From 7388fa001f4a1a4b0a704b001a005abe98350bec Mon Sep 17 00:00:00 2001
From: Maschell <Maschell@gmx.de>
Date: Sat, 9 Oct 2021 00:55:43 +0200
Subject: [PATCH] Add custom ioctl to read the OTP

---
 source/common/kernel_commands.h           | 1 +
 source/ios_kernel/source/kernel_patches.c | 5 +++++
 source/ios_mcp/source/ipc.c               | 9 +++++++++
 3 files changed, 15 insertions(+)

diff --git a/source/common/kernel_commands.h b/source/common/kernel_commands.h
index 1f27b53..dda3816 100644
--- a/source/common/kernel_commands.h
+++ b/source/common/kernel_commands.h
@@ -28,5 +28,6 @@
 #define KERNEL_WRITE32          2
 #define KERNEL_MEMCPY           3
 #define KERNEL_GET_CFW_CONFIG   4
+#define KERNEL_READ_OTP         5
 
 #endif
diff --git a/source/ios_kernel/source/kernel_patches.c b/source/ios_kernel/source/kernel_patches.c
index 416b486..6c7893a 100644
--- a/source/ios_kernel/source/kernel_patches.c
+++ b/source/ios_kernel/source/kernel_patches.c
@@ -71,6 +71,11 @@ int kernel_syscall_0x81(u32 command, u32 arg1, u32 arg2, u32 arg3) {
             //kernel_memcpy((void*)arg1, &cfw_config, sizeof(cfw_config));
             break;
         }
+        case KERNEL_READ_OTP: {
+            int (*read_otp_internal)(int index, void* out_buf, u32 size) = (int (*)(int, void*, u32)) 0x08120248;
+            read_otp_internal(0, (void*)(arg1), 0x400);
+            break;
+        }
         default:
             return -1;
     }
diff --git a/source/ios_mcp/source/ipc.c b/source/ios_mcp/source/ipc.c
index c1937f5..37b450c 100644
--- a/source/ios_mcp/source/ipc.c
+++ b/source/ios_mcp/source/ipc.c
@@ -47,6 +47,7 @@
 #define IOCTL_REPEATED_WRITE        0x05
 #define IOCTL_KERN_READ32           0x06
 #define IOCTL_KERN_WRITE32          0x07
+#define IOCTL_READ_OTP              0x08
 
 #define IOCTL_FSA_OPEN              0x40
 #define IOCTL_FSA_CLOSE             0x41
@@ -172,6 +173,14 @@ static int ipc_ioctl(ipcmessage *message) {
                 svcCustomKernelCommand(KERNEL_WRITE32, message->ioctl.buffer_in[0], message->ioctl.buffer_in[1]);
             }
             break;
+        }
+        case IOCTL_READ_OTP: {
+            if ((message->ioctl.length_io < 0x400)) {
+                res = IOS_ERROR_INVALID_SIZE;
+            } else {
+                svcCustomKernelCommand(KERNEL_READ_OTP, message->ioctl.buffer_io);
+            }
+            break;
         }
             //!--------------------------------------------------------------------------------------------------------------
             //! FSA handles for better performance