From: chaoskagami Date: Thu, 4 Aug 2016 01:35:38 +0000 (-0400) Subject: Last of the low-hanging fruit X-Git-Tag: v0.3.0~71 X-Git-Url: https://chaos.moe/g/?a=commitdiff_plain;h=11602daf47b7508e77ec6099e126710605a78c73;p=corbenik%2Fcorbenik.git Last of the low-hanging fruit --- diff --git a/include/firm/fcram.h b/include/firm/fcram.h deleted file mode 100644 index f743a51..0000000 --- a/include/firm/fcram.h +++ /dev/null @@ -1,38 +0,0 @@ -#ifndef __FCRAM_H -#define __FCRAM_H - -// File to keep track of all the fcram offsets in use. -// It provides an easy overview of all that is used. - -#include -#include - -extern void *fcram_temp; - -// Space between most of the locations -#define FCRAM_SPACING 0x100000 - -// Start of the space we use -#define FCRAM_START 0x24000000 - -// firm.c -#define FCRAM_FIRM_LOC FCRAM_START -#define FCRAM_TWL_FIRM_LOC (FCRAM_FIRM_LOC + FCRAM_SPACING) // Double size -#define FCRAM_AGB_FIRM_LOC (FCRAM_TWL_FIRM_LOC + FCRAM_SPACING * 2) - -// Throwaway temporary space. Don't expect it to stay sane. -#define FCRAM_JUNK_LOC FCRAM_START - -// Location to perform static allocations at. -#define FCRAM_STATIC_ALLOC_LOC (FCRAM_START + FCRAM_SPACING) - -// Grow memory segment. -void *fake_sbrk(size_t bytes); - -// Allocate memory for use. -void *malloc (size_t size); - -// Free in-use memory. -void free (void* ptr); - -#endif diff --git a/include/std/allocator.h b/include/std/allocator.h new file mode 100644 index 0000000..fa424f4 --- /dev/null +++ b/include/std/allocator.h @@ -0,0 +1,19 @@ +#ifndef __FCRAM_H +#define __FCRAM_H + +#include +#include + +// Space between most of the locations (remove me) +#define FCRAM_SPACING 0x100000 + +// Grow program break +void *sbrk(size_t bytes); + +// Allocate memory for use. +void *malloc (size_t size); + +// Free in-use memory. +void free (void* ptr); + +#endif diff --git a/source/Makefile.am b/source/Makefile.am index fa375a1..6f9bc98 100644 --- a/source/Makefile.am +++ b/source/Makefile.am @@ -19,4 +19,4 @@ corbenikdir = $(top_srcdir)/source inc_dir = $(top_srcdir)/include -corbenik_SOURCES = patch/reboot.c patch/svc.c patch/module.c patch/emunand.c main.c option.c std/fs.c std/draw.c std/memory.c std/abort.c menu.c chain.c firm/version.c firm/firm.c firm/decryptor.c firm/fcram.c interp.c input.c patcher.c display.c start.s interrupt.c screeninit.c +corbenik_SOURCES = patch/reboot.c patch/svc.c patch/module.c patch/emunand.c main.c option.c std/fs.c std/draw.c std/memory.c std/abort.c menu.c chain.c firm/version.c firm/firm.c firm/decryptor.c std/allocator.c interp.c input.c patcher.c display.c start.s interrupt.c screeninit.c diff --git a/source/firm/firm.c b/source/firm/firm.c index 698ff88..b2b28cd 100644 --- a/source/firm/firm.c +++ b/source/firm/firm.c @@ -296,14 +296,16 @@ decrypt_firm(firm_h *dest, char *path_firmkey, char *path_cetk, uint32_t *size) // Firmware is likely encrypted. Decrypt. if (!read_file(firm_key, path_firmkey, AES_BLOCK_SIZE)) { + uint8_t* temp = malloc(FCRAM_SPACING); // Missing firmkey. Attempt to get from CETK (only works if system was booted) - if (!read_file((void *)FCRAM_JUNK_LOC, path_cetk, FCRAM_SPACING) || decrypt_cetk_key(firm_key, (void *)FCRAM_JUNK_LOC)) { + if (!read_file(temp, path_cetk, FCRAM_SPACING) || decrypt_cetk_key(firm_key, temp)) { fprintf(stderr, " No firmkey and failed to extract from cetk\n"); return 1; } else { fprintf(stderr, " Saving firmkey for future use.