.file "phatpatch-volvo-0.6.c" .section .rodata.str1.4,"aMS",%progbits,1 .align 2 .LC0: .ascii "PhatPatch v0.6 - original code by bushing, addition" .ascii "al patches by sbingner\000" .align 2 .LC1: .ascii "Usage: phatpatch OPT ARG\012\011OPTS:\012\011\011p " .ascii "= Patch flash\012\011\011v = Verify patched flash\012" .ascii "\011\011s filename = save flash to filename\000" .align 2 .LC2: .ascii "/dev/mem\000" .align 2 .LC3: .ascii "Can not open /dev/mem\000" .align 2 .LC4: .ascii "Error MMAP /dev/mem\000" .align 2 .LC5: .ascii "Error: provide name of file to save flash to\000" .align 2 .LC6: .ascii "Saving current flash.\000" .align 2 .LC7: .ascii "Can not create /dos/Data/flash.rom\000" .align 2 .LC8: .ascii "first 2 words of flash=%04x %04x\012\000" .align 2 .LC9: .ascii "testing offsets 0x555 and 0x2aa\000" .align 2 .LC10: .ascii "writing auto-id command (AA, 55, 90)\000" .align 2 .LC11: .ascii "Flash chip reports manufacturer id=%04x, device id=" .ascii "%04x\012\000" .align 2 .LC12: .ascii "offsets 0x555 and 0x2aa verified\000" .align 2 .LC13: .ascii "testing offsets 0x5555 and 0x2aaa\000" .align 2 .LC14: .ascii "offsets 0x5555 and 0x2aaa verified\000" .align 2 .LC15: .ascii "Error: unable to unlock flash\000" .align 2 .LC16: .ascii "Resetting flash.\000" .align 2 .LC17: .ascii "Testing patch locations:\000" .align 2 .LC18: .ascii "Patch %d @ %04x: %s\012\000" .align 2 .LC19: .ascii "Expected: %04x %04x Actual: %04x %04x\012\000" .align 2 .LC20: .ascii "Match! Programming...\000" .align 2 .LC21: .ascii "Waiting...\000" .align 2 .LC22: .ascii "Wrote %04x\012\000" .align 2 .LC23: .ascii "Detected patch %d already applied\012\000" .align 2 .LC24: .ascii "Mismatch!\000" .align 2 .LC25: .ascii "Verifying:\000" .align 2 .LC26: .ascii "Verified!\000" .align 2 .LC27: .ascii "Unverified!\000" .align 2 .LC28: .ascii "Invalid option\000" .text .align 2 .global main .type main, %function main: @ args = 0, pretend = 0, frame = 0 @ frame_needed = 0, uses_anonymous_args = 0 stmfd sp!, {r4, r5, r6, r7, r8, sl, lr} mov r5, r0 sub sp, sp, #8 ldr r0, .L67 mov r6, r1 bl puts cmp r5, #1 bgt .L2 ldr r0, .L67+4 bl puts mvn r0, #0 b .L63 .L2: ldr r0, .L67+8 ldr r1, .L67+12 bl open subs ip, r0, #0 bge .L4 ldr r0, .L67+16 .L65: bl perror .L64: mov r0, #1 .L63: bl exit .L4: mov r7, #0 mov r0, r7 mov r1, #131072 mov r2, #3 mov r3, #1 str ip, [sp, #0] str r7, [sp, #4] bl mmap cmn r0, #1 mov r4, r0 ldreq r0, .L67+20 beq .L65 ldr r3, [r6, #4] ldrb r3, [r3, #0] @ zero_extendqisi2 cmp r3, #115 beq .L10 cmp r3, #118 beq .L11 cmp r3, #112 bne .L56 b .L9 .L10: cmp r5, #2 bne .L12 ldr r0, .L67+24 bl puts b .L66 .L12: ldr r0, .L67+28 bl puts ldr r0, [r6, #8] ldr r1, .L67+32 bl open subs r5, r0, #0 bge .L14 ldr r0, .L67+36 bl perror .L66: mov r0, r4 mov r1, #131072 bl munmap b .L64 .L14: mov r1, r4 mov r2, #131072 bl write mov r0, r5 bl close b .L62 .L9: cmp r5, #3 movne sl, #100 bne .L19 ldr r0, [r6, #8] bl atoi mov sl, r0 .L19: ldrh r3, [r4, #0] ldrh r2, [r4, #4] mov r1, r3 ldr r0, .L67+40 mov r5, r3 mov r6, r2 bl printf