root/platform/ixus105_sd1300/sub/100b/boot.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. taskHook
  2. CreateTask_spytask
  3. boot
  4. sub_FFC00354_my
  5. sub_FFC01198_my
  6. sub_FFC05E58_my
  7. taskcreate_Startup_my
  8. taskcreate_PhySw_my
  9. task_Startup_my
  10. init_file_modules_task
  11. sub_FFC714A4_my
  12. sub_FFC556EC_my
  13. sub_FFC55314_my
  14. sub_FFC55034_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 #include "dryos31.h"
   5 
   6 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
   7 
   8 const char * const new_sa = &_end;
   9 
  10 extern void task_PhySw();
  11 extern void task_CaptSeq();
  12 extern void task_InitFileModules();
  13 extern void task_RotaryEncoder();
  14 extern void task_MovieRecord();
  15 extern void task_ExpDrv();
  16 extern void task_FileWrite();
  17 
  18 void taskHook(context_t **context)
  19 { 
  20         task_t *tcb=(task_t*)((char*)context-offsetof(task_t, context));
  21         // Replace firmware task addresses with ours
  22         if(tcb->entry == (void*)task_PhySw)             tcb->entry = (void*)mykbd_task; 
  23         if(tcb->entry == (void*)task_CaptSeq)                   tcb->entry = (void*)capt_seq_task; 
  24         if(tcb->entry == (void*)task_InitFileModules)   tcb->entry = (void*)init_file_modules_task;
  25         if(tcb->entry == (void*)task_MovieRecord)               tcb->entry = (void*)movie_record_task;
  26         if(tcb->entry == (void*)task_ExpDrv)                    tcb->entry = (void*)exp_drv_task;
  27     if(tcb->entry == (void*)task_FileWrite)         tcb->entry = (void*)filewritetask;
  28 }
  29 
  30 void CreateTask_spytask() {
  31         _CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);
  32 };
  33 
  34 //** boot  @ 0xFFC0000C 
  35 
  36 void __attribute__((naked,noinline)) boot(  ) { 
  37 asm volatile (
  38       "LDR     R1, =0xC0410000 \n"
  39       "MOV     R0, #0 \n"
  40       "STR     R0, [R1] \n"
  41       "MOV     R1, #0x78 \n"
  42       "MCR     p15, 0, R1, c1, c0 \n"
  43       "MOV     R1, #0 \n"
  44       "MCR     p15, 0, R1, c7, c10, 4 \n"
  45       "MCR     p15, 0, R1, c7, c5 \n"
  46       "MCR     p15, 0, R1, c7, c6 \n"
  47       "MOV     R0, #0x3D \n"
  48       "MCR     p15, 0, R0, c6, c0 \n"
  49       "MOV     R0, #0xC000002F \n"
  50       "MCR     p15, 0, R0, c6, c1 \n"
  51       "MOV     R0, #0x33 \n"
  52       "MCR     p15, 0, R0, c6, c2 \n"
  53       "MOV     R0, #0x40000033 \n"
  54       "MCR     p15, 0, R0, c6, c3 \n"
  55       "MOV     R0, #0x80000017 \n"
  56       "MCR     p15, 0, R0, c6, c4 \n"
  57       "LDR     R0, =0xFFC0002B \n"
  58       "MCR     p15, 0, R0, c6, c5 \n"
  59       "MOV     R0, #0x34 \n"
  60       "MCR     p15, 0, R0, c2, c0 \n"
  61       "MOV     R0, #0x34 \n"
  62       "MCR     p15, 0, R0, c2, c0, 1 \n"
  63       "MOV     R0, #0x34 \n"
  64       "MCR     p15, 0, R0, c3, c0 \n"
  65       "LDR     R0, =0x3333330 \n"
  66       "MCR     p15, 0, R0, c5, c0, 2 \n"
  67       "LDR     R0, =0x3333330 \n"
  68       "MCR     p15, 0, R0, c5, c0, 3 \n"
  69       "MRC     p15, 0, R0, c1, c0 \n"
  70       "ORR     R0, R0, #0x1000 \n"
  71       "ORR     R0, R0, #4 \n"
  72       "ORR     R0, R0, #1 \n"
