976 
 977                 "NOP \n"
 978 
 979 
 980 "loc_FF863930: \n"
 981 "               LDR     R0, [R6,R5,LSL#2] \n"
 982 "               B       loc_FF863700 \n"
 983 
 984 "loc_FF863938: \n"
 985 "               LDR     R0, [R9,R4,LSL#2] \n"
 986 "               CMP     R0, #0 \n"
 987 "               MOVEQ   R1, #0x2E0 \n"
 988 
 989 //"             ADREQ   R0, 0xFF8638F8 \n"                      // "RotaryEncoder.c"
 990 "               LDREQ   R0, =0xFF8638F8 \n"                     // "RotaryEncoder.c"
 991 
 992 "               BLEQ    sub_FF81EB78 \n"                        // DebugAssert
 993 "               RSB     R0, R4, R4,LSL#3 \n"
 994 "               ADD     R0, R6, R0,LSL#2 \n"
 995 "               LDR     R0, [R0,#0xC] \n"
 996 "               BL      sub_FF89C2E4 \n"
 997 "               MOV     R2, #0 \n"
 998 "               STR     R2, [R9,R4,LSL#2] \n"
 999 "               B       loc_FF863698 \n"
1000  );
1001 };
1002 
1003 
1004 //FILE INIT STUFF
1005 void __attribute__((naked,noinline)) init_file_modules_task() {
1006  asm volatile(
1007          "STMFD   SP!, {R4-R6,LR}\n"
1008          "BL      sub_FF896688\n"
1009          "LDR     R5, =0x5006\n"
1010          "MOVS    R4, R0\n"
1011          "MOVNE   R1, #0\n"
1012          "MOVNE   R0, R5\n"
1013          "BLNE    sub_FF89A464\n"  //PostLogicalEventToUI
1014 //       "BL      sub_FF8966B4\n"
1015          "BL      sub_FF8966B4_my\n"
1016          //----------------------->
1017      "BL      core_spytask_can_start\n" // + safe to start spytask 
1018          "CMP     R4, #0\n"
1019          "MOVEQ   R0, R5\n"
1020          "LDMEQFD SP!, {R4-R6,LR}\n"
1021          "MOVEQ   R1, #0\n"
1022          "BEQ    sub_FF89A464\n"  //PostLogicalEventToUI
1023          "LDMFD   SP!, {R4-R6,PC}\n"
1024          );
1025 };
1026 
1027 void __attribute__((naked,noinline)) sub_FF8966B4_my() {
1028  asm volatile(
1029          "STMFD   SP!, {R4,LR}\n"
1030          "MOV     R0, #3\n"
1031 //       "BL      sub_FF87538C\n"         //__Mounter.c__0
1032          "BL      sub_FF87538C_my\n"      //__Mounter.c__0
1033 
1034          "B       sub_FF8966C0\n" // continue in firmware
1035          );
1036 };
1037 
1038 void __attribute__((naked,noinline)) sub_FF87538C_my() {
1039  asm volatile(
1040                  "STMFD   SP!, {R4-R8,LR}\n"
1041                  "MOV     R8, R0\n"
1042                  "BL      sub_FF87530C\n" //__Mounter.c__0
1043                  "LDR     R1, =0x3A068\n"
1044                  "MOV     R6, R0\n"
1045                  "ADD     R4, R1, R0,LSL#7\n"
1046                  "LDR     R0, [R4,#0x6C]\n"
1047                  "CMP     R0, #4\n"
1048                  "LDREQ   R1, =0x83F\n"
1049                  "LDREQ   R0, =0xFF874E4C\n" //aMounter_c
1050                  "BLEQ    sub_FF81EB78\n"  //DebugAssert
1051                  "MOV     R1, R8\n"
1052                  "MOV     R0, R6\n"
1053                  "BL      sub_FF874BC0\n"
1054                  "LDR     R0, [R4,#0x38]\n"
1055                  "BL      sub_FF875A30\n"
1056                  "CMP     R0, #0\n"
1057                  "STREQ   R0, [R4,#0x6C]\n"
1058                  "MOV     R0, R6\n"
1059                  "BL      sub_FF874C50\n"
1060                  "MOV     R0, R6\n"
1061 //               "BL      sub_FF874FB4\n"
1062                  "BL      sub_FF874FB4_my\n"
1063                  //------------------->
1064                  "B       sub_FF8753E4 \n" //continue in firmware
1065                  );
1066 
1067          };
1068 void __attribute__((naked,noinline)) sub_FF874FB4_my() {
1069  asm volatile(
1070                          "STMFD   SP!, {R4-R6,LR}\n"
1071                          "MOV     R5, R0\n"
1072                          "LDR     R0, =0x3A068\n"
1073                          "ADD     R4, R0, R5,LSL#7\n"
1074                          "LDR     R0, [R4,#0x6C]\n"
1075                          "TST     R0, #2\n"
1076                          "MOVNE   R0, #1\n"
1077                          "LDMNEFD SP!, {R4-R6,PC}\n"
1078                          "LDR     R0, [R4,#0x38]\n"
1079                          "MOV     R1, R5\n"
1080 //                       "BL      sub_FF874CD4\n"
1081                          "BL      sub_FF874CD4_my\n"
1082                                     //------------------->
1083 
1084              "B      sub_FF874FE0\n"  //continue in firmware
1085 
