root/platform/ixus870_sd880/sub/102b/boot.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. taskCreateHook
  2. taskCreateHook2
  3. CreateTask_spytask
  4. boot
  5. sub_FF8101A0_my
  6. sub_FF810F94_my
  7. sub_FF814D8C_my
  8. taskcreate_Startup_my
  9. task_Startup_my
  10. init_file_modules_task
  11. sub_FF872074_my
  12. sub_FF85511C_my
  13. sub_FF854F58_my
  14. sub_FF854CE8_my
  15. JogDial_task_my

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 
   5 const char * const new_sa = &_end;
   6 
   7 void JogDial_task_my(void);
   8 
   9 void taskCreateHook(int *p) { 
  10  p-=17;
  11  // taskcreate_CaptSeqTask -> SsShootTask
  12  if (p[0]==(int)0xFF861CFC)  p[0]=(int)capt_seq_task;
  13  // task_PhySw
  14  if (p[0]==(int)0xFF821814)  p[0]=(int)mykbd_task;
  15  // task_InitFileModules
  16  if (p[0]==(int)0xFF87C980)  p[0]=(int)init_file_modules_task;
  17  // via JogDail.c ref (function calls sub_FF..__JogDial.c__14)
  18  if (p[0]==(int)0xFF846338)  p[0]=(int)JogDial_task_my;
  19  // found @0xFF85E03C (above call to taskcreate_AviWrite)
  20  if (p[0]==(int)0xFF85E03C)  p[0]=(int)movie_record_task;
  21  // task_ExpDrvTask
  22  if (p[0]==(int)0xFF8A4608)  p[0]=(int)exp_drv_task;
  23  // task_FileWriteTask
  24  if (p[0]==(int)0xFFA1E5C0)  p[0]=(int)filewritetask;
  25 }
  26 
  27 void taskCreateHook2(int *p) { 
  28  p-=17;
  29  // task_InitFileModules
  30  if (p[0]==(int)0xFF87C980)  p[0]=(int)init_file_modules_task;
  31  // task_ExpDrvTask
  32  if (p[0]==(int)0xFF8A4608)  p[0]=(int)exp_drv_task;
  33  // task_FileWriteTask
  34  if (p[0]==(int)0xFFA1E5C0)  p[0]=(int)filewritetask;
  35 }
  36 
  37 void CreateTask_spytask() {
  38         _CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);
  39 };
  40 
  41 
  42 void __attribute__((naked,noinline)) boot() {
  43 
  44     // from start of firmware dump (0xFF81000C)
  45     asm volatile (
  46                  "LDR     R1, =0xC0410000\n"
  47                  "MOV     R0, #0\n"
  48                  "STR     R0, [R1]\n"
  49                  "MOV     R1, #0x78\n"
  50                  "MCR     p15, 0, R1,c1,c0\n"
  51                  "MOV     R1, #0\n"
  52                  "MCR     p15, 0, R1,c7,c10, 4\n"
  53                  "MCR     p15, 0, R1,c7,c5\n"
  54                  "MCR     p15, 0, R1,c7,c6\n"
  55                  "MOV     R0, #0x3D\n"
  56                  "MCR     p15, 0, R0,c6,c0\n"
  57                  "MOV     R0, #0xC000002F\n"
  58                  "MCR     p15, 0, R0,c6,c1\n"
  59                  "MOV     R0, #0x33\n"
  60                  "MCR     p15, 0, R0,c6,c2\n"
  61                  "MOV     R0, #0x40000033\n"
  62                  "MCR     p15, 0, R0,c6,c3\n"
  63                  "MOV     R0, #0x80000017\n"
  64                  "MCR     p15, 0, R0,c6,c4\n"
  65                  "LDR     R0, =0xFF80002D\n"
  66                  "MCR     p15, 0, R0,c6,c5\n"
  67                  "MOV     R0, #0x34\n"
  68                  "MCR     p15, 0, R0,c2,c0\n"
  69                  "MOV     R0, #0x34\n"
  70                  "MCR     p15, 0, R0,c2,c0, 1\n"
  71                  "MOV     R0, #0x34\n"
  72                  "MCR     p15, 0, R0,c3,c0\n"
