| 1 | #include "lolevel.h"
|
|---|
| 2 | #include "platform.h"
|
|---|
| 3 | #include "core.h"
|
|---|
| 4 | #include "dryos31.h"
|
|---|
| 5 |
|
|---|
| 6 | #define offsetof(TYPE, MEMBER) ((int) &((TYPE *)0)->MEMBER)
|
|---|
| 7 |
|
|---|
| 8 | const char * const new_sa = &_end;
|
|---|
| 9 |
|
|---|
| 10 | void taskHook(context_t **context) {
|
|---|
| 11 | task_t *tcb=(task_t*)((char*)context-offsetof(task_t, context));
|
|---|
| 12 |
|
|---|
| 13 | if(!_strcmp(tcb->name, "PhySw")) tcb->entry = (void*)mykbd_task;
|
|---|
| 14 | if(!_strcmp(tcb->name, "CaptSeqTask")) tcb->entry = (void*)capt_seq_task;
|
|---|
| 15 | if(!_strcmp(tcb->name, "InitFileModules")) tcb->entry = (void*)init_file_modules_task;
|
|---|
| 16 | if(!_strcmp(tcb->name, "MovieRecord")) tcb->entry = (void*)movie_record_task;
|
|---|
| 17 | if(!_strcmp(tcb->name, "ExpDrvTask")) tcb->entry = (void*)exp_drv_task;
|
|---|
| 18 | }
|
|---|
| 19 |
|
|---|
| 20 | void CreateTask_spytask() {
|
|---|
| 21 | _CreateTask("SpyTask", 0x19, 0x2000, core_spytask, 0);
|
|---|
| 22 | };
|
|---|
| 23 |
|
|---|
| 24 |
|
|---|
| 25 | void __attribute__((naked,noinline)) boot() {
|
|---|
| 26 | asm volatile (
|
|---|
| 27 | /*// LED Test
|
|---|
| 28 | "LDR R1, =0xC0220088\n" // Green LED
|
|---|
| 29 | "MOV R0, #0x46\n" // Power on LED
|
|---|
| 30 | "STR R0, [R1]\n"
|
|---|
| 31 | // End LED Test*/
|
|---|
| 32 |
|
|---|
| 33 | "LDR R1, =0xC0410000\n"
|
|---|
| 34 | "MOV R0, #0\n"
|
|---|
| 35 | "STR R0, [R1]\n"
|
|---|
| 36 | "MOV R1, #0x78\n"
|
|---|
| 37 | "MCR p15, 0, R1,c1,c0\n"
|
|---|
| 38 | "MOV R1, #0\n"
|
|---|
| 39 | "MCR p15, 0, R1,c7,c10, 4\n"
|
|---|
| 40 | "MCR p15, 0, R1,c7,c5\n"
|
|---|
| 41 | "MCR p15, 0, R1,c7,c6\n"
|
|---|
| 42 | "MOV R0, #0x3D\n"
|
|---|
| 43 | "MCR p15, 0, R0,c6,c0\n"
|
|---|
| 44 | "MOV R0, #0xC000002F\n"
|
|---|
| 45 | "MCR p15, 0, R0,c6,c1\n"
|
|---|
| 46 | "MOV R0, #0x31\n"
|
|---|
| 47 | "MCR p15, 0, R0,c6,c2\n"
|
|---|
| 48 | "LDR R0, =0x10000031\n"
|
|---|
| 49 | "MCR p15, 0, R0,c6,c3\n"
|
|---|
| 50 | "MOV R0, #0x40000017\n"
|
|---|
| 51 | "MCR p15, 0, R0,c6,c4\n"
|
|---|
| 52 | "LDR R0, =0xFFC0002B\n"
|
|---|
| 53 | "MCR p15, 0, R0,c6,c5\n"
|
|---|
| 54 | "MOV R0, #0x34\n"
|
|---|
| 55 | "MCR p15, 0, R0,c2,c0\n"
|
|---|
| 56 | "MOV R0, #0x34\n"
|
|---|
| 57 | "MCR p15, 0, R0,c2,c0, 1\n"
|
|---|
| 58 | "MOV R0, #0x34\n"
|
|---|
| 59 | "MCR p15, 0, R0,c3,c0\n"
|
|---|
| 60 | "LDR R0, =0x3333330\n"
|
|---|
| 61 | "MCR p15, 0, R0,c5,c0, 2\n"
|
|---|
| 62 | "LDR R0, =0x3333330\n"
|
|---|
| 63 | "MCR p15, 0, R0,c5,c0, 3\n"
|
|---|
| 64 | "MRC p15, 0, R0,c1,c0\n"
|
|---|
| 65 | "ORR R0, R0, #0x1000\n"
|
|---|
| 66 | "ORR R0, R0, #4\n"
|
|---|
| 67 | "ORR R0, R0, #1\n"
|
|---|
| 68 | "MCR p15, 0, R0,c1,c0\n"
|
|---|
| 69 | "MOV R1, #0x40000006\n"
|
|---|
| 70 | "MCR p15, 0, R1,c9,c1\n"
|
|---|
| 71 | "MOV R1, #6\n"
|
|---|
| 72 | "MCR p15, 0, R1,c9,c1, 1\n"
|
|---|
| 73 | "MRC p15, 0, R1,c1,c0\n"
|
|---|
| 74 | "ORR R1, R1, #0x50000\n"
|
|---|
| 75 | "MCR p15, 0, R1,c1,c0\n"
|
|---|
| 76 | "LDR R2, =0xC0200000\n"
|
|---|
| 77 | "MOV R1, #1\n"
|
|---|
| 78 | "STR R1, [R2,#0x10C]\n"
|
|---|
| 79 | "MOV R1, #0xFF\n"
|
|---|
| 80 | "STR R1, [R2,#0xC]\n"
|
|---|
| 81 | "STR R1, [R2,#0x1C]\n"
|
|---|
| 82 | "STR R1, [R2,#0x2C]\n"
|
|---|
| 83 | "STR R1, [R2,#0x3C]\n"
|
|---|
| 84 | "STR R1, [R2,#0x4C]\n"
|
|---|
| 85 | "STR R1, [R2,#0x5C]\n"
|
|---|
| 86 | "STR R1, [R2,#0x6C]\n"
|
|---|
| 87 | "STR R1, [R2,#0x7C]\n"
|
|---|
| 88 | "STR R1, [R2,#0x8C]\n"
|
|---|
| 89 | "STR R1, [R2,#0x9C]\n"
|
|---|
| 90 | "STR R1, [R2,#0xAC]\n"
|
|---|
| 91 | "STR R1, [R2,#0xBC]\n"
|
|---|
| 92 | "STR R1, [R2,#0xCC]\n"
|
|---|
| 93 | "STR R1, [R2,#0xDC]\n"
|
|---|
| 94 | "STR R1, [R2,#0xEC]\n"
|
|---|
| 95 | "STR R1, [R2,#0xFC]\n"
|
|---|
| 96 | "LDR R1, =0xC0400008\n"
|
|---|
| 97 | "LDR R2, =0x430005\n"
|
|---|
| 98 | "STR R2, [R1]\n"
|
|---|
| 99 | "MOV R1, #1\n"
|
|---|
| 100 | "LDR R2, =0xC0243100\n"
|
|---|
| 101 | "STR R2, [R1]\n"
|
|---|
| 102 | "LDR R2, =0xC0242010\n"
|
|---|
| 103 | "LDR R1, [R2]\n"
|
|---|
| 104 | "ORR R1, R1, #1\n"
|
|---|
| 105 | "STR R1, [R2]\n"
|
|---|
| 106 | "LDR R0, =0xFFEEB810\n"
|
|---|
| 107 | "LDR R1, =0x1900\n"
|
|---|
| 108 | "LDR R3, =0xABA4\n"
|
|---|
| 109 | "loc_FFC0013C:\n"
|
|---|
| 110 | "CMP R1, R3\n"
|
|---|
| 111 | "LDRCC R2, [R0],#4\n"
|
|---|
| 112 | "STRCC R2, [R1],#4\n"
|
|---|
| 113 | "BCC loc_FFC0013C\n"
|
|---|
| 114 | "LDR R1, =0x128E90\n"
|
|---|
| 115 | "MOV R2, #0\n"
|
|---|
| 116 | "loc_FFC00154:\n"
|
|---|
| 117 | "CMP R3, R1\n"
|
|---|
| 118 | "STRCC R2, [R3],#4\n"
|
|---|
| 119 | "BCC loc_FFC00154\n"
|
|---|
| 120 | "B sub_FFC00358_my\n" //--------->
|
|---|
| 121 | );
|
|---|
| 122 | };
|
|---|
| 123 |
|
|---|
| 124 |
|
|---|
| 125 | void __attribute__((naked,noinline)) sub_FFC00358_my() {
|
|---|
| 126 | *(int*)0x1934=(int)taskHook; // ?
|
|---|
| 127 | *(int*)0x1938=(int)taskHook; // ?
|
|---|
| 128 |
|
|---|
| 129 | // "correct power on" is to start in record mode if the power button is held down, on cameras that can start with play or power button. Otherwise CHDK always starts in play mode.
|
|---|
| 130 | *(int*)(0x20F8)= (*(int*)0xC022005C) & 1 ? 0x4000000 : 0x2000000; // replacement of sub_FFC42F30 for correct power-on.
