XHCIPatcher.py

def TuneDataPatch(data, value1, value2):
    movInstruction = 0x52800002
    instr1 = movInstruction | (value1 << 5)
    instr2 = movInstruction | (value2 << 5)
    
    loc = data.find(instr1.to_bytes(4, byteorder='little'))
    if loc < 0 or loc % 4 != 0:
        return data
    
    print("Patching tune data at 0x{:08x}".format(loc))

    data = data.replace(instr1.to_bytes(4, byteorder='little'), instr2.to_bytes(4, byteorder='little'))

    return data

def XHCIPatch(data, value1, value2):
    movInstruction = 0x52800001
    instr1 = movInstruction | (value1 << 5)
    instr2 = movInstruction | (value2 << 5)

    loc = data.find(instr1.to_bytes(4, byteorder='little'))
    if loc < 0 or loc % 4 != 0:
        return data
    
    print("Patching offset at 0x{:08x}".format(loc))

    data = data.replace(instr1.to_bytes(4, byteorder='little'), instr2.to_bytes(4, byteorder='little'))

    return data


file = open("./QcXhciFilter7180.sys", "rb")

data = file.read()

file.close()

# Patching offset of init sequence
for i in range(0x300):
    data = XHCIPatch(data, 0x3000 | i, 0x2000 | i)

# Patching efuse address
data = XHCIPatch(data, 0x4258, 0x4200)

# Tune data patching
data = TuneDataPatch(data, 0x47, 0x45)
data = TuneDataPatch(data, 0x28, 0x29)

file = open("./QcXhciFilter7150.sys", "wb")

file.write(data)

file.close()