  73       "MCR     p15, 0, R0, c1, c0 \n"
  74       "MOV     R1, #0x80000006 \n"
  75       "MCR     p15, 0, R1, c9, c1 \n"
  76       "MOV     R1, #6 \n"
  77       "MCR     p15, 0, R1, c9, c1, 1 \n"
  78       "MRC     p15, 0, R1, c1, c0 \n"
  79       "ORR     R1, R1, #0x50000 \n"
  80       "MCR     p15, 0, R1, c1, c0 \n"
  81       "LDR     R2, =0xC0200000 \n"
  82       "MOV     R1, #1 \n"
  83       "STR     R1, [R2, #0x10C] \n"
  84       "MOV     R1, #0xFF \n"
  85       "STR     R1, [R2, #0xC] \n"
  86       "STR     R1, [R2, #0x1C] \n"
  87       "STR     R1, [R2, #0x2C] \n"
  88       "STR     R1, [R2, #0x3C] \n"
  89       "STR     R1, [R2, #0x4C] \n"
  90       "STR     R1, [R2, #0x5C] \n"
  91       "STR     R1, [R2, #0x6C] \n"
  92       "STR     R1, [R2, #0x7C] \n"
  93       "STR     R1, [R2, #0x8C] \n"
  94       "STR     R1, [R2, #0x9C] \n"
  95       "STR     R1, [R2, #0xAC] \n"
  96       "STR     R1, [R2, #0xBC] \n"
  97       "STR     R1, [R2, #0xCC] \n"
  98       "STR     R1, [R2, #0xDC] \n"
  99       "STR     R1, [R2, #0xEC] \n"
 100       "STR     R1, [R2, #0xFC] \n"
 101       "LDR     R1, =0xC0400008 \n"
 102       "LDR     R2, =0x430005 \n"
 103       "STR     R2, [R1] \n"
 104       "MOV     R1, #1 \n"
 105       "LDR     R2, =0xC0243100 \n"
 106       "STR     R2, [R1] \n"
 107       "LDR     R2, =0xC0242010 \n"
 108       "LDR     R1, [R2] \n"
 109       "ORR     R1, R1, #1 \n"
 110       "STR     R1, [R2] \n"
 111       "LDR     R0, =0xFFF1636C \n"
 112       "LDR     R1, =0x1900 \n"
 113       "LDR     R3, =0xB4B8 \n"
 114 "loc_FFC0013C:\n"
 115       "CMP     R1, R3 \n"
 116       "LDRCC   R2, [R0], #4 \n"
 117       "STRCC   R2, [R1], #4 \n"
 118       "BCC     loc_FFC0013C \n"
 119       "LDR     R1, =0x12E9FC \n"
 120       "MOV     R2, #0 \n"
 121 "loc_FFC00154:\n"
 122       "CMP     R3, R1 \n"
 123       "STRCC   R2, [R3], #4 \n"
 124       "BCC     loc_FFC00154 \n"
 125 //      "B       sub_FFC00354 \n"  //original
 126       "B       sub_FFC00354_my \n" //patched
 127         );
 128 }
 129 
 130 //** sub_FFC00354_my  @ 0xFFC00354 
 131 
 132 void __attribute__((naked,noinline)) sub_FFC00354_my(  ) { 
 133    //*(int*)0x1934=(int)taskHook;
 134    *(int*)0x1938=(int)taskHook;
 135    *(int*)(0x221c+4)= (*(int*)0xc0220024)&1 ? 0x200000 : 0x100000; // replacement for correct power-on. ffc477a0
 136 asm volatile (
 137       "LDR     R0, =0xFFC003CC \n"
 138       "MOV     R1, #0 \n"
 139       "LDR     R3, =0xFFC00404 \n"
 140 "loc_FFC00360:\n"
 141       "CMP     R0, R3 \n"
 142       "LDRCC   R2, [R0], #4 \n"
 143       "STRCC   R2, [R1], #4 \n"
 144       "BCC     loc_FFC00360 \n"
 145       "LDR     R0, =0xFFC00404 \n"
 146       "MOV     R1, #0x4B0 \n"
 147       "LDR     R3, =0xFFC00618 \n"
 148 "loc_FFC0037C:\n"
 149       "CMP     R0, R3 \n"
 150       "LDRCC   R2, [R0], #4 \n"
 151       "STRCC   R2, [R1], #4 \n"
 152       "BCC     loc_FFC0037C \n"
 153       "MOV     R0, #0xD2 \n"
 154       "MSR     CPSR_cxsf, R0 \n"
 155       "MOV     SP, #0x1000 \n"
 156       "MOV     R0, #0xD3 \n"
 157       "MSR     CPSR_cxsf, R0 \n"
 158       "MOV     SP, #0x1000 \n"
 159       "LDR     R0, =0x6C4 \n"