|
|---|
| 131 |
|
|---|
| 132 | asm volatile (
|
|---|
| 133 | "LDR R0, =0xFFC003D0\n"
|
|---|
| 134 | "MOV R1, #0\n"
|
|---|
| 135 | "LDR R3, =0xFFC00408\n"
|
|---|
| 136 | "loc_FFC00364:\n"
|
|---|
| 137 | "CMP R0, R3\n"
|
|---|
| 138 | "LDRCC R2, [R0],#4\n"
|
|---|
| 139 | "STRCC R2, [R1],#4\n"
|
|---|
| 140 | "BCC loc_FFC00364\n"
|
|---|
| 141 | "LDR R0, =0xFFC00408\n"
|
|---|
| 142 | "MOV R1, #0x4B0\n"
|
|---|
| 143 | "LDR R3, =0xFFC0061C\n"
|
|---|
| 144 | "loc_FFC00380:\n"
|
|---|
| 145 | "CMP R0, R3\n"
|
|---|
| 146 | "LDRCC R2, [R0],#4\n"
|
|---|
| 147 | "STRCC R2, [R1],#4\n"
|
|---|
| 148 | "BCC loc_FFC00380\n"
|
|---|
| 149 | "MOV R0, #0xD2\n"
|
|---|
| 150 | "MSR CPSR_cxsf, R0\n"
|
|---|
| 151 | "MOV SP, #0x1000\n"
|
|---|
| 152 | "MOV R0, #0xD3\n"
|
|---|
| 153 | "MSR CPSR_cxsf, R0\n"
|
|---|
| 154 | "MOV SP, #0x1000\n"
|
|---|
| 155 | "LDR R0, =0x6C4\n"
|
|---|
| 156 | "LDR R2, =0xEEEEEEEE\n"
|
|---|
| 157 | "MOV R3, #0x1000\n"
|
|---|
| 158 | "loc_FFC003B4:\n"
|
|---|
| 159 | "CMP R0, R3\n"
|
|---|
| 160 | "STRCC R2, [R0],#4\n"
|
|---|
| 161 | "BCC loc_FFC003B4\n"
|
|---|
| 162 | "BL sub_FFC0119C_my\n" //-------->
|
|---|
| 163 | );
|
|---|
| 164 | }
|
|---|
| 165 |
|
|---|
| 166 | void __attribute__((naked,noinline)) sub_FFC0119C_my() {
|
|---|
| 167 | asm volatile (
|
|---|
| 168 | "STR LR, [SP,#-4]!\n"
|
|---|
| 169 | "SUB SP, SP, #0x74\n"
|
|---|
| 170 | "MOV R0, SP\n"
|
|---|
| 171 | "MOV R1, #0x74\n"
|
|---|
| 172 | "BL sub_FFE81080\n"
|
|---|
| 173 | "MOV R0, #0x53000\n"
|
|---|
| 174 | "STR R0, [SP,#4]\n"
|
|---|
| 175 | // "LDR R0, =0x128E90\n" // -
|
|---|
| 176 | "LDR R0, =new_sa\n" // +
|
|---|
| 177 | "LDR R0, [R0]\n" // +
|
|---|
| 178 | "LDR R2, =0x279C00\n"
|
|---|
| 179 | "LDR R1, =0x2724A8\n"
|
|---|
| 180 | "STR R0, [SP,#8]\n"
|
|---|
| 181 | "SUB R0, R1, R0\n"
|
|---|
| 182 | "ADD R3, SP, #0xC\n"
|
|---|
| 183 | "STR R2, [SP]\n"
|
|---|
| 184 | "STMIA R3, {R0-R2}\n"
|
|---|
| 185 | "MOV R0, #0x22\n"
|
|---|
| 186 | "STR R0, [SP,#0x18]\n"
|
|---|
| 187 | "MOV R0, #0x68\n"
|
|---|
| 188 | "STR R0, [SP,#0x1C]\n"
|
|---|
| 189 | "LDR R0, =0x19B\n"
|
|---|
| 190 | "LDR R1, =sub_FFC05E5C_my\n" //--------->
|
|---|
| 191 | "STR R0, [SP,#0x20]\n"
|
|---|
| 192 | "MOV R0, #0x96\n"
|
|---|
| 193 | "STR R0, [SP,#0x24]\n"
|
|---|
| 194 | "MOV R0, #0x78\n"
|
|---|
| 195 | "STR R0, [SP,#0x28]\n"
|
|---|
| 196 | "MOV R0, #0x64\n"
|
|---|
| 197 | "STR R0, [SP,#0x2C]\n"
|
|---|
| 198 | "MOV R0, #0\n"
|
|---|
| 199 | "STR R0, [SP,#0x30]\n"
|
|---|
| 200 | "STR R0, [SP,#0x34]\n"
|
|---|
| 201 | "MOV R0, #0x10\n"
|
|---|
| 202 | "STR R0, [SP,#0x5C]\n"
|
|---|
| 203 | "MOV R0, #0x800\n"
|
|---|
| 204 | "STR R0, [SP,#0x60]\n"
|
|---|
| 205 | "MOV R0, #0xA0\n"
|
|---|
| 206 | "STR R0, [SP,#0x64]\n"
|
|---|
| 207 | "MOV R0, #0x280\n"
|
|---|
| 208 | "STR R0, [SP,#0x68]\n"
|
|---|
| 209 | "MOV R0, SP\n"
|
|---|
| 210 | "MOV R2, #0\n"
|
|---|
| 211 | "BL sub_FFC03408\n"
|
|---|
| 212 | "ADD SP, SP, #0x74\n"
|
|---|
| 213 | "LDR PC, [SP],#4\n"
|
|---|
| 214 | );
|
|---|
| 215 | }
|
|---|
| 216 |
|
|---|
| 217 |
|
|---|
| 218 | void __attribute__((naked,noinline)) sub_FFC05E5C_my() {
|
|---|
| 219 | asm volatile (
|
|---|
| 220 | "STMFD SP!, {R4,LR}\n"
|
|---|
| 221 | "BL sub_FFC00B24\n"
|
|---|
| 222 | "BL sub_FFC0A8D0\n"