  73                  "LDR     R0, =0x3333330\n"
  74                  "MCR     p15, 0, R0,c5,c0, 2\n"
  75                  "LDR     R0, =0x3333330\n"
  76                  "MCR     p15, 0, R0,c5,c0, 3\n"
  77                  "MRC     p15, 0, R0,c1,c0\n"
  78                  "ORR     R0, R0, #0x1000\n"
  79                  "ORR     R0, R0, #4\n"
  80                  "ORR     R0, R0, #1\n"
  81                  "MCR     p15, 0, R0,c1,c0\n"
  82                  "MOV     R1, #0x80000006\n"
  83                  "MCR     p15, 0, R1,c9,c1\n"
  84                  "MOV     R1, #6\n"
  85                  "MCR     p15, 0, R1,c9,c1, 1\n"
  86                  "MRC     p15, 0, R1,c1,c0\n"
  87                  "ORR     R1, R1, #0x50000\n"
  88                  "MCR     p15, 0, R1,c1,c0\n"
  89                  "LDR     R2, =0xC0200000\n"
  90                  "MOV     R1, #1\n"
  91                  "STR     R1, [R2,#0x10C]\n"
  92                  "MOV     R1, #0xFF\n"
  93                  "STR     R1, [R2,#0xC]\n"
  94                  "STR     R1, [R2,#0x1C]\n"
  95                  "STR     R1, [R2,#0x2C]\n"
  96                  "STR     R1, [R2,#0x3C]\n"
  97                  "STR     R1, [R2,#0x4C]\n"
  98                  "STR     R1, [R2,#0x5C]\n"
  99                  "STR     R1, [R2,#0x6C]\n"
 100                  "STR     R1, [R2,#0x7C]\n"
 101                  "STR     R1, [R2,#0x8C]\n"
 102                  "STR     R1, [R2,#0x9C]\n"
 103                  "STR     R1, [R2,#0xAC]\n"
 104                  "STR     R1, [R2,#0xBC]\n"
 105                  "STR     R1, [R2,#0xCC]\n"
 106                  "STR     R1, [R2,#0xDC]\n"
 107                  "STR     R1, [R2,#0xEC]\n"
 108                  "STR     R1, [R2,#0xFC]\n"
 109                  "LDR     R1, =0xC0400008\n"
 110                  "LDR     R2, =0x430005\n"
 111                  "STR     R2, [R1]\n"
 112                  "MOV     R1, #1\n"
 113                  "LDR     R2, =0xC0243100\n"
 114                  "STR     R2, [R1]\n"
 115                  "LDR     R2, =0xC0242010\n"
 116                  "LDR     R1, [R2]\n"
 117                  "ORR     R1, R1, #1\n"
 118                  "STR     R1, [R2]\n"
 119                  "LDR     R0, =0xFFB53388\n"
 120                  "LDR     R1, =0x1900\n"
 121                  "LDR     R3, =0xFBE8\n"
 122  "loc_FF81013C:\n"
 123                  "CMP     R1, R3\n"
 124                  "LDRCC   R2, [R0],#4\n"
 125                  "STRCC   R2, [R1],#4\n"
 126                  "BCC     loc_FF81013C\n"
 127                  "LDR     R1, =0xDE578\n"
 128                  "MOV     R2, #0\n"
 129  "loc_FF810154:\n"
 130                  "CMP     R3, R1\n"
 131                  "STRCC   R2, [R3],#4\n"
 132                  "BCC     loc_FF810154\n"
 133                  "B       sub_FF8101A0_my\n"   //---------->
 134     );
 135 };
 136 
 137 
 138 void __attribute__((naked,noinline)) sub_FF8101A0_my() {
 139    *(int*)0x1930=(int)taskCreateHook;
 140    *(int*)0x1934=(int)taskCreateHook2;
 141    *(int*)0x2394= (*(int*)0xC02200F8)&1 ? 0x200000 : 0x100000; // replacement of sub_FF821958 for correct power-on.
 142    asm volatile (
 143                  "LDR     R0, =0xFF810218\n"
 144                  "MOV     R1, #0\n"
 145                  "LDR     R3, =0xFF810250\n"
 146  "loc_FF8101AC:\n"
 147                  "CMP     R0, R3\n"
 148                  "LDRCC   R2, [R0],#4\n"
 149                  "STRCC   R2, [R1],#4\n"
 150                  "BCC     loc_FF8101AC\n"
 151                  "LDR     R0, =0xFF810250\n"
 152                  "MOV     R1, #0x4B0\n"
 153                  "LDR     R3, =0xFF810464\n"
 154  "loc_FF8101C8:\n"
 155                  "CMP     R0, R3\n"
 156                  "LDRCC   R2, [R0],#4\n"
 157                  "STRCC   R2, [R1],#4\n"
 158                  "BCC     loc_FF8101C8\n"
 159                  "MOV     R0, #0xD2\n"
 160                  "MSR     CPSR_cxsf, R0\n"
 161                  "MOV     SP, #0x1000\n"
 162                  "MOV     R0, #0xD3\n"
 163                  "MSR     CPSR_cxsf, R0\n"
 164                  "MOV     SP, #0x1000\n"
 165                  "LDR     R0, =0x6C4\n"
 166                  "LDR     R2, =0xEEEEEEEE\n"
 167                  "MOV     R3, #0x1000\n"
 168  "loc_FF8101FC:\n"
 169                  "CMP     R0, R3\n"
 170                  "STRCC   R2, [R0],#4\n"
 171                  "BCC     loc_FF8101FC\n"
 172                  "BL      sub_FF810F94_my\n"  //------------>
 173      );
 174 }
 175 
 176 void __attribute__((naked,noinline)) sub_FF810F94_my() {
 177      asm volatile (
 178                  "STR     LR, [SP,#-4]!\n"
 179                  "SUB     SP, SP, #0x74\n"
 180                  "MOV     R0, SP\n"
 181                  "MOV     R1, #0x74\n"
 182                  "BL      sub_FFAD1B04\n"
 183                  "MOV     R0, #0x53000\n"
 184                  "STR     R0, [SP,#4]\n"
 185 #if defined(CHDK_NOT_IN_CANON_HEAP)
 186                  "LDR     R0, =0xDE578\n"       // MEMISOSTART!!!
 187 #else
 188                  "LDR     R0, =new_sa\n"        // +
 189                  "LDR     R0, [R0]\n"           // +
 190 #endif
 191                  "LDR     R2, =0x2B9C00\n"
 192                  "LDR     R1, =0x2B24A8\n"
 193                  "STR     R0, [SP,#8]\n"
 194                  "SUB     R0, R1, R0\n"
 195                  "ADD     R3, SP, #0xC\n"
 196                  "STR     R2, [SP]\n"
 197                  "STMIA   R3, {R0-R2}\n"
 198                  "MOV     R0, #0x22\n"
 199                  "STR     R0, [SP,#0x18]\n"
 200                  "MOV     R0, #0x68\n"
 201                  "STR     R0, [SP,#0x1C]\n"
 202                  "LDR     R0, =0x19B\n"
 203                  "LDR     R1, =sub_FF814D8C_my\n"  //------------>
 204 
 205                  "B       sub_FF810FE8\n"  // rest of sub
 206      );
 207 }
 208 
 209 
 210 void __attribute__((naked,noinline)) sub_FF814D8C_my() {
 211         asm volatile (
 212                  "STMFD   SP!, {R4,LR}\n"
 213                  "BL      sub_FF810940\n"
 214                  "BL      sub_FF81901C\n"
 215                  "CMP     R0, #0\n"
 216                  "LDRLT   R0, =0xFF814EA0\n"
 217                  "BLLT    sub_FF814E80\n"
 218                  "BL      sub_FF8149B4\n"
 219                  "CMP     R0, #0\n"
 220                  "LDRLT   R0, =0xFF814EA8\n"
 221                  "BLLT    sub_FF814E80\n"
 222                  "LDR     R0, =0xFF814EB8\n"
 223                  "BL      sub_FF814A9C\n"
 224                  "CMP     R0, #0\n"
 225                  "LDRLT   R0, =0xFF814EC0\n"
 226                  "BLLT    sub_FF814E80\n"
 227                  "LDR     R0, =0xFF814EB8\n"
 228                  "BL      sub_FF813548\n"
 229                  "CMP     R0, #0\n"
 230                  "LDRLT   R0, =0xFF814ED4\n"
 231                  "BLLT    sub_FF814E80\n"
 232                  "BL      sub_FF818BA4\n"
 233                  "CMP     R0, #0\n"
 234                  "LDRLT   R0, =0xFF814EE0\n"
 235                  "BLLT    sub_FF814E80\n"
 236                  "BL      sub_FF811478\n"
 237                  "CMP     R0, #0\n"
 238                  "LDRLT   R0, =0xFF814EEC\n"
 239                  "BLLT    sub_FF814E80\n"
 240                  "LDMFD   SP!, {R4,LR}\n"
 241                  "B       taskcreate_Startup_my\n" //---------->
 242         );
 243 };
 244 
 245 
 246 void __attribute__((naked,noinline)) taskcreate_Startup_my() {
 247      // from taskcreate_Startup (0xFF81C1A8)
 248      asm volatile (
 249                  "STMFD   SP!, {R3-R5,LR}\n"
 250 //                 "BL      j_nullsub_237\n"  // why not?