 160       "LDR     R2, =0xEEEEEEEE \n"
 161       "MOV     R3, #0x1000 \n"
 162 "loc_FFC003B0:\n"
 163       "CMP     R0, R3 \n"
 164       "STRCC   R2, [R0], #4 \n"
 165       "BCC     loc_FFC003B0 \n"
 166 //      "BL      sub_FFC01198 \n"  //original
 167       "BL      sub_FFC01198_my \n" //patched
 168         );
 169 }
 170 
 171 //** sub_FFC01198_my  @ 0xFFC01198 
 172 
 173 void __attribute__((naked,noinline)) sub_FFC01198_my(  ) { 
 174 asm volatile (
 175       "STR     LR, [SP, #-4]! \n"
 176       "SUB     SP, SP, #0x74 \n"
 177       "MOV     R0, SP \n"
 178       "MOV     R1, #0x74 \n"
 179       "BL      sub_FFEA2FA0 \n"
 180       "MOV     R0, #0x53000 \n"
 181       "STR     R0, [SP, #4] \n"
 182 #if defined(CHDK_NOT_IN_CANON_HEAP)
 183       "LDR     R0, =0x12E9FC \n" // MEMISOSTART: Use original heap offset since CHDK is loaded in high memory
 184 #else
 185                  "LDR     R0, =new_sa\n"        // + remove the line ^ if using these two
 186                  "LDR     R0, [R0]\n"           // + this is related to chdk size
 187 #endif
 188       "LDR     R2, =0x2F9C00 \n"
 189       "LDR     R1, =0x2F24A8 \n"
 190       "STR     R0, [SP, #8] \n"
 191       "SUB     R0, R1, R0 \n"
 192       "ADD     R3, SP, #0xC \n"
 193       "STR     R2, [SP] \n"
 194       "STMIA   R3, {R0-R2} \n"
 195       "MOV     R0, #0x22 \n"
 196       "STR     R0, [SP, #0x18] \n"
 197       "MOV     R0, #0x68 \n"
 198       "STR     R0, [SP, #0x1C] \n"
 199       "LDR     R0, =0x19B \n"
 200 //      "LDR     R1, =0xFFC05E58 \n"     //original
 201       "LDR     R1, =sub_FFC05E58_my \n"  //patched
 202       "STR     R0, [SP, #0x20] \n"
 203       "MOV     R0, #0x96 \n"
 204       "STR     R0, [SP, #0x24] \n"
 205       "MOV     R0, #0x78 \n"
 206       "STR     R0, [SP, #0x28] \n"
 207       "MOV     R0, #0x64 \n"
 208       "STR     R0, [SP, #0x2C] \n"
 209       "MOV     R0, #0 \n"
 210       "STR     R0, [SP, #0x30] \n"
 211       "STR     R0, [SP, #0x34] \n"
 212       "MOV     R0, #0x10 \n"
 213       "STR     R0, [SP, #0x5C] \n"
 214       "MOV     R0, #0x800 \n"
 215       "STR     R0, [SP, #0x60] \n"
 216       "MOV     R0, #0xA0 \n"
 217       "STR     R0, [SP, #0x64] \n"
 218       "MOV     R0, #0x280 \n"
 219       "STR     R0, [SP, #0x68] \n"
 220       "MOV     R0, SP \n"
 221       "MOV     R2, #0 \n"
 222       "BL      sub_FFC03404 \n"
 223       "ADD     SP, SP, #0x74 \n"
 224       "LDR     PC, [SP], #4 \n"
 225         );
 226 }
 227 
 228 
 229 //** sub_FFC05E58_my  @ 0xFFC05E58 
 230 
 231 void __attribute__((naked,noinline)) sub_FFC05E58_my(  ) { 
 232 asm volatile (
 233       "STMFD   SP!, {R4,LR} \n"
 234       "BL      sub_FFC00B20 \n"
 235       "BL      sub_FFC0A244 \n"
 236       "CMP     R0, #0 \n"
 237       "LDRLT   R0, =0xFFC05F6C \n"
 238       "BLLT    sub_FFC05F4C \n"
 239       "BL      sub_FFC05A94 \n"
 240       "CMP     R0, #0 \n"
 241       "LDRLT   R0, =0xFFC05F74 \n"
 242       "BLLT    sub_FFC05F4C \n"
 243       "LDR     R0, =0xFFC05F84 \n"
 244       "BL      sub_FFC05B7C \n"
 245       "CMP     R0, #0 \n"
 246       "LDRLT   R0, =0xFFC05F8C \n"
 247       "BLLT    sub_FFC05F4C \n"
 248       "LDR     R0, =0xFFC05F84 \n"
 249       "BL      sub_FFC03BF0 \n"
 250       "CMP     R0, #0 \n"
 251       "LDRLT   R0, =0xFFC05FA0 \n"
 252       "BLLT    sub_FFC05F4C \n"
 253       "BL      sub_FFC09C3C \n"
 254       "CMP     R0, #0 \n"
 255       "LDRLT   R0, =0xFFC05FAC \n"
 256       "BLLT    sub_FFC05F4C \n"
 257       "BL      sub_FFC0167C \n"
 258       "CMP     R0, #0 \n"
 259       "LDRLT   R0, =0xFFC05FB8 \n"
 260       "BLLT    sub_FFC05F4C \n"
 261       "LDMFD   SP!, {R4,LR} \n"
 262 //      "B       sub_FFC0FAF0 \n"       //original
 263       "B       taskcreate_Startup_my\n" //patched
 264         );
 265 }
 266 
 267 //** taskcreate_Startup_my  @ 0xFFC0FAF0 
 268 
 269 void __attribute__((naked,noinline)) taskcreate_Startup_my(  ) { 
 270 asm volatile (
 271       "STMFD   SP!, {R3,LR} \n"
 272       "BL      sub_FFC24318 \n"
 273       "BL      sub_FFC2B704 \n"
 274       "CMP     R0, #0 \n"
 275       "BNE     loc_FFC0FB34 \n"
 276       "BL      sub_FFC25B08 \n"
 277       "CMP     R0, #0 \n"
 278       "BEQ     loc_FFC0FB34 \n"
 279       "BL      sub_FFC24314 \n"
 280       "CMP     R0, #0 \n"
 281       "BNE     loc_FFC0FB34 \n"
 282       "BL      sub_FFC239E4 \n"
 283       "LDR     R1, =0xC0220000 \n"
 284       "MOV     R0, #0x44 \n"
 285       "STR     R0, [R1, #0x1C] \n"
 286       "BL      sub_FFC23BD0 \n"
 287 "loc_FFC0FB30:\n"
 288       "B       loc_FFC0FB30 \n"
 289 "loc_FFC0FB34:\n"
 290       //"BL      sub_FFC24320 \n"      // hijack power-on
 291       "BL      sub_FFC2431C \n"
 292       "BL      sub_FFC29938 \n"
 293       "LDR     R1, =0x34E000 \n"
 294       "MOV     R0, #0 \n"
 295       "BL      sub_FFC29D80 \n"
 296       "BL      sub_FFC29B2C \n"
 297       "MOV     R3, #0 \n"
 298       "STR     R3, [SP] \n"
 299       //"LDR     R3, =0xFFC0FA8C \n"
 300       "LDR     R3, =task_Startup_my\n"  //-------->
 301       "MOV     R2, #0 \n"
 302       "MOV     R1, #0x19 \n"
 303       "LDR     R0, =0xFFC0FB7C \n"
 304       "BL      sub_FFC0E83C \n"
 305       "MOV     R0, #0 \n"
 306       "LDMFD   SP!, {R12,PC} \n"
 307         );
 308 }
 309 
 310 //** taskcreate_PhySw_my  @ 0xFFC24208
 311 
 312 void __attribute__((naked,noinline)) taskcreate_PhySw_my() {
 313 asm volatile (
 314       "STMFD   SP!, {R3-R5,LR} \n"
 315       "LDR     R4, =0x1C20 \n"
 316       "LDR     R0, [R4, #0x10] \n"
 317       "CMP     R0, #0 \n"
 318       "BNE     loc_FFC2423C \n"
 319       "MOV     R3, #0 \n"
 320       "STR     R3, [SP] \n"
 321       //"LDR     R3, =0xFFC241D4 \n"    //original
 322       "LDR     R3, =mykbd_task\n"               //patched
 323       //"MOV     R2, #0x800 \n"
 324       "MOV     R2, #0x2000\n"                   // + stack size for new task_PhySw so we don't have to do stack switch
 325       "B       sub_FFC2422C\n"    // Continue code
 326 "loc_FFC2423C:\n"
 327       "B       sub_FFC2423C\n"    // Continue code
 328         );
 329 }
 330 
 331 //** task_Startup_my  @ 0xFFC0FA8C
 332 
 333 void __attribute__((naked,noinline)) task_Startup_my(  ) { 
 334 asm volatile (
 335       "STMFD   SP!, {R4,LR} \n"
 336       "BL      sub_FFC0650C \n"
 337       "BL      sub_FFC25418 \n"
 338       "BL      sub_FFC23638 \n"
 339       "BL      sub_FFC2B744 \n"
 340       "BL      sub_FFC2B930 \n"