|
|---|
| 223 | "CMP R0, #0\n"
|
|---|
| 224 | "LDRLT R0, =0xFFC05F70\n"
|
|---|
| 225 | "BLLT sub_FFC05F50\n"
|
|---|
| 226 | "BL sub_FFC05A98\n"
|
|---|
| 227 | "CMP R0, #0\n"
|
|---|
| 228 | "LDRLT R0, =0xFFC05F78\n"
|
|---|
| 229 | "BLLT sub_FFC05F50\n"
|
|---|
| 230 | "LDR R0, =0xFFC05F88\n"
|
|---|
| 231 | "BL sub_FFC05B80\n"
|
|---|
| 232 | "CMP R0, #0\n"
|
|---|
| 233 | "LDRLT R0, =0xFFC05F90\n"
|
|---|
| 234 | "BLLT sub_FFC05F50\n"
|
|---|
| 235 | "LDR R0, =0xFFC05F88\n"
|
|---|
| 236 | "BL sub_FFC03BF4\n"
|
|---|
| 237 | "CMP R0, #0\n"
|
|---|
| 238 | "LDRLT R0, =0xFFC05FA4\n"
|
|---|
| 239 | "BLLT sub_FFC05F50\n"
|
|---|
| 240 | "BL sub_FFC0A2C8\n"
|
|---|
| 241 | "CMP R0, #0\n"
|
|---|
| 242 | "LDRLT R0, =0xFFC05FB0\n"
|
|---|
| 243 | "BLLT sub_FFC05F50\n"
|
|---|
| 244 | "BL sub_FFC01680\n"
|
|---|
| 245 | "CMP R0, #0\n"
|
|---|
| 246 | "LDRLT R0, =0xFFC05FBC\n"
|
|---|
| 247 | "BLLT sub_FFC05F50\n"
|
|---|
| 248 | "LDMFD SP!, {R4,LR}\n"
|
|---|
| 249 | "B taskcreate_Startup_my\n" //-------->
|
|---|
| 250 | );
|
|---|
| 251 | };
|
|---|
| 252 |
|
|---|
| 253 |
|
|---|
| 254 | void __attribute__((naked,noinline)) taskcreate_Startup_my() {
|
|---|
| 255 | asm volatile (
|
|---|
| 256 | "STMFD SP!, {R3,LR}\n"
|
|---|
| 257 | // "BL j_nullsub_192\n"
|
|---|
| 258 | "BL sub_FFC2ABA4\n"
|
|---|
| 259 | "CMP R0, #0\n"
|
|---|
| 260 | "BNE loc_FFC10690\n"
|
|---|
| 261 | "BL sub_FFC250BC\n"
|
|---|
| 262 | "CMP R0, #0\n"
|
|---|
| 263 | "BEQ loc_FFC10690\n"
|
|---|
| 264 | "BL sub_FFC238CC\n"
|
|---|
| 265 | "CMP R0, #0\n"
|
|---|
| 266 | "BNE loc_FFC10690\n"
|
|---|
| 267 | "LDR R1, =0xC0220000\n"
|
|---|
| 268 | "MOV R0, #0x44\n"
|
|---|
| 269 | "STR R0, [R1,#0x20]\n"
|
|---|
| 270 | "loc_FFC1068C:\n"
|
|---|
| 271 | "B loc_FFC1068C\n"
|
|---|
| 272 | "loc_FFC10690:\n"
|
|---|
| 273 | // "BL sub_FFC238D8\n" // removed for correct power-on on 'on/off' button.
|
|---|
| 274 | // "BL j_nullsub_193\n"
|
|---|
| 275 | "BL sub_FFC28FD4\n"
|
|---|
| 276 | "LDR R1, =0x2CE000\n"
|
|---|
| 277 | "MOV R0, #0\n"
|
|---|
| 278 | "BL sub_FFC2921C\n"
|
|---|
| 279 | "BL sub_FFC291C8\n"
|
|---|
| 280 | "MOV R3, #0\n"
|
|---|
| 281 | "STR R3, [SP]\n"
|
|---|
| 282 | "LDR R3, =task_Startup_my\n" //-------->
|
|---|
| 283 | "MOV R2, #0\n"
|
|---|
| 284 | "MOV R1, #0x19\n"
|
|---|
| 285 | "LDR R0, =0xFFC106D8\n"
|
|---|
| 286 | "BL sub_FFC0F1A8\n"
|
|---|
| 287 | "MOV R0, #0\n"
|
|---|
| 288 | "LDMFD SP!, {R12,PC}\n"
|
|---|
| 289 | );
|
|---|
| 290 | }
|
|---|
| 291 |
|
|---|
| 292 | void __attribute__((naked,noinline)) task_Startup_my() {
|
|---|
| 293 | asm volatile (
|
|---|
| 294 | "STMFD SP!, {R4,LR}\n"
|
|---|
| 295 | "BL sub_FFC06278\n"
|
|---|
| 296 | "BL sub_FFC249CC\n"
|
|---|
| 297 | "BL sub_FFC2326C\n"
|
|---|
| 298 | // "BL j_nullsub_196\n"
|
|---|
| 299 | "BL sub_FFC2ADD0\n"
|
|---|
| 300 | // "BL sub_FFC2AC78\n" // - start diskboot.bin
|
|---|
| 301 | "BL sub_FFC2AF6C\n"
|
|---|
| 302 | "BL sub_FFC2AE00\n"
|
|---|
| 303 | "BL sub_FFC2846C\n"
|
|---|
| 304 | "BL sub_FFC2AF70\n"
|
|---|
| 305 | "BL CreateTask_spytask\n" // +
|
|---|
| 306 | // "BL sub_FFC237C0\n" // original taskcreate_PhySw
|
|---|
| 307 | "BL taskcreate_PhySw_my\n" // +
|
|---|
| 308 | "BL sub_FFC26CF8\n"
|
|---|
| 309 | "BL sub_FFC2AF88\n"
|
|---|
| 310 | // "BL nullsub_173\n"
|
|---|
| 311 | "BL sub_FFC22D48\n"
|
|---|
| 312 | "BL sub_FFC2A97C\n"
|
|---|
| 313 | "BL sub_FFC23220\n"
|
|---|
| 314 | "BL sub_FFC22CE8\n"
|
|---|
| 315 | "BL sub_FFC2B9B4\n"
|
|---|
| 316 | "BL sub_FFC22CC0\n"
|
|---|
| 317 | "LDMFD SP!, {R4,LR}\n"
|
|---|
| 318 | "B sub_FFC06128\n"
|
|---|
| 319 | );
|
|---|
| 320 | }
|
|---|
| 321 |
|
|---|
| 322 | // ROM:FFC237C0 taskcreate_PhySw
|
|---|
| 323 | void __attribute__((naked,noinline)) taskcreate_PhySw_my() {
|
|---|
| 324 | asm volatile(
|
|---|
| 325 | "STMFD SP!, {R3-R5,LR}\n"
|
|---|
| 326 | "LDR R4, =0x1BE4\n"
|
|---|
| 327 | "LDR R0, [R4,#0x10]\n"
|
|---|
| 328 | "CMP R0, #0\n"
|
|---|
| 329 | "BNE loc_FFC237F4\n"
|
|---|
| 330 | "MOV R3, #0\n"
|
|---|
| 331 | "STR R3, [SP]\n"
|
|---|
| 332 | "LDR R3, =mykbd_task\n" // Changed
|
|---|
| 333 | // "MOV R2, #0x800\n"
|
|---|
| 334 | "MOV R2, #0x2000\n" // + stack size for new task_PhySw so we don't have to do stack switch
|
|---|
| 335 | "B sub_FFC237E4\n" // Continue code
|
|---|
| 336 | "loc_FFC237F4:\n"
|
|---|
| 337 | "B sub_FFC237F4\n" // Continue code
|
|---|
| 338 | );
|
|---|
| 339 | }
|
|---|
| 340 | /*******************************************************************/
|
|---|
| 341 |
|
|---|
| 342 | // ROM:FFC705AC task_InitFileModules
|
|---|
| 343 | void __attribute__((naked,noinline)) init_file_modules_task() {
|
|---|
| 344 | asm volatile(
|
|---|
| 345 | "STMFD SP!, {R4-R6,LR}\n"
|
|---|
| 346 | "BL sub_FFC69E48\n"
|
|---|
| 347 | "LDR R5, =0x5006\n"
|
|---|
| 348 | "MOVS R4, R0\n"
|
|---|
| 349 | "MOVNE R1, #0\n"
|
|---|
| 350 | "MOVNE R0, R5\n"
|
|---|
| 351 | "BLNE sub_FFC6C70C\n"
|
|---|
| 352 | "BL sub_FFC69E74_my\n" //------------->
|
|---|
| 353 | "BL core_spytask_can_start\n" // + set "it's safe to start" flag for spytask
|
|---|
| 354 | "CMP R4, #0\n"
|
|---|
| 355 | "MOVEQ R0, R5\n"
|
|---|
| 356 | "LDMEQFD SP!, {R4-R6,LR}\n"
|
|---|
| 357 | "MOVEQ R1, #0\n"
|
|---|
| 358 | "BEQ sub_FFC6C70C\n"
|
|---|
| 359 | "LDMFD SP!, {R4-R6,PC}\n"
|
|---|
| 360 | );
|
|---|
| 361 | }
|
|---|
| 362 |
|
|---|
| 363 | void __attribute__((naked,noinline)) sub_FFC69E74_my() {
|
|---|
| 364 | asm volatile(
|
|---|
| 365 | "STMFD SP!, {R4,LR}\n"
|
|---|
| 366 | "MOV R0, #3\n"
|
|---|
| 367 | "BL sub_FFC50E94_my\n" //---------->
|
|---|
| 368 | // "BL nullsub_67\n"
|
|---|
| 369 | "LDR R4, =0x2A30\n"
|
|---|
| 370 | "LDR R0, [R4,#4]\n"
|
|---|
| 371 | "CMP R0, #0\n"
|
|---|
| 372 | "BNE loc_FFC69EAC\n"
|
|---|
| 373 | "BL sub_FFC500DC\n"
|
|---|
| 374 | "BL sub_FFCF0788\n"
|
|---|
| 375 | "BL sub_FFC500DC\n"
|
|---|
| 376 | "BL sub_FFC4CB54\n"
|
|---|
| 377 | "BL sub_FFC4FFDC\n"
|
|---|
| 378 | "BL sub_FFCF081C\n"
|
|---|
| 379 | "loc_FFC69EAC:\n"
|
|---|
| 380 | "MOV R0, #1\n"
|
|---|
| 381 | "STR R0, [R4]\n"
|
|---|
| 382 | "LDMFD SP!, {R4,PC}\n"
|
|---|
| 383 | );
|
|---|
| 384 | }
|
|---|
| 385 |
|
|---|
| 386 |
|
|---|
| 387 | void __attribute__((naked,noinline)) sub_FFC50E94_my() {
|
|---|
| 388 | asm volatile(
|
|---|
| 389 | "STMFD SP!, {R4-R8,LR}\n"
|
|---|
| 390 | "MOV R8, R0\n"
|
|---|
| 391 | "BL sub_FFC50E14\n"
|
|---|
| 392 | "LDR R1, =0x32350\n"
|
|---|
| 393 | "MOV R6, R0\n"
|
|---|
| 394 | "ADD R4, R1, R0,LSL#7\n"
|
|---|
| 395 | "LDR R0, [R4,#0x6C]\n"
|
|---|
| 396 | "CMP R0, #4\n"
