root/platform/m3/sub/120f/boot.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. save_romlog2
  2. spytask_my
  3. spytask
  4. CreateTask_spytask
  5. boot
  6. CreateTask_my
  7. sub_fc062f48_my
  8. sub_fc0630d9_my
  9. sub_fc0634e2_my
  10. sub_fc06347d_my
  11. sub_fc083bea_my
  12. init_file_modules_task
  13. kbd_p2_f_my
  14. sub_fc074e8a_my
  15. wrap_kbd_p1_f
  16. sub_fc0839d8_my
  17. sub_fc07507e_my
  18. agent_orange

   1 #include "lolevel.h"
   2 #include "platform.h"
   3 #include "core.h"
   4 #include "dryos31.h"
   5 #include "core.h"
   6 #include "callfunc.h"
   7 
   8 
   9 #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
  10 
  11 const char * const new_sa = &_end;
  12 
  13 // Forward declarations
  14 extern volatile int jogdial_stopped;
  15 void JogDial_task_my(void);
  16 
  17 extern void task_CaptSeq();
  18 extern void task_InitFileModules();
  19 extern void task_RotaryEncoder();
  20 extern void task_MovieRecord();
  21 extern void task_ExpDrv();
  22 
  23 extern unsigned _ExecuteEventProcedure(const char *name,...);
  24 //extern unsigned _sprintf(char *stream, const char *format,...);
  25 
  26 extern unsigned _LCDMsg_Create (unsigned, unsigned, unsigned);
  27 extern void _LCDMsg_SetStr (unsigned, char * );
  28 //extern long _VbattGet();
  29 
  30 
  31 static unsigned message;
  32 
  33 void save_romlog2(void)
  34 {
  35         unsigned args[4];
  36     args[0] = (unsigned)"SystemEventInit";
  37         call_func_ptr(_ExecuteEventProcedure,args,1);
  38                 args[0] = (unsigned)"UI.CreatePublic";
  39                 call_func_ptr(_ExecuteEventProcedure,args,1);
  40         args[0] = (unsigned)"System.Create";
  41         call_func_ptr(_ExecuteEventProcedure,args,1);
  42                 args[0] = (unsigned)"Driver.Create";
  43                 call_func_ptr(_ExecuteEventProcedure,args,1);
  44 
  45                 args[0] = (unsigned)"GetLogToFile";
  46                 args[1] = (unsigned)"A/ROMLOG.LOG";
  47                 args[2] = 1;            
  48                 call_func_ptr(_ExecuteEventProcedure,args,3);
  49                 
  50                 args[0] = (unsigned)"BeepDrive";
  51                 args[1] = (unsigned) 0x02;
  52                 call_func_ptr(_ExecuteEventProcedure,args,2);
  53         
  54                  // *(int*)0xd20b0810  = 0x4d0002;       // Orange Led = on
  55 
  56 }
  57 
  58 
  59 /*----------------------------------------------------------------------
  60     spytask  MY
  61 -----------------------------------------------------------------------*/
  62 void spytask_my(long ua, long ub, long uc, long ud, long ue, long uf)
  63 {
  64         _SleepTask(2800);
  65         save_romlog2();
  66 
  67         while (1){
  68         _SleepTask(300);
  69         }       
  70 }
  71 
  72 /*----------------------------------------------------------------------
  73     spytask
  74 -----------------------------------------------------------------------*/
  75 void spytask(long ua, long ub, long uc, long ud, long ue, long uf)
  76 {
  77     core_spytask();
  78 }
  79 
  80 
  81 /*----------------------------------------------------------------------
  82     CreateTask_spytask
  83 -----------------------------------------------------------------------*/
  84 void CreateTask_spytask()
  85 {
  86         if ( *(int*)(0x9e78) & 0x00600000 )  
  87                 {
  88                 if (( *(int*)(0xD20BF4A0) & 0x00002000) == 0) _CreateTask("SpyTaskMY", 0x19, 0x2000, spytask_my, 0);
  89                 _CreateTask("SpyTask", 0x19, 0x2000, spytask, 0);
  90                 }
  91 }
  92 
  93 ///*----------------------------------------------------------------------
  94 // Pointer to stack location where jogdial task records previous and current
  95 // jogdial positions
  96 // short *jog_position;
  97 
  98 /*----------------------------------------------------------------------
  99     boot()
 100 
 101     Main entry point for the CHDK code
 102 -----------------------------------------------------------------------*/
 103 
 104 /*************************************************************/
 105 void __attribute__((naked,noinline)) boot() {
 106     asm volatile ( // 0xfc02000c
 107 "       mov     r0, #0x4000\n"
 108 "       mov     sp, r0\n"
 109 "       bl      sub_fc02007e\n"
 110 "       ldr     r2, =0xc0242010\n"
 111 "       ldr     r1, [r2]\n"
 112 "       orr.w   r1, r1, #1\n"
 113 "       str     r1, [r2]\n"
 114 "       ldr     r0, =0xfcc98870\n"
 115 "       ldr     r1, =0x10e1000\n"
 116 "       ldr     r3, =0x11074ac\n"
 117 " loc_fc02002a:\n"
 118 "       cmp     r1, r3\n"
 119 "       itt cc\n"
 120 "       ldrcc.w r2, [r0],#4\n"
 121 "       strcc.w r2, [r1],#4\n"
 122 "       bcc     loc_fc02002a\n"
 123 "       ldr     r0, =0x10e1000\n"
 124 "       ldr     r1, =0x264ac\n"
 125 "       bl      sub_fc13019a\n"
 126 "       ldr     r0, =0xfccbed1c\n"
 127 "       ldr     r1, =0xbfe10800\n"
 128 "       ldr     r3, =0xbfe17391\n"
 129 " loc_fc020046:\n"
 130 "       cmp     r1, r3\n"
 131 "       itt cc\n"
 132 "       ldrcc.w r2, [r0],#4\n"
 133 "       strcc.w r2, [r1],#4\n"
 134 "       bcc     loc_fc020046\n"
 135 "       ldr     r0, =0xfcc50100\n"
 136 "       ldr     r1, =0x8000\n"
 137 "       ldr     r3, =0x50770\n"
 138 " loc_fc02005a:\n"
 139 "       cmp     r1, r3\n"
 140 "       itt cc\n"
 141 "       ldrcc.w r2, [r0],#4\n"
 142 "       strcc.w r2, [r1],#4\n"
 143 "       bcc     loc_fc02005a\n"
 144 
 145                 // "mov.w     r3, #0x01\n"                      // Enable TIO
 146                 // "ldr     r1, =0x00008000\n"          // Enable TIO
 147                 // "str.w     r3, [r1]\n"                               // Enable TIO
 148 
 149 "       ldr     r3, =0x50770\n"
 150 "       ldr     r1, =0x3a7cc8\n"
 151 "       mov.w   r2, #0\n"
 152 " loc_fc020070:\n"
 153 "       cmp     r3, r1\n"
 154 "       it cc\n"
 155 "       strcc.w r2, [r3],#4\n"
 156 "       bcc     loc_fc020070\n"
 157 
 158         // Install CreateTask patch
 159         "adr     r0, patch_CreateTask\n"    // Patch data
 160         "ldm     r0, {r1,r2}\n"             // Get two patch instructions
 161         "ldr     r0, =orig_CreateTask\n"    // Address to patch
 162         "bic     r0, #1\n"                  // clear thumb bit
 163         "stm     r0, {r1,r2}\n"             // Store patch instructions
 164 
 165                 "b.w     sub_fc062f48_my\n" // continue 
 166 
 167         "patch_CreateTask:\n"
 168         "ldr.w   pc, [pc,#0]\n"             // Do jump to absolute address CreateTask_my
 169         ".long   CreateTask_my + 1\n"           // has to be a thumb address
 170 );
 171 }
 172 
 173 /*************************************************************/
 174 void __attribute__((naked,noinline)) CreateTask_my() {
 175         
 176 //   *(int*)0xd20b0810  = 0x4d0002;     
 177 asm volatile (
 178 "    push   {r0}\n"
 179 
 180 /* "    push   {r1}\n"
 181 "       ldr r0, =#0x4d0002\n"
 182 "       ldr r1, =#0xd20b0810\n"    // beam address
 183 "       str r0, [r1]\n"
 184 "    pop    {r1}\n" 
 185 */
 186 
 187 //R3 = Pointer to task function to create
 188 
 189 "    ldr     r0, =task_CaptSeq\n"       // DryOS original code function ptr.
 190 "    cmp     r0, r3\n"                  // is the given taskptr equal to our searched function?
 191 "    itt     eq\n"                      // EQ block
 192 "    ldreq   r3, =capt_seq_task\n"      // if so replace with our task function base ptr.
 193 "    orreq   r3, #1\n"                  // make sure it's a thumb address (may not be needed?)
 194 "    beq     exitHook\n"                // below compares not necessary if this check has found something.
 195 
 196  
 197 "    LDR     R0, =task_ExpDrv\n"
 198 "    CMP     R0, R3\n"
 199 "    itt     eq\n"
 200 "    LDREQ   R3, =exp_drv_task\n"
 201 "    orreq   r3, #1\n"
 202 "    BEQ     exitHook\n"
 203  
 204 /*
 205 "    LDR     R0, =task_DvlpSeq\n"
 206 "    CMP     R0, R3\n"
 207 "    itt     eq\n"
 208 "    LDREQ   R3, =developseq_task\n"
 209 "    orreq   r3, #1\n"
 210 "    BEQ     exitHook\n"
 211 */
 212 
 213 
 214 "    LDR     R0, =task_FileWrite\n"
 215 "    CMP     R0, R3\n"
 216 "    itt     eq\n"
 217 "    LDREQ   R3, =filewritetask\n"
 218 "    orreq   r3, #1\n"
 219 "    BEQ     exitHook\n"
 220 
 221 "    LDR     R0, =0xFC2623F1\n" // TskCocoa0
 222 "    CMP     R0, R3\n"
 223 "    itt     eq\n"
 224 "    LDREQ   R3, =task_cocoa0\n"
 225 "    orreq   r3, #1\n"
 226 "    BEQ     exitHook\n"
 227 
 228 "    LDR     R0, =task_MovieRecord\n"
 229 "    CMP     R0, R3\n"
 230 "    itt     eq\n"
 231 "    LDREQ   R3, =movie_record_task\n"
 232 "    orreq   r3, #1\n"
 233 "    BEQ     exitHook\n"
 234 
 235 "    ldr     r0, =task_InitFileModules\n"
 236 "    cmp     r0, r3\n"
 237 "    itt     eq\n"
 238 "    ldreq   r3, =init_file_modules_task\n"
 239 "    orreq   r3, #1\n"
 240 "exitHook:\n" 
 241 
 242 
 243 // restore overwritten register(s)
 244 "    pop    {r0}\n"
 245 // Execute overwritten instructions from original code, then jump to firmware
 246 "    stmdb   sp!, {r1, r2, r3, r4, r5, r6, r7, r8, r9, lr}\n"
 247 "    mov     r4, r0\n"
 248 "    ldr     r0, =0x8160\n"
 249 "    ldr.w   pc, =(orig_CreateTask + 8) \n"  // Continue in firmware
 250 ".ltorg\n"
 251 );
 252 }
 253 
 254 //fc04f194 ??????????????