\n"); write_file(firm_key, path_firmkey, AES_BLOCK_SIZE); } + free(temp); } else { fprintf(stderr, " Read firmkey from filesystem.\n"); } diff --git a/source/linker.ld b/source/linker.ld index ce3aa9e..1203b40 100644 --- a/source/linker.ld +++ b/source/linker.ld @@ -48,5 +48,5 @@ SECTIONS . = ALIGN(4); - __end__ = 0x20400000; + __end__ = .; } diff --git a/source/patch/emunand.c b/source/patch/emunand.c index 7c00132..6426513 100644 --- a/source/patch/emunand.c +++ b/source/patch/emunand.c @@ -5,13 +5,13 @@ #include #include -uint8_t *emunand_temp = (uint8_t *)FCRAM_JUNK_LOC; - void verify_emunand(uint32_t index, uint32_t *off, uint32_t *head) { uint32_t nandSize = getMMCDevice(0)->total_size; + uint8_t *emunand_temp = (uint8_t*)malloc(2048); + uint32_t offset; if (nandSize > 0x200000) offset = 0x400000 * index; @@ -36,6 +36,8 @@ verify_emunand(uint32_t index, uint32_t *off, uint32_t *head) } else { abort("emunand: selected NAND image is not valid.\n"); } + + free(emunand_temp); } static void * diff --git a/source/patch/module.c b/source/patch/module.c index f630c49..aebee27 100644 --- a/source/patch/module.c +++ b/source/patch/module.c @@ -13,7 +13,8 @@ patch_modules() } size_t size = fsize(f); - fread((void *)FCRAM_JUNK_LOC, 1, size, f); + uint8_t* temp = malloc(size); + fread(temp, 1, size, f); fclose(f); // Look for the section that holds all the sysmodules @@ -29,10 +30,11 @@ patch_modules() if (!sysmodule_section) { fprintf(stderr, "Module: sysmodule section not found\n"); + free(temp); return 1; } - ncch_h *module = (ncch_h *)FCRAM_JUNK_LOC; + ncch_h *module = (ncch_h *)temp; ncch_h *sysmodule = (ncch_h *)((uint32_t)firm_loc + sysmodule_section->offset); // Check if we want to replace an existing sysmodule @@ -77,5 +79,7 @@ patch_modules() fprintf(stderr, "Module: injected modules.\n"); + free(temp); + return 0; } diff --git a/source/firm/fcram.c b/source/std/allocator.c similarity index 75% rename from source/firm/fcram.c rename to source/std/allocator.c index 3b1b263..0479be3 100644 --- a/source/firm/fcram.c +++ b/source/std/allocator.c @@ -3,19 +3,23 @@ // 16 <- AES block size. #define SALLOC_ALIGN 16 -void *fcram_temp = (void *)0x23000000; - -void *fcram_static_mem = (void*)FCRAM_STATIC_ALLOC_LOC; - struct alloc_info* first_mem = NULL; -// Low level static allocator / sbrk-like function. -void *fake_sbrk(size_t bytes) { - void *ret = fcram_static_mem; +void* sbrk(int incr) { + extern uint32_t __end__; /* Defined by the linker */ + static uint32_t *heap_end; + uint32_t *prev_heap_end; + + if (heap_end == 0) { + heap_end = &__end__; + } - fcram_static_mem = (uint8_t*)fcram_static_mem + bytes; + prev_heap_end = heap_end; + if (heap_end + incr > stack_ptr) + abort("Heap overflowed!\n"); - return ret; + heap_end += incr; + return (void*) prev_heap_end; } // This is an incredibly crappy and inefficient implementation of malloc/free nicked from stackoverflow. @@ -44,7 +48,7 @@ void* malloc(size_t size) { block = block->next; } - block = (free_block*)fake_sbrk(size); + block = (free_block*)sbrk(size); block->size = size; return ((char*)block) + sizeof(free_block);