 251                  "BL      sub_FF8294D4\n"
 252                  "CMP     R0, #0\n"
 253                  "BNE     loc_FF81C1F0\n"
 254                  "LDR     R4, =0xC0220000\n"
 255                  "LDR     R0, [R4,#0xFC]\n"
 256                  "TST     R0, #1\n"
 257                  "MOVEQ   R0, #0x12C\n"
 258                  "BLEQ    sub_FF8277EC\n"
 259                  "BL      sub_FF82194C\n"
 260                  "CMP     R0, #0\n"
 261                  "BNE     loc_FF81C1F0\n"
 262                  "BL      sub_FF8210C8\n"
 263                  "MOV     R0, #0x44\n"
 264                  "STR     R0, [R4,#0x1C]\n"
 265                  "BL      sub_FF8212B8\n"
 266  "loc_FF81C1EC:\n"
 267                  "B       loc_FF81C1EC\n"
 268  "loc_FF81C1F0:\n"
 269 //                 "BL      sub_FF821958\n"   // removed for correct power-on on 'on/off' button.
 270 //                 "BL      j_nullsub_238\n"  // why not?
 271                  "BL      sub_FF827664\n"
 272                  "LDR     R1, =0x30E000\n"
 273                  "MOV     R0, #0\n"
 274                  "BL      sub_FF827AAC\n"
 275                  "BL      sub_FF827858\n"
 276                  "MOV     R3, #0\n"
 277                  "STR     R3, [SP]\n"
 278                  "LDR     R3, =task_Startup_my\n"   //------------>
 279                  "MOV     R2, #0\n"
 280                  "MOV     R1, #0x19\n"
 281                  "LDR     R0, =0xFF81C238\n"
 282                  "BL      sub_FF81AEF4\n"
 283                  "MOV     R0, #0\n"
 284                  "LDMFD   SP!, {R3-R5,PC}\n"
 285      );
 286 }
 287 
 288 void __attribute__((naked,noinline)) task_Startup_my() {
 289      // from task_Startup (0xFF81C144)
 290      asm volatile (
 291                  "STMFD   SP!, {R4,LR}\n"
 292                  "BL      sub_FF8153CC\n"  // taskcreate_ClockSave
 293                  "BL      sub_FF822AB4\n"
 294                  "BL      sub_FF820E1C\n"
 295 //                 "BL      j_nullsub_241\n"  // why not?
 296                  "BL      sub_FF8296DC\n"
 297 //                 "BL      sub_FF82959C\n"    // start diskboot.bin (taskcreate_SD1stInit)
 298                  "BL      sub_FF829894\n"
 299                  "BL      sub_FF81FAB0\n"
 300                  "BL      sub_FF82972C\n"
 301                  "BL      sub_FF826C64\n"
 302                  "BL      sub_FF829898\n"
 303                  "BL      CreateTask_spytask\n"    // +
 304                  "BL      sub_FF821848\n"  // calls mykbd_task and JogDial_task
 305                                            //   - SleepTask
 306                                            //   - JogDialTask
 307                  "BL      sub_FF8249D0\n"  // calls capt_seq_task and movie_record_task
 308                  "BL      sub_FF8298B0\n"
 309 //                 "BL      nullsub_2\n"  // why not?
