From: chaoskagami Date: Wed, 22 Jun 2016 04:46:32 +0000 (-0400) Subject: Implement argc, argv[0] passing and detection of own path as PoC X-Git-Tag: v0.2.0~58 X-Git-Url: https://chaos.moe/g/?a=commitdiff_plain;h=3635db44b0b38d5bc22559a4063d454a33d9d7ac;p=corbenik%2Fcorbenik.git Implement argc, argv[0] passing and detection of own path as PoC --- diff --git a/external/bits/chain.s b/external/bits/chain.s index 5f57089..073f402 100644 --- a/external/bits/chain.s +++ b/external/bits/chain.s @@ -16,7 +16,6 @@ .syntax unified .section .text -.global copy copy: ldr r3, value add r1, r0, r1 @@ -51,9 +50,17 @@ boot: cmp r2, #4 bcc flush_dcache + // Reload argc and argv. + ldr r0, argc + ldr r1, argv + // Actually boot payload. ldr r3, offset bx r3 +.align 4 + value: .int 0x23efffff offset: .int 0x23f00000 +argc: .ascii "ARGC" +argv: .ascii "ARGV" diff --git a/host/copy.sh b/host/copy.sh index 7ff450b..1b1960d 100755 --- a/host/copy.sh +++ b/host/copy.sh @@ -8,15 +8,12 @@ dev=/dev/sdb mnt=/mnt/ext1 -mount ${dev}1 $mnt || exit 0 -cp out/arm9loaderhax.bin $mnt/arm9payload.bin || exit 0 -cp out/arm9loaderhax.bin $mnt/anim/boot/a.bin || exit 0 -cp out/arm9loaderhax.bin $mnt/anim/boot/l.bin || exit 0 -cp out/arm9loaderhax.bin $mnt/anim/boot/r.bin || exit 0 -cp out/arm9loaderhax.bin $mnt/anim/boot/none.bin || exit 0 +mount -t vfat ${dev}1 $mnt || exit 0 +cp out/arm9loaderhax.bin $mnt/arm9loaderhax.bin || exit 0 rm -rf $mnt/corbenik cp -r out/corbenik $mnt/ || exit 0 cp -r input/corbenik $mnt/ || exit 0 +cp out/arm9loaderhax.bin $mnt/corbenik/chain/Corbenik || exit 0 umount $mnt || exit 0 sync || exit 0 eject ${dev} || exit 0 diff --git a/source/chain.c b/source/chain.c index 2627d66..db80493 100644 --- a/source/chain.c +++ b/source/chain.c @@ -22,7 +22,7 @@ void chainload_file(char* chain_file_data) { char code_file[] = PATH_BITS "/chain.bin"; uint8_t* bootstrap = (uint8_t*)0x24F00000; - uint32_t size = 0; + uint32_t size = 0, b_size = 0; uint8_t* chain_data; FILE* f = fopen(code_file, "r"); @@ -31,11 +31,11 @@ void chainload_file(char* chain_file_data) { abort("Missing chainloader.\n"); } - size = fsize(f); - fread(bootstrap, 1, size, f); + b_size = fsize(f); + fread(bootstrap, 1, b_size, f); fclose(f); - chain_data = bootstrap + size; + chain_data = bootstrap + b_size; f = fopen(chain_file, "r"); if (!f) { @@ -47,9 +47,27 @@ void chainload_file(char* chain_file_data) { fread(chain_data, 1, size, f); fclose(f); + fprintf(stderr, "Setting argc, argv...\n"); + + size = size - (size % 4) + 4; + + uint32_t* off = (uint32_t*) &chain_data[size]; + + off[0] = (uint32_t)off + 4; // char** + off[1] = (uint32_t)off + 8; // char* + + char* arg0 = (char*)&off[1]; + memcpy(arg0, chain_file, strlen(chain_file) + 1); + + uint32_t* argc_off = (uint32_t*)memfind(bootstrap, b_size, "ARGC", 4); + uint32_t* argv_off = (uint32_t*)memfind(bootstrap, b_size, "ARGV", 4); + + argc_off[0] = 1; + argv_off[0] = (uint32_t)off; + fprintf(stderr, "Chaining to copy payload...\n"); - ((void(*)())0x24F00000)(chain_data, size); + ((void(*)(void*, uint32_t))0x24F00000)(chain_data, size + 256 + 8); // Size of payload + argv. } // This function is based on PathDeleteWorker from GodMode9. diff --git a/source/main.c b/source/main.c index 00fd14d..9788ded 100644 --- a/source/main.c +++ b/source/main.c @@ -13,7 +13,7 @@ int doing_autoboot = 0; void shut_up(); int -main() +main(int argc, char** argv) { if (PDN_MPCORE_CFG == 7) is_n3ds = 1; // Enable n3ds specific options. @@ -28,6 +28,11 @@ main() abort("Failed to mount SD card.