Skip to content

Commit

Permalink
-added anti move/delete protection of the ds vc title when in CBHC CFW
Browse files Browse the repository at this point in the history 
NOTE: this change (as well as the last update) do NOT AFFECT MOCHA CFW, they only affect my internal CBHC CFW which you can enable by just setting it to autoboot system menu which will give you full signature and region patching as well as this protection and re-applying patches on reloads; overall letting your wiiu and the menu run as they would normally
  • Loading branch information
@FIX94
FIX94 committed Dec 16, 2016
1 parent 3c6dadb commit 3b005e9
Show file tree
Hide file tree
Showing 13 changed files with 269 additions and 91 deletions.
10 changes: 8 additions & 2 deletions dsrom/CBHC/Makefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,16 @@ FIRMWARE = 550

all: clean setup main

$(CURDIR)/payload/arm_kernel_bin.h: $(CURDIR)/payload/wupserver_bin.h $(CURDIR)/payload/arm_user_bin.h
$(CURDIR)/payload/arm_kernel_bin.h: $(CURDIR)/payload/titleprot_bin.h $(CURDIR)/payload/wupserver_bin.h $(CURDIR)/payload/arm_user_bin.h
@$(MAKE) --no-print-directory -C $(CURDIR)/arm_kernel -f $(CURDIR)/arm_kernel/Makefile
@-mkdir -p $(CURDIR)/payload
@cp -p $(CURDIR)/arm_kernel/arm_kernel_bin.h $@

$(CURDIR)/payload/titleprot_bin.h:
@$(MAKE) --no-print-directory -C $(CURDIR)/titleprot -f $(CURDIR)/titleprot/Makefile
@-mkdir -p $(CURDIR)/payload
@cp -p $(CURDIR)/titleprot/titleprot_bin.h $@

$(CURDIR)/payload/wupserver_bin.h:
@$(MAKE) --no-print-directory -C $(CURDIR)/../../wupserver -f $(CURDIR)/../../wupserver/Makefile
@-mkdir -p $(CURDIR)/payload
Expand All @@ -46,5 +51,6 @@ clean:
rm -rf $(build) payload
rm -rf CBHC.elf CBHC.map
$(MAKE) --no-print-directory -C $(CURDIR)/arm_user -f $(CURDIR)/arm_user/Makefile clean
@$(MAKE) --no-print-directory -C $(CURDIR)/../../wupserver -f $(CURDIR)/../../wupserver/Makefile clean
$(MAKE) --no-print-directory -C $(CURDIR)/titleprot -f $(CURDIR)/titleprot/Makefile clean
$(MAKE) --no-print-directory -C $(CURDIR)/../../wupserver -f $(CURDIR)/../../wupserver/Makefile clean
$(MAKE) --no-print-directory -C $(CURDIR)/arm_kernel -f $(CURDIR)/arm_kernel/Makefile clean
11 changes: 11 additions & 0 deletions dsrom/CBHC/arm_kernel/source/wupserver.c → dsrom/CBHC/arm_kernel/source/getbins.c
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,16 @@
#include "../../payload/titleprot_bin.h"
#include "../../payload/wupserver_bin.h"

const unsigned char *get_titleprot_bin()
{
return titleprot_bin;
}

unsigned int get_titleprot_bin_len()
{
return titleprot_bin_len;
}

const unsigned char *get_wupserver_bin()
{
return wupserver_bin;
Expand Down
17 changes: 17 additions & 0 deletions dsrom/CBHC/arm_kernel/source/getbins.h
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@

#ifndef _GETBINS_H_
#define _GETBINS_H_

#define titleprot_addr 0x0510D984
#define wupserver_addr 0x0510E570

#define titleprot_phys (titleprot_addr - 0x05100000 + 0x13D80000)
#define wupserver_phys (wupserver_addr - 0x05100000 + 0x13D80000)

const unsigned char *get_titleprot_bin();
unsigned int get_titleprot_bin_len();

const unsigned char *get_wupserver_bin();
unsigned int get_wupserver_bin_len();

#endif
146 changes: 83 additions & 63 deletions dsrom/CBHC/arm_kernel/source/main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
#include "reload.h"
#include "elf_patcher.h"
#include "../../payload/arm_user_bin.h"
#include "wupserver.h"
#include "getbins.h"
static const char repairData_set_fault_behavior[] = {
0xE1,0x2F,0xFF,0x1E,0xE9,0x2D,0x40,0x30,0xE5,0x93,0x20,0x00,0xE1,0xA0,0x40,0x00,
0xE5,0x92,0x30,0x54,0xE1,0xA0,0x50,0x01,0xE3,0x53,0x00,0x01,0x0A,0x00,0x00,0x02,
Expand Down Expand Up @@ -43,7 +43,10 @@ static const char os_launch_hook[] = {

static const char sd_path[] = "/vol/sdcard";

#define wupserver_phys (0x0510E570 - 0x05100000 + 0x13D80000)
#define LAUNCH_SYSMENU 0
#define LAUNCH_HBL 1
#define LAUNCH_MOCHA 2
#define LAUNCH_CFW_IMG 3

int _main()
{
Expand All @@ -57,15 +60,18 @@ int _main()

unsigned int control_register = disable_mmu();

/* copy in ds vc title id to protect from moving/deleting */
kernel_memcpy((void*)(get_titleprot_bin()+get_titleprot_bin_len()-8), (void*)0x01E70108, 4);

/* get value CBHC used to boot up */
unsigned int launchmode = *(volatile u32*)0x01E7010C;

/* Save the request handle so we can reply later */
*(volatile u32*)0x01E10000 = *(volatile u32*)0x1016AD18;

/* Patch kernel_error_handler to BX LR immediately */
*(volatile u32*)0x08129A24 = 0xE12FFF1E;

/* apply IOS ELF launch hook (thanks dimok!) */
*(volatile u32*)0x0812A120 = ARM_BL(0x0812A120, kernel_launch_ios);

void * pset_fault_behavior = (void*)0x081298BC;
kernel_memcpy(pset_fault_behavior, (void*)repairData_set_fault_behavior, sizeof(repairData_set_fault_behavior));

Expand All @@ -79,61 +85,75 @@ int _main()
void * pUserBinDest = (void*)0x101312D0;
kernel_memcpy(pUserBinDest, (void*)pUserBinSource, sizeof(arm_user_bin));

// overwrite mcp_d_r code with wupserver
*(unsigned int*)(0x0510E56C - 0x05100000 + 0x13D80000) = 0x47700000; //bx lr
kernel_memcpy((void*)wupserver_phys, get_wupserver_bin(), get_wupserver_bin_len());
invalidate_dcache((u32)wupserver_phys, get_wupserver_bin_len());
invalidate_icache();

// replace ioctl 0x62 code with jump to wupserver
*(unsigned int*)(0x05026BA8 - 0x05000000 + 0x081C0000) = 0x47780000; // bx pc
*(unsigned int*)(0x05026BAC - 0x05000000 + 0x081C0000) = 0xE59F1000; // ldr r1, [pc]
*(unsigned int*)(0x05026BB0 - 0x05000000 + 0x081C0000) = 0xE12FFF11; // bx r1
*(unsigned int*)(0x05026BB4 - 0x05000000 + 0x081C0000) = 0x0510E570; // wupserver code

// fix 10 minute timeout that crashes MCP after 10 minutes of booting
*(volatile u32*)(0x05022474 - 0x05000000 + 0x081C0000) = 0xFFFFFFFF; // NEW_TIMEOUT

// patch cached cert check
*(volatile u32*)(0x05054D6C - 0x05000000 + 0x081C0000) = 0xE3A00000; // mov r0, 0
*(volatile u32*)(0x05054D70 - 0x05000000 + 0x081C0000) = 0xE12FFF1E; // bx lr

// patch cert verification
*(volatile u32*)(0x05052A90 - 0x05000000 + 0x081C0000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x05052A94 - 0x05000000 + 0x081C0000) = 0xE12FFF1E; // bx lr

// patch MCP authentication check
*(volatile u32*)(0x05014CAC - 0x05000000 + 0x081C0000) = 0x20004770; // mov r0, #0; bx lr

// patch IOSC_VerifyPubkeySign to always succeed
*(volatile u32*)(0x05052C44 - 0x05000000 + 0x081C0000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x05052C48 - 0x05000000 + 0x081C0000) = 0xE12FFF1E; // bx lr

