root/platform/ixus105_sd1300/sub/100c/boot.c

DEFINITIONS

1. taskHook
2. CreateTask_spytask
3. boot
4. sub_FFC00354_my
5. sub_FFC01198_my
6. sub_FFC05E58_my
7. taskcreate_Startup_my
8. taskcreate_PhySw_my
9. task_Startup_my
10. init_file_modules_task
11. sub_FFC714F4_my
12. sub_FFC556EC_my
13. sub_FFC55314_my
14. sub_FFC55034_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 #include "dryos31.h"
   6 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
   8 const char * const new_sa = &_end;
  10 extern void task_PhySw();
  11 extern void task_CaptSeq();
  12 extern void task_InitFileModules();
  13 extern void task_RotaryEncoder();
  14 extern void task_MovieRecord();
  15 extern void task_ExpDrv();
  16 extern void task_FileWrite();
  18 void taskHook(context_t **context)
  19 { 
task_t *tcb=(task_t*)((char*)context-offsetof(task_t, context));
  21         // Replace firmware task addresses with ours
  22         if(tcb->entry == (void*)task_PhySw)             tcb->entry = (void*)mykbd_task; 
  23         if(tcb->entry == (void*)task_CaptSeq)                   tcb->entry = (void*)capt_seq_task; 
  24         if(tcb->entry == (void*)task_InitFileModules)   tcb->entry = (void*)init_file_modules_task;
  25         if(tcb->entry == (void*)task_MovieRecord)               tcb->entry = (void*)movie_record_task;
  26         if(tcb->entry == (void*)task_ExpDrv)                    tcb->entry = (void*)exp_drv_task;
  27     if(tcb->entry == (void*)task_FileWrite)         tcb->entry = (void*)filewritetask;
  28 }
  30 void CreateTask_spytask() {
_CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);
  32 };
  34 //** boot  @ 0xFFC0000C 
  36 void __attribute__((naked,noinline)) boot(  ) { 
  37 asm volatile (
  38       "LDR     R1, =0xC0410000 \n"
  39       "MOV     R0, #0 \n"
  40       "STR     R0, [R1] \n"
  41       "MOV     R1, #0x78 \n"
  42       "MCR     p15, 0, R1, c1, c0 \n"
  43       "MOV     R1, #0 \n"
  44       "MCR     p15, 0, R1, c7, c10, 4 \n"
  45       "MCR     p15, 0, R1, c7, c5 \n"
  46       "MCR     p15, 0, R1, c7, c6 \n"
  47       "MOV     R0, #0x3D \n"
  48       "MCR     p15, 0, R0, c6, c0 \n"
  49       "MOV     R0, #0xC000002F \n"
  50       "MCR     p15, 0, R0, c6, c1 \n"
  51       "MOV     R0, #0x33 \n"
  52       "MCR     p15, 0, R0, c6, c2 \n"
  53       "MOV     R0, #0x40000033 \n"
  54       "MCR     p15, 0, R0, c6, c3 \n"
  55       "MOV     R0, #0x80000017 \n"
  56       "MCR     p15, 0, R0, c6, c4 \n"
  57       "LDR     R0, =0xFFC0002B \n"
  58       "MCR     p15, 0, R0, c6, c5 \n"
  59       "MOV     R0, #0x34 \n"
  60       "MCR     p15, 0, R0, c2, c0 \n"
  61       "MOV     R0, #0x34 \n"
  62       "MCR     p15, 0, R0, c2, c0, 1 \n"
  63       "MOV     R0, #0x34 \n"
  64       "MCR     p15, 0, R0, c3, c0 \n"
  65       "LDR     R0, =0x3333330 \n"
  66       "MCR     p15, 0, R0, c5, c0, 2 \n"
  67       "LDR     R0, =0x3333330 \n"
  68       "MCR     p15, 0, R0, c5, c0, 3 \n"
  69       "MRC     p15, 0, R0, c1, c0 \n"
  70       "ORR     R0, R0, #0x1000 \n"
  71       "ORR     R0, R0, #4 \n"
  72       "ORR     R0, R0, #1 \n"
  73       "MCR     p15, 0, R0, c1, c0 \n"
  74       "MOV     R1, #0x80000006 \n"