ldr r0, .L67+44 bl puts ldr r0, .L67+48 bl puts mov r0, #0 bl fflush ldr r2, .L67+52 mov r1, #170 @ movhi ldr r3, .L67+56 strh r1, [r4, r2] @ movhi mov r1, #85 @ movhi strh r1, [r4, r3] @ movhi mov r3, #144 @ movhi strh r3, [r4, r2] @ movhi ldrh r3, [r4, #0] cmp r5, r3 bne .L20 ldrh r3, [r4, #4] cmp r6, r3 beq .L22 .L20: ldrh r1, [r4, #0] ldr r0, .L67+60 ldrh r2, [r4, #4] bl printf ldr r0, .L67+64 bl puts ldr r7, .L67+68 ldr r6, .L67+72 b .L23 .L22: ldr r0, .L67+76 bl puts ldr r0, .L67+48 bl puts mov r0, #0 bl fflush ldr r3, .L67+80 mov r1, #170 @ movhi ldr r2, .L67+84 strh r1, [r4, r3] @ movhi mov r1, #85 @ movhi strh r1, [r4, r2] @ movhi mov r2, #144 @ movhi strh r2, [r4, r3] @ movhi ldrh r3, [r4, #0] cmp r5, r3 bne .L24 ldrh r3, [r4, #4] cmp r6, r3 beq .L26 .L24: ldrh r1, [r4, #0] ldr r0, .L67+60 ldrh r2, [r4, #4] bl printf ldr r0, .L67+88 bl puts ldr r7, .L67+92 ldr r6, .L67+96 b .L23 .L26: ldr r0, .L67+100 bl puts b .L64 .L23: mov r0, #0 bl fflush ldr r0, .L67+104 bl puts mov r0, #0 bl fflush mov r3, #240 @ movhi strh r3, [r4, #0] @ movhi ldr r0, .L67+108 bl puts mov r0, #0 bl fflush ldr r5, .L67+112 add r8, r4, r6, asl #2 add r7, r4, r7, asl #2 mov r6, #0 .L27: cmp r6, sl bge .L28 add r6, r6, #1 mov r1, r6 ldr r2, [r5, #4] ldr r3, [r5, #0] ldr r0, .L67+116 bl printf mov r0, #0 bl fflush ldr r0, [r5, #4] bic r0, r0, #1 ldrh r3, [r4, r0] add r0, r4, r0 ldrh ip, [r0, #2] ldrh r1, [r5, #8] ldrh r2, [r5, #10] ldr r0, .L67+120 str ip, [sp, #0] bl printf mov r0, #0 bl fflush ldr r3, [r5, #4] bic r1, r3, #1 ldrh r2, [r4, r1] ldrh r3, [r5, #8] cmp r3, r2 add r0, r4, r1 bne .L30 ldrh r2, [r0, #2] ldrh r3, [r5, #10] cmp r3, r2 bne .L30 ldr r0, .L67+124 bl puts mov r0, #0 bl fflush ldrh r2, [r5, #8] ldrh r3, [r5, #12] cmp r2, r3 beq .L33 mov r1, #170 @ movhi mov r2, #85 @ movhi mov r3, #160 @ movhi strh r1, [r7, #0] @ movhi strh r2, [r8, #0] @ movhi strh r3, [r7, #0] @ movhi ldr r3, [r5, #4] ldrh r2, [r5, #12] bic r3, r3, #1 strh r2, [r4, r3] @ movhi mov r0, #2 bl sleep b .L58 .L36: ldr r0, .L67+128 bl puts .L58: mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 ldrh r3, [r4, r3] ldrh r1, [r5, #12] cmp r1, r3 bne .L36 ldr r0, .L67+132 bl printf .L33: ldrh r2, [r5, #10] ldrh r3, [r5, #14] cmp r2, r3 beq .L38 mov r1, #170 @ movhi strh r1, [r7, #0] @ movhi mov r2, #85 @ movhi mov r1, #160 @ movhi strh r2, [r8, #0] @ movhi ldr r3, [r5, #4] strh r1, [r7, #0] @ movhi bic r3, r3, #1 ldrh r2, [r5, #14] add r3, r4, r3 strh r2, [r3, #2] @ movhi mov r0, #2 bl sleep b .L59 .L41: ldr r0, .L67+128 bl puts .L59: mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 add r3, r4, r3 ldrh r3, [r3, #2] ldrh r1, [r5, #14] cmp r1, r3 bne .L41 ldr r0, .L67+132 bl printf b .L38 .L30: ldrh r2, [r0, #0] ldrh r3, [r5, #12] cmp r3, r2 bne .L43 add r3, r4, r1 ldrh r2, [r3, #2] ldrh r3, [r5, #14] cmp r3, r2 bne .L43 mov r1, r6 ldr r0, .L67+136 bl printf b .L46 .L43: ldr r0, .L67+140 bl puts .L46: mov r0, #0 bl fflush .L38: mov r0, #2 bl sleep cmp r6, #9 add r5, r5, #16 beq .L28 b .L27 .L11: ldr r0, .L67+144 bl puts mov