//Just patches signatures check, loads in sysnand void DevMode(){ u8* firm = 0x24000000; nand_readsectors(0, 0xF0000/0x200, firm, FIRM0); if(strncmp((char*)firm, "FIRM", 4)) nand_readsectors(0, 0xF0000/0x200, firm, FIRM1); unsigned char sign1[] = {0xC1, 0x17, 0x49, 0x1C, 0x31, 0xD0, 0x68, 0x46, 0x01, 0x78, 0x40, 0x1C, 0x00, 0x29, 0x10, 0xD1}; unsigned char sign2[] = {0xC0, 0x1C, 0x76, 0xE7, 0x20, 0x00, 0x74, 0xE7, 0x22, 0xF8, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x0F}; unsigned char patch1[] = { 0x00, 0x20, 0x4E, 0xB0, 0x70, 0xBD }; unsigned char patch2[] = { 0x00, 0x20}; for(int i = 0; i < 0xF0000; i++){ if(!memcmp(firm + i, sign1, 16)){ memcpy(firm + i, patch1, 6); } if(!memcmp(firm + i, sign2, 16)){ memcpy(firm + i, patch2, 2); } } memcpy(0x080F0000, GetFilePack("reboot.bin"), 0x8000); _softreset(); }
int InstallData(char* drive){ FIL firmfile; char* progressbar = "[ ]"; char* progress = progressbar+1; print("%s", progressbar); ConsolePrevLine(); //Create the workdir sprintf(tmpstr, "%s:%s", drive, DATAFOLDER); f_mkdir(tmpstr); f_chmod(tmpstr, AM_HID, AM_HID); //Read firmware data if(f_open(&firmfile, "firmware.bin", FA_READ | FA_OPEN_EXISTING) == FR_OK){ //... We'll see }else return CONF_NOFIRMBIN; *progress++ = '.'; DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); //Create patched native_firm f_read(&firmfile, WORKBUF, NAT_SIZE, &tmpu32); u8* n_firm = decryptFirmTitle(WORKBUF, NAT_SIZE, 0x00000002); u8* n_firm_patch = GetFilePack("nat_patch.bin"); applyPatch(n_firm, n_firm_patch); u8 keyx[16] = {0}; if(GetSystemVersion() < 3){ FileOpen(&tempfile, KEYFILENAME, 0); FileRead(&tempfile, &keyx[0], 16, 0); FileClose(&tempfile); } *progress++ = '.'; DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); for(int i = 0; i < NAT_SIZE; i+=0x4){ if(!strcmp((char*)n_firm + i, "Shit")){ if(1){ memcpy((char*)n_firm + i, rxmode_emu_label, 4); }else{ memcpy((char*)n_firm + i, rxmode_sys_label , 4); } } if(!strcmp((char*)n_firm + i, "InsertKeyXHere!") && keyx[0] != 0){ memcpy(n_firm + i, keyx, 16); } if(*((unsigned int*)(n_firm + i)) == 0xAAAABBBB){ *((unsigned int*)(n_firm + i)) = (checkEmuNAND() / 0x200) - 1; } } *progress++ = '.'; DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); sprintf(tmpstr, "%s:%s/0004013800000002.bin", drive, DATAFOLDER); if(FileOpen(&tempfile, tmpstr, 1)){ FileWrite(&tempfile, n_firm, NAT_SIZE, 0); FileClose(&tempfile); //FileCopy("0004013800000002.bin", tmpstr); }else return CONF_ERRNFIRM; *progress++ = '.'; DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); //Create AGB patched firmware f_read(&firmfile, WORKBUF, AGB_SIZE, &tmpu32); u8* a_firm = decryptFirmTitle(WORKBUF, AGB_SIZE, 0x00000202); u8* a_firm_patch = GetFilePack("agb_patch.bin"); if(a_firm){ applyPatch(a_firm, a_firm_patch); sprintf(tmpstr, "%s:%s/0004013800000202.bin", drive, DATAFOLDER); if(FileOpen(&tempfile, tmpstr, 1)){ FileWrite(&tempfile, a_firm, AGB_SIZE, 0); FileClose(&tempfile); }else return CONF_ERRNFIRM; *progress++ = '.'; }else{ //If we cannot decrypt it from firmware.bin becouse of titlekey messed up, it probably means that AGB has been modified in some way. //So we read it from his installed ncch... FindApp(0x00040138, 0x00000202, 1); char* path = getContentAppPath(); FileOpen(&tempfile, path, 0); FileRead(&tempfile, WORKBUF, AGB_SIZE, 0); FileClose(&tempfile); a_firm = decryptFirmTitleNcch(WORKBUF, AGB_SIZE); if(a_firm){ applyPatch(a_firm, a_firm_patch); sprintf(tmpstr, "%s:%s/0004013800000202.bin", drive, DATAFOLDER); if(FileOpen(&tempfile, tmpstr, 1)){ FileWrite(&tempfile, a_firm, AGB_SIZE, 0); FileClose(&tempfile); }else return CONF_ERRNFIRM; *progress++ = '.'; }else{ *progress++ = 'x'; //If we get here, then we'll play without AGB, lol } } DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); //Create TWL patched firmware f_read(&firmfile, WORKBUF, TWL_SIZE, &tmpu32); u8* t_firm = decryptFirmTitle(WORKBUF, TWL_SIZE, 0x00000102); u8* t_firm_patch = GetFilePack("twl_patch.bin"); if(t_firm){ applyPatch(t_firm, t_firm_patch); sprintf(tmpstr, "%s:%s/0004013800000102.bin", drive, DATAFOLDER); if(FileOpen(&tempfile, tmpstr, 1)){ FileWrite(&tempfile, t_firm, TWL_SIZE, 0); FileClose(&tempfile); //FileCopy("0004013800000102.bin", tmpstr); }else return CONF_ERRNFIRM; *progress++ = '.'; }else{ *progress++ = 'x'; } DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); sprintf(tmpstr, "%s:%s/data.bin", drive, DATAFOLDER); if(FileOpen(&tempfile, tmpstr, 1)){ FileWrite(&tempfile, __DATE__, 12, 0); FileWrite(&tempfile, __TIME__, 9, 12); FileClose(&tempfile); }else return CONF_CANTOPENFILE; *progress++ = '.'; DrawString(BOT_SCREEN, progressbar, 130, 50, ConsoleGetTextColor(), ConsoleGetBackgroundColor()); f_close(&firmfile); return 0; }
void firmlaunch(u8* firm){ memcpy(FIRM_ADDR, firm, 0x200000); //Fixed size, no FIRM right now is that big memcpy(0x080F0000, GetFilePack("reboot.bin"), 0x8000); _softreset(); }