 255 void __attribute__((naked,noinline)) sub_fc062f48_my() {
 256 
 257     asm volatile (
 258     "push    {r4, lr}\n"
 259 #if defined(CHDK_NOT_IN_CANON_HEAP)
 260 "        ldr     r4, =0x3a7cc8\n"         // heap start, modify here
 261 #else
 262     "ldr     r4, =new_sa\n"             // +
 263     "ldr     r4, [r4]\n"                // +
 264 #endif
 265 "        sub     sp, sp, #0x78\n"
 266 "        ldr     r0, =0x74e000\n"
 267 "        ldr     r1, =0xafd8c\n"
 268 "        subs    r0, r0, r4\n"
 269 "        cmp     r0, r1\n"
 270 "        bcs     loc_fc062f5a\n"
 271 "  loc_fc062f58:\n"
 272 "        b       loc_fc062f58\n"
 273 "  loc_fc062f5a:\n"
 274 "        ldr     r1, =0x8074\n"
 275 "        mov.w   r0, #0x80000\n"
 276 "        str     r0, [r1]\n"
 277 "        ldr     r1, =0x8078\n"
 278 "        ldr     r0, =0x42a41000\n"
 279 "        str     r0, [r1]\n"
 280 "        ldr     r1, =0x807c\n"
 281 "        ldr     r0, =0x42a43000\n"
 282 "        str     r0, [r1]\n"
 283 "        movs    r1, #0x78\n"
 284 "        mov     r0, sp\n"
 285 "        blx     sub_fc30243c\n"
 286 "        ldr     r0, =0x68e000\n"
 287 "        mov.w   r1, #0xc0000\n"
 288 "        stmea.w sp, {r0,r1,r4}\n"
 289 "        ldr     r1, =0x682274\n"
 290 "        subs    r2, r1, r4\n"
 291 "        strd.w  r2, r1, [sp,#0xc]\n"
 292 "        str     r0, [sp,#0x14]\n"
 293 "        movs    r0, #0x22\n"
 294 "        str     r0, [sp,#0x18]\n"
 295 "        movs    r0, #0x98\n"
 296 "        str     r0, [sp,#0x1c]\n"
 297 "        movw    r0, #0x24c\n"
 298 "        str     r0, [sp,#0x20]\n"
 299 "        movs    r0, #0xfa\n"
 300 "        str     r0, [sp,#0x24]\n"
 301 "        movs    r0, #0xe8\n"
 302 "        str     r0, [sp,#0x28]\n"
 303 "        movs    r0, #0x85\n"
 304 "        str     r0, [sp,#0x2c]\n"
 305 "        movs    r0, #0x40\n"
 306 "        str     r0, [sp,#0x30]\n"
 307 "        movs    r0, #4\n"
 308 "        str     r0, [sp,#0x34]\n"
 309 "        movs    r0, #0\n"
 310 "        str     r0, [sp,#0x38]\n"
 311 "        movs    r0, #0x10\n"
 312 "        str     r0, [sp,#0x5c]\n"
 313 "        movs    r2, #0\n"
 314 "        lsls    r0, r0, #8\n"
 315 "        str     r0, [sp,#0x60]\n"
 316 "        ldr     r1, =sub_fc0630d9_my\n"
 317 "        asrs    r0, r0, #4\n"
 318 "        str     r0, [sp,#0x64]\n"
 319 "        lsls    r0, r0, #5\n"
 320 "        str     r0, [sp,#0x68]\n"
 321 "        mov     r0, sp\n"
 322 "        blx     sub_fc301ba0\n"
 323 "        add     sp, sp, #0x78\n"
 324 "        pop     {r4,pc}\n"
 325 ".ltorg\n"
 326     );
 327 }
 328 
 329 //fc0630d9
 330 void __attribute__((naked,noinline)) sub_fc0630d9_my() {
 331     asm volatile (
 332 "       push    {r4,lr}\n"
 333 "       ldr     r4, =0xfc063180\n"
 334 "       bl      sub_fc0643d4\n"
 335 "       ldr     r0, =0x80ec\n"
 336 "       ldr     r1, [r0]\n"
 337 "       ldr     r0, =0x8074\n"
 338 "       ldr     r0, [r0]\n"
 339 "       adds    r0, #0x10\n"
 340 "       cmp     r1, r0\n"
 341 "       bcs     loc_fc0630f4\n"
 342 "       ldr     r0, =0xfc063190\n"
 343 "       bl      sub_fc06316a\n"
 344 " loc_fc0630f4:\n"
 345 "       bl      sub_fc130274\n"
 346 "       ldr     r1, =0xbfe10000\n"
 347 "       mov.w   r2, #0xeeeeeeee\n"
 348 "       ldr     r3, =0xbfe10800\n"
 349 " loc_fc063100:\n"
 350 "       stmia   r1!, {r2}\n"
 351 "       cmp     r1, r3\n"
 352 "       bcc     loc_fc063100\n"
 353 "       bl      sub_fc130286\n"
 354 "       bl      sub_fc1edfbc\n"
 355 "       cmp     r0, #0\n"
 356 "       bge     loc_fc063118\n"
 357 "       ldr     r0, =0xfc0631b0\n"
 358 "       bl      sub_fc06316a\n"
 359 " loc_fc063118:\n"
 360 "       bl      sub_fc063964\n"
 361 "       cmp     r0, #0\n"
 362 "       bge     loc_fc063126\n"
 363 "       ldr     r0, =0xfc0631b8\n"
 364 "       bl      sub_fc06316a\n"
 365 " loc_fc063126:\n"
 366 "       mov     r0, r4\n"
 367 "       bl      sub_fc0639f2\n"
 368 "       cmp     r0, #0\n"
 369 "       bge     loc_fc063136\n"
 370 "       ldr     r0, =0xfc0631c8\n"
 371 "       bl      sub_fc06316a\n"
 372 " loc_fc063136:\n"
 373 "       mov     r0, r4\n"
 374 "       bl      sub_fc063314\n"
 375 "       cmp     r0, #0\n"
 376 "       bge     loc_fc063146\n"
 377 "       ldr     r0, =0xfc0631dc\n"
 378 "       bl      sub_fc06316a\n"
 379 " loc_fc063146:\n"
 380 "       bl      sub_fc063458\n"
 381 "       cmp     r0, #0\n"
 382 "       bge     loc_fc063154\n"
 383 "       ldr     r0, =0xfc0631e8\n"
 384 "       bl      sub_fc06316a\n"
 385 " loc_fc063154:\n"
 386 "       bl      sub_fc0665ac\n"
 387 "       cmp     r0, #0\n"
 388 "       bge     loc_fc063162\n"
 389 "       ldr     r0, =0xfc0631f4\n"
 390 "       bl      sub_fc06316a\n"
 391 " loc_fc063162:\n"
 392 "       pop.w   {r4,lr}\n"
 393 "       b.w     sub_fc0634e2_my\n" // -> continue (taskcreate_startup)
 394 ".ltorg\n"
 395     );
 396 }
 397 
 398 void __attribute__((naked,noinline)) sub_fc0634e2_my() {
 399     asm volatile (
 400 "       push    {r3,lr}\n"
 401 "       bl      sub_fc0635fc\n"
 402 "       bl      sub_fc13131c\n"
 403 "       cbnz    r0, loc_fc0634f8\n"
 404 "       bl      sub_fc07803e\n"
 405 "       cbz     r0, loc_fc0634f8\n"
 406 "       movs    r0, #1\n"
 407 "       b       loc_fc0634fa\n"
 408 " loc_fc0634f8:\n"
 409 "       movs    r0, #0\n"
 410 " loc_fc0634fa:\n"
 411 "       bl      sub_fc083cc4\n"
 412 "       cbnz    r0, loc_fc063506\n"
 413 "       bl      sub_fc0635ea\n"
 414 " loc_fc063504:\n"
 415 "       b       loc_fc063504\n"
 416 " loc_fc063506:\n"
 417 "       blx     sub_fc301bf8\n"
 418 "       ldr     r1, =0x74e000\n"
 419 "       movs    r0, #0\n"
 420 "       bl      sub_fc37a758\n"
 421 "       blx     sub_fc301fdc\n"
 422 "       movs    r3, #0\n"
 423 "       str     r3, [sp]\n"
 424 "       ldr     r3, =sub_fc06347d_my\n"
 425 "       movs    r2, #0\n"
 426 "       movs    r1, #0x19\n"
 427 "       ldr     r0, =0xfc063534\n"
 428 "       blx     sub_fc3021d4\n"
 429 "       movs    r0, #0\n"
 430 "       pop     {r3,pc}\n"
 431 ".ltorg\n"
 432     );
 433 }
 434 
 435 // task_Startup
 436 void __attribute__((naked,noinline)) sub_fc06347d_my() {
 437     asm volatile (
 438 "  push    {r4,lr}\n"
 439 "  bl      sub_fc131030\n"
 440 "  bl      sub_fc0635c8\n"
 441 // "  bl      j_nullsub_20\n"
 442 "  bl      sub_fc0f41f0\n"
 443 //"  bl      sub_fc0637b2\n"  // - startdiskboot
 444 "  bl      sub_010e16c8\n" // + Switch off SD power
 445 "  bl      sub_fc36dfa6\n"
 446 "  bl      sub_fc0f4348\n"
 447 "  bl      sub_fc0638a4\n"
 448 "  bl      sub_fc0636dc\n"
 449 "  bl      sub_fc0f4222\n"
 450 "  bl      sub_fc1ee770\n"
 451 "  bl      sub_fc0f434e\n"
 452 "  bl      CreateTask_spytask\n"  // +
 453 "  bl      sub_fc083bea_my\n"     // -> taskcreate_physw
 454 "  bl      sub_fc0a9870\n"
 455 "  bl      sub_fc0f4364\n"
 456 "  bl      sub_fc0d2610\n"
 457 "  bl      sub_fc130de8\n"
 458 "  bl      sub_fc1311da\n"
 459 "  bl      sub_fc0f41a2\n"
 460 "  bl      sub_fc130da4\n"
 461 // "  bl      nullsub_9\n"
 462 "  bl      sub_fc363020\n"
 463 "  bl      sub_fc130d78\n"
 464 // "    bl agent_orange\n"
 465 "  pop.w   {r4,lr}\n"
 466 //"  b.w     sub_fc131006\n" // - (not recognized automatically yet, transformed into ldr pc)
 467 "ldr     pc, =0xfc131007\n"     // + thumb address must be used
 468 ".ltorg\n"
 469     );
 470 }
 471 
 472 //taskcreate_physw   
 473 void __attribute__((naked,noinline)) sub_fc083bea_my() {
 474     asm volatile (
 475 "       push    {r3-r5,lr}\n"
 476 "       bl      sub_fc0763a4\n"
 477 "       bl      sub_fc077fbc\n"
 478 "       cbnz    r0, loc_fc083bfa\n"
 479 "       bl      sub_fc076348\n"
 480 " loc_fc083bfa:\n"
 481 "       ldr     r4, =0x82cc\n"
 482 "       ldr     r0, [r4,#4]\n"
 483 "       cmp     r0, #0\n"
 484 "       bne     locret_fc083c16\n"
 485 "       movs    r3, #0\n"
 486 "       str     r3, [sp]\n"
 487 "       ldr     r3, =mykbd_task\n" //=0xfc083bc5\n"
 488 //"       ldr     r3, =0xfc083bc5\n" // -orig kbd_task
 489 "       movs    r1, #0x17\n"
 490 "       ldr     r0, =0xfc083f2c\n" // "PhySw"
 491 "       movw    r2, #0x2000\n"   // original value 0x800
 492 "       blx     sub_fc3022e4\n"
 493 "       str     r0, [r4,#4]\n"
 494 " locret_fc083c16:\n"
 495 "       pop     {r3-r5,pc}\n"
 496 ".ltorg\n"
 497     );
 498 }
 499 
 500 void __attribute__((naked,noinline)) init_file_modules_task() { //sub_FC0F79A0_my()
 501     asm volatile (
 502 "       push    {r4-r6,lr}\n"
 503 "       bl      sub_fc0f9dec\n"
 504 "       movs    r4, r0\n"
 505 "       movw    r5, #0x5006\n"
 506 "       beq     loc_fc0f79b6\n"
 507 "       movs    r1, #0\n"
 508 "       mov     r0, r5\n"
 509 "       bl      sub_fc37eba4\n"
 510 " loc_fc0f79b6:\n"
 511 "       bl      sub_fc0f9e16\n"
 512 "    BL      core_spytask_can_start\n" // + CHDK: Set "it's-safe-to-start" flag for spytask
 513 "       cmp     r4, #0\n"
 514 "       bne     locret_fc0f79ca\n"
 515 "       mov     r0, r5\n"
 516 "       pop.w   {r4-r6,lr}\n"
 517 "       movs    r1, #0\n"
 518 "       b.w     sub_fc37eba4\n"
 519 " locret_fc0f79ca:\n"
 520 "       pop     {r4-r6,pc}\n"
 521 ".ltorg\n"
 522     );
 523 }
 524 
 525 void __attribute__((naked,noinline)) kbd_p2_f_my() { // sub_FC083914
 526     asm volatile(
 527 "       push.w  {r4-r8,lr}\n"
 528 "       ldr     r6, =0x520ec\n"
 529 "       sub     sp, sp, #0x18\n"
 530 "       add     r7, sp, #8\n"
 531 "       subs    r6, #0xc\n"
 532 "       b       loc_fc083956\n"
 533 " loc_fc083922:\n"
 534 "       ldr     r1, =0x520ec\n"
 535 "       add     r3, sp, #0x8\n"
 536 "       ldrb.w  r0, [sp,#0x4]\n"
 537 "       add     r2, sp, #0x14\n"
 538 "       subs    r1, #0x18\n"
 539 "       bl      sub_fc075420\n"
 540 "       cbnz    r0, loc_fc08393c\n"
 541 "       ldr     r1, [sp,#0x14]\n"
 542 "       movs    r0, #0\n"
 543 "       bl      sub_fc083886\n"
 544 " loc_fc08393c:\n"
 545 "       movs    r0, #2\n"
 546 " loc_fc08393e:\n"
 547 "       ldr.w   r1, [r7,r0,lsl#2]\n"
 548 "       cbz     r1, loc_fc08394e\n"
 549 "       ldr.w   r2, [r6,r0,lsl#2]\n"
 550 "       bics    r2, r1\n"
 551 "       str.w   r2, [r6,r0,lsl#2]\n"
 552 " loc_fc08394e:\n"
 553 "       subs    r0, r0, #1\n"
 554 "       sxtb    r0, r0\n"
 555 "       cmp     r0, #0\n"
 556 "       bge     loc_fc08393e\n"
 557 " loc_fc083956:\n"
 558 "       ldr     r0, =0x520ec\n"
 559 "       add     r1, sp, #0x4\n"
 560 "       subs    r0, #0xc\n"
 561 "       bl      sub_fc0750d2\n"
 562 "       cmp     r0, #0\n"
 563 "       bne     loc_fc083922\n"
 564 "       ldr.w   r8, =0x520ec\n"
 565 "       movs    r4, #0\n"
 566 " loc_fc08396a:\n"
 567 "       movs    r5, #0\n"
 568 "       ldr.w   r0, [r6,r4,lsl#2]\n"
 569 "       ldr.w   r1, [r8,r4,lsl#2]\n"
 570 "       ands    r0, r1\n"
 571 "       str.w   r0, [r6,r4,lsl#2]\n"
 572 "       b       loc_fc0839c2\n"
 573 " loc_fc08397c:\n"
 574 "       lsrs    r0, r5\n"
 575 "       lsls    r0, r0, #0x1f\n"
 576 "       beq     loc_fc0839ba\n"
 577 "       ldr     r1, =0x520ec\n"
 578 "       add.w   r0, r5, r4,lsl#5\n"
 579 "       add     r3, sp, #0x8\n"
 580 "       subs    r1, #0x18\n"
 581 "       add     r2, sp, #0x14\n"
 582 "       uxtb    r0, r0\n"
 583 "       bl      sub_fc075420\n"
 584 "       cbnz    r0, loc_fc08399e\n"
 585 "       ldr     r1, [sp,#0x14]\n"
 586 "       movs    r0, #1\n"
 587 "       bl      sub_fc083886\n"
 588 " loc_fc08399e:\n"
 589 "       mov     r0, r4\n"
 590 "       b       loc_fc0839b6\n"
 591 " loc_fc0839a2:\n"
 592 "       ldr.w   r1, [r7,r0,lsl#2]\n"
 593 "       cbz     r1, loc_fc0839b2\n"
 594 "       ldr.w   r2, [r6,r0,lsl#2]\n"
 595 "       bics    r2, r1\n"
 596 "       str.w   r2, [r6,r0,lsl#2]\n"
 597 " loc_fc0839b2:\n"
 598 "       adds    r0, r0, #1\n"
 599 "       sxtb    r0, r0\n"
 600 " loc_fc0839b6:\n"
 601 "       cmp     r0, #3\n"