  75       "MCR     p15, 0, R1, c9, c1 \n"
  76       "MOV     R1, #6 \n"
  77       "MCR     p15, 0, R1, c9, c1, 1 \n"
  78       "MRC     p15, 0, R1, c1, c0 \n"
  79       "ORR     R1, R1, #0x50000 \n"
  80       "MCR     p15, 0, R1, c1, c0 \n"
  81       "LDR     R2, =0xC0200000 \n"
  82       "MOV     R1, #1 \n"
  83       "STR     R1, [R2, #0x10C] \n"
  84       "MOV     R1, #0xFF \n"
  85       "STR     R1, [R2, #0xC] \n"
  86       "STR     R1, [R2, #0x1C] \n"
  87       "STR     R1, [R2, #0x2C] \n"
  88       "STR     R1, [R2, #0x3C] \n"
  89       "STR     R1, [R2, #0x4C] \n"
  90       "STR     R1, [R2, #0x5C] \n"
  91       "STR     R1, [R2, #0x6C] \n"
  92       "STR     R1, [R2, #0x7C] \n"
  93       "STR     R1, [R2, #0x8C] \n"
  94       "STR     R1, [R2, #0x9C] \n"
  95       "STR     R1, [R2, #0xAC] \n"
  96       "STR     R1, [R2, #0xBC] \n"
  97       "STR     R1, [R2, #0xCC] \n"
  98       "STR     R1, [R2, #0xDC] \n"
  99       "STR     R1, [R2, #0xEC] \n"
 100       "STR     R1, [R2, #0xFC] \n"
 101       "LDR     R1, =0xC0400008 \n"
 102       "LDR     R2, =0x430005 \n"
 103       "STR     R2, [R1] \n"
 104       "MOV     R1, #1 \n"
 105       "LDR     R2, =0xC0243100 \n"
 106       "STR     R2, [R1] \n"
 107       "LDR     R2, =0xC0242010 \n"
 108       "LDR     R1, [R2] \n"
 109       "ORR     R1, R1, #1 \n"
 110       "STR     R1, [R2] \n"
 111       "LDR     R0, =0xFFF1642C \n"
 112       "LDR     R1, =0x1900 \n"
 113       "LDR     R3, =0xB4B8 \n"
 114 "loc_FFC0013C:\n"
 115       "CMP     R1, R3 \n"
 116       "LDRCC   R2, [R0], #4 \n"
 117       "STRCC   R2, [R1], #4 \n"
 118       "BCC     loc_FFC0013C \n"
 119       "LDR     R1, =0x12E9FC \n"
 120       "MOV     R2, #0 \n"
 121 "loc_FFC00154:\n"
 122       "CMP     R3, R1 \n"
 123       "STRCC   R2, [R3], #4 \n"
 124       "BCC     loc_FFC00154 \n"
 125 //      "B       sub_FFC00354 \n"  //original
 126       "B       sub_FFC00354_my \n" //patched
 127         );
 128 }
 131 //** sub_FFC00354_my  @ 0xFFC00354 
 133 void __attribute__((naked,noinline)) sub_FFC00354_my(  ) { 
 134    //*(int*)0x1934=(int)taskHook;
 135    *(int*)0x1938=(int)taskHook;
 136    // replacement for correct power-on. ffc477a0
 137    *(int*)(0x221c+4)= (*(int*)0xc0220024)&1 ? 0x200000 : 0x100000; 
 138 asm volatile (
 139       "LDR     R0, =0xFFC003CC \n"
 140       "MOV     R1, #0 \n"
 141       "LDR     R3, =0xFFC00404 \n"
 142 "loc_FFC00360:\n"
 143       "CMP     R0, R3 \n"
 144       "LDRCC   R2, [R0], #4 \n"
 145       "STRCC   R2, [R1], #4 \n"
 146       "BCC     loc_FFC00360 \n"
 147       "LDR     R0, =0xFFC00404 \n"
 148       "MOV     R1, #0x4B0 \n"
 149       "LDR     R3, =0xFFC00618 \n"
 150 "loc_FFC0037C:\n"
 151       "CMP     R0, R3 \n"
 152       "LDRCC   R2, [R0], #4 \n"
 153       "STRCC   R2, [R1], #4 \n"
 154       "BCC     loc_FFC0037C \n"
 155       "MOV     R0, #0xD2 \n"
 156       "MSR     CPSR_cxsf, R0 \n"
 157       "MOV     SP, #0x1000 \n"
 158       "MOV     R0, #0xD3 \n"
 159       "MSR     CPSR_cxsf, R0 \n"
 160       "MOV     SP, #0x1000 \n"
 161       "LDR     R0, =0x6C4 \n"
 162       "LDR     R2, =0xEEEEEEEE \n"
 163       "MOV     R3, #0x1000 \n"
 164 "loc_FFC003B0:\n"
 165       "CMP     R0, R3 \n"
 166       "STRCC   R2, [R0], #4 \n"
 167       "BCC     loc_FFC003B0 \n"
 168 //      "BL      sub_FFC01198 \n"  //original
 169       "BL      sub_FFC01198_my \n" //patched
 170         );
 171 }
 173 //** sub_FFC01198_my  @ 0xFFC01198 
 175 void __attribute__((naked,noinline)) sub_FFC01198_my(  ) { 
 176 asm volatile (
 177       "STR     LR, [SP, #-4]! \n"
 178       "SUB     SP, SP, #0x74 \n"
 179       "MOV     R0, SP \n"
 180       "MOV     R1, #0x74 \n"
 181       "BL      sub_FFEA3060 \n"
 182       "MOV     R0, #0x53000 \n"
 183       "STR     R0, [SP, #4] \n"
 184 #if defined(CHDK_NOT_IN_CANON_HEAP)
 185       "LDR     R0, =0x12E9FC\n" // MEMISOSTART: Use original heap offset since CHDK is loaded in high memory
 186 #else
 187       "LDR     R0, =new_sa\n"      //otherwise use patched value
 188       "LDR     R0, [R0]\n"
 189 #endif
 190       "LDR     R2, =0x2F9C00 \n"
 191       "LDR     R1, =0x2F24A8 \n"
 192       "STR     R0, [SP, #8] \n"
 193       "SUB     R0, R1, R0 \n"
 194       "ADD     R3, SP, #0xC \n"
 195       "STR     R2, [SP] \n"
 196       "STMIA   R3, {R0-R2} \n"
 197       "MOV     R0, #0x22 \n"
 198       "STR     R0, [SP, #0x18] \n"
 199       "MOV     R0, #0x68 \n"
 200       "STR     R0, [SP, #0x1C] \n"
 201       "LDR     R0, =0x19B \n"
 202 //      "LDR     R1, =0xFFC05E58 \n"   //original
 203       "LDR     R1, =sub_FFC05E58_my \n"  //patched
 204       "STR     R0, [SP, #0x20] \n"
 205       "MOV     R0, #0x96 \n"
 206       "STR     R0, [SP, #0x24] \n"
 207       "MOV     R0, #0x78 \n"
 208       "STR     R0, [SP, #0x28] \n"
 209       "MOV     R0, #0x64 \n"
 210       "STR     R0, [SP, #0x2C] \n"
 211       "MOV     R0, #0 \n"
 212       "STR     R0, [SP, #0x30] \n"
 213       "STR     R0, [SP, #0x34] \n"
 214       "MOV     R0, #0x10 \n"
 215       "STR     R0, [SP, #0x5C] \n"
 216       "MOV     R0, #0x800 \n"
 217       "STR     R0, [SP, #0x60] \n"
 218       "MOV     R0, #0xA0 \n"
 219       "STR     R0, [SP, #0x64] \n"
 220       "MOV     R0, #0x280 \n"
 221       "STR     R0, [SP, #0x68] \n"
 222       "MOV     R0, SP \n"
 223       "MOV     R2, #0 \n"
 224       "BL      sub_FFC03404 \n"
 225       "ADD     SP, SP, #0x74 \n"
 226       "LDR     PC, [SP], #4 \n"
 227         );
 228 }
 231 //** sub_FFC05E58_my  @ 0xFFC05E58 
 233 void __attribute__((naked,noinline)) sub_FFC05E58_my(  ) { 
 234 asm volatile (
 235       "STMFD   SP!, {R4,LR} \n"
 236       "BL      sub_FFC00B20 \n"
 237       "BL      sub_FFC0A244 \n"
 238       "CMP     R0, #0 \n"
 239       "LDRLT   R0, =0xFFC05F6C \n"
 240       "BLLT    sub_FFC05F4C \n"
 241       "BL      sub_FFC05A94 \n"
 242       "CMP     R0, #0 \n"
 243       "LDRLT   R0, =0xFFC05F74 \n"
 244       "BLLT    sub_FFC05F4C \n"
 245       "LDR     R0, =0xFFC05F84 \n"
 246       "BL      sub_FFC05B7C \n"
 247       "CMP     R0, #0 \n"
 248       "LDRLT   R0, =0xFFC05F8C \n"
 249       "BLLT    sub_FFC05F4C \n"
 250       "LDR     R0, =0xFFC05F84 \n"
 251       "BL      sub_FFC03BF0 \n"
 252       "CMP     R0, #0 \n"
 253       "LDRLT   R0, =0xFFC05FA0 \n"
 254       "BLLT    sub_FFC05F4C \n"
