@@ -60,7 +60,7 @@ void plant_hacks_for_e0070000(unsigned addr) {
60
60
* (unsigned short * ) (addr + 0x9DA2 ) = 0xbf00 ;
61
61
}
62
62
63
- // following should be integrated in dcache_clean_all
63
+ // should be integrated in dcache_clean_all
64
64
void l2_cache_sync (void ) {
65
65
* (int * ) 0xc1100730 = 0 ;
66
66
}
@@ -155,6 +155,56 @@ void __attribute__((naked,noinline)) sub_e00200f8_my() {
155
155
);
156
156
}
157
157
158
+ void __attribute__((naked ,noinline )) CreateTask_my () {
159
+ asm volatile (
160
+ " push {r0}\n"
161
+ " ldr r0, =task_InitFileModules\n"
162
+ " cmp r0, r3\n"
163
+ " it eq\n"
164
+ " ldreq r3, =init_file_modules_task\n"
165
+ "exitHook:\n"
166
+ " pop {r0}\n" // restore overwritten register(s)
167
+
168
+ // execute overwritten instructions from original code, then jump to firmware
169
+ // capdis -f=chdk -jfw -stubs -s=CreateTask -c=4 PRIMARY.BIN 0xe0000000
170
+ // CreateTask 0xdffc93a3
171
+ " push {r1, r2, r3, r4, r5, r6, r7, lr}\n"
172
+ " mov r4, r3\n"
173
+ " mov.w r3, #0x1000\n"
174
+ " ldr r5, [sp, #0x20]\n"
175
+ " ldr pc, =0xdffc93ad\n" // Continue in firmware
176
+ ".ltorg\n"
177
+ );
178
+ }
179
+
180
+ void __attribute__((naked ,noinline )) init_file_modules_task () {
181
+ // tools/capdis -f=chdk -jfw -stubs -s=task_InitFileModules -c=18 PRIMARY.BIN 0xe0000000
182
+ // task_InitFileModules 0xe00fdd05
183
+ asm volatile (
184
+ " push {r4, r5, r6, lr}\n"
185
+ " movs r0, #6\n"
186
+ " bl sub_e0362f64\n" // return
187
+ " bl sub_e011ce98\n"
188
+ " movs r4, r0\n"
189
+ " movw r5, #0x5006\n"
190
+ " beq loc_e00fdd20\n"
191
+ " movs r1, #0\n"
192
+ " mov r0, r5\n"
193
+ " bl _PostLogicalEventToUI\n"
194
+ "loc_e00fdd20:\n"
195
+ " bl sub_e011cec0\n"
196
+ " BL core_spytask_can_start\n" // set "it's-safe-to-start" flag for spytask
197
+ " cmp r4, #0\n"
198
+ " bne loc_e00fdd34\n" // return
199
+ " mov r0, r5\n"
200
+ " pop.w {r4, r5, r6, lr}\n"
201
+ " movs r1, #1\n"
202
+ " b.w _PostLogicalEventToUI\n"
203
+ "loc_e00fdd34:\n"
204
+ " pop {r4, r5, r6, pc}\n"
205
+ );
206
+ }
207
+
158
208
/**
159
209
* @see main startup
160
210
*/
@@ -239,13 +289,33 @@ void __attribute__((naked,noinline)) boot() {
239
289
" it lo\n"
240
290
" strlo r2, [r3], #4\n"
241
291
" blo loc_e002009e\n"
292
+
293
+ // install CreateTask patch
294
+ // use half words in case source or destination not word aligned
295
+ " adr r0, patch_CreateTask\n" // src: patch data
296
+ " ldr r1, =hook_CreateTask\n" // dest: address to patch
297
+ " add r2, r0, #10\n" // 2.5 words as target is not word aligned
298
+ "patch_hook_loop:\n"
299
+ " ldrh r3, [r0],#2\n"
300
+ " strh r3, [r1],#2\n"
301
+ " cmp r0,r2\n"
302
+ " blo patch_hook_loop\n"
303
+
242
304
" ldr r0, =0xdffc4900\n"
243
305
" ldr r1, =0x000152a0\n"
244
306
" bl _dcache_clean_by_mva\n"
245
307
" ldr r0, =0xdffc4900\n"
246
308
" ldr r1, =0x000152a0\n"
247
309
" bl _icache_branchpr_invalidate\n"
248
- " b loc_e0020032\n" // +
310
+ " b loc_e0020032\n" // +
311
+
312
+ " .align 2\n"
313
+ " .short 0\n" // added for alignment
314
+ "patch_CreateTask:\n"
315
+ " ldr.w pc, _createtask_my\n" // jump to absolute address CreateTask_my
316
+ " .short 0\n" // added for alignment
317
+ "_createtask_my:\n"
318
+ " .long CreateTask_my + 1\n" // has to be a thumb address
249
319
);
250
320
251
321
}
0 commit comments