\n"); } + if (argc >= 1 && argc < 2) { + // Valid argc passed. + fprintf(stderr, "Chainloaded. Path: %s\n", argv[0]); + } + load_config(); // Load configuration. if (CFG_BOOTENV == 7) { diff --git a/source/start.s b/source/start.s index bc0b91b..04e29d1 100644 --- a/source/start.s +++ b/source/start.s @@ -2,34 +2,42 @@ .align 4 .global _start _start: + ldr r2, =argc + str r0, [r2] + + ldr r2, =argv + str r1, [r2] + b mpu - nop +argc: .int 0x00000000 +argv: .int 0x00000000 + mpu: - @ Change the stack pointer + // Change the stack pointer mov sp, #0x27000000 - @ Disable caches / mpu - mrc p15, 0, r4, c1, c0, 0 @ read control register - bic r4, #(1<<12) @ - instruction cache disable - bic r4, #(1<<2) @ - data cache disable - bic r4, #(1<<0) @ - mpu disable - mcr p15, 0, r4, c1, c0, 0 @ write control register + // Disable caches / mpu + mrc p15, 0, r4, c1, c0, 0 // read control register + bic r4, #(1<<12) // - instruction cache disable + bic r4, #(1<<2) // - data cache disable + bic r4, #(1<<0) // - mpu disable + mcr p15, 0, r4, c1, c0, 0 // write control register - @ Give read/write access to all the memory regions + // Give read/write access to all the memory regions ldr r5, =0x33333333 - mcr p15, 0, r5, c5, c0, 2 @ write data access - mcr p15, 0, r5, c5, c0, 3 @ write instruction access + mcr p15, 0, r5, c5, c0, 2 // write data access + mcr p15, 0, r5, c5, c0, 3 // write instruction access - @ Sets MPU permissions and cache settings - ldr r0, =0xFFFF001D @ ffff0000 32k - ldr r1, =0x01FF801D @ 01ff8000 32k - ldr r2, =0x08000027 @ 08000000 1M - ldr r3, =0x10000021 @ 10000000 128k - ldr r4, =0x10100025 @ 10100000 512k - ldr r5, =0x20000035 @ 20000000 128M - ldr r6, =0x1FF00027 @ 1FF00000 1M - ldr r7, =0x1800002D @ 18000000 8M + // Sets MPU permissions and cache settings + ldr r0, =0xFFFF001D // ffff0000 32k + ldr r1, =0x01FF801D // 01ff8000 32k + ldr r2, =0x08000027 // 08000000 1M + ldr r3, =0x10000021 // 10000000 128k + ldr r4, =0x10100025 // 10100000 512k + ldr r5, =0x20000035 // 20000000 128M + ldr r6, =0x1FF00027 // 1FF00000 1M + ldr r7, =0x1800002D // 18000000 8M mov r10, #0x25 mov r11, #0x25 mov r12, #0x25 @@ -41,29 +49,32 @@ mpu: mcr p15, 0, r5, c6, c5, 0 mcr p15, 0, r6, c6, c6, 0 mcr p15, 0, r7, c6, c7, 0 - mcr p15, 0, r10, c3, c0, 0 @ Write bufferable 0, 2, 5 - mcr p15, 0, r11, c2, c0, 0 @ Data cacheable 0, 2, 5 - mcr p15, 0, r12, c2, c0, 1 @ Inst cacheable 0, 2, 5 + mcr p15, 0, r10, c3, c0, 0 // Write bufferable 0, 2, 5 + mcr p15, 0, r11, c2, c0, 0 // Data cacheable 0, 2, 5 + mcr p15, 0, r12, c2, c0, 1 // Inst cacheable 0, 2, 5 - @ Enable caches - mrc p15, 0, r4, c1, c0, 0 @ read control register - orr r4, r4, #(1<<18) @ - itcm enable - orr r4, r4, #(1<<12) @ - instruction cache enable - orr r4, r4, #(1<<2) @ - data cache enable - orr r4, r4, #(1<<0) @ - mpu enable - mcr p15, 0, r4, c1, c0, 0 @ write control register + // Enable caches + mrc p15, 0, r4, c1, c0, 0 // read control register + orr r4, r4, #(1<<18) // - itcm enable + orr r4, r4, #(1<<12) // - instruction cache enable + orr r4, r4, #(1<<2) // - data cache enable + orr r4, r4, #(1<<0) // - mpu enable + mcr p15, 0, r4, c1, c0, 0 // write control register - @ Flush caches + // Flush caches mov r5, #0 - mcr p15, 0, r5, c7, c5, 0 @ flush I-cache - mcr p15, 0, r5, c7, c6, 0 @ flush D-cache - mcr p15, 0, r5, c7, c10, 4 @ drain write buffer + mcr p15, 0, r5, c7, c5, 0 // flush I-cache + mcr p15, 0, r5, c7, c6, 0 // flush D-cache + mcr p15, 0, r5, c7, c10, 4 // drain write buffer - @ Fixes mounting of SDMC + // Fixes mounting of SDMC ldr r0, =0x10000020 mov r1, #0x340 str r1, [r0] + ldr r0, argc + ldr r1, argv + bl main .die: