.file "phatpatch-0.4.c" .section .rodata.str1.4,"aMS",%progbits,1 .align 2 .LC0: .ascii "PhatPatch v0.4 - original code by bushing, addition" .ascii "al patches by sbingner\000" .align 2 .LC1: .ascii "Usage: phatpatch OPT ARG\012\011OPTS:\012\011\011p " .ascii "= Patch flash\012\011\011v = Verify patched flash\012" .ascii "\011\011s filename = save flash to filename\000" .align 2 .LC2: .ascii "/dev/mem\000" .align 2 .LC3: .ascii "Can not open /dev/mem\000" .align 2 .LC4: .ascii "Error MMAP /dev/mem\000" .align 2 .LC5: .ascii "Error: provide name of file to save flash to\000" .align 2 .LC6: .ascii "Saving current flash.\000" .align 2 .LC7: .ascii "Can not create /dos/Data/flash.rom\000" .align 2 .LC8: .ascii "first 2 words of flash=%04x %04x\012\000" .align 2 .LC9: .ascii "writing auto-id command (AA, 55, 90)\000" .align 2 .LC10: .ascii "Flash chip reports manufacturer id=%04x, device id=" .ascii "%04x\012\000" .align 2 .LC11: .ascii "Resetting flash.\000" .align 2 .LC12: .ascii "Testing patch locations:\000" .align 2 .LC13: .ascii "Patch %d @ %04x: %s\012\000" .align 2 .LC14: .ascii "Expected: %04x %04x Actual: %04x %04x\012\000" .align 2 .LC15: .ascii "Match! Programming...\000" .align 2 .LC16: .ascii "Waiting...\000" .align 2 .LC17: .ascii "Wrote %04x\012\000" .align 2 .LC18: .ascii "Mismatch!\000" .align 2 .LC19: .ascii "Verifying:\000" .align 2 .LC20: .ascii "Verified!\000" .align 2 .LC21: .ascii "Unverified!\000" .align 2 .LC22: .ascii "Invalid option\000" .text .align 2 .global main .type main, %function main: @ args = 0, pretend = 0, frame = 0 @ frame_needed = 0, uses_anonymous_args = 0 stmfd sp!, {r4, r5, r6, r7, r8, lr} mov r5, r0 sub sp, sp, #8 ldr r0, .L52 mov r7, r1 bl puts cmp r5, #1 bgt .L2 ldr r0, .L52+4 bl puts mvn r0, #0 b .L48 .L2: ldr r0, .L52+8 ldr r1, .L52+12 bl open subs ip, r0, #0 bge .L4 ldr r0, .L52+16 .L50: bl perror .L49: mov r0, #1 .L48: bl exit .L4: mov r6, #0 mov r0, r6 mov r1, #131072 mov r2, #3 mov r3, #1 str ip, [sp, #0] str r6, [sp, #4] bl mmap cmn r0, #1 mov r4, r0 ldreq r0, .L52+20 beq .L50 ldr r3, [r7, #4] ldrb r3, [r3, #0] @ zero_extendqisi2 cmp r3, #115 beq .L10 cmp r3, #118 beq .L11 cmp r3, #112 bne .L41 b .L9 .L10: cmp r5, #2 bne .L12 ldr r0, .L52+24 bl puts b .L51 .L12: ldr r0, .L52+28 bl puts ldr r0, [r7, #8] ldr r1, .L52+32 bl open subs r5, r0, #0 bge .L14 ldr r0, .L52+36 bl perror .L51: mov r0, r4 mov r1, #131072 bl munmap b .L49 .L14: mov r1, r4 mov r2, #131072 bl write mov r0, r5 bl close b .L47 .L9: ldrh r1, [r4, #0] ldr r0, .L52+40 ldrh r2, [r4, #4] bl printf ldr r0, .L52+44 bl puts mov r0, #0 bl fflush ldr r2, .L52+48 mov r1, #170 @ movhi ldr r3, .L52+52 strh r1, [r4, r2] @ movhi mov r1, #85 @ movhi strh r1, [r4, r3] @ movhi mov r3, #144 @ movhi strh r3, [r4, r2] @ movhi ldr r0, .L52+56 ldrh r1, [r4, #0] ldrh r2, [r4, #4] bl printf mov r0, #0 bl fflush ldr r0, .L52+60 bl puts mov r0, #0 bl fflush mov r1, #240 @ movhi strh r1, [r4, #0] @ movhi ldr r0, .L52+64 bl puts mov r0, #0 bl fflush add r6, r4, #5440 add r7, r4, #2720 ldr r5, .L52+68 add r6, r6, #20 add r7, r7, #8 mov r8, #0 .L17: add r8, r8, #1 mov r1, r8 ldr r2, [r5, #4] ldr r3, [r5, #0] ldr r0, .L52+72 bl printf mov r0, #0 bl fflush ldr r0, [r5, #4] bic r0, r0, #1 ldrh r3, [r4, r0] add r0, r4, r0 ldrh ip, [r0, #2] ldrh r1, [r5, #8] ldrh r2, [r5, #10] ldr r0, .L52+76 str ip, [sp, #0] bl printf mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 ldrh r1, [r4, r3] ldrh r2, [r5, #8] cmp r2, r1 add r3, r4, r3 bne .L18 ldrh r2, [r3, #2] ldrh r3, [r5, #10] cmp r3, r2 bne .L18 ldr r0, .L52+80 bl puts mov r0, #0 bl fflush ldrh r2, [r5, #8] ldrh r3, [r5, #12] cmp r2, r3 beq .L21 mov r2, #170 @ movhi mov r3, #85 @ movhi mov r1, #160 @ movhi strh r2, [r6, #0] @ movhi strh r3, [r7, #0] @ movhi strh r1, [r6, #0] @ movhi ldr r3, [r5, #4] ldrh r2, [r5, #12] bic r3, r3, #1 strh r2, [r4, r3] @ movhi mov r0, #2 bl sleep b .L44 .L24: ldr r0, .L52+84 bl puts .L44: mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 ldrh r3, [r4, r3] ldrh r1, [r5, #12] cmp r1, r3 bne .L24 ldr r0, .L52+88 bl printf .L21: ldrh r2, [r5, #10] ldrh r3, [r5, #14] cmp r2, r3 beq .L26 mov r2, #170 @ movhi strh r2, [r6, #0] @ movhi mov r1, #85 @ movhi mov r2, #160 @ movhi strh r1, [r7, #0] @ movhi ldr r3, [r5, #4] strh r2, [r6, #0] @ movhi bic r3, r3, #1 ldrh r2, [r5, #14] add r3, r4, r3 strh r2, [r3, #2] @ movhi mov r0, #2 bl sleep b .L45 .L29: ldr r0, .L52+84 bl puts .L45: mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 add r3, r4, r3 ldrh r3, [r3, #2] ldrh r1, [r5, #14] cmp r1, r3 bne .L29 ldr r0, .L52+88 bl printf b .L26 .L18: ldr r0, .L52+92 bl puts mov r0, #0 bl fflush .L26: mov r0, #2 bl sleep cmp r8, #7 add r5, r5, #16 bne .L17 mov r5, #0 b .L16 .L11: ldr r0, .L52+96 bl puts mov r0, r6 bl fflush ldr r5, .L52+68 mov r7, r6 .L32: add r6, r6, #1 mov r1, r6 ldr r2, [r5, #4] ldr r3, [r5, #0] ldr r0, .L52+72 bl printf mov r0, #0 bl fflush ldr r0, [r5, #4] bic r0, r0, #1 ldrh r3, [r4, r0] add r0, r4, r0 ldrh ip, [r0, #2] ldrh r1, [r5, #12] ldrh r2, [r5, #14] ldr r0, .L52+76 str ip, [sp, #0] bl printf mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 ldrh r1, [r4, r3] ldrh r2, [r5, #12] cmp r2, r1 add r3, r4, r3 bne .L33 ldrh r2, [r3, #2] ldrh r3, [r5, #14] cmp r3, r2 ldreq r0, .L52+100 beq .L46 .L33: ldr r0, .L52+104 add r7, r7, #1 .L46: bl puts cmp r6, #7 add r5, r5, #16 bne .L32 mov r5, r7 b .L16 .L41: ldr r0, .L52+108 bl puts .L47: mov r5, r6 .L16: mov r0, r4 mov r1, #131072 bl munmap mov r0, r5 add sp, sp, #8 ldmfd sp!, {r4, r5, r6, r7, r8, pc} .L53: .align 2 .L52: .word .LC0 .word .LC1 .word .LC2 .word 4098 .word .LC3 .word .LC4 .word .LC5 .word .LC6 .word 4162 .word .LC7 .word .LC8 .word .LC9 .word 5460 .word 2728 .word .LC10 .word .LC11 .word .LC12 .word patches .word .LC13 .word .LC14 .word .LC15 .word .LC16 .word .LC17 .word .LC18 .word .LC19 .word .LC20 .word .LC21 .word .LC22 .size main, .-main .global patches .section .rodata.str1.4 .align 2 .LC23: .ascii "make drive signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC24: .ascii "make rc.sh signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC25: .ascii "make phatd signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC26: .ascii "make linux signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC27: .ascii "make ramdisk invalid signature return 0 instead of " .ascii "0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0" .ascii "]\000" .align 2 .LC28: .ascii "make ramdisk signature check verify 0 instead of 1:" .ascii " [cmp r0, #1 -> cmp r0, #0]\000" .align 2 .LC29: .ascii "make ramdisk valid signature return 0 instead of 1:" .ascii " [moveq r0, #1 -> moveq r0, #0]\000" .data .align 2 .type patches, %object .size patches, 112 patches: .word .LC23 .word 3000 .short 51 .short 6656 .short 0 .short 6656 .word .LC24 .word 3052 .short 38 .short 6656 .short 0 .short 6656 .word .LC25 .word 3104 .short 25 .short 6656 .short 0 .short 6656 .word .LC26 .word 3156 .short 12 .short 6656 .short 0 .short 6656 .word .LC27 .word 852 .short 0 .short 5088 .short 0 .short 5024 .word .LC28 .word 3200 .short 1 .short -7344 .short 0 .short -7344 .word .LC29 .word 856 .short 1 .short 928 .short 0 .short 928 .ident "GCC: (GNU) 4.1.2"