root/platform/a3400/sub/100f/boot.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. taskHook
  2. boot
  3. sub_FF810380_my
  4. sub_FF8111D8_my
  5. sub_FF814288_my
  6. sub_FF81A6A8_my
  7. taskcreate_Startup_my
  8. task_Startup_my
  9. taskcreatePhySw_my
  10. CreateTask_spytask
  11. init_file_modules_task
  12. task_TouchPanel_my
  13. sub_FF8591CC_my
  14. sub_FF858F90_my
  15. sub_FF8590B4_my
  16. sub_FF858E74_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 #include "dryos31.h"
   5 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
   6 
   7 const char * const new_sa = &_end;
   8 
   9 void CreateTask_PhySw();
  10 void CreateTask_spytask();
  11 
  12 extern void task_CaptSeq();
  13 extern void task_InitFileModules();
  14 extern void task_MovieRecord();
  15 extern void task_ExpDrv();
  16 extern void task_PhySw();
  17 extern void task_FileWrite();
  18 #if 0
  19 extern void task_TouchPanel();
  20 void task_TouchPanel_my(void);
  21 #endif
  22 
  23 void taskHook(context_t **context) {
  24 
  25     task_t *tcb=(task_t*)((char*)context-offsetof(task_t, context));
  26 
  27         if(tcb->entry == (void*)task_PhySw)            tcb->entry = (void*)mykbd_task;
  28         if(tcb->entry == (void*)task_CaptSeq)          tcb->entry = (void*)capt_seq_task; 
  29         if(tcb->entry == (void*)task_InitFileModules)  tcb->entry = (void*)init_file_modules_task;
  30         if(tcb->entry == (void*)task_MovieRecord)      tcb->entry = (void*)movie_record_task;
  31         if(tcb->entry == (void*)task_ExpDrv)           tcb->entry = (void*)exp_drv_task;
  32         if(tcb->entry == (void*)task_FileWrite)        tcb->entry = (void*)filewritetask;
  33 #if 0
  34         if(tcb->entry == (void*)task_TouchPanel)       tcb->entry = (void*)task_TouchPanel_my;
  35 #endif
  36 }
  37 
  38 //** boot  @ 0xFF81000C 
  39 
  40 void __attribute__((naked,noinline)) boot(  ) { 
  41 asm volatile (
  42       "LDR     R1, =0xC0410000 \n"
  43       "MOV     R0, #0 \n"
  44       "STR     R0, [R1] \n"
  45       "MOV     R1, #0x78 \n"
  46       "MCR     p15, 0, R1, c1, c0 \n"
  47       "MOV     R1, #0 \n"
  48       "MCR     p15, 0, R1, c7, c10, 4 \n"
  49       "MCR     p15, 0, R1, c7, c5 \n"
  50       "MCR     p15, 0, R1, c7, c6 \n"
  51       "MOV     R0, #0x3D \n"
  52       "MCR     p15, 0, R0, c6, c0 \n"
  53       "MOV     R0, #0xC000002F \n"
  54       "MCR     p15, 0, R0, c6, c1 \n"
  55       "MOV     R0, #0x33 \n"
  56       "MCR     p15, 0, R0, c6, c2 \n"
  57       "MOV     R0, #0x40000033 \n"
  58       "MCR     p15, 0, R0, c6, c3 \n"
  59       "MOV     R0, #0x80000017 \n"
  60       "MCR     p15, 0, R0, c6, c4 \n"
  61       "LDR     R0, =0xFF80002D \n"
  62       "MCR     p15, 0, R0, c6, c5 \n"
  63       "MOV     R0, #0x34 \n"
  64       "MCR     p15, 0, R0, c2, c0 \n"
  65       "MOV     R0, #0x34 \n"
  66       "MCR     p15, 0, R0, c2, c0, 1 \n"
  67       "MOV     R0, #0x34 \n"
  68       "MCR     p15, 0, R0, c3, c0 \n"
  69       "LDR     R0, =0x3333330 \n"
  70       "MCR     p15, 0, R0, c5, c0, 2 \n"
  71       "LDR     R0, =0x3333330 \n"
  72       "MCR     p15, 0, R0, c5, c0, 3 \n"
  73       "MRC     p15, 0, R0, c1, c0 \n"
  74       "ORR     R0, R0, #0x1000 \n"
  75       "ORR     R0, R0, #4 \n"
  76       "ORR     R0, R0, #1 \n"
  77       "MCR     p15, 0, R0, c1, c0 \n"
  78       "MOV     R1, #0x80000006 \n"
  79       "MCR     p15, 0, R1, c9, c1 \n"
  80       "MOV     R1, #6 \n"
  81       "MCR     p15, 0, R1, c9, c1, 1 \n"
  82       "MRC     p15, 0, R1, c1, c0 \n"
  83       "ORR     R1, R1, #0x50000 \n"
  84       "MCR     p15, 0, R1, c1, c0 \n"
  85       "LDR     R2, =0xC0200000 \n"
  86       "MOV     R1, #1 \n"
  87       "STR     R1, [R2, #0x10C] \n"
  88       "MOV     R1, #0xFF \n"
  89       "STR     R1, [R2, #0xC] \n"
  90       "STR     R1, [R2, #0x1C] \n"
  91       "STR     R1, [R2, #0x2C] \n"
  92       "STR     R1, [R2, #0x3C] \n"
  93       "STR     R1, [R2, #0x4C] \n"
  94       "STR     R1, [R2, #0x5C] \n"
  95       "STR     R1, [R2, #0x6C] \n"
  96       "STR     R1, [R2, #0x7C] \n"
  97       "STR     R1, [R2, #0x8C] \n"
  98       "STR     R1, [R2, #0x9C] \n"
  99       "STR     R1, [R2, #0xAC] \n"
 100       "STR     R1, [R2, #0xBC] \n"
 101       "STR     R1, [R2, #0xCC] \n"
 102       "STR     R1, [R2, #0xDC] \n"
 103       "STR     R1, [R2, #0xEC] \n"
 104       "STR     R1, [R2, #0xFC] \n"
 105       "LDR     R1, =0xC0400008 \n"
 106       "LDR     R2, =0x430005 \n"
 107       "STR     R2, [R1] \n"
 108       "MOV     R1, #1 \n"
 109       "LDR     R2, =0xC0243100 \n"
 110       "STR     R2, [R1] \n"
 111       "LDR     R2, =0xC0242010 \n"
 112       "LDR     R1, [R2] \n"
 113       "ORR     R1, R1, #1 \n"
 114       "STR     R1, [R2] \n"
 115       "LDR     R0, =0xFFC241C0 \n"
 116       "LDR     R1, =0x3F1000 \n"
 117       "LDR     R3, =0x400654 \n"
 118 "loc_FF81013C:\n"
 119       "CMP     R1, R3 \n"
 120       "LDRCC   R2, [R0], #4 \n"
 121       "STRCC   R2, [R1], #4 \n"
 122       "BCC     loc_FF81013C \n"
 123       "LDR     R0, =0xFFC180A8 \n"
 124       "LDR     R1, =0x1900 \n"
 125       "LDR     R3, =0xDA18 \n"
 126 "loc_FF810158:\n"
 127       "CMP     R1, R3 \n"
 128       "LDRCC   R2, [R0], #4 \n"
 129       "STRCC   R2, [R1], #4 \n"
 130       "BCC     loc_FF810158 \n"
 131       "LDR     R1, =0x15967C \n" //MEMISOSTART
 132       "MOV     R2, #0 \n"
 133 "loc_FF810170:\n"
 134       "CMP     R3, R1 \n"
 135       "STRCC   R2, [R3], #4 \n"
 136       "BCC     loc_FF810170 \n"
 137 //      "B       sub_FF810380 \n" //original
 138       "B       sub_FF810380_my \n" //patched
 139         );
 140 }
 141 
 142 
 143 //** sub_FF810380_my  @ 0xFF810380 
 144 
 145 void __attribute__((naked,noinline)) sub_FF810380_my(  ) { 
 146 
 147    //http://chdk.setepontos.com/index.php/topic,4194.0.html
 148    *(int*)0x1934=(int)taskHook;
 149    *(int*)0x1938=(int)taskHook;
 150 
 151     // Power Button detection (short press = playback mode, long press = record mode) 
 152     // C02200F8  ?? power up button
 153     // 0x24B8    a3400 101a Found @ 0xFF8563F8
 154     if ((*(int*) 0xC02200F8) & 1)                 // look at power-on switch
 155             *(int*)(0x24B8+4) = 0x200000;         // start in play mode
 156     else
 157             *(int*)(0x24B8+4) = 0x100000;         // start in rec mode
 158     
 159 asm volatile (
 160       "LDR     R0, =0xFF8103F8 \n"
 161       "MOV     R1, #0 \n"
 162       "LDR     R3, =0xFF810430 \n"
 163 "loc_FF81038C:\n"
 164       "CMP     R0, R3 \n"
 165       "LDRCC   R2, [R0], #4 \n"
 166       "STRCC   R2, [R1], #4 \n"
 167       "BCC     loc_FF81038C \n"
 168       "LDR     R0, =0xFF810430 \n"
 169       "MOV     R1, #0x4B0 \n"
 170       "LDR     R3, =0xFF810644 \n"
 171 "loc_FF8103A8:\n"
 172       "CMP     R0, R3 \n"
 173       "LDRCC   R2, [R0], #4 \n"
 174       "STRCC   R2, [R1], #4 \n"
 175       "BCC     loc_FF8103A8 \n"
 176       "MOV     R0, #0xD2 \n"
 177       "MSR     CPSR_cxsf, R0 \n"
 178       "MOV     SP, #0x1000 \n"
 179       "MOV     R0, #0xD3 \n"
 180       "MSR     CPSR_cxsf, R0 \n"
 181       "MOV     SP, #0x1000 \n"
 182       "LDR     R0, =0x6C4 \n"
 183       "LDR     R2, =0xEEEEEEEE \n"
 184       "MOV     R3, #0x1000 \n"
 185 "loc_FF8103DC:\n"
 186       "CMP     R0, R3 \n"
 187       "STRCC   R2, [R0], #4 \n"
 188       "BCC     loc_FF8103DC \n"
 189 //      "BL      sub_FF8111D8 \n" //original
 190       "BL      sub_FF8111D8_my \n" //patched
 191         );
 192 }
 193 
 194 //** sub_FF8111D8_my  @ 0xFF8111D8 
 195 
 196 void __attribute__((naked,noinline)) sub_FF8111D8_my(  ) { 
 197 asm volatile (
 198       "STR     LR, [SP, #-4]! \n"
 199       "SUB     SP, SP, #0x74 \n"
 200       "MOV     R1, #0x74 \n"
 201       "MOV     R0, SP \n"
 202       "BL      sub_003FC448 \n" //RAM
 203       "MOV     R0, #0x57000 \n"
 204       "STR     R0, [SP, #4] \n"
 205 #if defined(CHDK_NOT_IN_CANON_HEAP)
 206       "LDR     R0, =0x15967C \n" // MEMISOSTART: Use original heap offset since CHDK is loaded in high memory 
 207 #else
 208       "LDR     R0, =new_sa \n"      //otherwise use patched value
 209       "LDR     R0, [R0] \n"
 210 #endif
 211       "LDR     R2, =0x2ED440 \n"
 212       "STR     R0, [SP, #8] \n"
 213       "SUB     R0, R2, R0 \n"
 214       "STR     R0, [SP, #0xC] \n"
 215       "MOV     R0, #0x22 \n"
 216       "STR     R0, [SP, #0x18] \n"
 217       "MOV     R0, #0x7C \n"
 218       "STR     R0, [SP, #0x1C] \n"
 219       "LDR     R1, =0x2F5C00 \n"
 220       "LDR     R0, =0x1CD \n"
 221       "STR     R1, [SP] \n"
 222       "STR     R0, [SP, #0x20] \n"
 223       "MOV     R0, #0x96 \n"
 224       "STR     R2, [SP, #0x10] \n"
 225       "STR     R1, [SP, #0x14] \n"
 226       "STR     R0, [SP, #0x24] \n"
 227       "STR     R0, [SP, #0x28] \n"
 228       "MOV     R0, #0x64 \n"
 229       "STR     R0, [SP, #0x2C] \n"
 230       "MOV     R0, #0 \n"
 231       "STR     R0, [SP, #0x30] \n"
 232       "STR     R0, [SP, #0x34] \n"
 233       "MOV     R0, #0x10 \n"
 234       "STR     R0, [SP, #0x5C] \n"
 235       "MOV     R0, #0x800 \n"
 236       "STR     R0, [SP, #0x60] \n"
 237       "MOV     R0, #0xA0 \n"
 238       "STR     R0, [SP, #0x64] \n"
 239       "MOV     R0, #0x280 \n"
 240       "STR     R0, [SP, #0x68] \n"
 241 //      "LDR     R1, =0xFF814288 \n" //original
 242       "LDR     R1, =sub_FF814288_my \n" //patched
 243       "MOV     R2, #0 \n"
 244       "MOV     R0, SP \n"
 245       "BL      sub_003F2778 \n" //RAM
 246       "ADD     SP, SP, #0x74 \n"
 247       "LDR     PC, [SP], #4 \n"
 248         );
 249 }
 250 
 251 //** sub_FF814288_my  @ 0xFF814288 
 252 
 253 void __attribute__((naked,noinline)) sub_FF814288_my(  ) { 
 254 asm volatile (
 255       "STMFD   SP!, {R4,LR} \n"
 256       "BL      sub_FF810B50 \n"
 257       "BL      sub_FF815174 \n"
 258       "CMP     R0, #0 \n"
 259       "LDRLT   R0, =0xFF81439C \n" // "dmSetup"
 260       "BLLT    _err_init_task \n" 
 261       "BL      sub_FF813EC0 \n"
 262       "CMP     R0, #0 \n"
 263       "LDRLT   R0, =0xFF8143A4 \n" // "termDriverInit"
 264       "BLLT    _err_init_task \n"
 265       "LDR     R0, =0xFF8143B4 \n" // "/_term"
 266       "BL      sub_FF813FA8 \n"
 267       "CMP     R0, #0 \n"
 268       "LDRLT   R0, =0xFF8143BC \n" // "termDeviceCreate"
 269       "BLLT    _err_init_task \n"
 270       "LDR     R0, =0xFF8143B4 \n" //  "/_term"
 271       "BL      sub_FF8129C8 \n"
 272       "CMP     R0, #0 \n"
 273       "LDRLT   R0, =0xFF8143D0 \n" // "stdioSetup"
 274       "BLLT    _err_init_task \n"
 275       "BL      sub_FF814B10 \n"
 276       "CMP     R0, #0 \n"
 277       "LDRLT   R0, =0xFF8143DC \n" // "stdlibSetup"
 278       "BLLT    _err_init_task \n"
 279       "BL      sub_FF8116C8 \n"
 280       "CMP     R0, #0 \n"
 281       "LDRLT   R0, =0xFF8143E8 \n" // "armlib_setup"
 282       "BLLT    _err_init_task \n"
 283       "LDMFD   SP!, {R4,LR} \n"
 284 //      "B       sub_FF81A6A8 \n" //original
 285       "B       sub_FF81A6A8_my \n" //patched
 286         );
 287 }
 288 
 289 
 290 //** sub_FF81A6A8_my  @ 0xFF81A6A8 
 291 
 292 void __attribute__((naked,noinline)) sub_FF81A6A8_my(  ) { 
 293 asm volatile (
 294       "STMFD   SP!, {R4,LR} \n"
 295       "BL      sub_FF82EB0C \n"
 296 //      "BL      loc_FF81A6BC \n" // original taskcreate_Startup
 297       "BL      taskcreate_Startup_my \n" //patched taskcreate_Startup
 298       "MOV     R0, #0 \n"
 299       "LDMFD   SP!, {R4,PC} \n"
 300         );
 301 }
 302 
 303 //** taskcreate_Startup_my  @ 0xFF81A6BC 
 304 
 305 void __attribute__((naked,noinline)) taskcreate_Startup_my(  ) { 
 306 asm volatile (
 307       "STMFD   SP!, {R3-R7,LR} \n"
 308       "BL      sub_FF835B90 \n"
 309       "LDR     R6, =0xC0220000 \n"
 310       "MOVS    R4, R0 \n"
 311       "MOV     R5, #1 \n"
 312       "BNE     loc_FF81A70C \n"
 313       "BL      sub_FF830568 \n"
 314       "CMP     R0, #0 \n"
 315       "BEQ     loc_FF81A70C \n"
 316       "LDR     R0, [R6, #0xFC] \n"
 317       "BIC     R1, R5, R0 \n"
 318       "LDR     R0, [R6, #0xF8] \n"
 319       "BIC     R0, R5, R0 \n"
 320       "ORRS    R2, R0, R1 \n"
 321       "BNE     loc_FF81A71C \n"
 322       "BL      sub_FF82E1C8 \n"
 323       "MOV     R0, #0x44 \n"
 324       "STR     R0, [R6, #0x12C] \n"
 325       "BL      sub_FF82E2E4 \n"
 326 "loc_FF81A708:\n"
 327       "B       loc_FF81A708 \n"
 328 "loc_FF81A70C:\n"
 329       "LDR     R0, [R6, #0xF8] \n"
 330       "LDR     R1, [R6, #0xFC] \n"
 331       "BIC     R0, R5, R0 \n"
 332       "BIC     R1, R5, R1 \n"
 333 "loc_FF81A71C:\n"
 334       "MOV     R3, #0 \n"
 335       "MOV     R2, R4 \n"
 336 //      "BL      sub_FF82EB14 \n" // StartUp mode detection. We must remove this for power-on mode handling to work
 337       "BL      sub_FF82EB10 \n"
 338       "BL      sub_003F77E0 \n" //RAM
 339       "LDR     R1, =0x34E000 \n"
 340       "MOV     R0, #0 \n"
 341       "BL      sub_FF8341C8 \n"
 342       "BL      sub_003F79F8 \n" //RAM
 343       "MOV     R3, #0 \n"
 344       "STR     R3, [SP] \n"
 345 //      "LDR     R3, =0xFF81A638 \n" //original
 346       "LDR     R3, =task_Startup_my \n" //patched
 347       "MOV     R2, #0 \n"
 348       "MOV     R1, #0x19 \n"
 349       "LDR     R0, =0xFF81A770 \n"
 350       "BL      _CreateTask \n"
 351       "MOV     R0, #0 \n"
 352       "LDMFD   SP!, {R3-R7,PC} \n"
 353         );
 354 }
 355 
 356 
 357 //** task_Startup_my  @ 0xFF81A638 
 358 
 359 void __attribute__((naked,noinline)) task_Startup_my(  ) { 
 360 asm volatile (
 361       "STMFD   SP!, {R4,LR} \n"
 362       "BL      sub_FF8148C8 \n"
 363       "BL      sub_FF82FC34 \n"
 364       "BL      sub_FF82DE60 \n"
 365       "BL      sub_FF835BD8 \n"
 366       "BL      sub_FF835DC4 \n"
 367       "BL      sub_FF82CC5C \n"
 368       "BL      sub_FF82D824 \n"
 369 //      "BL      sub_FF835C6C \n" //disable Diskboot.bin
 370       "BL      sub_FF835F44 \n"
 371       "BL      sub_FF836110 \n"
 372       "BL      sub_FF835F08 \n"
 373       "BL      sub_FF835DF4 \n"
 374       "BL      sub_FF8340FC \n"
 375       "BL      sub_FF836118 \n"
 376       "BL     CreateTask_spytask \n"            //added to create the Spytask
 377 //      "BL      sub_FF82E9B0 \n" //original taskcreate_PhySw()
 378       "BL     taskcreatePhySw_my \n"            // patched taskcreate_PhySw()
 379       "BL      sub_FF832390 \n"
 380       "BL      sub_FF836130 \n"
 381       "BL      sub_FF82B9D8 \n"
 382       "BL      sub_FF82C520 \n"
 383       "BL      sub_FF83594C \n"
 384       "BL      sub_FF82CB4C \n"
 385       "BL      sub_FF82C4BC \n"
 386       "BL      sub_FF835F34 \n"
 387       "BL      sub_FF836C88 \n"
 388       "BL      sub_FF82C480 \n"
 389       "LDMFD   SP!, {R4,LR} \n"
 390       "B       sub_FF8149E8 \n"
 391         );
 392 }
 393 
 394 
 395 //** taskcreatePhySw_my  @ 0xFF82E9B0 
 396 
 397 void __attribute__((naked,noinline)) taskcreatePhySw_my(  ) { 
 398 asm volatile (
 399       "STMFD   SP!, {R3-R5,LR} \n"
 400       "LDR     R4, =0x1C18 \n"
 401       "LDR     R0, [R4, #4] \n"
 402       "CMP     R0, #0 \n"
 403       "BNE     loc_FF82E9E4 \n"
 404       "MOV     R3, #0 \n"
 405       "STR     R3, [SP] \n"
 406 //      "LDR     R3, =0xFF82E97C \n"
 407       "LDR     R3, =mykbd_task \n" //patched  task_PhySw
 408 //      "MOV     R2, #0x800 \n"
 409       "MOV     R2, #0x2000 \n" // stack size for new task_PhySw so we don't have to do stack switch
 410       "MOV     R1, #0x17 \n"
 411       "LDR     R0, =0xFF82EC0C \n"
 412       "BL      sub_003F7A50 \n"
 413       "STR     R0, [R4, #4] \n"
 414 "loc_FF82E9E4:\n"
 415       "BL      sub_FF880638 \n"
 416       "BL      sub_FF8304B8 \n"
 417       "CMP     R0, #0 \n"
 418       "BNE     loc_FF82EA00 \n"
 419       "LDR     R1, =0x31BAC \n"
 420       "MOV     R0, #0 \n"
 421       "BL      sub_FF8805A8 \n"
 422 "loc_FF82EA00:\n"
 423       "LDMFD   SP!, {R3-R5,PC} \n"
 424         );
 425 }
 426 
 427 void CreateTask_spytask() {
 428 
 429         _CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);                        
 430 };
 431 
 432 //** init_file_modules_task  @ 0xFF88A668 
 433 
 434 void __attribute__((naked,noinline)) init_file_modules_task(  ) { 
 435 asm volatile (
 436       "STMFD   SP!, {R4-R6,LR} \n"
 437       "BL      sub_FF882BA4 \n"
 438       "LDR     R5, =0x5006 \n"
 439       "MOVS    R4, R0 \n"
 440       "MOVNE   R1, #0 \n"
 441       "MOVNE   R0, R5 \n"
 442       "BLNE    _PostLogicalEventToUI \n"
 443       "BL      sub_FF882BD0 \n"
 444       "BL          core_spytask_can_start \n" //added CHDK: Set "it's-safe-to-start"-Flag for spytask
 445       "CMP     R4, #0 \n"
 446       "LDMNEFD SP!, {R4-R6,PC} \n"
 447       "MOV     R0, R5 \n"
 448       "LDMFD   SP!, {R4-R6,LR} \n"
 449       "MOV     R1, #0 \n"
 450       "B       _PostLogicalEventToUI \n"
 451         );
 452 }
 453 
 454 #if 0
 455 void __attribute__((naked,noinline)) task_TouchPanel_my(  ) {
 456 asm volatile (
 457       "    STMFD   SP!, {R3-R7,LR} \n" 
 458       "    MOV     R0, #0 \n" 
 459       "    LDR     R1, =0xC0221000 \n" 
 460       "    MOV     R4, R0 \n" 
 461       "    STR     R0, [SP] \n" 
 462       "    MOV     R0, #0xB \n" 
 463       "    STR     R0, [R1, #0x314] \n" 
 464       "    MOV     R0, #0x1C \n" 
 465       "    SUB     R1, R1, #0x1E000 \n" 
 466       "    STR     R0, [R1, #0x40] \n" 
 467       "    MOV     R3, #0 \n" 
 468       "    LDR     R2, =0xFF858DD0 \n" 
 469       "    MOV     R1, #0x55 \n" 
 470       "    MOV     R0, R3 \n" 
 471       "    BL      sub_003F67BC \n" 
 472       "    BL      sub_FF85966C \n" 
 473       "    LDR     R5, =0x25A8 \n" 
 474       "    MOV     R1, #0x10 \n" 
 475       "    LDR     R0, [R5, #0x20] \n" 
 476       "    BL      sub_003FACA0 \n" 
 477       "    MOV     R6, #7 \n" 
 478 "loc_FF859268:\n"
 479       "    LDR     R0, [R5, #0x20] \n" 
 480       "    MOV     R2, #0 \n" 
 481       "    MOV     R1, #0x17 \n" 
 482       "    BL      sub_003FAAC8 \n" 
 483       "    CMP     R0, #0 \n" 
 484       "    LDRNE   R0, =0xFF858E04 \n" 
 485       "    MOVNE   R1, #0x31C \n" 
 486       "    BLNE    sub_003F6AFC \n" 
 487       "    LDR     R0, [R5, #0x20] \n" 
 488       "    MOV     R1, SP \n" 
 489       "    BL      sub_003FACD8 \n" 
 490       "    CMP     R0, #0 \n" 
 491       "    LDRNE   R1, =0x31D \n" 
 492       "    LDRNE   R0, =0xFF858E04 \n" 
 493       "    BLNE    sub_003F6AFC \n" 
 494       "    LDR     R0, [SP] \n" 
 495       "    TST     R0, #1 \n" 
 496       "    BEQ     loc_FF8592E8 \n" 
 497       "    LDR     R0, [R5, #4] \n" 
 498       "    CMP     R0, #7 \n" 
 499       "    BEQ     loc_FF8592C4 \n" 
 500       "    BL      sub_FF87D9D0 \n" 
 501       "    STR     R6, [R5, #4] \n" 
 502 "loc_FF8592C4:\n"
 503       "    LDR     R0, [R5, #0x20] \n" 
 504       "    MOV     R1, #5 \n" 
 505       "    BL      sub_003FACA0 \n" 
 506       "    BL      sub_FF858E2C \n" 
 507       "    MOV     R4, #0 \n" 
 508       "    BL      sub_FF85966C \n" 
 509       "    LDR     R0, [R5, #0x20] \n" 
 510       "    MOV     R1, #0x80000000 \n" 
 511       "    BL      sub_003FAC6C \n" 
 512 "loc_FF8592E8:\n"
 513       "    LDR     R0, [SP] \n" 
 514       "    TST     R0, #2 \n" 
 515       "    BEQ     loc_FF859318 \n" 
 516       "    LDR     R0, [R5, #0x20] \n" 
 517       "    MOV     R1, #2 \n" 
 518       "    BL      sub_003FACA0 \n" 
 519       "    CMP     R4, #0 \n" 
 520       "    BNE     loc_FF859268 \n" 
 521       "    LDR     R0, =0xBB8 \n" 
 522       "    BL      sub_FF858C2C \n" 
 523       "    MOV     R4, #1 \n" 
 524       "    BL      sub_FF859798 \n" 
 525 "loc_FF859318:\n"
 526       "    LDR     R0, [SP] \n" 
 527       "    TST     R0, #0x10 \n" 
 528       "    BEQ     loc_FF859360 \n" 
 529       "    LDR     R0, [R5, #4] \n" 
 530       "    CMP     R0, #7 \n" 
 531       "    BEQ     loc_FF859338 \n" 
 532       "    BL      sub_FF87D9D0 \n" 
 533       "    STR     R6, [R5, #4] \n" 
 534 "loc_FF859338:\n"
 535       "    BL      sub_FF85966C \n" 
 536       "    LDR     R0, [R5, #0x20] \n" 
 537       "    MOV     R1, #0x14 \n" 
 538       "    BL      sub_003FACA0 \n" 
 539       "    CMP     R4, #0 \n" 
 540       "    BEQ     loc_FF859268 \n" 
 541       "    BL      sub_FF8591CC_my \n" // ->
 542       "    LDR     R0, [R5, #0xC] \n" 
 543       "    CMP     R0, #0 \n" 
 544       "    BLNE    sub_FF859774 \n" 
 545 "loc_FF859360:\n"
 546       "    LDR     R0, [SP] \n" 
 547       "    TST     R0, #4 \n" 
 548       "    BEQ     loc_FF859268 \n" 
 549       "    STR     R6, [R5, #4] \n" 
 550       "    LDR     R0, [R5, #0x20] \n" 
 551       "    MOV     R1, #4 \n" 
 552       "    BL      sub_003FACA0 \n" 
 553       "    CMP     R4, #0 \n" 
 554       "    BEQ     loc_FF859268 \n" 
 555       "    BL      sub_FF8591CC_my \n" // ->
 556       "    LDR     R0, [R5, #0xC] \n" 
 557       "    CMP     R0, #0 \n" 
 558       "    BLNE    sub_FF859774 \n" 
 559       "    B       loc_FF859268 \n" 
 560     );
 561 }
 562 
 563 void __attribute__((naked,noinline)) sub_FF8591CC_my(  ) {
 564 asm volatile (
 565       "    LDR     R1, =0x25A8 \n" 
 566       "    LDR     R0, [R1, #0xC] \n" 
 567       "    CMP     R0, #0 \n" 
 568       "    BEQ     loc_FF8591F8 \n" 