 310 
 311                  "B       sub_FF81C184\n" // rest of task_Startup (incl. init_file_modules_task and exp_drv_task)
 312      );
 313 }
 314 
 315 
 316 void __attribute__((naked,noinline)) init_file_modules_task() {
 317  asm volatile(
 318                  "STMFD   SP!, {R4-R6,LR}\n"
 319                  "BL      sub_FF872048\n"
 320                  "LDR     R5, =0x5006\n"
 321                  "MOVS    R4, R0\n"
 322                  "MOVNE   R1, #0\n"
 323                  "MOVNE   R0, R5\n"
 324                  "BLNE    sub_FF876CF0\n"
 325                  "BL      sub_FF872074_my\n"           //---------->
 326                  "BL      core_spytask_can_start\n"      // CHDK: Set "it's-save-to-start"-Flag for spytask
 327                  "CMP     R4, #0\n"
 328                  "MOVEQ   R0, R5\n"
 329                  "LDMEQFD SP!, {R4-R6,LR}\n"
 330                  "MOVEQ   R1, #0\n"
 331                  "BEQ     sub_FF876CF0\n"
 332                  "LDMFD   SP!, {R4-R6,PC}\n"
 333  );
 334 }
 335 
 336 void __attribute__((naked,noinline)) sub_FF872074_my() {
 337  asm volatile(
 338                  "STMFD   SP!, {R4,LR}\n"
 339                  "BL      sub_FF85511C_my\n"    //----------->
 340 
 341                  "B       sub_FF87207C\n"  // continue with rest of sub
 342  );
 343 }
 344 
 345 void __attribute__((naked,noinline)) sub_FF85511C_my() {
 346  asm volatile(
 347                  "STMFD   SP!, {R4-R6,LR}\n"
 348                  "MOV     R6, #0\n"
 349                  "MOV     R0, R6\n"
 350                  "BL      sub_FF854BDC\n"
 351                  "LDR     R4, =0x1990C\n"
 352                  "MOV     R5, #0\n"
 353                  "LDR     R0, [R4,#0x38]\n"
 354                  "BL      sub_FF85563C\n"
 355                  "CMP     R0, #0\n"
 356                  "LDREQ   R0, =0x282C\n"
 357                  "STREQ   R5, [R0,#0x10]\n"
 358                  "STREQ   R5, [R0,#0x14]\n"
 359                  "STREQ   R5, [R0,#0x18]\n"
 360                  "MOV     R0, R6\n"
 361                  "BL      sub_FF854C1C\n"
 362                  "MOV     R0, R6\n"
 363                  "BL      sub_FF854F58_my\n"     //--------->
 364 
 365                  "B       sub_FF855160\n"  // continue with rest of sub
 366  );
 367 }
 368 
 369 void __attribute__((naked,noinline)) sub_FF854F58_my() {
 370  asm volatile(
 371                  "STMFD   SP!, {R4-R6,LR}\n"
 372                  "LDR     R5, =0x282C\n"
 373                  "MOV     R6, R0\n"
 374                  "LDR     R0, [R5,#0x14]\n"
 375                  "CMP     R0, #0\n"
 376                  "MOVNE   R0, #1\n"
 377                  "LDMNEFD SP!, {R4-R6,PC}\n"
 378                  "MOV     R0, #0x17\n"
 379                  "MUL     R1, R0, R6\n"
 380                  "LDR     R0, =0x1990C\n"
 381                  "ADD     R4, R0, R1,LSL#2\n"
 382                  "LDR     R0, [R4,#0x38]\n"
 383                  "MOV     R1, R6\n"
 384                  "BL      sub_FF854CE8_my\n"  //-------------->
 385 
 386                  "B       sub_FF854F90\n"  // continue with rest of sub
 387  );
 388 }
 389 
 390 void __attribute__((naked,noinline)) sub_FF854CE8_my() {
 391  asm volatile(
 392                  "STMFD   SP!, {R4-R8,LR}\n"
 393                  "MOV     R8, R0\n"
 394                  "MOV     R0, #0x17\n"
 395                  "MUL     R1, R0, R1\n"
 396                  "LDR     R0, =0x1990C\n"
 397                  "MOV     R6, #0\n"
 398                  "ADD     R7, R0, R1,LSL#2\n"
 399                  "LDR     R0, [R7,#0x3C]\n"
 400                  "MOV     R5, #0\n"