 255       "BL      sub_FFC09C3C \n"
 256       "CMP     R0, #0 \n"
 257       "LDRLT   R0, =0xFFC05FAC \n"
 258       "BLLT    sub_FFC05F4C \n"
 259       "BL      sub_FFC0167C \n"
 260       "CMP     R0, #0 \n"
 261       "LDRLT   R0, =0xFFC05FB8 \n"
 262       "BLLT    sub_FFC05F4C \n"
 263       "LDMFD   SP!, {R4,LR} \n"
 264 //      "B       sub_FFC0FAF0 \n"   //original
 265       "B       taskcreate_Startup_my\n"  //patched
 266         );
 267 }
 270 //** taskcreate_Startup_my  @ 0xFFC0FAD0 
 272 void __attribute__((naked,noinline)) taskcreate_Startup_my(  ) { 
 273 asm volatile (
 274       "STMFD   SP!, {R3,LR} \n"
 275       "BL      sub_FFC24318 \n"
 276       "BL      sub_FFC2B704 \n"
 277       "CMP     R0, #0 \n"
 278       "BNE     loc_FFC0FB34 \n"
 279       "BL      sub_FFC25B08 \n"
 280       "CMP     R0, #0 \n"
 281       "BEQ     loc_FFC0FB34 \n"
 282       "BL      sub_FFC24314 \n"
 283       "CMP     R0, #0 \n"
 284       "BNE     loc_FFC0FB34 \n"
 285       "BL      sub_FFC239E4 \n"
 286       "LDR     R1, =0xC0220000 \n"
 287       "MOV     R0, #0x44 \n"
 288       "STR     R0, [R1, #0x1C] \n"
 289       "BL      sub_FFC23BD0 \n"
 290 "loc_FFC0FB30:\n"
 291       "B       loc_FFC0FB30 \n"
 292 "loc_FFC0FB34:\n"
 293 //      "BL      sub_FFC24320 \n"    // hijack power-on
 294       "BL      sub_FFC2431C \n"
 295       "BL      sub_FFC29938 \n"
 296       "LDR     R1, =0x34E000 \n"
 297       "MOV     R0, #0 \n"
 298       "BL      sub_FFC29D80 \n"
 299       "BL      sub_FFC29B2C \n"
 300       "MOV     R3, #0 \n"
 301       "STR     R3, [SP] \n"
 302 //      "LDR     R3, =0xFFC0FA8C \n"
 303       "LDR     R3, =task_Startup_my\n"  //patch
 304       "MOV     R2, #0 \n"
 305       "MOV     R1, #0x19 \n"
 306       "LDR     R0, =0xFFC0FB7C \n"
 307       "BL      sub_FFC0E83C \n"
 308       "MOV     R0, #0 \n"
 309       "LDMFD   SP!, {R12,PC} \n"
 310         );
 311 }
 313 //** taskcreate_PhySw_my  @ 0xFFC24208 
 315 void __attribute__((naked,noinline)) taskcreate_PhySw_my(  ) { 
 316 asm volatile (
 317       "STMFD   SP!, {R3-R5,LR} \n"
 318       "LDR     R4, =0x1C20 \n"
 319       "LDR     R0, [R4, #0x10] \n"
 320       "CMP     R0, #0 \n"
 321       "BNE     loc_FFC2423C \n"
 322       "MOV     R3, #0 \n"
 323       "STR     R3, [SP] \n"
 324 //      "LDR     R3, =0xFFC241D4 \n"    //original task_phySw
 325       "LDR     R3, =mykbd_task\n"               // Changed
 326 //      "MOV     R2, #0x800 \n"
 327       "MOV     R2, #0x2000\n"                   // + stack size for new task_PhySw so we don't have to do stack switch
 328       "B       sub_FFC2422C\n"          // Continue code
 329 "loc_FFC2423C:\n"
 330                         "B       sub_FFC2423C\n"    // Continue code
 331         );
 332 }
 334 //** task_Startup_my @ 0xFFC0FA8C
 336 void __attribute__((naked,noinline)) task_Startup_my() {
 337 asm volatile (
 338       "STMFD   SP!, {R4,LR} \n" 
 339       "BL      sub_FFC0650C \n" 
 340       "BL      sub_FFC25418 \n" 
 341       "BL      sub_FFC23638 \n" 
 342       "BL      sub_FFC2B744 \n" 
 343       "BL      sub_FFC2B930 \n" 
 344 //      "BL      sub_FFC2B7D8 \n" //Disable DISKBOOT.BIN
