Bond697 icon

GW 1.0 ROP Loader

Bond697 | PRO | 04/11/14 05:14:35 PM UTC | 0 ⭐ | 971 👁️ | Never ⏰ | []
text |

2.21 KB

|

None

|

0 👍

/

0 👎

file modes:
read 1
write 2
create 4
 file position:
begin 0
current 1
end 2
 media type:
nand 0
sdmc 1
ctrc 2
 mountsdmc - const char*
file ops - const wchar_t*
  NVRAM chains
 initial patch 
 --- top --- (low address)
 0010F2B9	- begin, THUMB
0001FE00	pop {r0, r2, pc}
00000100	
 001549E1	pop {r1, pc}
00279400
 001334FC	load_nvram(0x1FE00, 0x279400, 0x100);	
001E8CD0	r4
 0010538C	pop {r3, pc}
F027949C	mainmem virtual addr - r3
 00143D60	ADD     SP, SP, R3 - exit to loader chain
 --- bottom --- (high address)
 *SD must be mounted then fopen, fread, decrypt, jump*
 loader patch
 --- top --- (low address)
 0010F2B9	- begin, THUMB		
00272BAE	pop {r0, r2, pc}
BADC0DED	const char* archive_name = "YS:"
 0018F19C	nn::fs::MountSdmc("YS:");
0010B690	r3
00FAB000	r4
00200200	r5
 0010F2B9	pop {r0, r2, pc}
00279000	this->
00000001	FILE_READ
 001549E1	pop {r1, pc}
00276F38	const wchar_t* file_name = L"YS:/Launcher.dat"
 001B82AC	nn::fs::FileStream::Initialize(this->, L"YS:/Launcher.dat", FILE_READ);
0018D5DC	r4
00278340	r5
00100200	r6
000048CC	r7
00143D60	r8
 0010F2B9	pop {r0, r2, pc}	
00279000	this->
002B0000	void* in_buf(for fread)
 001002F9	pop {pc}
 001002F9	pop {pc}
 001002F9	pop {pc}
 001002F9	pop {pc}
 001002F9	pop {pc}
 001002F9	pop {pc}
 001549E1	pop {r1, pc}
00000000
 001549E1	pop {r1, pc}
00279020	s32* read_in
 0010538C	pop {r3, pc}
00009000	size_t read_size
 001B3958	nn::fs::FileStream::TryRead(this->, s32* read_in, void* in_buf, size_t read_size);
002104E5	r4
0019DA00	r5
00017500	r6
0021DF86	r7
001AC100	r8
001DDA22	r9
 0016FE91	POP     {R0-R4,PC}	
00100100	r0  - ptr to 16-byte Launcher.dat decryption key	 
00144CBC	r1
002B0000	r2	in_buf(to decrypt from)
00009000	r3	read_size(to decrypt)
001549E1	r4	
 0022EFAC	decryptAES
00105C88	r4	
000E0000	r5
00250390	r6	
001EFAC0	r7
0016FE91	r8
 0010538C	pop {r3, pc}	
00036B24	
 00143D60	ADD     SP, SP, R3 - exit to Launcher.dat
 --- bottom --- (high address)
   virtual s32 Write(const void* buffer, size_t size, bool flush)
virtual Result TryWrite(s32* pOut, const void* buffer, size_t size, bool flush)
this->
279020
00100000
c000
 00 00 10 00
00 10 00 00

Comments