 341       //"BL      sub_FFC2B7D8 \n"    //Disable DISKBOOT.BIN
 342       "BL      sub_FFC2BACC \n"
 343       "BL      sub_FFC222E4 \n"
 344       "BL      sub_FFC2B960 \n"
 345       "BL      sub_FFC290DC \n"
 346       "BL      CreateTask_spytask\n" // +
 347       "BL      sub_FFC2BAD0 \n"
 348 //      "BL      sub_FFC24208 \n" //original taskcreate_PhySw()
 349       "BL      taskcreate_PhySw_my\n"   // +
 350       "BL      sub_FFC27744 \n"
 351       "BL      sub_FFC2BAE8 \n"
 352       "BL      sub_FFC216A8 \n"
 353       "BL      sub_FFC23090 \n"
 354       "BL      sub_FFC2B4E0 \n"
 355       "BL      sub_FFC235EC \n"
 356       "BL      sub_FFC2302C \n"
 357       "BL      sub_FFC22318 \n"
 358       "BL      sub_FFC2C528 \n"
 359       "BL      sub_FFC23004 \n"
 360       "LDMFD   SP!, {R4,LR} \n"
 361       "B       sub_FFC0662C \n"
 362         );
 363 }
 364 
 365 
 366 //** init_file_modules_task  @ 0xFFC77BA8 
 367 
 368 void __attribute__((naked,noinline)) init_file_modules_task() {
 369 asm volatile (
 370       "STMFD   SP!, {R4-R6,LR} \n"
 371       "BL      sub_FFC71478 \n"
 372       "LDR     R5, =0x5006 \n"
 373       "MOVS    R4, R0 \n"
 374       "MOVNE   R1, #0 \n"
 375       "MOVNE   R0, R5 \n"
 376       "BLNE    sub_FFC73D30 \n"
 377 //      "BL      sub_FFC714A4 \n"  //original
 378       "BL      sub_FFC714A4_my \n"  //patched
 379       "BL      core_spytask_can_start\n"        // added
 380       "CMP     R4, #0 \n"
 381       "MOVEQ   R0, R5 \n"
 382       "LDMEQFD SP!, {R4-R6,LR} \n"
 383       "MOVEQ   R1, #0 \n"
 384       "BEQ     sub_FFC73D30 \n"
 385       "LDMFD   SP!, {R4-R6,PC} \n"
 386         );
 387 }
 388 
 389 
 390 //** sub_FFC714A4  @ 0xFFC714A4 
 391 
 392 void __attribute__((naked,noinline)) sub_FFC714A4_my() {
 393 asm volatile (
 394       "STMFD   SP!, {R4,LR} \n"
 395       "MOV     R0, #3 \n"
 396 //      "BL      sub_FFC556EC \n"  //original
 397       "BL      sub_FFC556EC_my\n"  //patched
 398       "BL      sub_FFD04A78 \n"
 399       "LDR     R4, =0x2BD4 \n"
 400       "LDR     R0, [R4, #4] \n"
 401       "CMP     R0, #0 \n"
 402       "BNE     loc_FFC714DC \n"
 403       "BL      sub_FFC54934 \n"
 404       "BL      sub_FFCFB048 \n"
 405       "BL      sub_FFC54934 \n"
 406       "BL      sub_FFC513AC \n"
 407       "BL      sub_FFC54834 \n"
 408       "BL      sub_FFCFB0DC \n"
 409 "loc_FFC714DC:\n"
 410       "MOV     R0, #1 \n"
 411       "STR     R0, [R4] \n"
 412       "LDMFD   SP!, {R4,PC} \n"
 413         );
 414 }
 415 
 416 
 417 //** sub_FFC556EC_my  @ 0xFFC556EC
 418 
 419 void __attribute__((naked,noinline)) sub_FFC556EC_my() {
 420 asm volatile (
 421       "STMFD   SP!, {R4-R8,LR} \n"
 422       "MOV     R8, R0 \n"
 423       "BL      sub_FFC5566C \n"
 424       "LDR     R1, =0x33940 \n"
 425       "MOV     R6, R0 \n"
 426       "ADD     R4, R1, R0, LSL #7 \n"
 427       "LDR     R0, [R4, #0x6C] \n"
 428       "CMP     R0, #4 \n"
 429       "LDREQ   R1, =0x817 \n"
 430       "LDREQ   R0, =0xFFC551AC \n"
 431       "BLEQ    sub_FFC0EB14 \n"        // DebugAssert
 432       "MOV     R1, R8 \n"
 433       "MOV     R0, R6 \n"
 434       "BL      sub_FFC54F24 \n"
 435       "LDR     R0, [R4, #0x38] \n"
