Gateway 3DS Installer Mockup

gateway.c

/* TYPEDEFS */
typedef unsigned char u8;
typedef unsigned short u16;
typedef long size_t;
/* EXTERNS */
int iprintf(const char * format, ...);
void firmware_page_program_and_write(int offset, void * buffer, int length);
void firmware_read(int offset, void *buffer, int length);
int memcmp(void * dst, void * src, int length);
int memcpy(void * dst, void * src, int length);
void * memUncached(void * addr);
void *memset(void * s, int c, size_t n);
void INIT(void);
void WAIT_FOR_BUTTON_PRESS(void);
u16 CRC16(void * addr, int length);

#define FW_SIZE 0x20000
char fw_buffer[FW_SIZE];

char patches1[] = {
	0xb9,0xf2,0x10,0x00,0xae,0x2b,0x27,0x00,0xed,0x0d,0xdc,0xba,0x9c,0xf1,0x18,0x00,
	0x90,0xb6,0x10,0x00,0x00,0xb0,0xfa,0x00,0x00,0x02,0x20,0x00,0xb9,0xf2,0x10,0x00,
	0x00,0x90,0x27,0x00,0x01,0x00,0x00,0x00,0xe1,0x49,0x15,0x00,0x38,0x6f,0x27,0x00,
	0xac,0x82,0x1b,0x00,0xdc,0xd5,0x18,0x00,0x40,0x83,0x27,0x00,0x00,0x02,0x10,0x00,
	0xcc,0x48,0x00,0x00,0x60,0x3d,0x14,0x00,0xb9,0xf2,0x10,0x00,0x00,0x90,0x27,0x00,
	0x00,0x00,0x2b,0x00,0xf9,0x02,0x10,0x00,0xf9,0x02,0x10,0x00,0xf9,0x02,0x10,0x00,
	0xf9,0x02,0x10,0x00,0xf9,0x02,0x10,0x00,0xf9,0x02,0x10,0x00,0xe1,0x49,0x15,0x00,
	0x00,0x00,0x00,0x00,0xe1,0x49,0x15,0x00,0x20,0x90,0x27,0x00,0x8c,0x53,0x10,0x00,
	0x00,0x90,0x00,0x00,0x58,0x39,0x1b,0x00,0xe5,0x04,0x21,0x00,0x00,0xda,0x19,0x00,
	0x00,0x75,0x01,0x00,0x86,0xdf,0x21,0x00,0x00,0xc1,0x1a,0x00,0x22,0xda,0x1d,0x00,
	0x91,0xfe,0x16,0x00,0x00,0x01,0x10,0x00,0xbc,0x4c,0x14,0x00,0x00,0x00,0x2b,0x00,
	0x00,0x90,0x00,0x00,0xe1,0x49,0x15,0x00,0xac,0xef,0x22,0x00,0x88,0x5c,0x10,0x00,
	0x00,0x00,0x0e,0x00,0x90,0x03,0x25,0x00,0xc0,0xfa,0x1e,0x00,0x91,0xfe,0x16,0x00,
	0x8c,0x53,0x10,0x00,0x24,0x6b,0x03,0x00,0x60,0x3d,0x14,0x00,
};
int patches1_len = 0xDC;

char patches2[] = {
	0xb9,0xf2,0x10,0x00,0x00,0xfe,0x01,0x00,0x00,0x01,0x00,0x00,0xe1,0x49,0x15,0x00,
	0x00,0x94,0x27,0x00,0xfc,0x34,0x13,0x00,0xd0,0x8c,0x1e,0x00,0x8c,0x53,0x10,0x00,
	0x9c,0x94,0x27,0xf0,0x60,0x3d,0x14,0x00,
};
int patches2_len = 0x28;

void programming()
{
	int offset = 0;
	iprintf("  >> PROGRAMMING [");
	do
	{
		firmware_page_program_and_write(offset, fw_buffer + offset, 0x20);
		offset += 0x20;
	} while (offset != FW_SIZE);
	iprintf("]\n");
}

char temp_buffer[0x20] = {0};
void verifying()
{
	int offset = 0;
	iprintf("  >> VERIFYING [");
	do
	{
		firmware_read(offset, temp_buffer, 0x20);
		if (memcmp(temp_buffer, fw_buffer + offset, 0x20))
		{
			iprintf(" >> VERIFY ERROR\n");
			WAIT_FOR_BUTTON_PRESS();
			break;
		}
		offset += 0x20;
	} while (offset != FW_SIZE);
	iprintf("]\n");

}

int main()
{
	void * uncached = memUncached(fw_buffer);
	memset(uncached, 0, FW_SIZE);
	INIT();

	iprintf("\n\n  >> GATEWAY 3DS INSTALLER\n\n");
	iprintf("  >> PRESS (A) TO INSTALL\n");
	iprintf("  >> PRESS (B) TO EXIT\n");

	WAIT_FOR_BUTTON_PRESS();

install:
	firmware_read(0, fw_buffer, FW_SIZE);
	memcpy(fw_buffer + 0x1FE00, patches1, patches1_len); /* UserSettings 1 */
	*(u16*)(fw_buffer + 0x1FE70) = 0x51; /* update_counter UserSettings 1 */
	*(u16*)(fw_buffer + 0x1FF70) = 0x52; /* update_counter UserSettings 2 */
	*(u16*)(fw_buffer + 0x1FF50) = 0x6E; /* message_length UserSettings 2 */
	memcpy(fw_buffer + 0x1FFB4, patches2, patches2_len); /* UserSettings 2 Not used area */

	/* PATCH CRC16s */
	*(u16*)(fw_buffer + 0x1FE72) = CRC16(fw_buffer + 0x1FE00, 0x70); /* 00h - 6Fh (1) */
	*(u16*)(fw_buffer + 0x1FEFE) = CRC16(fw_buffer + 0x1FE74, 0x8A); /* 74h - FDh (1) */
	*(u16*)(fw_buffer + 0x1FF72) = CRC16(fw_buffer + 0x1FF00, 0x70); /* 00h - 6Fh (2) */
	*(u16*)(fw_buffer + 0x1FFFE) = CRC16(fw_buffer + 0x1FF74, 0x8A); /* 74h - FDh (2) */

	programming();
	verifying();
	iprintf(" ** DONE! ENJOY GATEWAY! **\n");
	iprintf(" >> PRESS (A) TO EXIT\n");

	WAIT_FOR_BUTTON_PRESS();
	return 0;
}