 569       "    CMP     R0, #1 \n" 
 570       "    BEQ     sub_FF858F90_my \n" // ->
 571       "    CMP     R0, #2 \n" 
 572       "    BEQ     sub_FF8590B4_my \n" // ->
 573       "    LDRNE   R1, =0x307 \n" 
 574       "    LDRNE   R0, =0xFF858E04 \n" 
 575       "    BNE     sub_003F6AFC \n" 
 576 "loc_FF8591F8:\n"
 577       "    LDR     R0, =0xC0220000 \n" 
 578       "    LDR     R0, [R0, #0x2C] \n" 
 579       "    TST     R0, #1 \n" 
 580       "    BNE     sub_FF859798 \n" 
 581       "    MOV     R0, #1 \n" 
 582       "    STR     R0, [R1, #0xC] \n" 
 583       "    BX      LR \n" 
 584     );
 585 }
 586 
 587 void __attribute__((naked,noinline)) sub_FF858F90_my(  ) {
 588 asm volatile (
 589       "    STMFD   SP!, {R3-R7,LR} \n" 
 590       "    LDR     R6, =0xC0220000 \n" 
 591       "    LDR     R0, [R6, #0x2C] \n" 
 592       "    TST     R0, #1 \n" 
 593       "    BNE     loc_FF8590AC \n" 
 594       "    LDR     R1, =0x25D4 \n" 
 595       "    MOV     R0, #0 \n" 
 596       "    BL      sub_FF858C8C \n" 
 597       "    LDR     R4, =0x25D4 \n" 
 598       "    LDR     R5, =0x3FF \n" 
 599       "    LDRH    R0, [R4, #6] \n" 
 600       "    BIC     R0, R0, #0x8000 \n" 
 601       "    EOR     R2, R5, R0, LSR #5 \n" 
 602       "    LDRH    R0, [R4, #4] \n" 
 603       "    BIC     R0, R0, #0x8000 \n" 
 604       "    EOR     R1, R5, R0, LSR #5 \n" 
 605       "    LDRH    R0, [R4, #2] \n" 
 606       "    BIC     R0, R0, #0x8000 \n" 
 607       "    EOR     R0, R5, R0, LSR #5 \n" 
 608       "    BL      sub_FF858DB4 \n" 
 609       "    CMP     R0, #0x1F40 \n" 
 610       "    BGT     loc_FF859058 \n" 
 611       "    LDR     R0, =0x2710 \n" 
 612       "    BL      sub_FF858C2C \n" 
 613       "    LDR     R0, [R6, #0x2C] \n" 
 614       "    SUB     R6, R4, #0x2C \n" 
 615       "    TST     R0, #1 \n" 
 616       "    BNE     loc_FF85905C \n" 
 617       "    ADD     R1, R4, #0 \n" 
 618       "    MOV     R0, #0 \n" 
 619       "    BL      sub_FF858C8C \n" 
 620       "    LDRH    R0, [R4, #6] \n" 
 621       "    BIC     R0, R0, #0x8000 \n" 
 622       "    EOR     R2, R5, R0, LSR #5 \n" 
 623       "    LDRH    R0, [R4, #4] \n" 
 624       "    BIC     R0, R0, #0x8000 \n" 
 625       "    EOR     R1, R5, R0, LSR #5 \n" 
 626       "    LDRH    R0, [R4, #2] \n" 
 627       "    BIC     R0, R0, #0x8000 \n" 
 628       "    EOR     R0, R5, R0, LSR #5 \n" 
 629       "    BL      sub_FF858DB4 \n" 
 630       "    CMP     R0, #0x1F40 \n" 
 631       "    BGT     loc_FF859058 \n" 
 632       "    BL      sub_FF858E74_my \n" // ->
 633       "    MOV     R0, #3 \n" 
 634       "    STR     R0, [R6, #0x10] \n" 
 635       "    MOV     R0, #2 \n" 
 636       "    STR     R0, [R6, #0xC] \n" 
 637       "    MVN     R0, #0x8000 \n" 
 638       "    STRH    R0, [R4] \n" 
 639 "loc_FF859058:\n"
 640       "    LDMFD   SP!, {R3-R7,PC} \n" 
 641 "loc_FF85905C:\n"
 642       "    LDR     R0, [R6, #0x14] \n" 
 643       "    CMP     R0, #0 \n" 
 644       "    LDRNE   R0, =0xFF8591C4 \n" 
 645       "    BLNE    sub_FF8117C8 \n" 
 646       "    LDRH    R0, [R4, #6] \n" 
 647       "    BIC     R0, R0, #0x8000 \n" 
 648       "    EOR     R3, R5, R0, LSR #5 \n" 
 649       "    STR     R3, [SP] \n" 
 650       "    LDRH    R0, [R4, #4] \n" 
 651       "    LDR     R12, [R6, #0x18] \n" 
 652       "    BIC     R0, R0, #0x8000 \n" 
 653       "    EOR     R3, R5, R0, LSR #5 \n" 
 654       "    LDRH    R0, [R4, #2] \n" 
 655       "    BIC     R0, R0, #0x8000 \n" 
 656       "    EOR     R2, R5, R0, LSR #5 \n" 
 657       "    LDRH    R0, [R4] \n" 
 658       "    BIC     R0, R0, #0x8000 \n" 
 659       "    EOR     R1, R5, R0, LSR #5 \n" 
 660       "    MOV     R0, #0 \n" 
 661       "    BLX     R12 \n" 
 662 "loc_FF8590AC:\n"
 663       "    BL      sub_FF858E2C \n" 
 664       "    LDMFD   SP!, {R3-R7,PC} \n" 
 665     );
 666 }
 667 
 668 
 669 void __attribute__((naked,noinline)) sub_FF8590B4_my(  ) {
 670 asm volatile (
 671       "    STMFD   SP!, {R3-R9,LR} \n" 
 672       "    LDR     R7, =0xC0220000 \n" 
 673       "    LDR     R0, [R7, #0x2C] \n" 
 674       "    LDR     R5, =0x25A8 \n" 
 675       "    TST     R0, #1 \n" 
 676       "    LDR     R0, [R5, #0x10] \n" 
 677       "    LDR     R6, =0x2710 \n" 
 678       "    SUB     R0, R0, #1 \n" 
 679       "    BEQ     loc_FF8590EC \n" 
 680       "    CMP     R0, #0 \n" 
 681       "    STR     R0, [R5, #0x10] \n" 
 682       "    LDMEQFD SP!, {R3-R9,LR} \n" 
 683       "    BEQ     sub_FF858E2C \n" 
 684       "    B       loc_FF859110 \n" 
 685 "loc_FF8590EC:\n"
 686       "    LDR     R4, =0x25D4 \n" 
 687       "    LDR     R8, =0x7FFF \n" 
 688       "    MOV     R1, #3 \n" 
 689       "    CMP     R0, #2 \n" 
 690       "    STR     R1, [R5, #0x10] \n" 
 691       "    BCS     loc_FF85911C \n" 
 692       "    LDRH    R0, [R4] \n" 
 693       "    CMP     R0, R8 \n" 
 694       "    BNE     loc_FF8591A0 \n" 
 695 "loc_FF859110:\n"
 696       "    MOV     R0, R6 \n" 
 697       "    LDMFD   SP!, {R3-R9,LR} \n" 
 698       "    B       sub_FF858C2C \n" 
 699 "loc_FF85911C:\n"
 700       "    LDR     R1, =0x25D4 \n" 
 701       "    MOV     R0, #0 \n" 
 702       "    BL      sub_FF858C8C \n" 
 703       "    MOV     R0, R6 \n" 
 704       "    BL      sub_FF858C2C \n" 
 705       "    LDR     R0, [R7, #0x2C] \n" 
 706       "    TST     R0, #1 \n" 
 707       "    BEQ     loc_FF8591A0 \n" 
 708       "    LDR     R0, [R5, #0x14] \n" 
 709       "    CMP     R0, #0 \n" 
 710       "    LDRNE   R0, =0xFF8591C4 \n" 
 711       "    BLNE    sub_FF8117C8 \n" 
 712       "    LDRH    R0, [R4, #6] \n" 
 713       "    BIC     R1, R0, #0x8000 \n" 
 714       "    LDR     R0, =0x3FF \n" 
 715       "    EOR     R3, R0, R1, LSR #5 \n" 
 716       "    STR     R3, [SP] \n" 
 717       "    LDRH    R1, [R4, #4] \n" 
 718       "    LDR     R12, [R5, #0x18] \n" 
 719       "    BIC     R1, R1, #0x8000 \n" 
 720       "    EOR     R3, R0, R1, LSR #5 \n" 
 721       "    LDRH    R1, [R4, #2] \n" 
 722       "    BIC     R1, R1, #0x8000 \n" 
 723       "    EOR     R2, R0, R1, LSR #5 \n" 
 724       "    LDRH    R1, [R4] \n" 
 725       "    BIC     R1, R1, #0x8000 \n" 
 726       "    EOR     R1, R0, R1, LSR #5 \n" 
 727       "    MOV     R0, #0 \n" 
 728       "    BLX     R12 \n" 
 729       "    LDR     R0, [R5, #0x10] \n" 
 730       "    SUB     R0, R0, #1 \n" 
 731       "    STR     R0, [R5, #0x10] \n" 
 732       "    LDMFD   SP!, {R3-R9,PC} \n" 
 733 "loc_FF8591A0:\n"
 734       "    BL      sub_FF858E74_my \n" // ->
 735       "    STRH    R8, [R4] \n" 
 736       "    LDMFD   SP!, {R3-R9,PC} \n" 
 737     );
 738 }
 739 
 740 void __attribute__((naked,noinline)) sub_FF858E74_my(  ) {
 741 asm volatile (
 742       "    STMFD   SP!, {R4,R5,LR} \n"
 743       "    BL      chdk_process_touch \n"
 744       "    LDMFD   SP!, {R4,R5,LR} \n"
 745       "    CMP     R0, #0 \n"
 746       "    BXNE    LR \n"
 747       "    LDR     PC, =0xFF858E74 \n"  // Continue in firmware
 748 );
 749 }
 750 #endif

/* [<][>][^][v][top][bottom][index][help] */