 436       "BL      sub_FFC55D8C \n"
 437       "CMP     R0, #0 \n"
 438       "STREQ   R0, [R4, #0x6C] \n"
 439       "MOV     R0, R6 \n"
 440       "BL      sub_FFC54FB4 \n"
 441       "MOV     R0, R6 \n"
 442 //      "BL      sub_FFC55314 \n"   //original
 443       "BL      sub_FFC55314_my \n"  //patched
 444       "MOV     R5, R0 \n"
 445       "MOV     R0, R6 \n"
 446       "BL      sub_FFC55544 \n"
 447       "LDR     R6, [R4, #0x3C] \n"
 448       "AND     R7, R5, R0 \n"
 449       "CMP     R6, #0 \n"
 450       "LDR     R1, [R4, #0x38] \n"
 451       "MOVEQ   R0, #0x80000001 \n"
 452       "MOV     R5, #0 \n"
 453       "BEQ     loc_FFC5579C \n"
 454       "MOV     R0, R1 \n"
 455       "BL      sub_FFC54A9C \n"
 456       "CMP     R0, #0 \n"
 457       "MOVNE   R5, #4 \n"
 458       "CMP     R6, #5 \n"
 459       "ORRNE   R0, R5, #1 \n"
 460       "BICEQ   R0, R5, #1 \n"
 461       "CMP     R7, #0 \n"
 462       "BICEQ   R0, R0, #2 \n"
 463       "ORREQ   R0, R0, #0x80000000 \n"
 464       "BICNE   R0, R0, #0x80000000 \n"
 465       "ORRNE   R0, R0, #2 \n"
 466 "loc_FFC5579C:\n"
 467       "CMP     R8, #7 \n"
 468       "STR     R0, [R4, #0x40] \n"
 469       "LDMNEFD SP!, {R4-R8,PC} \n"
 470       "MOV     R0, R8 \n"
 471       "BL      sub_FFC556BC \n"
 472       "CMP     R0, #0 \n"
 473       "LDMEQFD SP!, {R4-R8,LR} \n"
 474       "LDREQ   R0, =0xFFC557E8 \n"      // "EMEM MOUNT ERROR"
 475       "BEQ     sub_FFC0177C \n"         // qPrintf
 476       "LDMFD   SP!, {R4-R8,PC} \n"
 477         );
 478 }
 479 
 480 
 481 //** sub_FFC55314_my  @ 0xFFC55314
 482 
 483 void __attribute__((naked,noinline)) sub_FFC55314_my() {
 484 asm volatile (
 485       "STMFD   SP!, {R4-R6,LR} \n"
 486       "MOV     R5, R0 \n"
 487       "LDR     R0, =0x33940 \n"
 488       "ADD     R4, R0, R5, LSL #7 \n"
 489       "LDR     R0, [R4, #0x6C] \n"
 490       "TST     R0, #2 \n"
 491       "MOVNE   R0, #1 \n"
 492       "LDMNEFD SP!, {R4-R6,PC} \n"
 493       "LDR     R0, [R4, #0x38] \n"
 494       "MOV     R1, R5 \n"
 495 //      "BL      sub_FFC55034 \n"        //original
 496       "BL       sub_FFC55034_my \n"          // patched
 497       "CMP     R0, #0 \n"
 498       "LDRNE   R0, [R4, #0x38] \n"
 499       "MOVNE   R1, R5 \n"
 500       "BLNE    sub_FFC551D0 \n"
 501       "LDR     R2, =0x339C0 \n"
 502       "ADD     R1, R5, R5, LSL #4 \n"
 503       "LDR     R1, [R2, R1, LSL #2] \n"
 504       "CMP     R1, #4 \n"
 505       "BEQ     loc_FFC55374 \n"
 506       "CMP     R0, #0 \n"
 507       "LDMEQFD SP!, {R4-R6,PC} \n"
 508       "MOV     R0, R5 \n"
 509       "BL      sub_FFC54B2C \n"
 510 "loc_FFC55374:\n"
 511       "CMP     R0, #0 \n"
 512       "LDRNE   R1, [R4, #0x6C] \n"
 513       "ORRNE   R1, R1, #2 \n"
 514       "STRNE   R1, [R4, #0x6C] \n"
 515       "LDMFD   SP!, {R4-R6,PC} \n"
 516         );
 517 }
 518 
 519 
 520 //** sub_FFC55034_my  @ 0xFFC55034
 521 
 522 void __attribute__((naked,noinline)) sub_FFC55034_my() {
 523 asm volatile (
 524       "STMFD   SP!, {R4-R10,LR} \n"
 525       "MOV     R9, R0 \n"
 526       "LDR     R0, =0x33940 \n"
 527       "MOV     R8, #0 \n"
 528       "ADD     R5, R0, R1, LSL #7 \n"
 529       "LDR     R0, [R5, #0x3C] \n"
 530       "MOV     R7, #0 \n"
 531       "CMP     R0, #7 \n"
 532       "MOV     R6, #0 \n"
 533       "ADDLS   PC, PC, R0, LSL #2 \n"
 534       "B       loc_FFC5518C \n"
 535       "B       loc_FFC55098 \n"
 536       "B       loc_FFC55080 \n"
 537       "B       loc_FFC55080 \n"
 538       "B       loc_FFC55080 \n"
 539       "B       loc_FFC55080 \n"
 540       "B       loc_FFC55184 \n"
 541       "B       loc_FFC55080 \n"
 542       "B       loc_FFC55080 \n"
 543 "loc_FFC55080:\n"
 544       "MOV     R2, #0 \n"
 545       "MOV     R1, #0x200 \n"
 546       "MOV     R0, #2 \n"
 547       "BL      sub_FFC6B5D8 \n"
 548       "MOVS    R4, R0 \n"
 549       "BNE     loc_FFC550A0 \n"
 550 "loc_FFC55098:\n"
 551       "MOV     R0, #0 \n"
 552       "LDMFD   SP!, {R4-R10,PC} \n"
 553 "loc_FFC550A0:\n"
 554       "LDR     R12, [R5, #0x50] \n"
 555       "MOV     R3, R4 \n"
 556       "MOV     R2, #1 \n"
 557       "MOV     R1, #0 \n"
 558       "MOV     R0, R9 \n"
 559       "BLX     R12 \n"
 560       "CMP     R0, #1 \n"
 561       "BNE     loc_FFC550CC \n"
 562       "MOV     R0, #2 \n"
 563       "BL      sub_FFC6B724 \n"
 564       "B       loc_FFC55098 \n"
 565 "loc_FFC550CC:\n"
 566       "LDR     R1, [R5, #0x64] \n"
 567       "MOV     R0, R9 \n"
 568       "BLX     R1 \n"
 569 //------------------  begin added code ---------------
 570                 "MOV   R1, R4\n"           //  pointer to MBR in R1
 571                 "BL    mbr_read_dryos\n"   //  total sectors count in R0 before and after call
 572 
 573                 // Start of DataGhost's FAT32 autodetection code
 574                 // Policy: If there is a partition which has type W95 FAT32, use the first one of those for image storage
 575                 // According to the code below, we can use R1, R2, R3 and R12.
 576                 // LR wasn't really used anywhere but for storing a part of the partition signature. This is the only thing
 577                 // that won't work with an offset, but since we can load from LR+offset into LR, we can use this to do that :)
 578                 "MOV     R12, R4\n"                    // Copy the MBR start address so we have something to work with
 579                 "MOV     LR, R4\n"                     // Save old offset for MBR signature
 580                 "MOV     R1, #1\n"                     // Note the current partition number
 581                 "B       dg_sd_fat32_enter\n"          // We actually need to check the first partition as well, no increments yet!
 582    "dg_sd_fat32:\n"
 583                 "CMP     R1, #4\n"                     // Did we already see the 4th partition?
 584                 "BEQ     dg_sd_fat32_end\n"            // Yes, break. We didn't find anything, so don't change anything.
 585                 "ADD     R12, R12, #0x10\n"            // Second partition
 586                 "ADD     R1, R1, #1\n"                 // Second partition for the loop
 587    "dg_sd_fat32_enter:\n"
 588                 "LDRB    R2, [R12, #0x1BE]\n"          // Partition status
 589                 "LDRB    R3, [R12, #0x1C2]\n"          // Partition type (FAT32 = 0xB)
 590                 "CMP     R3, #0xB\n"                   // Is this a FAT32 partition?
