The-Homebrew-Cloud/MochaPayload
2
0
Fork 0
mirror of https://github.com/wiiu-env/MochaPayload.git synced 2024-11-25 17:26:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

ios_kernel: Make instant patches a bit more verbose

Browse Source
This commit is contained in:
Maschell 2023-03-11 17:17:01 +01:00
parent 363a5687aa
commit 90668c95ea
1 changed files with 47 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
source/ios_kernel/source/instant_patches.c
View File

@ -38,10 +38,22 @@ typedef struct {
u32 type;
u32 cached;
} ios_map_shared_info_t;
#define MCP_CUSTOM_TEXT_LENGTH 0xA000
#define MCP_CUSTOM_TEXT_START 0x05116000
#define ENVIRONMENT_PATH_LENGTH 0x100
#define mcp_text_phys(addr) ((u32) (addr) -0x05000000 + 0x081C0000)
#define mcp_rodata_phys(addr) ((u32) (addr) -0x05060000 + 0x08220000)
#define mcp_data_phys(addr) ((u32) (addr) -0x05074000 + 0x08234000)
#define acp_phys(addr) ((u32) (addr) -0xE0000000 + 0x12900000)
#define fsa_phys(addr) ((u32) (addr))
#define kernel_phys(addr) ((u32) (addr))
#define acp_text_phys(addr) ((u32) (addr) -0xE0000000 + 0x12900000)
#define nimboss_text_phys(addr) ((u32) (addr) -0xe2000000 + 0x12EC0000)
#define nimboss_rodata_phys(addr) ((u32) (addr) -0xe2280000 + 0x13140000)
#define bsp_data_phys(addr) ((u32) (addr) -0xe6042000 + 0x13d02000)
#define mcp_custom_text_phys(addr) ((u32) (addr) -0x05100000 + 0x13D80000)
#define mcp_custom_bss_phys(addr) ((u32) (addr) -0x05000000 + 0x081C0000)
void instant_patches_setup(void) {
// apply IOS ELF launch hook
@ -51,80 +63,79 @@ void instant_patches_setup(void) {
// Keep patches for backwards compatibility (libiosuhax)
// patch FSA raw access
*(volatile u32 *) 0x1070FAE8 = 0x05812070;
*(volatile u32 *) 0x1070FAEC = 0xEAFFFFF9;
*(volatile u32 *) fsa_phys(0x1070FAE8) = 0x05812070;
*(volatile u32 *) fsa_phys(0x1070FAEC) = 0xEAFFFFF9;
// Add IOCTL 0x28 to indicate the calling client should have full fs permissions
*(volatile u32 *) 0x10701248 = _FSA_ioctl0x28_hook;
*(volatile u32 *) fsa_phys(0x10701248) = _FSA_ioctl0x28_hook;
// Give clients that called IOCTL 0x28 full permissions
*(volatile u32 *) 0x10704540 = ARM_BL(0x10704540, FSA_IOCTLV_HOOK);
*(volatile u32 *) 0x107044f0 = ARM_BL(0x107044f0, FSA_IOCTL_HOOK);
*(volatile u32 *) 0x10704458 = ARM_BL(0x10704458, FSA_IOS_Close_Hook);
*(volatile u32 *) fsa_phys(0x10704540) = ARM_BL(0x10704540, FSA_IOCTLV_HOOK);
*(volatile u32 *) fsa_phys(0x107044f0) = ARM_BL(0x107044f0, FSA_IOCTL_HOOK);
*(volatile u32 *) fsa_phys(0x10704458) = ARM_BL(0x10704458, FSA_IOS_Close_Hook);
reset_fs_bss();
// patch /dev/odm IOCTL 0x06 to return the disc key if in_buf[0] > 2.
*(volatile u32 *) 0x10739948 = 0xe3a0b001; // mov r11, 0x01
*(volatile u32 *) 0x1073994C = 0xe3a07020; // mov r7, 0x20
*(volatile u32 *) 0x10739950 = 0xea000013; // b LAB_107399a8
*(volatile u32 *) fsa_phys(0x10739948) = 0xe3a0b001; // mov r11, 0x01
*(volatile u32 *) fsa_phys(0x1073994C) = 0xe3a07020; // mov r7, 0x20
*(volatile u32 *) fsa_phys(0x10739950) = 0xea000013; // b LAB_107399a8
int (*_iosMapSharedUserExecution)(void *descr) = (void *) 0x08124F88;
// patch kernel dev node registration
*(volatile u32 *) 0x081430B4 = 1;
*(volatile u32 *) kernel_phys(0x081430B4) = 1;
// fix 10 minute timeout that crashes MCP after 10 minutes of booting
*(volatile u32 *) (0x05022474 - 0x05000000 + 0x081C0000) = 0xFFFFFFFF; // NEW_TIMEOUT
*(volatile u32 *) mcp_text_phys(0x05022474) = 0xFFFFFFFF; // NEW_TIMEOUT
kernel_memset((void *) (0x050BD000 - 0x05000000 + 0x081C0000), 0, 0x2F00);
kernel_memset((void *) mcp_text_phys(0x050BD000), 0, 0x2F00);
// allow custom bootLogoTex and bootMovie.h264
*(volatile u32 *) (0xE0030D68 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) (0xE0030D34 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) acp_text_phys(0xE0030D68) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) acp_text_phys(0xE0030D34) = 0xE3A00000; // mov r0, #0
// Patch update check
*(volatile u32 *) (0xe22830e0 - 0xe2280000 + 0x13140000) = 0x00000000;
*(volatile u32 *) (0xe22b2a78 - 0xe2280000 + 0x13140000) = 0x00000000;
*(volatile u32 *) (0xe204fb68 - 0xe2000000 + 0x12EC0000) = 0xe3a00000;
*(volatile u32 *) nimboss_rodata_phys(0xe22830e0) = 0x00000000;
*(volatile u32 *) nimboss_rodata_phys(0xe22b2a78) = 0x00000000;
*(volatile u32 *) nimboss_text_phys(0xe204fb68) = 0xe3a00000;
// allow any region title launch
*(volatile u32 *) (0xE0030498 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) acp_phys(0xE0030498) = 0xE3A00000; // mov r0, #0
// Patch CheckTitleLaunch to ignore gamepad connected result
*(volatile u32 *) (0xE0030868 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) acp_phys(0xE0030868) = 0xE3A00000; // mov r0, #0
*(volatile u32 *) (0x050254D6 - 0x05000000 + 0x081C0000) = THUMB_BL(0x050254D6, MCP_LoadFile_patch);
*(volatile u32 *) (0x05025242 - 0x05000000 + 0x081C0000) = THUMB_BL(0x05025242, MCP_ioctl100_patch);
*(volatile u32 *) mcp_text_phys(0x050254D6) = THUMB_BL(0x050254D6, MCP_LoadFile_patch);
*(volatile u32 *) mcp_text_phys(0x05025242) = THUMB_BL(0x05025242, MCP_ioctl100_patch);
*(volatile u32 *) (0x0501dd78 - 0x05000000 + 0x081C0000) = THUMB_BL(0x0501dd78, MCP_ReadCOSXml_patch);
*(volatile u32 *) (0x051105ce - 0x05000000 + 0x081C0000) = THUMB_BL(0x051105ce, MCP_ReadCOSXml_patch);
*(volatile u32 *) mcp_text_phys(0x0501dd78) = THUMB_BL(0x0501dd78, MCP_ReadCOSXml_patch);
*(volatile u32 *) mcp_text_phys(0x051105ce) = THUMB_BL(0x051105ce, MCP_ReadCOSXml_patch);
// give us bsp::ee:read permission for PPC
*(volatile u32 *) (0xe6044db0 - 0xe6042000 + 0x13d02000) = 0x000001F0;
*(volatile u32 *) bsp_data_phys(0xe6044db0) = 0x000001F0;
// patch default title id to system menu
*(volatile u32 *) mcp_data_phys(0x050B817C) = *(volatile u32 *) 0x0017FFF0;
*(volatile u32 *) mcp_data_phys(0x050B8180) = *(volatile u32 *) 0x0017FFF4;
// Place the environment path at the end of our .text section.
for (int i = 0; i < 0x100; i += 4) {
*(volatile u32 *) (0x0511FF00 - 0x05100000 + 0x13D80000 + i) = *(volatile u32 *) (0x0017FEF0 + i);
for (int i = 0; i < ENVIRONMENT_PATH_LENGTH; i += 4) {
*(volatile u32 *) mcp_custom_text_phys(MCP_CUSTOM_TEXT_START + MCP_CUSTOM_TEXT_LENGTH - ENVIRONMENT_PATH_LENGTH + i) = *(volatile u32 *) (0x0017FEF0 + i);
}
// force check USB storage on load
*(volatile u32 *) acp_phys(0xE012202C) = 0x00000001; // find USB flag
// set zero to start thread directly on first title change
*(volatile u32 *) (0x050BC580 - 0x05000000 + 0x081C0000) = 0;
*(volatile u32 *) mcp_text_phys(0x050BC580) = 0;
// Patch FS to syslog everything
*(volatile u32 *) (0x107F5720) = ARM_B(0x107F5720, 0x107F0C84);
*(volatile u32 *) fsa_phys(0x107F5720) = ARM_B(0x107F5720, 0x107F0C84);
// Patch MCP to syslog everything
*(volatile u32 *) (0x05055438 - 0x05100000 + 0x13D80000) = ARM_B(0x05055438, 0x0503dcf8);
ios_map_shared_info_t map_info;
map_info.paddr = 0x050BD000 - 0x05000000 + 0x081C0000;
map_info.paddr = mcp_custom_bss_phys(0x050BD000);
map_info.vaddr = 0x050BD000;
map_info.size = 0x3000;
map_info.domain = 1; // MCP
@ -132,9 +143,9 @@ void instant_patches_setup(void) {
map_info.cached = 0xFFFFFFFF;
_iosMapSharedUserExecution(&map_info); // actually a bss section but oh well it will have read/write
map_info.paddr = 0x05116000 - 0x05100000 + 0x13D80000;
map_info.vaddr = 0x05116000;
map_info.size = 0xA000;
map_info.paddr = mcp_custom_text_phys(MCP_CUSTOM_TEXT_START);
map_info.vaddr = MCP_CUSTOM_TEXT_START;
map_info.size = MCP_CUSTOM_TEXT_LENGTH;
map_info.domain = 1; // MCP
map_info.type = 3; // 0 = undefined, 1 = kernel only, 2 = read only, 3 = read write
map_info.cached = 0xFFFFFFFF;