|
|---|
| 397 | "LDREQ R1, =0x817\n"
|
|---|
| 398 | "LDREQ R0, =0xFFC50954\n"
|
|---|
| 399 | "BLEQ sub_FFC0F680\n"
|
|---|
| 400 | "MOV R1, R8\n"
|
|---|
| 401 | "MOV R0, R6\n"
|
|---|
| 402 | "BL sub_FFC506CC\n"
|
|---|
| 403 | "LDR R0, [R4,#0x38]\n"
|
|---|
| 404 | "BL sub_FFC51534\n"
|
|---|
| 405 | "CMP R0, #0\n"
|
|---|
| 406 | "STREQ R0, [R4,#0x6C]\n"
|
|---|
| 407 | "MOV R0, R6\n"
|
|---|
| 408 | "BL sub_FFC5075C\n"
|
|---|
| 409 | "MOV R0, R6\n"
|
|---|
| 410 | "BL sub_FFC50ABC_my\n" //--------->
|
|---|
| 411 | "MOV R5, R0\n"
|
|---|
| 412 | "MOV R0, R6\n"
|
|---|
| 413 | "BL sub_FFC50CEC\n"
|
|---|
| 414 | "LDR R6, [R4,#0x3C]\n"
|
|---|
| 415 | "AND R7, R5, R0\n"
|
|---|
| 416 | "CMP R6, #0\n"
|
|---|
| 417 | "LDR R1, [R4,#0x38]\n"
|
|---|
| 418 | "MOVEQ R0, #0x80000001\n"
|
|---|
| 419 | "MOV R5, #0\n"
|
|---|
| 420 | "BEQ loc_FFC50F44\n"
|
|---|
| 421 | "MOV R0, R1\n"
|
|---|
| 422 | "BL sub_FFC50244\n"
|
|---|
| 423 | "CMP R0, #0\n"
|
|---|
| 424 | "MOVNE R5, #4\n"
|
|---|
| 425 | "CMP R6, #5\n"
|
|---|
| 426 | "ORRNE R0, R5, #1\n"
|
|---|
| 427 | "BICEQ R0, R5, #1\n"
|
|---|
| 428 | "CMP R7, #0\n"
|
|---|
| 429 | "BICEQ R0, R0, #2\n"
|
|---|
| 430 | "ORREQ R0, R0, #0x80000000\n"
|
|---|
| 431 | "BICNE R0, R0, #0x80000000\n"
|
|---|
| 432 | "ORRNE R0, R0, #2\n"
|
|---|
| 433 | "loc_FFC50F44:\n"
|
|---|
| 434 | "CMP R8, #7\n"
|
|---|
| 435 | "STR R0, [R4,#0x40]\n"
|
|---|
| 436 | "LDMNEFD SP!, {R4-R8,PC}\n"
|
|---|
| 437 | "MOV R0, R8\n"
|
|---|
| 438 | "BL sub_FFC50E64\n"
|
|---|
| 439 | "CMP R0, #0\n"
|
|---|
| 440 | "LDMEQFD SP!, {R4-R8,LR}\n"
|
|---|
| 441 | "LDREQ R0, =0xFFC50F90\n"
|
|---|
| 442 | "BEQ sub_FFC01780\n"
|
|---|
| 443 | "LDMFD SP!, {R4-R8,PC}\n"
|
|---|
| 444 | );
|
|---|
| 445 | }
|
|---|
| 446 |
|
|---|
| 447 | void __attribute__((naked,noinline)) sub_FFC50ABC_my() {
|
|---|
| 448 | asm volatile(
|
|---|
| 449 | "STMFD SP!, {R4-R6,LR}\n"
|
|---|
| 450 | "MOV R5, R0\n"
|
|---|
| 451 | "LDR R0, =0x32350\n"
|
|---|
| 452 | "ADD R4, R0, R5,LSL#7\n"
|
|---|
| 453 | "LDR R0, [R4,#0x6C]\n"
|
|---|
| 454 | "TST R0, #2\n"
|
|---|
| 455 | "MOVNE R0, #1\n"
|
|---|
| 456 | "LDMNEFD SP!, {R4-R6,PC}\n"
|
|---|
| 457 | "LDR R0, [R4,#0x38]\n"
|
|---|
| 458 | "MOV R1, R5\n"
|
|---|
| 459 | "BL sub_FFC507DC_my\n" //--------->
|
|---|
| 460 | "CMP R0, #0\n"
|
|---|
| 461 | "LDRNE R0, [R4,#0x38]\n"
|
|---|
| 462 | "MOVNE R1, R5\n"
|
|---|
| 463 | "BLNE sub_FFC50978\n"
|
|---|
| 464 | "LDR R2, =0x323D0\n"
|
|---|
| 465 | "ADD R1, R5, R5,LSL#4\n"
|
|---|
| 466 | "LDR R1, [R2,R1,LSL#2]\n"
|
|---|
| 467 | "CMP R1, #4\n"
|
|---|
| 468 | "BEQ loc_FFC50B1C\n"
|
|---|
| 469 | "CMP R0, #0\n"
|
|---|
| 470 | "LDMEQFD SP!, {R4-R6,PC}\n"
|
|---|
| 471 | "MOV R0, R5\n"
|
|---|
| 472 | "BL sub_FFC502D4\n"
|
|---|
| 473 | "loc_FFC50B1C:\n"
|
|---|
| 474 | "CMP R0, #0\n"
|
|---|
| 475 | "LDRNE R1, [R4,#0x6C]\n"
|
|---|
| 476 | "ORRNE R1, R1, #2\n"
|
|---|
| 477 | "STRNE R1, [R4,#0x6C]\n"
|
|---|
| 478 | "LDMFD SP!, {R4-R6,PC}\n"
|
|---|
| 479 | );
|
|---|
| 480 | }
|
|---|
| 481 |
|
|---|
| 482 | void __attribute__((naked,noinline)) sub_FFC507DC_my() {
|
|---|
| 483 | asm volatile(
|
|---|
| 484 | "STMFD SP!, {R4-R10,LR}\n"
|
|---|
| 485 | "MOV R9, R0\n"
|
|---|
| 486 | "LDR R0, =0x32350\n"
|
|---|
| 487 | "MOV R8, #0\n"
|
|---|
| 488 | "ADD R5, R0, R1,LSL#7\n"
|
|---|
| 489 | "LDR R0, [R5,#0x3C]\n"
|
|---|
| 490 | "MOV R7, #0\n"
|
|---|
| 491 | "CMP R0, #7\n"
|
|---|
| 492 | "MOV R6, #0\n"
|
|---|
| 493 | "ADDLS PC, PC, R0,LSL#2\n"
|
|---|
| 494 | "B loc_FFC50934\n"
|
|---|
| 495 | "loc_FFC50808:\n"
|
|---|
| 496 | "B loc_FFC50840\n"
|
|---|
| 497 | "loc_FFC5080C:\n"
|
|---|
| 498 | "B loc_FFC50828\n"
|
|---|
| 499 | "loc_FFC50810:\n"
|
|---|
| 500 | "B loc_FFC50828\n"
|
|---|
| 501 | "loc_FFC50814:\n"
|
|---|
| 502 | "B loc_FFC50828\n"
|
|---|
| 503 | "loc_FFC50818:\n"
|
|---|
| 504 | "B loc_FFC50828\n"
|
|---|
| 505 | "loc_FFC5081C:\n"
|
|---|
| 506 | "B loc_FFC5092C\n"
|
|---|
| 507 | "loc_FFC50820:\n"
|
|---|
| 508 | "B loc_FFC50828\n"
|
|---|
| 509 | "loc_FFC50824:\n"
|
|---|
| 510 | "B loc_FFC50828\n"
|
|---|
| 511 | "loc_FFC50828:\n"
|
|---|
| 512 | "MOV R2, #0\n"
|
|---|
| 513 | "MOV R1, #0x200\n"
|
|---|
| 514 | "MOV R0, #2\n"
|
|---|
| 515 | "BL sub_FFC64074\n"
|
|---|
| 516 | "MOVS R4, R0\n"
|
|---|
| 517 | "BNE loc_FFC50848\n"
|
|---|
| 518 | "loc_FFC50840:\n"
|
|---|
| 519 | "MOV R0, #0\n"
|
|---|
| 520 | "LDMFD SP!, {R4-R10,PC}\n"
|
|---|
| 521 | "loc_FFC50848:\n"
|
|---|
| 522 | "LDR R12, [R5,#0x50]\n"
|
|---|
| 523 | "MOV R3, R4\n"
|
|---|
| 524 | "MOV R2, #1\n"
|
|---|
| 525 | "MOV R1, #0\n"
|
|---|
| 526 | "MOV R0, R9\n"
|
|---|
| 527 | "BLX R12\n"
|
|---|
| 528 | "CMP R0, #1\n"
|
|---|
| 529 | "BNE loc_FFC50874\n"
|
|---|
| 530 | "MOV R0, #2\n"
|
|---|
| 531 | "BL sub_FFC641C0\n"
|
|---|
| 532 | "B loc_FFC50840\n"
|
|---|
| 533 | "loc_FFC50874:\n"
|
|---|
| 534 | "LDR R1, [R5,#0x64]\n"
|
|---|
| 535 | "MOV R0, R9\n"
|
|---|
| 536 | "BLX R1\n"
|
|---|
| 537 |
|
|---|
| 538 | "MOV R1, R4\n" // + pointer to MBR in R1
|
|---|
| 539 | "BL mbr_read_dryos\n" // + total sectors count in R0 before and after call
|
|---|
| 540 |
|
|---|
| 541 | // Start of DataGhost's FAT32 autodetection code
|
|---|
| 542 | // Policy: If there is a partition which has type W95 FAT32, use the first one of those for image storage
|
|---|
| 543 | // According to the code below, we can use R1, R2, R3 and R12.
|
|---|
| 544 | // LR wasn't really used anywhere but for storing a part of the partition signature. This is the only thing
|
|---|
| 545 | // that won't work with an offset, but since we can load from LR+offset into LR, we can use this to do that :)
|
|---|
| 546 | "MOV R12, R4\n" // Copy the MBR start address so we have something to work with
|
|---|
| 547 | "MOV LR, R4\n" // Save old offset for MBR signature
|
|---|
| 548 | "MOV R1, #1\n" // Note the current partition number
|
|---|
| 549 | "B dg_sd_fat32_enter\n" // We actually need to check the first partition as well, no increments yet!
|
|---|
| 550 | "dg_sd_fat32:\n"
|
|---|
| 551 | "CMP R1, #4\n" // Did we already see the 4th partition?
|
|---|
| 552 | "BEQ dg_sd_fat32_end\n" // Yes, break. We didn't find anything, so don't change anything.
|
|---|
| 553 | "ADD R12, R12, #0x10\n" // Second partition
|
|---|
| 554 | "ADD R1, R1, #1\n" // Second partition for the loop
|
|---|
| 555 | "dg_sd_fat32_enter:\n"
|
|---|
| 556 | "LDRB R2, [R12, #0x1BE]\n" // Partition status
|
|---|
| 557 | "LDRB R3, [R12, #0x1C2]\n" // Partition type (FAT32 = 0xB)
|
|---|
| 558 | "CMP R3, #0xB\n" // Is this a FAT32 partition?
|
|---|
| 559 | "CMPNE R3, #0xC\n" // Not 0xB, is it 0xC (FAT32 LBA) then?
|
|---|
| 560 | "BNE dg_sd_fat32\n" // No, it isn't. Loop again.
|
|---|
| 561 | "CMP R2, #0x00\n" // It is, check the validity of the partition type
|
|---|
| 562 | "CMPNE R2, #0x80\n"
|
|---|
| 563 | "BNE dg_sd_fat32\n" // Invalid, go to next partition
|
|---|
| 564 | // This partition is valid, it's the first one, bingo!
|
|---|
| 565 | "MOV R4, R12\n" // Move the new MBR offset for the partition detection.
|
|---|
| 566 |
|
|---|
| 567 | "dg_sd_fat32_end:\n"
|
|---|
| 568 | // End of DataGhost's FAT32 autodetection code
|
|---|
| 569 |
|
|---|
| 570 |
|
|---|
| 571 | "LDRB R1, [R4,#0x1C9]\n"
|
|---|
| 572 | "LDRB R3, [R4,#0x1C8]\n"
|
|---|
| 573 | "LDRB R12, [R4,#0x1CC]\n"
|
|---|
| 574 | "MOV R1, R1,LSL#24\n"
|
|---|
| 575 | "ORR R1, R1, R3,LSL#16\n"
|
|---|
| 576 | "LDRB R3, [R4,#0x1C7]\n"
|
|---|
| 577 | "LDRB R2, [R4,#0x1BE]\n"
|
|---|
| 578 | // "LDRB LR, [R4,#0x1FF]\n" // -
|
|---|
| 579 | "ORR R1, R1, R3,LSL#8\n"
|
|---|
| 580 | "LDRB R3, [R4,#0x1C6]\n"
|
|---|
| 581 | "CMP R2, #0\n"
|
|---|
| 582 | "CMPNE R2, #0x80\n"
|
|---|
| 583 | "ORR R1, R1, R3\n"
|
|---|
| 584 | "LDRB R3, [R4,#0x1CD]\n"
|
|---|
| 585 | "MOV R3, R3,LSL#24\n"
|
|---|
| 586 | "ORR R3, R3, R12,LSL#16\n"
|
|---|
| 587 | "LDRB R12, [R4,#0x1CB]\n"
|
|---|
| 588 | "ORR R3, R3, R12,LSL#8\n"
|
|---|
| 589 | "LDRB R12, [R4,#0x1CA]\n"
|
|---|
| 590 | "ORR R3, R3, R12\n"
|
|---|
| 591 | // "LDRB R12, [R4,#0x1FE]\n" // -
|
|---|
| 592 | "LDRB R12, [LR,#0x1FE]\n" // + First MBR signature byte (0x55), LR is original offset.
|
|---|
| 593 | "LDRB LR, [LR,#0x1FF]\n" // + Last MBR signature byte (0xAA), LR is original offset.
|
|---|
| 594 | "BNE loc_FFC50900\n"
|
|---|
| 595 | "CMP R0, R1\n"
|
|---|
| 596 | "BCC loc_FFC50900\n"
|
|---|
| 597 | "ADD R2, R1, R3\n"
|
|---|
| 598 | "CMP R2, R0\n"
|
|---|
| 599 | "CMPLS R12, #0x55\n"
|
|---|
| 600 | "CMPEQ LR, #0xAA\n"
|
|---|
| 601 | "MOVEQ R7, R1\n"
|
|---|
| 602 | "MOVEQ R6, R3\n"
|
|---|
| 603 | "MOVEQ R4, #1\n"
|
|---|
| 604 | "BEQ loc_FFC50904\n"
|
|---|
| 605 | "loc_FFC50900:\n"
|
|---|
| 606 | "MOV R4, R8\n"
|
|---|
| 607 | "loc_FFC50904:\n"
|
|---|
| 608 | "MOV R0, #2\n"
|
|---|
| 609 | "BL sub_FFC641C0\n"
|
|---|
| 610 | "CMP R4, #0\n"
|
|---|
| 611 | "BNE loc_FFC50940\n"
|
|---|
| 612 | "LDR R1, [R5,#0x64]\n"
|
|---|
| 613 | "MOV R7, #0\n"
|
|---|
| 614 | "MOV R0, R9\n"
|
|---|
| 615 | "BLX R1\n"
|
|---|
| 616 | "MOV R6, R0\n"
|
|---|
| 617 | "B loc_FFC50940\n"
|
|---|
| 618 | "loc_FFC5092C:\n"
|
|---|
| 619 | "MOV R6, #0x40\n"
|
|---|
| 620 | "B loc_FFC50940\n"
|
|---|
| 621 | "loc_FFC50934:\n"
|
|---|
| 622 | "LDR R1, =0x572\n"
|
|---|
| 623 | "LDR R0, =0xFFC50954\n"
|
|---|
| 624 | "BL sub_FFC0F680\n"
|
|---|
| 625 | "loc_FFC50940:\n"
|
|---|
| 626 | "STR R7, [R5,#0x44]!\n"
|
|---|
| 627 | "STMIB R5, {R6,R8}\n"
|
|---|
| 628 | "MOV R0, #1\n"
|
|---|
| 629 | "LDMFD SP!, {R4-R10,PC}\n"
|
|---|
| 630 | );
|
|---|
| 631 | }
|
|---|
| 632 |
|
|---|
| 633 |
|
|---|
| 634 |
|
|---|