 591                 "CMPNE   R3, #0xC\n"                   // Not 0xB, is it 0xC (FAT32 LBA) then?
 592                 "BNE     dg_sd_fat32\n"                // No, it isn't.
 593                 "CMP     R2, #0x00\n"                  // It is, check the validity of the partition type
 594                 "CMPNE   R2, #0x80\n"
 595                 "BNE     dg_sd_fat32\n"                // Invalid, go to next partition
 596                                                                                            // This partition is valid, it's the first one, bingo!
 597                 "MOV     R4, R12\n"                    // Move the new MBR offset for the partition detection.
 598 
 599    "dg_sd_fat32_end:\n"
 600                 // End of DataGhost's FAT32 autodetection code
 601 //------------------  end added code ---------------
 602 
 603       "LDRB    R1, [R4, #0x1C9] \n"
 604       "LDRB    R3, [R4, #0x1C8] \n"
 605       "LDRB    R12, [R4, #0x1CC] \n"
 606       "MOV     R1, R1, LSL #0x18 \n"
 607       "ORR     R1, R1, R3, LSL #0x10 \n"
 608       "LDRB    R3, [R4, #0x1C7] \n"
 609       "LDRB    R2, [R4, #0x1BE] \n"
 610 // "            LDRB    LR, [R4,#0x1FF]\n"       // replaced, see below
 611       "ORR     R1, R1, R3, LSL #8 \n"
 612       "LDRB    R3, [R4, #0x1C6] \n"
 613       "CMP     R2, #0 \n"
 614       "CMPNE   R2, #0x80 \n"
 615       "ORR     R1, R1, R3 \n"
 616       "LDRB    R3, [R4, #0x1CD] \n"
 617       "MOV     R3, R3, LSL #0x18 \n"
 618       "ORR     R3, R3, R12, LSL #0x10 \n"
 619       "LDRB    R12, [R4, #0x1CB] \n"
 620       "ORR     R3, R3, R12, LSL #8 \n"
 621       "LDRB    R12, [R4, #0x1CA] \n"
 622       "ORR     R3, R3, R12 \n"
 623 //      "LDRB    R12, [R4, #0x1FE] \n"
 624           "LDRB    R12, [LR,#0x1FE]\n"        //added First MBR signature byte (0x55)
 625       "LDRB    LR, [LR,#0x1FF]\n"         //added Last MBR signature byte (0xAA)
 626       "BNE     loc_FFC55158 \n"
 627       "CMP     R0, R1 \n"
 628       "BCC     loc_FFC55158 \n"
 629       "ADD     R2, R1, R3 \n"
 630       "CMP     R2, R0 \n"
 631       "CMPLS   R12, #0x55 \n"
 632       "CMPEQ   LR, #0xAA \n"
 633       "MOVEQ   R7, R1 \n"
 634       "MOVEQ   R6, R3 \n"
 635       "MOVEQ   R4, #1 \n"
 636       "BEQ     loc_FFC5515C \n"
 637 "loc_FFC55158:\n"
 638       "MOV     R4, R8 \n"
 639 "loc_FFC5515C:\n"
 640       "MOV     R0, #2 \n"
 641       "BL      sub_FFC6B724 \n"
 642       "CMP     R4, #0 \n"
 643       "BNE     loc_FFC55198 \n"
 644       "LDR     R1, [R5, #0x64] \n"
 645       "MOV     R7, #0 \n"
 646       "MOV     R0, R9 \n"
 647       "BLX     R1 \n"
 648       "MOV     R6, R0 \n"
 649       "B       loc_FFC55198 \n"
 650 "loc_FFC55184:\n"
 651       "MOV     R6, #0x40 \n"
 652       "B       loc_FFC55198 \n"
 653 "loc_FFC5518C:\n"
 654       "LDR     R1, =0x572 \n"
 655       "LDR     R0, =0xFFC551AC \n" // "Mounter.c"
 656       "BL      sub_FFC0EB14 \n"    // DebugAssert
 657 "loc_FFC55198:\n"
 658       "STR     R7, [R5, #0x44]! \n"
 659       "STMIB   R5, {R6,R8} \n"
 660       "MOV     R0, #1 \n"
 661       "LDMFD   SP!, {R4-R10,PC} \n"
 662         );
 663 }

/* [<][>][^][v][top][bottom][index][help] */