 602 "       blt     loc_fc0839a2\n"
 603 " loc_fc0839ba:\n"
 604 "       ldr.w   r0, [r6,r4,lsl#2]\n"
 605 "       adds    r5, r5, #1\n"
 606 "       uxtb    r5, r5\n"
 607 " loc_fc0839c2:\n"
 608 "       cmp     r0, #0\n"
 609 "       bne     loc_fc08397c\n"
 610 "       adds    r4, r4, #1\n"
 611 "       sxtb    r4, r4\n"
 612 "       cmp     r4, #3\n"
 613 "       blt     loc_fc08396a\n"
 614 "       bl      sub_fc074e8a_my\n" // ->
 615 "       add     sp, sp, #0x18\n"
 616 "       pop.w   {r4-r8,pc}\n"
 617 ".ltorg\n"
 618     );
 619 }
 620 
 621 void __attribute__((naked,noinline)) sub_fc074e8a_my() {
 622     asm volatile(
 623 "  push    {r4,lr}\n"
 624 "  ldr     r4, =0x9e6c\n"
 625 "  ldr     r0, [r4,#0x10]\n"
 626 "  bl      sub_fc0765e4\n"
 627 "  ldr     r0, [r4,#0x14]\n"
 628 "  bl      sub_fc07666e\n"
 629 "  bl      sub_fc0766f6\n"
 630 "  bl      sub_fc17b378\n"
 631 "  ldr     r0, [r4,#0x18]\n"
 632 "  bl      sub_fc076500\n"
 633 "  ldr     r0, [r4,#0x1C]\n"
 634 "  bl      sub_fc076500\n"
 635 // "  pop.w   {r4,lr}\n"                  // - (reordered below)
 636 // "  b.w     sub_fc076948\n"    // - (reordered below)
 637 
 638 "    bl      handle_jogdial\n"  // +
 639 "    cmp     r0, #0\n"          // +
 640 "    beq     no_scroll\n"       // +
 641 "                 b.w     sub_fc076948\n"// handles scrollwheel(s), void function, no args
 642 "no_scroll:\n"                  // +
 643 "    pop     {r4, pc}\n"        // +
 644     );
 645 }
 646 
 647 
 648 long __attribute__((naked,noinline)) wrap_kbd_p1_f() {
 649 
 650 asm volatile(
 651 "       push    {r1-r7,lr}\n"
 652 "       movs    r4, #0\n"
 653 "       bl      my_kbd_read_keys\n"
 654 " kbd_p1_f_cont:\n"
 655 "       ldr     r3, =physw_status\n"
 656 "       movs    r0, #2\n"
 657 "       mov     r5, sp\n"
 658 "       add.w   r6, r3, #0x24\n"
 659 " loc_fc083ebe:\n"
 660 "       add.w   r1, r6, r0,lsl#2\n"
 661 "       ldr.w   r2, [r3,r0,lsl#2]\n"
 662 "       ldr     r7, [r1,#0xc]\n"
 663 "       ldr     r1, [r1,#0x18]\n"
 664 "       and.w   r2, r2, r7\n"
 665 "       eor.w   r2, r2, r1\n"
 666 "       str.w   r2, [r5,r0,lsl#2]\n"
 667 "       subs    r0, r0, #1\n"
 668 "       bpl     loc_fc083ebe\n"
 669 "       ldr     r2, =physw_status\n"
 670 "       mov     r0, sp\n"
 671 "       adds    r2, #0x18\n"
 672 "       sub.w   r1, r2, #0xc\n"
 673 "       bl      sub_fc0839d8_my\n" //kbd_read_keys2\n"
 674 "       ldr     r0, =physw_status\n"
 675 "       adds    r0, #0xc\n"
 676 "       bl      sub_fc074e34\n"
 677 "       cmp     r0, #1\n"
 678 "       bne     loc_fc083ef6\n"
 679 "       movs    r4, #1\n"
 680 " loc_fc083ef6:\n"
 681 "       ldr     r2, =physw_status\n"
 682 "       movs    r0, #2\n"
 683 "       adds    r2, #0x18\n"
 684 "       sub.w   r3, r2, #0xc\n"
 685 " loc_fc083f00:\n"
 686 "       ldr.w   r1, [r2,r0,lsl#2]\n"
 687 "       cbz     r1, loc_fc083f1a\n"
 688 "       ldr.w   r4, [r3,r0,lsl#2]\n"
 689 "       ldr.w   r6, [r5,r0,lsl#2]\n"
 690 "       bics    r4, r1\n"
 691 "       ands    r1, r6\n"
 692 "       orrs    r4, r1\n"
 693 "       str.w   r4, [r3,r0,lsl#2]\n"
 694 "       movs    r4, #1\n"
 695 " loc_fc083f1a:\n"
 696 "       subs    r0, r0, #1\n"
 697 "       bpl     loc_fc083f00\n"
 698 "       mov     r0, r4\n"
 699 "       pop     {r1-r7,pc}\n"
 700 ".ltorg\n"
 701 );
 702 return 0;
 703 }
 704 
 705 void __attribute__((naked,noinline)) sub_fc0839d8_my() {
 706 asm volatile(
 707 "       push.w  {r0-r12,lr}\n"
 708 "       ldr     r7, =0x520ec\n"
 709 "       mov     r5, r0\n"
 710 "       mov.w   r0, #0xffffffff\n"
 711 "       mov     r9, r1\n"
 712 "       str     r0, [sp]\n"
 713 "       movs    r0, #2\n"
 714 "       adds    r7, #0x24\n"
 715 "       mov     r6, r2\n"
 716 " loc_fc0839ee:\n"
 717 "       ldr.w   r1, [r5,r0,lsl#2]\n"
 718 "       ldr.w   r2, [r9,r0,lsl#2]\n"
 719 "       eors    r1, r2\n"
 720 "       add.w   r2, r7, r0,lsl#2\n"
 721 "       ldr.w   r2, [r2,#0xc0]\n"
 722 "       ands    r1, r2\n"
 723 "       str.w   r1, [r6,r0,lsl#2]\n"
 724 "       subs    r0, r0, #1\n"
 725 "       sxtb    r0, r0\n"
 726 "       cmp     r0, #0\n"
 727 "       bge     loc_fc0839ee\n"
 728 "       movs    r0, #2\n"
 729 " loc_fc083a10:\n"
 730 "       ldrh    r1, [r7,#0x30]\n"
 731 "       add.w   r1, r1, r1,lsl#1\n"
 732 "       ldr.w   r2, [r5,r0,lsl#2]\n"
 733 "       add.w   r1, r7, r1,lsl#2\n"
 734 "       add.w   r1, r1, r0,lsl#2\n"
 735 "       subs    r0, r0, #1\n"
 736 "       sxtb    r0, r0\n"
 737 "       cmp     r0, #0\n"
 738 "       str     r2, [r1,#0xc]\n"
 739 "       bge     loc_fc083a10\n"
 740 "       ldrh    r0, [r7,#0x30]\n"
 741 "       mov.w   r12, #0\n"
 742 "       adds    r0, r0, #1\n"
 743 "       cmp     r0, #3\n"
 744 "       bcc     loc_fc083a3e\n"
 745 "       strh.w  r12, [r7,#0x30]\n"
 746 "       b       loc_fc083a40\n"
 747 " loc_fc083a3e:\n"
 748 "       strh    r0, [r7,#0x30]\n"
 749 " loc_fc083a40:\n"
 750 "       movs    r0, #2\n"
 751 " loc_fc083a42:\n"
 752 "       movs    r2, #0\n"
 753 "       mov     r1, r2\n"
 754 " loc_fc083a46:\n"
 755 "       add.w   r3, r1, r1,lsl#1\n"
 756 "       adds    r1, r1, #1\n"
 757 "       add.w   r3, r7, r3,lsl#2\n"
 758 "       add.w   r3, r3, r0,lsl#2\n"
 759 "       sxtb    r1, r1\n"
 760 "       ldr     r4, [r3,#0xc]\n"
 761 "       ldr     r3, [r3,#0x18]\n"
 762 "       eors    r4, r3\n"
 763 "       orrs    r2, r4\n"
 764 "       cmp     r1, #2\n"
 765 "       blt     loc_fc083a46\n"
 766 "       ldr.w   r1, [r5,r0,lsl#2]\n"
 767 "       ldr.w   r3, [r9,r0,lsl#2]\n"
 768 "       eors    r1, r3\n"
 769 "       bics    r1, r2\n"
 770 "       ldr.w   r2, [r7,r0,lsl#2]\n"
 771 "       ands    r1, r2\n"
 772 "       ldr.w   r2, [r6,r0,lsl#2]\n"
 773 "       orrs    r1, r2\n"
 774 "       str.w   r1, [r6,r0,lsl#2]\n"
 775 "       subs    r0, r0, #1\n"
 776 "       sxtb    r0, r0\n"
 777 "       cmp     r0, #0\n"
 778 "       bge     loc_fc083a42\n"
 779 "       add.w   r10, sp, #4\n"
 780 "       mov.w   r8, #4\n"
 781 "       mov     r11, r12\n"
 782 " loc_fc083a90:\n"
 783 "       ldr     r3, =0x520ec\n"
 784 "       movs    r1, #0\n"
 785 "       mov     r12, r10\n"
 786 "       movs    r0, #2\n"
 787 "       rsb.w   r2, r8, r8,lsl#3\n"
 788 "       adds    r3, #0x24\n"
 789 "       add.w   r4, r3, r2,lsl#2\n"
 790 " loc_fc083aa2:\n"
 791 "       mov     r10, r12\n"
 792 "       add.w   r2, r4, r0,lsl#2\n"
 793 "       str.w   r11, [r12,r0,lsl#2]\n"
 794 "       ldr     r2, [r2,#0x38]\n"
 795 "       cbz     r2, loc_fc083ac2\n"
 796 "       ldr.w   r3, [r9,r0,lsl#2]\n"
 797 "       ldr.w   r7, [r5,r0,lsl#2]\n"
 798 "       eors    r3, r7\n"
 799 "       ands    r3, r2\n"
 800 "       orrs    r1, r3\n"
 801 "       str.w   r3, [r10,r0,lsl#2]\n"
 802 " loc_fc083ac2:\n"
 803 "       subs    r0, r0, #1\n"
 804 "       sxtb    r0, r0\n"
 805 "       cmp     r0, #0\n"
 806 "       bge     loc_fc083aa2\n"
 807 "       cbnz    r1, loc_fc083ad2\n"
 808 "       strb.w  r11, [r4,#0x36]\n"
 809 "       b       loc_fc083b86\n"
 810 " loc_fc083ad2:\n"
 811 "       ldrb.w  r0, [r4,#0x36]\n"
 812 "       cbz     r0, loc_fc083afa\n"
 813 "       movs    r0, #2\n"
 814 " loc_fc083ada:\n"
 815 "       add.w   r1, r4, r0,lsl#2\n"
 816 "       ldr.w   r3, [r5,r0,lsl#2]\n"
 817 "       ldr     r2, [r1,#0x44]\n"
 818 "       ldr     r1, [r1,#0x38]\n"
 819 "       eors    r2, r3\n"
 820 "       tst     r2, r1\n"
 821 "       beq     loc_fc083af2\n"
 822 "       strb.w  r11, [r4,#0x36]\n"
 823 "       b       loc_fc083afa\n"
 824 " loc_fc083af2:\n"
 825 "       subs    r0, r0, #1\n"
 826 "       sxtb    r0, r0\n"
 827 "       cmp     r0, #0\n"
 828 "       bge     loc_fc083ada\n"
 829 " loc_fc083afa:\n"
 830 "       add.w   r4, r4, #0x34\n"
 831 "       ldrb    r0, [r4,#2]\n"
 832 "       add.w   r0, r0, #1\n"
 833 "       strb    r0, [r4,#2]\n"
 834 "       ldrb.w  r0, [r4],#-0x34\n"
 835 "       lsls    r0, r0, #0x18\n"
 836 "       bpl     loc_fc083b34\n"
 837 "       ldr     r0, [r5]\n"
 838 "       ldr     r1, [r4,#0x38]\n"
 839 "       ldr     r2, [r4,#0x3c]\n"
 840 "       ands    r0, r1\n"
 841 "       ldr     r1, [r5,#4]\n"
 842 "       ands    r1, r2\n"
 843 "       ldr     r2, [r4,#0x40]\n"
 844 "       orrs    r0, r1\n"
 845 "       ldr     r1, [r5,#8]\n"
 846 "       ands    r1, r2\n"
 847 "       orrs    r0, r1\n"
 848 "       ldrb.w  r0, [r4,#0x35]\n"
 849 "       beq     loc_fc083b2e\n"
 850 "       lsrs    r7, r0, #4\n"
 851 "       b       loc_fc083b38\n"
 852 " loc_fc083b2e:\n"
 853 "       and.w   r7, r0, #0xf\n"
 854 "       b       loc_fc083b38\n"
 855 " loc_fc083b34:\n"
 856 "       ldrsb.w r7, [r4,#0x35]\n"
 857 " loc_fc083b38:\n"
 858 "       cmp     r7, #1\n"
 859 "       bne     loc_fc083b4a\n"
 860 "       ldr     r2, =0x520ec\n"
 861 "       add.w   r3, r4, #0x34\n"
 862 "       mov     r1, r5\n"
 863 "       mov     r0, sp\n"
 864 "       bl      sub_fc07507e_my\n" //getkbdstate2
 865 " loc_fc083b4a:\n"
 866 "       ldrb.w  r0, [r4,#0x36]\n"
 867 "       cmp     r0, r7\n"
 868 "       blt     loc_fc083b72\n"
 869 "       movs    r0, #2\n"
 870 "       mov     r2, r10\n"
 871 " loc_fc083b56:\n"
 872 "       ldr.w   r1, [r2,r0,lsl#2]\n"
 873 "       cbz     r1, loc_fc083b66\n"
 874 "       ldr.w   r3, [r6,r0,lsl#2]\n"
 875 "       orrs    r3, r1\n"
 876 "       str.w   r3, [r6,r0,lsl#2]\n"
 877 " loc_fc083b66:\n"
 878 "       subs    r0, r0, #1\n"
 879 "       sxtb    r0, r0\n"
 880 "       cmp     r0, #0\n"
 881 "       bge     loc_fc083b56\n"
 882 "       strb.w  r11, [r4,#0x36]\n"
 883 " loc_fc083b72:\n"
 884 "       movs    r0, #2\n"
 885 " loc_fc083b74:\n"
 886 "       add.w   r2, r4, r0,lsl#2\n"
 887 "       ldr.w   r1, [r5,r0,lsl#2]\n"
 888 "       subs    r0, r0, #1\n"
 889 "       sxtb    r0, r0\n"
 890 "       cmp     r0, #0\n"
 891 "       str     r1, [r2,#0x44]\n"
 892 "       bge     loc_fc083b74\n"
 893 " loc_fc083b86:\n"
 894 "       sub.w   r0, r8, #1\n"
 895 "       sxtb.w  r8, r0\n"
 896 "       cmp.w   r8, #0\n"
 897 "       bge.w   loc_fc083a90\n"
 898 "       pop.w   {r0-r12,pc}\n"
 899 ".ltorg\n"
 900 );
 901 }
 902 
 903 
 904 void __attribute__((naked,noinline)) sub_fc07507e_my() {
 905 
 906 extern long kbd_mod_state[];
 907 asm volatile(
 908 "       push    {r4-r8,lr}\n"
 909 "       ldr     r4, [r0]\n"
 910 "       adds    r4, r4, #1\n"
 911 "       bne     loc_fc075090\n"
 912 "       ldr     r4, =0xd20bf4a0\n"
 913 "       ldr     r4, [r4]\n"
 914 "       ldr     r5, =0x43ff9\n"
 915 "ldr     r8, =kbd_mod_state\n"
 916 "ldr     r8, [r8,#4]\n"
 917 "ands    r4, r8\n"
 918 "       ands    r4, r5\n"
 919 "       str     r4, [r0]\n"
 920 " loc_fc075090:\n"
 921 "       movs    r4, #2\n"
 922 " loc_fc075092:\n"
 923 "       add.w   r5, r3, r4,lsl#2\n"
 924 "       ldr     r5, [r5,#4]\n"
 925 "       cbnz    r5, loc_fc07509e\n"
 926 "       subs    r4, r4, #1\n"
 927 "       bpl     loc_fc075092\n"
 928 " loc_fc07509e:\n"
 929 "       ldr     r5, [r0]\n"
 930 "       add.w   r0, r2, r4,lsl#2\n"
 931 "       add.w   r7, r3, r4,lsl#2\n"
 932 "       ldr     r2, [r0,#0xc]\n"
 933 "       ldr     r0, [r0,#0x18]\n"
 934 "       ands    r5, r2\n"
 935 "       ldr.w   r2, [r1,r4,lsl#2]\n"
 936 "       eors    r5, r0\n"
 937 "       ldr     r0, [r7,#4]\n"
 938 "       ands    r5, r0\n"
 939 "       and.w   r6, r2, r0\n"
 940 "       cmp     r6, r5\n"
 941 "       beq     locret_fc0750d0\n"
 942 "       ldr     r5, [r7,#0x10]\n"
 943 "       bics    r2, r0\n"
 944 "       ands    r5, r0\n"
 945 "       orrs    r2, r5\n"
 946 "       str.w   r2, [r1,r4,lsl#2]\n"
 947 "       movs    r0, #0\n"
 948 "       strb    r0, [r3,#2]\n"
 949 " locret_fc0750d0:\n"
 950 "       pop     {r4-r8,pc}\n"
 951 ".ltorg\n"
 952 );
 953 }
 954 
 955 void agent_orange(){
 956 *(int*)0xd20b0810  = 0x4d0002;   // Orange Led = on
 957 }
 958 

/* [<][>][^][v][top][bottom][index][help] */