mirror of
https://github.com/wiiu-env/wiiu-nanddumper-payload.git
synced 2024-11-16 16:39:18 +01:00
143 lines
4.8 KiB
C
143 lines
4.8 KiB
C
/***************************************************************************
|
|
* Copyright (C) 2016
|
|
* by Dimok
|
|
*
|
|
* This software is provided 'as-is', without any express or implied
|
|
* warranty. In no event will the authors be held liable for any
|
|
* damages arising from the use of this software.
|
|
*
|
|
* Permission is granted to anyone to use this software for any
|
|
* purpose, including commercial applications, and to alter it and
|
|
* redistribute it freely, subject to the following restrictions:
|
|
*
|
|
* 1. The origin of this software must not be misrepresented; you
|
|
* must not claim that you wrote the original software. If you use
|
|
* this software in a product, an acknowledgment in the product
|
|
* documentation would be appreciated but is not required.
|
|
*
|
|
* 2. Altered source versions must be plainly marked as such, and
|
|
* must not be misrepresented as being the original software.
|
|
*
|
|
* 3. This notice may not be removed or altered from any source
|
|
* distribution.
|
|
***************************************************************************/
|
|
#include "types.h"
|
|
#include "elf_patcher.h"
|
|
#include "ios_mcp_patches.h"
|
|
#include "ios_fs_patches.h"
|
|
#include "ios_bsp_patches.h"
|
|
#include "kernel_patches.h"
|
|
#include "exception_handler.h"
|
|
#include "fsa.h"
|
|
#include "config.h"
|
|
#include "utils.h"
|
|
|
|
extern void __KERNEL_CODE_START(void);
|
|
extern void __KERNEL_CODE_END(void);
|
|
|
|
extern const patch_table_t kernel_patches_table[];
|
|
extern const patch_table_t kernel_patches_table_end[];
|
|
|
|
static u8 otp_buffer[0x400];
|
|
|
|
static const u32 mcpIoMappings_patch[] =
|
|
{
|
|
// vaddr paddr size ? ? ?
|
|
0x0D000000, 0x0D000000, 0x001C0000, 0x00000000, 0x00000003, 0x00000000, // mapping 1
|
|
0x0D800000, 0x0D800000, 0x001C0000, 0x00000000, 0x00000003, 0x00000000, // mapping 2
|
|
0x0C200000, 0x0C200000, 0x00100000, 0x00000000, 0x00000003, 0x00000000 // mapping 3
|
|
};
|
|
|
|
static const u32 KERNEL_MCP_IOMAPPINGS_STRUCT[] =
|
|
{
|
|
(u32)mcpIoMappings_patch, // ptr to iomapping structs
|
|
0x00000003, // number of iomappings
|
|
0x00000001 // pid (MCP)
|
|
};
|
|
|
|
static u32 kernel_syscall_0x81(u32 address)
|
|
{
|
|
return *(volatile u32*)address;
|
|
}
|
|
|
|
static int kernel_read_otp_internal(int index, void* out_buf, u32 size)
|
|
{
|
|
kernel_memcpy(out_buf, otp_buffer + (index << 2), size);
|
|
return 0;
|
|
}
|
|
|
|
int kernel_init_otp_buffer(u32 sd_sector, int dumpFound)
|
|
{
|
|
int res;
|
|
|
|
if(dumpFound)
|
|
{
|
|
res = FSA_SDReadRawSectors(otp_buffer, sd_sector, 2);
|
|
}
|
|
else
|
|
{
|
|
int (*orig_kernel_read_otp_internal)(int index, void* out_buf, u32 size) = (void*)0x08120248;
|
|
res = orig_kernel_read_otp_internal(0, otp_buffer, 0x400);
|
|
}
|
|
|
|
if((res == 0) && (dumpFound == 0))
|
|
{
|
|
FSA_SDWriteRawSectors(otp_buffer, sd_sector, 2);
|
|
}
|
|
return res;
|
|
}
|
|
|
|
void kernel_launch_ios(u32 launch_address, u32 L, u32 C, u32 H)
|
|
{
|
|
void (*kernel_launch_bootrom)(u32 launch_address, u32 L, u32 C, u32 H) = (void*)0x0812A050;
|
|
|
|
if(*(u32*)(launch_address - 0x300 + 0x1AC) == 0x00DFD000)
|
|
{
|
|
int level = disable_interrupts();
|
|
unsigned int control_register = disable_mmu();
|
|
|
|
u32 ios_elf_start = launch_address + 0x804 - 0x300;
|
|
|
|
//! try to keep the order of virt. addresses to reduce the memmove amount
|
|
mcp_run_patches(ios_elf_start);
|
|
kernel_run_patches(ios_elf_start);
|
|
|
|
//if(cfw_config.redNAND)
|
|
//{
|
|
fs_run_patches(ios_elf_start);
|
|
|
|
// if(cfw_config.seeprom_red)
|
|
// bsp_run_patches(ios_elf_start);
|
|
//}
|
|
|
|
restore_mmu(control_register);
|
|
enable_interrupts(level);
|
|
}
|
|
|
|
kernel_launch_bootrom(launch_address, L, C, H);
|
|
}
|
|
|
|
void kernel_run_patches(u32 ios_elf_start)
|
|
{
|
|
section_write(ios_elf_start, (u32)__KERNEL_CODE_START, __KERNEL_CODE_START, __KERNEL_CODE_END - __KERNEL_CODE_START);
|
|
section_write_word(ios_elf_start, 0x0812A120, ARM_BL(0x0812A120, kernel_launch_ios));
|
|
|
|
section_write(ios_elf_start, 0x08140DE0, KERNEL_MCP_IOMAPPINGS_STRUCT, sizeof(KERNEL_MCP_IOMAPPINGS_STRUCT));
|
|
|
|
section_write_word(ios_elf_start, 0x0812A134, ARM_BL(0x0812A134, crash_handler_prefetch));
|
|
section_write_word(ios_elf_start, 0x0812A1AC, ARM_BL(0x0812A1AC, crash_handler_data));
|
|
section_write_word(ios_elf_start, 0x08129E50, ARM_BL(0x08129E50, crash_handler_undef_instr));
|
|
|
|
section_write_word(ios_elf_start, 0x0812CD2C, ARM_B(0x0812CD2C, kernel_syscall_0x81));
|
|
|
|
/*if(cfw_config.redNAND && cfw_config.otp_red)
|
|
{
|
|
section_write(ios_elf_start, (u32)otp_buffer, otp_buffer, 0x400);
|
|
section_write_word(ios_elf_start, 0x08120248, ARM_B(0x08120248, kernel_read_otp_internal));
|
|
}*/
|
|
|
|
u32 patch_count = (u32)(((u8*)kernel_patches_table_end) - ((u8*)kernel_patches_table)) / sizeof(patch_table_t);
|
|
patch_table_entries(ios_elf_start, kernel_patches_table, patch_count);
|
|
}
|
|
|