 345       "BL      sub_FFC2BACC \n" 
 346       "BL      sub_FFC222E4 \n" 
 347       "BL      sub_FFC2B960 \n" 
 348       "BL      sub_FFC290DC \n" 
 349                  "BL      CreateTask_spytask\n" // +
 350       "BL      sub_FFC2BAD0 \n" 
 351 //      "BL      sub_FFC24208 \n" //original taskcreate_PhySw()
 352       "BL      taskcreate_PhySw_my\n"   // +
 353       "BL      sub_FFC27744 \n" 
 354       "BL      sub_FFC2BAE8 \n" 
 355       "BL      sub_FFC216A8 \n" 
 356       "BL      sub_FFC23090 \n" 
 357       "BL      sub_FFC2B4E0 \n" 
 358       "BL      sub_FFC235EC \n" 
 359       "BL      sub_FFC2302C \n" 
 360       "BL      sub_FFC22318 \n" 
 361       "BL      sub_FFC2C528 \n" 
 362       "BL      sub_FFC23004 \n" 
 363       "LDMFD   SP!, {R4,LR} \n" 
 364       "B       sub_FFC0662C \n" 
 365     );
 366 }
 369 //** init_file_modules_task  @ 0xFFC77BF8 
 371 void __attribute__((naked,noinline)) init_file_modules_task(  ) { 
 372 asm volatile (
 373       "STMFD   SP!, {R4-R6,LR} \n"
 374       "BL      sub_FFC714C8 \n"
 375       "LDR     R5, =0x5006 \n"
 376       "MOVS    R4, R0 \n"
 377       "MOVNE   R1, #0 \n"
 378       "MOVNE   R0, R5 \n"
 379       "BLNE    sub_FFC73D80 \n"
 380 //      "BL      sub_FFC714F4 \n"  //original
 381       "BL      sub_FFC714F4_my \n"  //patched
 382       "BL      core_spytask_can_start\n"        // added
 383       "CMP     R4, #0 \n"
 384       "MOVEQ   R0, R5 \n"
 385       "LDMEQFD SP!, {R4-R6,LR} \n"
 386       "MOVEQ   R1, #0 \n"
 387       "BEQ     sub_FFC73D80 \n"
 388       "LDMFD   SP!, {R4-R6,PC} \n"
 389         );
 390 }
 393 //** sub_FFC714F4  @ 0xFFC714F4 
 395 void __attribute__((naked,noinline)) sub_FFC714F4_my() {
 396 asm volatile (
 397       "STMFD   SP!, {R4,LR} \n"
 398       "MOV     R0, #3 \n"
 399 //      "BL      sub_FFC556EC \n"  //original
 400       "BL      sub_FFC556EC_my\n"  //patched
 401       "BL      sub_FFD04AC8 \n"
 402       "LDR     R4, =0x2BD4 \n"
 403       "LDR     R0, [R4, #4] \n"
 404       "CMP     R0, #0 \n"
 405       "BNE     loc_FFC7152C \n"
 406       "BL      sub_FFC54934 \n"
 407       "BL      sub_FFCFB098 \n"
 408       "BL      sub_FFC54934 \n"
 409       "BL      sub_FFC513AC \n"
 410       "BL      sub_FFC54834 \n"
 411       "BL      sub_FFCFB12C \n"
 412 "loc_FFC7152C:\n"
 413       "MOV     R0, #1 \n"
 414       "STR     R0, [R4] \n"
 415       "LDMFD   SP!, {R4,PC} \n"
 416         );
 417 }
 420 //** sub_FFC556EC_my  @ 0xFFC556EC 
 422 void __attribute__((naked,noinline)) sub_FFC556EC_my(  ) { 
 423 asm volatile (
 424       "STMFD   SP!, {R4-R8,LR} \n"
 425       "MOV     R8, R0 \n"
 426       "BL      sub_FFC5566C \n"
 427       "LDR     R1, =0x33940 \n"
 428       "MOV     R6, R0 \n"
 429       "ADD     R4, R1, R0, LSL #7 \n"
 430       "LDR     R0, [R4, #0x6C] \n"
 431       "CMP     R0, #4 \n"
 432       "LDREQ   R1, =0x817 \n"
 433       "LDREQ   R0, =0xFFC551AC \n"
 434       "BLEQ    sub_FFC0EB14 \n"        // DebugAssert
 435       "MOV     R1, R8 \n"
 436       "MOV     R0, R6 \n"
 437       "BL      sub_FFC54F24 \n"
 438       "LDR     R0, [R4, #0x38] \n"
 439       "BL      sub_FFC55D8C \n"
 440       "CMP     R0, #0 \n"
