This source file includes following definitions.
- CreateTask_spytask
- boot
- CreateTask_low_my
- sub_FF8203C4_my
- sub_FF8228D4_my
- sub_FF8246FC_my
- sub_FF8285C0_my
- task_Startup_my
- taskcreatePhySw_my
- init_file_modules_task
- init_required_fw_features
1
2
3
4 #include "lolevel.h"
5 #include "platform.h"
6 #include "core.h"
7 #include "dryos31.h"
8
9 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
10
11 const char * const new_sa = &_end;
12
13
14
15
16 void CreateTask_spytask()
17 {
18 _CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);
19 }
20
21
22
23
24
25
26
27
28
29 void __attribute__((naked,noinline)) boot() {
30 asm volatile (
31 " LDR R1, =0xC0410000 \n"
32 " MOV R0, #0 \n"
33 " STR R0, [R1] \n"
34 " MOV R1, #0x78 \n"
35 " MCR p15, 0, R1, c1, c0 \n"
36 " MOV R1, #0 \n"
37 " MCR p15, 0, R1, c7, c10, 4 \n"
38 " MCR p15, 0, R1, c7, c5 \n"
39 " MCR p15, 0, R1, c7, c6 \n"
40 " MOV R0, #0x3D \n"
41 " MCR p15, 0, R0, c6, c0 \n"
42 " MOV R0, #0xC000002F \n"
43 " MCR p15, 0, R0, c6, c1 \n"
44 " MOV R0, #0x35 \n"
45 " MCR p15, 0, R0, c6, c2 \n"
46 " MOV R0, #0x40000035 \n"
47 " MCR p15, 0, R0, c6, c3 \n"
48 " MOV R0, #0x80000017 \n"
49 " MCR p15, 0, R0, c6, c4 \n"
50 " LDR R0, =0xFF80002D \n"
51 " MCR p15, 0, R0, c6, c5 \n"
52 " MOV R0, #0x34 \n"
53 " MCR p15, 0, R0, c2, c0 \n"
54 " MOV R0, #0x34 \n"
55 " MCR p15, 0, R0, c2, c0, 1 \n"
56 " MOV R0, #0x34 \n"
57 " MCR p15, 0, R0, c3, c0 \n"
58 " LDR R0, =0x3333330 \n"
59 " MCR p15, 0, R0, c5, c0, 2 \n"
60 " LDR R0, =0x3333330 \n"
61 " MCR p15, 0, R0, c5, c0, 3 \n"
62 " MRC p15, 0, R0, c1, c0 \n"
63 " ORR R0, R0, #0x1000 \n"
64 " ORR R0, R0, #4 \n"
65 " ORR R0, R0, #1 \n"
66 " MCR p15, 0, R0, c1, c0 \n"
67 " MOV R1, #0x80000006 \n"
68 " MCR p15, 0, R1, c9, c1 \n"
69 " MOV R1, #6 \n"
70 " MCR p15, 0, R1, c9, c1, 1 \n"
71 " MRC p15, 0, R1, c1, c0 \n"
72 " ORR R1, R1, #0x50000 \n"
73 " MCR p15, 0, R1, c1, c0 \n"
74 " LDR R2, =0xC0200000 \n"
75 " MOV R1, #1 \n"
76 " STR R1, [R2, #0x10C] \n"
77 " MVN R1, #0 \n"
78 " STR R1, [R2, #0xC] \n"
79 " STR R1, [R2, #0x1C] \n"
80 " STR R1, [R2, #0x2C] \n"
81 " STR R1, [R2, #0x3C] \n"
82 " STR R1, [R2, #0x4C] \n"
83 " STR R1, [R2, #0x5C] \n"
84 " STR R1, [R2, #0x6C] \n"
85 " STR R1, [R2, #0x7C] \n"
86 " STR R1, [R2, #0x8C] \n"
87 " STR R1, [R2, #0x9C] \n"
88 " STR R1, [R2, #0xAC] \n"
89 " STR R1, [R2, #0xBC] \n"