r0, r7 bl fflush ldr r5, .L67+112 mov r6, r7 .L47: add r6, r6, #1 mov r1, r6 ldr r2, [r5, #4] ldr r3, [r5, #0] ldr r0, .L67+116 bl printf mov r0, #0 bl fflush ldr r0, [r5, #4] bic r0, r0, #1 ldrh r3, [r4, r0] add r0, r4, r0 ldrh ip, [r0, #2] ldrh r1, [r5, #12] ldrh r2, [r5, #14] ldr r0, .L67+120 str ip, [sp, #0] bl printf mov r0, #0 bl fflush ldr r3, [r5, #4] bic r3, r3, #1 ldrh r1, [r4, r3] ldrh r2, [r5, #12] cmp r2, r1 add r3, r4, r3 bne .L48 ldrh r2, [r3, #2] ldrh r3, [r5, #14] cmp r3, r2 ldreq r0, .L67+148 beq .L60 .L48: ldr r0, .L67+152 add r7, r7, #1 .L60: bl puts cmp r6, #9 add r5, r5, #16 bne .L47 b .L62 .L56: ldr r0, .L67+156 bl puts .L62: mov r5, r7 b .L16 .L28: mov r5, #0 .L16: mov r0, r4 mov r1, #131072 bl munmap mov r0, r5 add sp, sp, #8 ldmfd sp!, {r4, r5, r6, r7, r8, sl, pc} .L68: .align 2 .L67: .word .LC0 .word .LC1 .word .LC2 .word 4098 .word .LC3 .word .LC4 .word .LC5 .word .LC6 .word 4162 .word .LC7 .word .LC8 .word .LC9 .word .LC10 .word 5460 .word 2728 .word .LC11 .word .LC12 .word 1365 .word 682 .word .LC13 .word 87380 .word 43688 .word .LC14 .word 21845 .word 10922 .word .LC15 .word .LC16 .word .LC17 .word patches .word .LC18 .word .LC19 .word .LC20 .word .LC21 .word .LC22 .word .LC23 .word .LC24 .word .LC25 .word .LC26 .word .LC27 .word .LC28 .size main, .-main .global patches .section .rodata.str1.4 .align 2 .LC29: .ascii "make drive signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC30: .ascii "make rc.sh signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC31: .ascii "make phatd signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC32: .ascii "make linux signature check always succeed: [bne ver" .ascii "ify_sig_failed -> bne PC+1]\000" .align 2 .LC33: .ascii "make ramdisk invalid signature return 0 instead of " .ascii "0xFFFFFFFF: [movlne r0, 0xFFFFFFFF -> movlne r0, #0" .ascii "]\000" .align 2 .LC34: .ascii "make ramdisk signature check verify 0 instead of 1:" .ascii " [cmp r0, #1 -> cmp r0, #0]\000" .align 2 .LC35: .ascii "make ramdisk valid signature return 0 instead of 1:" .ascii " [moveq r0, #1 -> moveq r0, #0]\000" .align 2 .LC36: .ascii "don't try to read ramdisk.sig (boot without any .si" .ascii "g files): [bl sector_read_suzy -> bl PC+1]\000" .align 2 .LC37: .ascii "don't try to read linux.sig (boot without any .sig " .ascii "files): [bl sector_read_suzy -> bl PC+1]\000" .data .align 2 .type patches, %object .size patches, 144 patches: .word .LC29 .word 3472 .short 51 .short 6656 .short 0 .short 6656 .word .LC30 .word 3524 .short 38 .short 6656 .short 0 .short 6656 .word .LC31 .word 3576 .short 25 .short 6656 .short 0 .short 6656 .word .LC32 .word 3628 .short 12 .short 6656 .short 0 .short 6656 .word .LC33 .word 1308 .short 0 .short 5088 .short 0 .short 5024 .word .LC34 .word 3672 .short 1 .short -7344 .short 0 .short -7344 .word .LC35 .word 1312 .short 1 .short 928 .short 0 .short 928 .word .LC36 .word 1268 .short 736 .short -5376 .short 0 .short -5376 .word .LC37 .word 1120 .short 773 .short -5376 .short 0 .short -5376 .ident "GCC: (GNU) 4.1.2"