 401                  "CMP     R0, #6\n"
 402                  "ADDLS   PC, PC, R0,LSL#2\n"
 403                  "B       loc_FF854E34\n"
 404  "loc_FF854D18:\n"
 405                  "B       loc_FF854D4C\n"
 406  "loc_FF854D1C:\n"
 407                  "B       loc_FF854D34\n"
 408  "loc_FF854D20:\n"
 409                  "B       loc_FF854D34\n"
 410  "loc_FF854D24:\n"
 411                  "B       loc_FF854D34\n"
 412  "loc_FF854D28:\n"
 413                  "B       loc_FF854D34\n"
 414  "loc_FF854D2C:\n"
 415                  "B       loc_FF854E2C\n"
 416  "loc_FF854D30:\n"
 417                  "B       loc_FF854D34\n"
 418  "loc_FF854D34:\n"
 419                  "MOV     R2, #0\n"
 420                  "MOV     R1, #0x200\n"
 421                  "MOV     R0, #2\n"
 422                  "BL      sub_FF86BFF0\n"
 423                  "MOVS    R4, R0\n"
 424                  "BNE     loc_FF854D54\n"
 425  "loc_FF854D4C:\n"
 426                  "MOV     R0, #0\n"
 427                  "LDMFD   SP!, {R4-R8,PC}\n"
 428  "loc_FF854D54:\n"
 429                  "LDR     R12, [R7,#0x4C]\n"
 430                  "MOV     R3, R4\n"
 431                  "MOV     R2, #1\n"
 432                  "MOV     R1, #0\n"
 433                  "MOV     R0, R8\n"
 434                  "BLX     R12\n"
 435                  "CMP     R0, #1\n"
 436                  "BNE     loc_FF854D80\n"
 437                  "MOV     R0, #2\n"
 438                  "BL      sub_FF86C13C\n"
 439                  "B       loc_FF854D4C\n"
 440  "loc_FF854D80:\n"
 441                  "MOV     R0, R8\n"
 442                  "BL      sub_FF918C14\n"
 443 
 444      // ------------------ added code ------------------
 445 
 446                  "MOV   R1, R4\n"           //  pointer to MBR in R1
 447                  "BL    mbr_read_dryos\n"   //  total sectors count in R0 before and after call
 448 
 449           // Start of DataGhost's FAT32 autodetection code
 450           // Policy: If there is a partition which has type W95 FAT32, use the first one of those for image storage
 451           // According to the code below, we can use R1, R2, R3 and R12.
 452           // LR wasn't really used anywhere but for storing a part of the partition signature. This is the only thing
 453           // that won't work with an offset, but since we can load from LR+offset into LR, we can use this to do that :)
 454           "MOV     R12, R4\n"                    // Copy the MBR start address so we have something to work with
 455           "MOV     LR, R4\n"                     // Save old offset for MBR signature
 456           "MOV     R1, #1\n"                     // Note the current partition number
 457           "B       dg_sd_fat32_enter\n"          // We actually need to check the first partition as well, no increments yet!
 458      "dg_sd_fat32:\n"
 459           "CMP     R1, #4\n"                     // Did we already see the 4th partition?
 460           "BEQ     dg_sd_fat32_end\n"            // Yes, break. We didn't find anything, so don't change anything.
 461           "ADD     R12, R12, #0x10\n"            // Second partition
 462           "ADD     R1, R1, #1\n"                 // Second partition for the loop
 463      "dg_sd_fat32_enter:\n"
 464           "LDRB    R2, [R12, #0x1BE]\n"          // Partition status
 465           "LDRB    R3, [R12, #0x1C2]\n"          // Partition type (FAT32 = 0xB)
 466           "CMP     R3, #0xB\n"                   // Is this a FAT32 partition?
 467           "CMPNE   R3, #0xC\n"                   // Not 0xB, is it 0xC (FAT32 LBA) then?
 468           "BNE     dg_sd_fat32\n"                // No, it isn't. Loop again.
 469           "CMP     R2, #0x00\n"                  // It is, check the validity of the partition type
 470           "CMPNE   R2, #0x80\n"
 471           "BNE     dg_sd_fat32\n"                // Invalid, go to next partition
 472                                                  // This partition is valid, it's the first one, bingo!
 473           "MOV     R4, R12\n"                    // Move the new MBR offset for the partition detection.
 474           
 475      "dg_sd_fat32_end:\n"
 476           // End of DataGhost's FAT32 autodetection code
 477 
 478      // ----------- continue (at 0xFF854D88) -----------
 479 
 480                  "LDRB    R1, [R4,#0x1C9]\n"
 481                  "LDRB    R3, [R4,#0x1C8]\n"
 482                  "LDRB    R12, [R4,#0x1CC]\n"
 483                  "MOV     R1, R1,LSL#24\n"
 484                  "ORR     R1, R1, R3,LSL#16\n"
 485                  "LDRB    R3, [R4,#0x1C7]\n"
 486                  "LDRB    R2, [R4,#0x1BE]\n"
 487              //  "LDRB    LR, [R4,#0x1FF]\n"           // -
 488                  "ORR     R1, R1, R3,LSL#8\n"
 489                  "LDRB    R3, [R4,#0x1C6]\n"
 490                  "CMP     R2, #0\n"
 491                  "CMPNE   R2, #0x80\n"
 492                  "ORR     R1, R1, R3\n"
 493                  "LDRB    R3, [R4,#0x1CD]\n"
 494                  "MOV     R3, R3,LSL#24\n"
 495                  "ORR     R3, R3, R12,LSL#16\n"
 496                  "LDRB    R12, [R4,#0x1CB]\n"
 497                  "ORR     R3, R3, R12,LSL#8\n"
 498                  "LDRB    R12, [R4,#0x1CA]\n"
 499                  "ORR     R3, R3, R12\n"
 500              //  "LDRB    R12, [R4,#0x1FE]\n"           // -
 501                  "LDRB    R12, [LR,#0x1FE]\n"           // + First MBR signature byte (0x55), LR is original offset.
 502                  "LDRB    LR, [LR,#0x1FF]\n"            // + Last MBR signature byte (0xAA), LR is original offset.
 503                  "MOV     R4, #0\n"
 504                  "BNE     loc_FF854E08\n"
 505                  "CMP     R0, R1\n"
 506                  "BCC     loc_FF854E08\n"
 507                  "ADD     R2, R1, R3\n"
 508                  "CMP     R2, R0\n"
 509                  "CMPLS   R12, #0x55\n"
 510                  "CMPEQ   LR, #0xAA\n"
 511                  "MOVEQ   R6, R1\n"
 512                  "MOVEQ   R5, R3\n"
 513                  "MOVEQ   R4, #1\n"
 514  "loc_FF854E08:\n"
 515                  "MOV     R0, #2\n"
 516                  "BL      sub_FF86C13C\n"
 517                  "CMP     R4, #0\n"
 518                  "BNE     loc_FF854E40\n"
 519                  "MOV     R6, #0\n"
 520                  "MOV     R0, R8\n"
 521                  "BL      sub_FF918C14\n"
 522                  "MOV     R5, R0\n"
 523                  "B       loc_FF854E40\n"
 524  "loc_FF854E2C:\n"
 525                  "MOV     R5, #0x40\n"
 526                  "B       loc_FF854E40\n"
 527  "loc_FF854E34:\n"
 528                  "LDR     R1, =0x37A\n"
 529                  "LDR     R0, =0xFF854CDC\n"
 530                  "BL      sub_FF81B1CC\n"
 531  "loc_FF854E40:\n"
 532                  "STR     R6, [R7,#0x44]!\n"
 533                  "MOV     R0, #1\n"
 534                  "STR     R5, [R7,#4]\n"
 535                  "LDMFD   SP!, {R4-R8,PC}\n"
 536  );
 537 }
 538 
 539 
 540 void __attribute__((naked,noinline)) JogDial_task_my() {
 541  // from sub_FF846338
 542  asm volatile(
 543                  "STMFD   SP!, {R3-R11,LR}\n"