90 " STR R1, [R2, #0xCC] \n"
91 " STR R1, [R2, #0xDC] \n"
92 " STR R1, [R2, #0xEC] \n"
93 " STR R1, [R2, #0xFC] \n"
94 " LDR R1, =0xC0400008 \n"
95 " LDR R2, =0x430005 \n"
96 " STR R2, [R1] \n"
97 " MOV R1, #1 \n"
98 " LDR R2, =0xC0243100 \n"
99 " STR R2, [R1] \n"
100 " LDR R2, =0xC0242010 \n"
101 " LDR R1, [R2] \n"
102 " ORR R1, R1, #1 \n"
103 " STR R1, [R2] \n"
104 " LDR R0, =0xFFD52B40 \n"
105 " LDR R1, =0x6B1000 \n"
106 " LDR R3, =0x6BE8D2 \n"
107
108 "loc_FF82013C:\n"
109 " CMP R1, R3 \n"
110 " LDRCC R2, [R0], #4 \n"
111 " STRCC R2, [R1], #4 \n"
112 " BCC loc_FF82013C \n"
113 " LDR R0, =0xFFD42FE0 \n"
114 " LDR R1, =0x1900 \n"
115 " LDR R3, =0x11460 \n"
116
117 "loc_FF820158:\n"
118 " CMP R1, R3 \n"
119 " LDRCC R2, [R0], #4 \n"
120 " STRCC R2, [R1], #4 \n"
121 " BCC loc_FF820158 \n"
122 " LDR R1, =0x1BDF3C \n"
123 " MOV R2, #0 \n"
124
125 "loc_FF820170:\n"
126 " CMP R3, R1 \n"
127 " STRCC R2, [R3], #4 \n"
128 " BCC loc_FF820170 \n"
129
130
131
132
133 " LDR R0, =patch_CreateTask_low\n"
134 " LDM R0, {R1,R2}\n"
135 " LDR R0, =hook_CreateTask_low\n"
136 " STM R0, {R1,R2}\n"
137
138 " B sub_FF8203C4_my \n"
139
140 "patch_CreateTask_low:\n"
141 " LDR PC, [PC,#-0x4]\n"
142 " .long CreateTask_low_my\n"
143 );
144 }
145
146
147
148 void __attribute__((naked,noinline)) CreateTask_low_my() {
149 asm volatile (
150 " STMFD SP!, {R1}\n"
151
152
153
154 " LDR R1, =task_CaptSeq\n"
155 " CMP R1, R0\n"
156 " LDREQ R0, =capt_seq_task\n"
157 " BEQ exitHook\n"
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172 " LDR R1, =task_FileWrite\n"
173 " CMP R1, R0\n"
174 " LDREQ R0, =filewritetask\n"
175 " BEQ exitHook\n"
176
177
178 " LDR R1, =task_MovieRecord\n"
179 " CMP R1, R0\n"
180 " LDREQ R0, =movie_record_task\n"
181 " BEQ exitHook\n"
182
183
184 " LDR R1, =task_LiveImageTask\n"
185 " CMP R1, R0\n"
186 " LDREQ R0, =liveimage_task\n"
187 " BEQ exitHook\n"
188
189
190 " LDR R1, =task_InitFileModules\n"
191 " CMP R1, R0\n"
192 " LDREQ R0, =init_file_modules_task\n"
193
194 "exitHook:\n"
195
196 " LDMFD SP!, {R1}\n"
197
198 " STMFD SP!, {R4-R8,LR} \n"
199 " CMP R3, #0 \n"
200 " LDR PC, =0x006B15AC \n"
201 );
202 }
203
204
205
206 void __attribute__((naked,noinline)) sub_FF8203C4_my() {
207
208
209
210
211
212
213 *(int*)(0x297c+0x4) = (*(int*)0xC022F484)&0x20000 ? 0x400000 : 0x200000;
214
215 asm volatile (
216 " LDR R0, =0xFF82043C \n"