 441       "STREQ   R0, [R4, #0x6C] \n"
 442       "MOV     R0, R6 \n"
 443       "BL      sub_FFC54FB4 \n"
 444       "MOV     R0, R6 \n"
 445 //      "BL      sub_FFC55314 \n"   //original
 446       "BL      sub_FFC55314_my \n"  //patched
 447       "MOV     R5, R0 \n"
 448       "MOV     R0, R6 \n"
 449       "BL      sub_FFC55544 \n"
 450       "LDR     R6, [R4, #0x3C] \n"
 451       "AND     R7, R5, R0 \n"
 452       "CMP     R6, #0 \n"
 453       "LDR     R1, [R4, #0x38] \n"
 454       "MOVEQ   R0, #0x80000001 \n"
 455       "MOV     R5, #0 \n"
 456       "BEQ     loc_FFC5579C \n"
 457       "MOV     R0, R1 \n"
 458       "BL      sub_FFC54A9C \n"
 459       "CMP     R0, #0 \n"
 460       "MOVNE   R5, #4 \n"
 461       "CMP     R6, #5 \n"
 462       "ORRNE   R0, R5, #1 \n"
 463       "BICEQ   R0, R5, #1 \n"
 464       "CMP     R7, #0 \n"
 465       "BICEQ   R0, R0, #2 \n"
 466       "ORREQ   R0, R0, #0x80000000 \n"
 467       "BICNE   R0, R0, #0x80000000 \n"
 468       "ORRNE   R0, R0, #2 \n"
 469 "loc_FFC5579C:\n"
 470       "CMP     R8, #7 \n"
 471       "STR     R0, [R4, #0x40] \n"
 472       "LDMNEFD SP!, {R4-R8,PC} \n"
 473       "MOV     R0, R8 \n"
 474       "BL      sub_FFC556BC \n"
 475       "CMP     R0, #0 \n"
 476       "LDMEQFD SP!, {R4-R8,LR} \n"
 477       "LDREQ   R0, =0xFFC557E8 \n"      // "EMEM MOUNT ERROR"
 478       "BEQ     sub_FFC0177C \n"         // qPrintf
 479       "LDMFD   SP!, {R4-R8,PC} \n"
 480         );
 481 }
 484 //** sub_FFC55314_my  @ 0xFFC55314 
 486 void __attribute__((naked,noinline)) sub_FFC55314_my(  ) { 
 487 asm volatile (
 488       "STMFD   SP!, {R4-R6,LR} \n"
 489       "MOV     R5, R0 \n"
 490       "LDR     R0, =0x33940 \n"
 491       "ADD     R4, R0, R5, LSL #7 \n"
 492       "LDR     R0, [R4, #0x6C] \n"
 493       "TST     R0, #2 \n"
 494       "MOVNE   R0, #1 \n"
 495       "LDMNEFD SP!, {R4-R6,PC} \n"
 496       "LDR     R0, [R4, #0x38] \n"
 497       "MOV     R1, R5 \n"
 498 //      "BL      sub_FFC55034 \n"        //original
 499       "BL       sub_FFC55034_my \n"          // patched
 500       "CMP     R0, #0 \n"
 501       "LDRNE   R0, [R4, #0x38] \n"
 502       "MOVNE   R1, R5 \n"
 503       "BLNE    sub_FFC551D0 \n"
 504       "LDR     R2, =0x339C0 \n"
 505       "ADD     R1, R5, R5, LSL #4 \n"
 506       "LDR     R1, [R2, R1, LSL #2] \n"
 507       "CMP     R1, #4 \n"
 508       "BEQ     loc_FFC55374 \n"
 509       "CMP     R0, #0 \n"
 510       "LDMEQFD SP!, {R4-R6,PC} \n"
 511       "MOV     R0, R5 \n"
 512       "BL      sub_FFC54B2C \n"
 513 "loc_FFC55374:\n"
 514       "CMP     R0, #0 \n"
 515       "LDRNE   R1, [R4, #0x6C] \n"
 516       "ORRNE   R1, R1, #2 \n"
 517       "STRNE   R1, [R4, #0x6C] \n"
 518       "LDMFD   SP!, {R4-R6,PC} \n"
 519         );
 520 }
 523 //** sub_FFC55034_my  @ 0xFFC55034 
 525 void __attribute__((naked,noinline)) sub_FFC55034_my(  ) { 
 526 asm volatile (
 527       "STMFD   SP!, {R4-R10,LR} \n"
 528       "MOV     R9, R0 \n"
 529       "LDR     R0, =0x33940 \n"
 530       "MOV     R8, #0 \n"
 531       "ADD     R5, R0, R1, LSL #7 \n"
 532       "LDR     R0, [R5, #0x3C] \n"
 533       "MOV     R7, #0 \n"
 534       "CMP     R0, #7 \n"