1086                          );
1087 
1088          };
1089 
1090 void __attribute__((naked,noinline)) sub_FF874CD4_my() {
1091  asm volatile(
1092          "              STMFD   SP!, {R4-R10,LR}\n"
1093          "              MOV     R9, R0\n"
1094          "              LDR     R0, =0x3A068\n"
1095          "              MOV     R8, #0\n"
1096          "              ADD     R5, R0, R1,LSL#7\n"
1097          "              LDR     R0, [R5,#0x3C]\n"
1098          "              MOV     R7, #0\n"
1099          "              CMP     R0, #7\n"
1100          "              MOV     R6, #0\n"
1101          "              ADDLS   PC, PC, R0,LSL#2\n"
1102          "              B       loc_FF874E2C\n"
1103          "loc_FF874D00:\n"
1104          "              B       loc_FF874D38\n"
1105          "loc_FF874D04:\n"
1106          "              B       loc_FF874D20\n"
1107          "loc_FF874D08:\n"
1108          "              B       loc_FF874D20\n"
1109          "loc_FF874D0C:\n"
1110          "              B       loc_FF874D20\n"
1111          "loc_FF874D10:\n"
1112          "              B       loc_FF874D20\n"
1113          "loc_FF874D14:\n"
1114          "              B       loc_FF874E24\n"
1115          "loc_FF874D18:\n"
1116          "              B       loc_FF874D20\n"
1117          "loc_FF874D1C:\n"
1118          "              B       loc_FF874D20\n"
1119 "loc_FF874D20:\n"
1120          "              MOV     R2, #0\n"
1121          "              MOV     R1, #0x200\n"
1122          "              MOV     R0, #2\n"
1123          "              BL      sub_FF890738\n"
1124          "              MOVS    R4, R0\n"
1125          "              BNE     loc_FF874D40\n"
1126 "loc_FF874D38:\n"
1127          "              MOV     R0, #0\n"
1128          "              LDMFD   SP!, {R4-R10,PC}\n"
1129 "loc_FF874D40:\n"
1130          "              LDR     R12, [R5,#0x50]\n"
1131          "              MOV     R3, R4\n"
1132          "              MOV     R2, #1\n"
1133          "              MOV     R1, #0\n"
1134          "              MOV     R0, R9\n"
1135          "              BLX     R12\n"
1136          "              CMP     R0, #1\n"
1137          "              BNE     loc_FF874D6C\n"
1138          "              MOV     R0, #2\n"
1139          "              BL      sub_FF890888\n" //__ExMemMan.c__0 ; LOCATION: ExMemMan.c:0
1140          "              B       loc_FF874D38\n"
1141 "loc_FF874D6C:\n"
1142          "              LDR     R1, [R5,#0x64]\n"
1143          "              MOV     R0, R9\n"
1144          "              BLX     R1\n"
1145 //Allready inserted code
1146 
1147                  "MOV   R1, R4\n"           //  pointer to MBR in R1
1148                  "BL    mbr_read_dryos\n"   //  total sectors count in R0 before and after call
1149 
1150         // Start of DataGhost's FAT32 autodetection code
1151           // Policy: If there is a partition which has type W95 FAT32, use the first one of those for image storage
1152           // According to the code below, we can use R1, R2, R3 and R12.
1153           // LR wasn't really used anywhere but for storing a part of the partition signature. This is the only thing
1154           // that won't work with an offset, but since we can load from LR+offset into LR, we can use this to do that :)
1155           "MOV     R12, R4\n"                    // Copy the MBR start address so we have something to work with
1156           "MOV     LR, R4\n"                     // Save old offset for MBR signature
1157           "MOV     R1, #1\n"                     // Note the current partition number
1158           "B       dg_sd_fat32_enter\n"          // We actually need to check the first partition as well, no increments yet!
1159      "dg_sd_fat32:\n"
1160           "CMP     R1, #4\n"                     // Did we already see the 4th partition?
1161           "BEQ     dg_sd_fat32_end\n"            // Yes, break. We didn't find anything, so don't change anything.
1162           "ADD     R12, R12, #0x10\n"            // Second partition
1163           "ADD     R1, R1, #1\n"                 // Second partition for the loop
1164      "dg_sd_fat32_enter:\n"
1165           "LDRB    R2, [R12, #0x1BE]\n"          // Partition status
1166           "LDRB    R3, [R12, #0x1C2]\n"          // Partition type (FAT32 = 0xB)
1167           "CMP     R3, #0xB\n"                   // Is this a FAT32 partition?