217 " MOV R1, #0 \n"
218 " LDR R3, =0xFF820474 \n"
219
220 "loc_FF8203D0:\n"
221 " CMP R0, R3 \n"
222 " LDRCC R2, [R0], #4 \n"
223 " STRCC R2, [R1], #4 \n"
224 " BCC loc_FF8203D0 \n"
225 " LDR R0, =0xFF820474 \n"
226 " MOV R1, #0x1C0 \n"
227 " LDR R3, =0xFF82065C \n"
228
229 "loc_FF8203EC:\n"
230 " CMP R0, R3 \n"
231 " LDRCC R2, [R0], #4 \n"
232 " STRCC R2, [R1], #4 \n"
233 " BCC loc_FF8203EC \n"
234 " MOV R0, #0xD2 \n"
235 " MSR CPSR_cxsf, R0 \n"
236 " MOV SP, #0x1000 \n"
237 " MOV R0, #0xD3 \n"
238 " MSR CPSR_cxsf, R0 \n"
239 " MOV SP, #0x1000 \n"
240 " LDR R0, =0x3A8 \n"
241 " LDR R2, =0xEEEEEEEE \n"
242 " MOV R3, #0x1000 \n"
243
244 "loc_FF820420:\n"
245 " CMP R0, R3 \n"
246 " STRCC R2, [R0], #4 \n"
247 " BCC loc_FF820420 \n"
248 " B sub_FF8228D4_my \n"
249 );
250 }
251
252
253
254 void __attribute__((naked,noinline)) sub_FF8228D4_my() {
255 asm volatile (
256 " LDR R0, =0x1A5C \n"
257 " STR LR, [SP, #-4]! \n"
258 " SUB SP, SP, #0x7C \n"
259 " MOV R1, #0x80000 \n"
260 " STR R1, [R0] \n"
261 " LDR R0, =0x40BEE980 \n"
262 " LDR R1, =0x1A60 \n"
263 " STR R0, [R1] \n"
264 " LDR R1, =0x1A64 \n"
265 " ADD R0, R0, #0x2000 \n"
266 " STR R0, [R1] \n"
267 " MOV R1, #0x78 \n"
268 " ADD R0, SP, #4 \n"
269 " BL sub_006BAAF4 \n"
270 " MOV R0, #0x84000 \n"
271 " STR R0, [SP, #8] \n"
272
273 #if defined(CHDK_NOT_IN_CANON_HEAP)
274 " LDR R0, =0x1BDF3C \n"
275 #else
276 " LDR R0, =new_sa\n"
277 " LDR R0, [R0]\n"
278 #endif
279
280 " LDR R2, =0x5817B0 \n"
281 " STR R0, [SP, #0xC] \n"
282 " SUB R0, R2, R0 \n"
283 " STR R0, [SP, #0x10] \n"
284 " MOV R0, #0x22 \n"
285 " STR R0, [SP, #0x1C] \n"
286 " MOV R0, #0x7C \n"
287 " STR R0, [SP, #0x20] \n"
288 " LDR R1, =0x58A000 \n"
289 " LDR R0, =0x1D3 \n"
290 " STR R1, [SP, #4] \n"
291 " STR R0, [SP, #0x24] \n"
292 " MOV R0, #0x96 \n"
293 " STR R2, [SP, #0x14] \n"
294 " STR R1, [SP, #0x18] \n"
295 " STR R0, [SP, #0x28] \n"
296 " STR R0, [SP, #0x2C] \n"
297 " MOV R0, #0x64 \n"
298 " STR R0, [SP, #0x30] \n"
299 " MOV R0, #0 \n"
300 " STR R0, [SP, #0x34] \n"
301 " STR R0, [SP, #0x38] \n"
302 " STR R0, [SP, #0x3C] \n"
303 " MOV R0, #0x10 \n"
304 " STR R0, [SP, #0x60] \n"
305 " MOV R0, #0x1000 \n"
306 " STR R0, [SP, #0x64] \n"
307 " MOV R0, #0x100 \n"
308 " STR R0, [SP, #0x68] \n"
309 " MOV R0, #0x2000 \n"
310 " STR R0, [SP, #0x6C] \n"
311 " LDR R1, =sub_FF8246FC_my \n"
312 " MOV R2, #0 \n"
