This repository has been archived by the owner on Jun 8, 2020. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 3
/
DownloadCode.S
65 lines (54 loc) · 1.8 KB
/
DownloadCode.S
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
.arm
.text
#include "rop.h"
#ifdef ARM_CODE
#define CODE_SIZE arm_code_end-arm_code
#else
#define CODE_SIZE 0x300*15-0x460
#endif
.global _start
@---------------------------------------------------------------------------------
_start:
rop_memcpy(BUFFER_LOC+0x300*0, ROP_LOC+0x304*1, 0x300)
rop_memcpy(BUFFER_LOC+0x300*1, ROP_LOC+0x304*2, 0x300)
rop_memcpy(BUFFER_LOC+0x300*2, ROP_LOC+0x304*3, 0x300)
rop_memcpy(BUFFER_LOC+0x300*3, ROP_LOC+0x304*4, 0x300)
rop_memcpy(BUFFER_LOC+0x300*4, ROP_LOC+0x1400+0x304*0, 0x300)
rop_memcpy(BUFFER_LOC+0x300*5, ROP_LOC+0x1400+0x304*1, 0x300)
rop_memcpy(BUFFER_LOC+0x300*6, ROP_LOC+0x1400+0x304*2, 0x300)
rop_memcpy(BUFFER_LOC+0x300*7, ROP_LOC+0x1400+0x304*3, 0x300)
rop_memcpy(BUFFER_LOC+0x300*8, ROP_LOC+0x1400+0x304*4, 0x300)
rop_memcpy(BUFFER_LOC+0x300*9, ROP_LOC+0x2800+0x304*0, 0x300)
rop_memcpy(BUFFER_LOC+0x300*10, ROP_LOC+0x2800+0x304*1, 0x300)
rop_memcpy(BUFFER_LOC+0x300*11, ROP_LOC+0x2800+0x304*2, 0x300)
rop_memcpy(BUFFER_LOC+0x300*12, ROP_LOC+0x2800+0x304*3, 0x300)
rop_memcpy(BUFFER_LOC+0x300*13, ROP_LOC+0x2800+0x304*4, 0x300)
rop_fs_mount(DMC)
.fill 3, 4, POP_PC
.word POP_R0_PC
@.org 0x21C
.word MAGIC
rop_flush_data_cache(BUFFER_LOC+arm_code-0x300, CODE_SIZE)
rop_gx_texture_copy(BUFFER_LOC+arm_code-0x300, CODE_TARGET, CODE_SIZE)
rop_flush_data_cache(BUFFER_LOC, 0x38400*2)
rop_gx_texture_copy(BUFFER_LOC, 0x1F48F000, 0x38400*2)
rop_sleep(1000000000)
@ rop_sleep(1000000000)
@ rop_flush_data_cache(BUFFER_LOC, 0x38400)
@ rop_gx_texture_copy(BUFFER_LOC, 0x1F4C7800, 0x38400)
@ rop_sleep(1000000000)
rop_jump_arm
.org 0x300
.org 0x3F4
.word ROP_LOC+_start+0x8C
.org 0x428
.word ROP_LOC+_start, 0, POP_PC
.org 0x458
.word POP_PC, POP_PC
arm_code:
#ifdef ARM_CODE
#define S_(x) #x
#define S(x) S_(x)
.incbin S(ARM_CODE)
#endif
arm_code_end: