rw-r-r-0644

.arm.big

.open "patches/sections/0x08120000.bin","patches/patched_sections/0x08120000.bin",0x08120000

CODE_SECTION_BASE equ 0x08120000
CODE_SECTION_SIZE equ 0x00015000
CODE_BASE equ (CODE_SECTION_BASE + CODE_SECTION_SIZE)

RODATA_SECTION_BASE equ 0x08140000
RODATA_SECTION_SIZE equ 0x00002478

rw-r-r-0644

/* this computations are repeated thoughout the function */
static inline u32 _blockClusters(FSISFS_Volume *isfs) {
    return isfs->devCaps.blockSize >> 0xe;
}
static inline u32 _superblockCount(FSISFS_Volume *isfs) {
    return 1 << isfs->superblockCountLog2;
}
static inline u8 _superblockSizeLog2(FSISFS_Volume *isfs) {
    return isfs->metadataSizeLog2 - isfs->superblockCountLog2;
}

rw-r-r-0644

#!/usr/bin/env python3
import struct
import sys
from Crypto.Hash import SHA1

stage2file = sys.argv[1]
outfile = sys.argv[2]

stage2 = bytearray(open(stage2file, "rb").read())

rw-r-r-0644

int write_payload(uint8_t *ptr)
{
	/* instructions placed at 0x0C+(0x20*k)
	 * will be corrupted if the 2 least
	 * significant bits are set */

	/* clean the area overwritten by the stack overflow
	 * memset( 0x0D40E240, 0, 0xB70 ) */
	write32(ptr+0x000, 0xe59f30f8); // ldr r3, [pc, #0xF8]

rw-r-r-0644

int ISFS_Setup(ISFS *this,int init)
{
	if (init == 0)
		return 0;

	super = ISFS_LoadSuperblock(this);
	if (!super)
		return -0x8046F;

rw-r-r-0644

ISFS_Superblock *ISFS_LoadSuperblock(ISFS *isfs)
{
	if ((isfs->initState & 2) == 0)
		return;

	if ((isfs->initState & 0x44) == 0x44)
		return NULL;

	int latestVersion = 0;

rw-r-r-0644

/* gensuperblock.c
 * 
 * Copyright (C) 2021 rw-r-r-0644
 * This file is under GNU GPLv2+
 */
#include <arpa/inet.h>
#include <stdint.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>

rw-r-r-0644

#include <iostream>
#include <fstream>
#include <arpa/inet.h>
#include <cstdint>
#include <cstring>

struct FST_Entry
{
    char name[12];
    uint8_t mode;

rw-r-r-0644

; brainfuck.rkt
;
; A slow, limited, but fun to write brainfuck interpreter in Racket teaching language
; Input instructions are not supported
;
; (language: Intermediate Student with lambda)
;
; Copyright (C) 2021 rw-r-r-0644
; This code is under GNU GPLv2

rw-r-r-0644

.text

@ this code runs at 0x00000048 after boot1 jumps to NULL

.global _start
_start:
	@ Patch PRSH checksum (offsets replaced when writing payload)
	ldr r2, =0xcafe0001			@ prsh_hdr_offset
	ldr r0, =0xcafe0002			@ checksum_old
	str r0, [r2]