313 " ADD R0, SP, #4 \n"
314 " BL sub_006B1BC8 \n"
315 " ADD SP, SP, #0x7C \n"
316 " LDR PC, [SP], #4 \n"
317 );
318 }
319
320
321
322 void __attribute__((naked,noinline)) sub_FF8246FC_my() {
323 asm volatile (
324 " STMFD SP!, {R4,LR} \n"
325 " LDR R4, =0xFF8247B8 /*'/_term'*/ \n"
326 " BL sub_FF820858 \n"
327 " LDR R1, =0x1A5C \n"
328 " LDR R0, =0x19F0 \n"
329 " LDR R1, [R1] \n"
330 " LDR R0, [R0] \n"
331 " ADD R1, R1, #0x10 \n"
332 " CMP R0, R1 \n"
333 " LDRCC R0, =0xFF8247C8 /*'USER_MEM size checking'*/ \n"
334 " BLCC _err_init_task \n"
335 " BL sub_FF8234D8 \n"
336 " CMP R0, #0 \n"
337 " LDRLT R0, =0xFF8247E0 /*'dmSetup'*/ \n"
338 " BLLT _err_init_task \n"
339 " BL sub_FF8224E8 \n"
340 " CMP R0, #0 \n"
341 " LDRLT R0, =0xFF8247E8 /*'termDriverInit'*/ \n"
342 " BLLT _err_init_task \n"
343 " MOV R0, R4 \n"
344 " BL sub_FF8225C8 \n"
345 " CMP R0, #0 \n"
346 " LDRLT R0, =0xFF8247F8 /*'termDeviceCreate'*/ \n"
347 " BLLT _err_init_task \n"
348 " MOV R0, R4 \n"
349 " BL sub_FF822100 \n"
350 " CMP R0, #0 \n"
351 " LDRLT R0, =0xFF82480C /*'stdioSetup'*/ \n"
352 " BLLT _err_init_task \n"
353 " BL sub_FF82534C \n"
354 " CMP R0, #0 \n"
355 " LDRLT R0, =0xFF824818 /*'stdlibSetup'*/ \n"
356 " BLLT _err_init_task \n"
357 " BL sub_FF8210A8 \n"
358 " CMP R0, #0 \n"
359 " LDRLT R0, =0xFF824824 /*'extlib_setup'*/ \n"
360 " BLLT _err_init_task \n"
361 " LDMFD SP!, {R4,LR} \n"
362 " B sub_FF8285C0_my \n"
363 );
364 }
365
366
367
368 void __attribute__((naked,noinline)) sub_FF8285C0_my() {
369 asm volatile (
370 " STMFD SP!, {R3,LR} \n"
371
372 " BL sub_FF83892C \n"
373 " CMP R0, #0 \n"
374 " BNE loc_FF8285E4 \n"
375 " BL sub_FF82E8B0 /*_IsNormalCameraMode_FW*/ \n"
376 " CMP R0, #0 \n"
377 " MOVNE R0, #1 \n"
378 " BNE loc_FF8285E8 \n"
379
380 "loc_FF8285E4:\n"
381 " MOV R0, #0 \n"
382
383 "loc_FF8285E8:\n"
384 " BL sub_FF82D9E0 \n"
385 " CMP R0, #0 \n"
386 " BNE loc_FF8285FC \n"
387 " BL sub_FF82D1C8 \n"
388
389 "loc_FF8285F8:\n"
390 " B loc_FF8285F8 \n"
391
392 "loc_FF8285FC:\n"
393 " BL sub_FF82A464 \n"
394 " LDR R1, =0x60E000 \n"
395 " MOV R0, #0 \n"
396 " BL sub_FF838E38 \n"
397 " BL sub_FF82A7AC /*_EnableDispatch*/ \n"
398 " MOV R3, #0 \n"
399 " STR R3, [SP] \n"
400 " LDR R3, =task_Startup_my \n"
401 " MOV R2, #0 \n"
402 " MOV R1, #0x19 \n"
403 " LDR R0, =0xFF82863C /*'Startup'*/ \n"
404 " BL _CreateTask \n"
405 " MOV R0, #0 \n"
406 " LDMFD SP!, {R3,PC} \n"
407 );
408 }
409
410
411
412 void __attribute__((naked,noinline)) task_Startup_my() {
413 asm volatile (
414 " STMFD SP!, {R4,LR} \n"
415 " BL sub_FF822C7C \n"
416 " BL sub_FF82DE6C \n"
417 " BL sub_FF82D174 \n"
418
419 " BL sub_FF838B68 \n"
420
421 " BL sub_FF838CC4 \n"
422 " BL sub_FF838F0C \n"
423
424 " BL sub_FF838BA4 \n"
425 " BL sub_FF834B50 \n"
426 " BL sub_FF838F14 \n"
427 " BL CreateTask_spytask\n"
428 " BL taskcreatePhySw_my \n"
429 " BL init_required_fw_features\n"
430 " BL sub_FF832B6C \n"
431 " BL sub_FF8B4B4C \n"
432 " BL sub_FF82AFE0 \n"
433 " BL sub_FF82CCD0 \n"
434 " BL sub_FF838738 \n"
435 " BL sub_FF82D128 \n"
436 " BL sub_FF82CC64 \n"
437
438 " BL sub_FF82BCF8 \n"
439 " BL sub_FF82CC20 \n"
440 " LDMFD SP!, {R4,LR} \n"
441 " B sub_FF822DCC \n"
442 );
443 }
444
445
446
447 void __attribute__((naked,noinline)) taskcreatePhySw_my() {
448 asm volatile (
449 " STMFD SP!, {R3-R5,LR} \n"
450 " BL sub_FF837988 \n"
451 " BL sub_FF82E7E8 /*_IsFactoryMode_FW*/ \n"
452 " CMP R0, #0 \n"
453 " BLEQ sub_FF8378F0 /*_OpLog.Start_FW*/ \n"
454 " LDR R4, =0x1C94 \n"
455 " LDR R0, [R4, #4] \n"
456 " CMP R0, #0 \n"
457 " BNE loc_FF82D8D0 \n"
458 " MOV R3, #0 \n"
459 " STR R3, [SP] \n"
460 " LDR R3, =mykbd_task \n"
461 " MOV R2, #0x2000 \n"
462 " MOV R1, #0x17 \n"
463 " LDR R0, =0xFF82DB3C /*'PhySw'*/ \n"
464 " BL sub_FF82661C /*_CreateTaskStrictly*/ \n"
465 " STR R0, [R4, #4] \n"
466
467 "loc_FF82D8D0:\n"
468 " LDMFD SP!, {R3-R5,PC} \n"
469 );
470 }
471
472
473
474 void __attribute__((naked,noinline)) init_file_modules_task() {
475 asm volatile (
476 " STMFD SP!, {R4-R6,LR} \n"
477 " BL sub_FF8A1E0C \n"
478 " LDR R5, =0x5006 \n"
479 " MOVS R4, R0 \n"
480 " MOVNE R1, #0 \n"
481 " MOVNE R0, R5 \n"
482 " BLNE _PostLogicalEventToUI \n"
483 " BL sub_FF8A1E3C \n"
484 " BL core_spytask_can_start\n"
485 " CMP R4, #0 \n"
486 " LDMNEFD SP!, {R4-R6,PC} \n"
487 " MOV R0, R5 \n"
488 " LDMFD SP!, {R4-R6,LR} \n"
489 " MOV R1, #0 \n"
490 " B _PostLogicalEventToUI \n"
491 );
492 }
493
494
495
496
497
498 void init_required_fw_features(void) {
499 extern void _init_focus_eventflag();
500
501
502
503
504 _init_focus_eventflag();
505
506
507
508 extern int av_override_semaphore;
509 extern int _CreateBinarySemaphoreStrictly(int x, int y);
510 av_override_semaphore = _CreateBinarySemaphoreStrictly(0,0);
511 }
512