 535       "MOV     R6, #0 \n"
 536       "ADDLS   PC, PC, R0, LSL #2 \n"
 537       "B       loc_FFC5518C \n"
 538       "B       loc_FFC55098 \n"
 539       "B       loc_FFC55080 \n"
 540       "B       loc_FFC55080 \n"
 541       "B       loc_FFC55080 \n"
 542       "B       loc_FFC55080 \n"
 543       "B       loc_FFC55184 \n"
 544       "B       loc_FFC55080 \n"
 545       "B       loc_FFC55080 \n"
 546 "loc_FFC55080:\n"
 547       "MOV     R2, #0 \n"
 548       "MOV     R1, #0x200 \n"
 549       "MOV     R0, #2 \n"
 550       "BL      sub_FFC6B628 \n"
 551       "MOVS    R4, R0 \n"
 552       "BNE     loc_FFC550A0 \n"
 553 "loc_FFC55098:\n"
 554       "MOV     R0, #0 \n"
 555       "LDMFD   SP!, {R4-R10,PC} \n"
 556 "loc_FFC550A0:\n"
 557       "LDR     R12, [R5, #0x50] \n"
 558       "MOV     R3, R4 \n"
 559       "MOV     R2, #1 \n"
 560       "MOV     R1, #0 \n"
 561       "MOV     R0, R9 \n"
 562       "BLX     R12 \n"
 563       "CMP     R0, #1 \n"
 564       "BNE     loc_FFC550CC \n"
 565       "MOV     R0, #2 \n"
 566       "BL      sub_FFC6B774 \n"
 567       "B       loc_FFC55098 \n"
 568 "loc_FFC550CC:\n"
 569       "LDR     R1, [R5, #0x64] \n"
 570       "MOV     R0, R9 \n"
 571       "BLX     R1 \n"
 572 //------------------  begin added code ---------------
 573                 "MOV   R1, R4\n"           //  pointer to MBR in R1
 574                 "BL    mbr_read_dryos\n"   //  total sectors count in R0 before and after call
 576                 // Start of DataGhost's FAT32 autodetection code
 577                 // Policy: If there is a partition which has type W95 FAT32, use the first one of those for image storage
 578                 // According to the code below, we can use R1, R2, R3 and R12.
 579                 // LR wasn't really used anywhere but for storing a part of the partition signature. This is the only thing
 580                 // that won't work with an offset, but since we can load from LR+offset into LR, we can use this to do that :)
 581                 "MOV     R12, R4\n"                    // Copy the MBR start address so we have something to work with
 582                 "MOV     LR, R4\n"                     // Save old offset for MBR signature
 583                 "MOV     R1, #1\n"                     // Note the current partition number
 584                 "B       dg_sd_fat32_enter\n"          // We actually need to check the first partition as well, no increments yet!
 585    "dg_sd_fat32:\n"
 586                 "CMP     R1, #4\n"                     // Did we already see the 4th partition?
 587                 "BEQ     dg_sd_fat32_end\n"            // Yes, break. We didn't find anything, so don't change anything.
 588                 "ADD     R12, R12, #0x10\n"            // Second partition
 589                 "ADD     R1, R1, #1\n"                 // Second partition for the loop
 590    "dg_sd_fat32_enter:\n"
 591                 "LDRB    R2, [R12, #0x1BE]\n"          // Partition status
 592                 "LDRB    R3, [R12, #0x1C2]\n"          // Partition type (FAT32 = 0xB)
 593                 "CMP     R3, #0xB\n"                   // Is this a FAT32 partition?
 594                 "CMPNE   R3, #0xC\n"                   // Not 0xB, is it 0xC (FAT32 LBA) then?
 595                 "BNE     dg_sd_fat32\n"                // No, it isn't.
 596                 "CMP     R2, #0x00\n"                  // It is, check the validity of the partition type
 597                 "CMPNE   R2, #0x80\n"
 598                 "BNE     dg_sd_fat32\n"                // Invalid, go to next partition
 599                                                                                            // This partition is valid, it's the first one, bingo!
 600                 "MOV     R4, R12\n"                    // Move the new MBR offset for the partition detection.
 602    "dg_sd_fat32_end:\n"
 603                 // End of DataGhost's FAT32 autodetection code
 604 //------------------  end added code ---------------
 606       "LDRB    R1, [R4, #0x1C9] \n"
 607       "LDRB    R3, [R4, #0x1C8] \n"
 608       "LDRB    R12, [R4, #0x1CC] \n"
 609       "MOV     R1, R1, LSL #0x18 \n"
 610       "ORR     R1, R1, R3, LSL #0x10 \n"
 611       "LDRB    R3, [R4, #0x1C7] \n"
 612       "LDRB    R2, [R4, #0x1BE] \n"
 613 // "            LDRB    LR, [R4,#0x1FF]\n"       // replaced, see below
 614       "ORR     R1, R1, R3, LSL #8 \n"
 615       "LDRB    R3, [R4, #0x1C6] \n"
 616       "CMP     R2, #0 \n"
 617       "CMPNE   R2, #0x80 \n"
 618       "ORR     R1, R1, R3 \n"
 619       "LDRB    R3, [R4, #0x1CD] \n"
 620       "MOV     R3, R3, LSL #0x18 \n"
 621       "ORR     R3, R3, R12, LSL #0x10 \n"
 622       "LDRB    R12, [R4, #0x1CB] \n"
 623       "ORR     R3, R3, R12, LSL #8 \n"
 624       "LDRB    R12, [R4, #0x1CA] \n"
 625       "ORR     R3, R3, R12 \n"
 626 //      "LDRB    R12, [R4, #0x1FE] \n"
 627           "LDRB    R12, [LR,#0x1FE]\n"        //added First MBR signature byte (0x55)
 628       "LDRB    LR, [LR,#0x1FF]\n"         //added Last MBR signature byte (0xAA)
 629       "BNE     loc_FFC55158 \n"
 630       "CMP     R0, R1 \n"
 631       "BCC     loc_FFC55158 \n"
 632       "ADD     R2, R1, R3 \n"
 633       "CMP     R2, R0 \n"
 634       "CMPLS   R12, #0x55 \n"
 635       "CMPEQ   LR, #0xAA \n"
 636       "MOVEQ   R7, R1 \n"
 637       "MOVEQ   R6, R3 \n"
 638       "MOVEQ   R4, #1 \n"
 639       "BEQ     loc_FFC5515C \n"
 640 "loc_FFC55158:\n"
 641       "MOV     R4, R8 \n"
 642 "loc_FFC5515C:\n"
 643       "MOV     R0, #2 \n"
 644       "BL      sub_FFC6B774 \n"
 645       "CMP     R4, #0 \n"
 646       "BNE     loc_FFC55198 \n"
 647       "LDR     R1, [R5, #0x64] \n"
 648       "MOV     R7, #0 \n"
 649       "MOV     R0, R9 \n"
 650       "BLX     R1 \n"
 651       "MOV     R6, R0 \n"
 652       "B       loc_FFC55198 \n"
 653 "loc_FFC55184:\n"
 654       "MOV     R6, #0x40 \n"
 655       "B       loc_FFC55198 \n"
 656 "loc_FFC5518C:\n"
 657       "LDR     R1, =0x572 \n"
 658       "LDR     R0, =0xFFC551AC \n" // "Mounter.c"
 659       "BL      sub_FFC0EB14 \n"    // DebugAssert
 660 "loc_FFC55198:\n"
 661       "STR     R7, [R5, #0x44]! \n"
 662       "STMIB   R5, {R6,R8} \n"
 663       "MOV     R0, #1 \n"
 664       "LDMFD   SP!, {R4-R10,PC} \n"
 665         );
 666 }