1168           "CMPNE   R3, #0xC\n"                   // Not 0xB, is it 0xC (FAT32 LBA) then?
1169           "BNE     dg_sd_fat32\n"                // No, it isn't. Loop again.
1170           "CMP     R2, #0x00\n"                  // It is, check the validity of the partition type
1171           "CMPNE   R2, #0x80\n"
1172           "BNE     dg_sd_fat32\n"                // Invalid, go to next partition
1173                                                  // This partition is valid, it's the first one, bingo!
1174           "MOV     R4, R12\n"                    // Move the new MBR offset for the partition detection.
1175 
1176      "dg_sd_fat32_end:\n"
1177           // End of DataGhost's FAT32 autodetection code
1178 
1179 
1180 
1181 
1182 
1183          "              LDRB    R1, [R4,#0x1C9]\n"
1184          "              LDRB    R3, [R4,#0x1C8]\n"
1185          "              LDRB    R12, [R4,#0x1CC]\n"
1186          "              MOV     R1, R1,LSL#24\n"
1187          "              ORR     R1, R1, R3,LSL#16\n"
1188          "              LDRB    R3, [R4,#0x1C7]\n"
1189          "              LDRB    R2, [R4,#0x1BE]\n"
1190          //"            LDRB    LR, [R4,#0x1FF]\n"     //remains commented as in sx200
1191          "              ORR     R1, R1, R3,LSL#8\n"
1192          "              LDRB    R3, [R4,#0x1C6]\n"
1193          "              CMP     R2, #0\n"
1194          "              CMPNE   R2, #0x80\n"
1195          "              ORR     R1, R1, R3\n"
1196          "              LDRB    R3, [R4,#0x1CD]\n"
1197          "              MOV     R3, R3,LSL#24\n"
1198          "              ORR     R3, R3, R12,LSL#16\n"
1199          "              LDRB    R12, [R4,#0x1CB]\n"
1200          "              ORR     R3, R3, R12,LSL#8\n"
1201          "              LDRB    R12, [R4,#0x1CA]\n"
1202          "              ORR     R3, R3, R12\n"
1203          //"            LDRB    R12, [R4,#0x1FE]\n"    //remains commented as in sx200
1204      // Left as in sx200
1205              "LDRB    R12, [LR,#0x1FE]\n"           // + First MBR signature byte (0x55), LR is original offset.
1206              "LDRB    LR, [LR,#0x1FF]\n"            // + Last MBR signature byte (0xAA), LR is original offset.
1207 
1208 
1209          "              BNE     loc_FF874DF8\n"
1210          "              CMP     R0, R1\n"
1211          "              BCC     loc_FF874DF8\n"
1212          "              ADD     R2, R1, R3\n"
1213          "              CMP     R2, R0\n"
1214          "              CMPLS   R12, #0x55\n"
1215          "              CMPEQ   LR, #0xAA\n"
1216          "              MOVEQ   R7, R1\n"
1217          "              MOVEQ   R6, R3\n"
1218          "              MOVEQ   R4, #1\n"
1219          "              BEQ     loc_FF874DFC\n"
1220 "loc_FF874DF8:\n"
1221          "              MOV     R4, R8\n"
1222 "loc_FF874DFC:\n"
1223          "              MOV     R0, #2\n"
1224          "              BL      sub_FF890888\n" //__ExMemMan.c__0 ; LOCATION: ExMemMan.c:0
1225          "              CMP     R4, #0\n"
1226          "              BNE     loc_FF874E38\n"
1227          "              LDR     R1, [R5,#0x64]\n"
1228          "              MOV     R7, #0\n"
1229          "              MOV     R0, R9\n"
1230          "              BLX     R1\n"
1231          "              MOV     R6, R0\n"
1232          "              B       loc_FF874E38\n"
1233 "loc_FF874E24:\n"
1234          "              MOV     R6, #0x40\n"
1235          "              B       loc_FF874E38\n"
1236 "loc_FF874E2C:\n"
1237          "              LDR     R1, =0x597\n"
1238          "              LDR     R0, =0xFF874E4C\n" //aMounter_c ; Mounter.c
1239          "              BL      sub_FF81EB78\n" //DebugAssert
1240 
1241 "loc_FF874E38:\n"
1242          "              STR     R7, [R5,#0x44]!\n"
1243          "              STMIB   R5, {R6,R8}\n"
1244          "              MOV     R0, #1\n"
1245 "               LDMFD   SP!, {R4-R10,PC}\n"
1246 
1247                   );
1248 
1249                  };

/* [<][>][^][v][top][bottom][index][help] */