USBSerialLoggingModule/source/kernel.cpp

#include <cstdint>

#define k_memset ((void (*)( uint32_t , uint32_t, uint32_t))0xfff09d60)
#define KiReport ((void (*)( const char*, ... ))0xfff0ad0c)
#define IopShell_AsyncCallback (0xfff1b7d8)
#define IopShell_ReadCallback (0xfff1b9a0)
#define k_memcpy ((void (*)(void*,void*, uint32_t))0xfff09e44)
#define IPCKDriver_OpenAsync ((int32_t (*)(uint32_t client_ram_pid, const char *device, uint32_t mode, uint32_t asyncCallback, void * context))0xfff0b9c8)
#define WaitAsyncReply ((uint32_t (*)(void* , uint32_t, uint32_t))0xfff180dc)

#define IPCKDriver_IoctlAsync ((int32_t (*)( \
                                uint32_t clientProcessId,\
                                uint32_t loaderProcessId,\
                                uint32_t handle,\
                                uint32_t request,\
                                void* inBuf,\
                                uint32_t inLen,\
                                void* outBuf,\
                                uint32_t outLen,\
                                uint32_t asyncCallback,\
                                void * context))0xfff0bc5c)


uint32_t IPCKDriver_IOS_Open_Sync(uint32_t clientProcessId, const char *device_name, uint32_t mode) {
    register int r13 asm ("r13");
    k_memcpy((void *) (r13 - 0x1180), (void *) device_name, 0x10);
    void *context = (void *) (r13 + 0x450);
    auto error = IPCKDriver_OpenAsync(clientProcessId, (const char *) (r13 - 0x1180), mode, IopShell_AsyncCallback, context);
    if (error < 0) {
        return error;
    }
    return WaitAsyncReply(context, 20000000, 6);
}

uint32_t IPCKDriver_IOS_Ioctl_Sync(uint32_t clientProcessId, uint32_t handle, uint32_t request, void *inBuf, uint32_t inLen, void *outBuf, uint32_t ouLen) {
    register int r13 asm ("r13");
    void *context = (void *) (r13 + 0x450);

    auto error = IPCKDriver_IoctlAsync(clientProcessId, 0xFFFFFFFF, handle, request, inBuf, inLen, outBuf, ouLen, IopShell_AsyncCallback, context);

    if (error < 0) {
        return error;
    }
    uint32_t res = WaitAsyncReply(context, 20000000, 6);
    return res;
}


void IopShellInitInternal() {
    register int r13 asm ("r13");
    *((uint32_t *) (r13 + 0x450)) = 0;
    *((uint32_t *) (r13 + 0x454)) = 0;
    *((uint32_t *) (r13 + 0x458)) = 0xffffffe3;
    auto handle = IPCKDriver_IOS_Open_Sync(0, "/dev/iopsh", (uint32_t) 5);
    if (static_cast<int>(handle) < 0) {
        KiReport("####################################################################################\n");
        KiReport("IopShellInit failed\n");
        KiReport("####################################################################################\n");
        return;
    }
    *(uint32_t *) (r13 + -0x6d84) = static_cast<uint32_t>(handle);
    *(uint32_t *) (r13 + -0x1178) = 5;
    *(uint32_t *) (r13 + -0x117c) = 0x1040;

    auto result = IPCKDriver_IOS_Ioctl_Sync(0, static_cast<uint32_t>(handle), 3, (void *) (r13 - 0x1180), 0x14, (void *) (r13 - 0x1140), 0x4);
    if (static_cast<int>(result) < 0) {
        KiReport("####################################################################################\n");
        KiReport("IopShellInit failed\n");
        KiReport("####################################################################################\n");
        return;
    }
    *(uint32_t *) (r13 + -0x117c) = 0x636F7300; // "cos"
    result = IPCKDriver_IOS_Ioctl_Sync(0, static_cast<uint32_t>(handle), 1, (void *) (r13 - 0x1180), 0x14, (void *) (r13 - 0x1140), 0x4);
    if (static_cast<int>(result) < 0) {
        KiReport("####################################################################################\n");
        KiReport("IopShellInit failed\n");
        KiReport("####################################################################################\n");
        return;
    }
    *((uint32_t *) (r13 + 0x450)) = 0;
    *((uint32_t *) (r13 + 0x454)) = 0;
    *((uint32_t *) (r13 + 0x458)) = 0xffffffe3;
    k_memset((r13 - 0x1180), 0, 0x1040);
    result = IPCKDriver_IoctlAsync(0, 0xFFFFFFFF, handle, 5, nullptr, 0, (void *) (r13 - 0x1180), 0x1040, IopShell_ReadCallback, (void*) (r13 + 0x450));
    if (static_cast<int>(result) < 0) {
        KiReport("####################################################################################\n");
        KiReport("IopShellInit failed\n");
        KiReport("####################################################################################\n");
        return;
    }
    KiReport("IopShellInit was successful\n");
}