 544                  "BL      sub_FF8464E8\n"
 545                  "LDR     R11, =0x80000B01\n"
 546                  "LDR     R8, =0xFFAD70B0\n"
 547                  "LDR     R7, =0xC0240000\n"
 548                  "LDR     R6, =0x23A0\n"
 549                  "MOV     R9, #1\n"
 550                  "MOV     R10, #0\n"
 551  "loc_FF846358:\n"
 552                  "LDR     R3, =0x1AE\n"
 553                  "LDR     R0, [R6,#0xC]\n"
 554                  "LDR     R2, =0xFF846590\n"
 555                  "MOV     R1, #0\n"
 556                  "BL      sub_FF827994\n"
 557                  "MOV     R0, #40\n"
 558                  "BL      _SleepTask\n"
 559 
 560 //------------------  added code ---------------------
 561 "labelA:\n"
 562                 "LDR     R0, =jogdial_stopped\n"
 563                 "LDR     R0, [R0]\n"
 564                 "CMP     R0, #1\n"
 565                 "BNE     labelB\n"
 566                 "MOV     R0, #40\n"
 567                 "BL      _SleepTask\n"
 568                 "B       labelA\n"
 569 "labelB:\n"
 570 //------------------  original code ------------------
 571 
 572                  "LDR     R0, [R7,#0x104]\n"
 573                  "MOV     R0, R0,ASR#16\n"
 574                  "STRH    R0, [R6]\n"
 575                  "LDRSH   R2, [R6,#2]\n"
 576                  "SUB     R1, R0, R2\n"
 577                  "CMP     R1, #0\n"
 578                  "BEQ     loc_FF84641C\n"
 579                  "MOV     R5, R1\n"
 580                  "RSBLT   R5, R5, #0\n"
 581                  "MOVLE   R4, #0\n"
 582                  "MOVGT   R4, #1\n"
 583                  "CMP     R5, #0xFF\n"
 584                  "BLS     loc_FF8463D0\n"
 585                  "CMP     R1, #0\n"
 586                  "RSBLE   R1, R2, #0xFF\n"
 587                  "ADDLE   R1, R1, #0x7F00\n"
 588                  "ADDLE   R0, R1, R0\n"
 589                  "RSBGT   R0, R0, #0xFF\n"
 590                  "ADDGT   R0, R0, #0x7F00\n"
 591                  "ADDGT   R0, R0, R2\n"
 592                  "ADD     R5, R0, #0x8000\n"
 593                  "ADD     R5, R5, #1\n"
 594                  "EOR     R4, R4, #1\n"
 595  "loc_FF8463D0:\n"
 596                  "LDR     R0, [R6,#0x14]\n"
 597                  "CMP     R0, #0\n"
 598                  "BEQ     loc_FF846414\n"
 599                  "LDR     R0, [R6,#0x1C]\n"
 600                  "CMP     R0, #0\n"
 601                  "BEQ     loc_FF8463FC\n"
 602                  "LDR     R1, [R8,R4,LSL#2]\n"
 603                  "CMP     R1, R0\n"
 604                  "BEQ     loc_FF846404\n"
 605                  "LDR     R0, =0xB01\n"
 606                  "BL      sub_FF878BA0\n"
 607  "loc_FF8463FC:\n"
 608                  "MOV     R0, R11\n"
 609                  "BL      sub_FF878BA0\n"
 610  "loc_FF846404:\n"
 611                  "LDR     R0, [R8,R4,LSL#2]\n"
 612                  "MOV     R1, R5\n"
 613                  "STR     R0, [R6,#0x1C]\n"
 614                  "BL      sub_FF878AE8\n"
 615  "loc_FF846414:\n"
 616                  "LDRH    R0, [R6]\n"
 617                  "STRH    R0, [R6,#2]\n"
 618  "loc_FF84641C:\n"
 619                  "STR     R10, [R7,#0x100]\n"
 620                  "STR     R9, [R7,#0x108]\n"
 621                  "LDR     R0, [R6,#0x10]\n"
 622                  "CMP     R0, #0\n"
 623                  "BLNE    _SleepTask\n"
 624                  "B       loc_FF846358\n"
 625  );
 626 }

/* [<][>][^][v][top][bottom][index][help] */