// patch OS launch sig check
*(volatile u32*)(0x0500A818 - 0x05000000 + 0x081C0000) = 0x20002000; // mov r0, #0; mov r0, #0

// patch default title id
*(volatile u32*)(0x050B817C - 0x05074000 + 0x08234000) = *(volatile u32*)0x01E70100;
*(volatile u32*)(0x050B8180 - 0x05074000 + 0x08234000) = *(volatile u32*)0x01E70104;

// allow custom bootLogoTex and bootMovie.h264
*(volatile u32*)(0xE0030D68 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0xE0030D34 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0

// allow any region title launch
*(volatile u32*)(0xE0030498 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0

// force check USB storage on load
*(volatile u32*)(0xE012202C - 0xE0000000 + 0x12900000) = 0x00000001; // find USB flag

// nop out memcmp hash checks
*(volatile u32*)(0x040017E0 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x040019C4 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x04001BB0 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x04001D40 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
if(launchmode != LAUNCH_MOCHA)
{
// nop out memcmp hash checks
*(volatile u32*)(0x040017E0 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x040019C4 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x04001BB0 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x04001D40 - 0x04000000 + 0x08280000) = 0xE3A00000; // mov r0, #0

// patch OS launch sig check
*(volatile u32*)(0x0500A818 - 0x05000000 + 0x081C0000) = 0x20002000; // mov r0, #0; mov r0, #0

// patch MCP authentication check
*(volatile u32*)(0x05014CAC - 0x05000000 + 0x081C0000) = 0x20004770; // mov r0, #0; bx lr

// fix 10 minute timeout that crashes MCP after 10 minutes of booting
*(volatile u32*)(0x05022474 - 0x05000000 + 0x081C0000) = 0xFFFFFFFF; // NEW_TIMEOUT

// replace ioctl 0x62 code with jump to wupserver
*(volatile u32*)(0x05026BA8 - 0x05000000 + 0x081C0000) = 0x47780000; // bx pc
*(volatile u32*)(0x05026BAC - 0x05000000 + 0x081C0000) = 0xE59F1000; // ldr r1, [pc]
*(volatile u32*)(0x05026BB0 - 0x05000000 + 0x081C0000) = 0xE12FFF11; // bx r1
*(volatile u32*)(0x05026BB4 - 0x05000000 + 0x081C0000) = wupserver_addr; // wupserver code

// patch cert verification
*(volatile u32*)(0x05052A90 - 0x05000000 + 0x081C0000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x05052A94 - 0x05000000 + 0x081C0000) = 0xE12FFF1E; // bx lr

// patch IOSC_VerifyPubkeySign to always succeed
*(volatile u32*)(0x05052C44 - 0x05000000 + 0x081C0000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0x05052C48 - 0x05000000 + 0x081C0000) = 0xE12FFF1E; // bx lr

// patch cached cert check
*(volatile u32*)(0x05054D6C - 0x05000000 + 0x081C0000) = 0xE3A00000; // mov r0, 0
*(volatile u32*)(0x05054D70 - 0x05000000 + 0x081C0000) = 0xE12FFF1E; // bx lr

// change system.xml to syshax.xml
*(volatile u32*)(0x050600F0 - 0x05060000 + 0x08220000) = 0x79736861; // ysha
*(volatile u32*)(0x050600F4 - 0x05060000 + 0x08220000) = 0x782E786D; // x.xm

*(volatile u32*)(0x05060114 - 0x05060000 + 0x08220000) = 0x79736861; // ysha
*(volatile u32*)(0x05060118 - 0x05060000 + 0x08220000) = 0x782E786D; // x.xm

// jump to titleprot code (titleprot_addr+4)
*(volatile u32*)(0x05107F70 - 0x05100000 + 0x13D80000) = 0xF005FD0A; //bl (titleprot_addr+4)
// overwrite mcp_d_r code with titleprot
*(volatile u32*)titleprot_phys = 0x20004770; // mov r0, #0; bx lr
kernel_memcpy((void*)(titleprot_phys+4), get_titleprot_bin(), get_titleprot_bin_len());
invalidate_dcache((u32)(titleprot_phys+4), get_titleprot_bin_len());
invalidate_icache();

// overwrite mcp_d_r code with wupserver
*(volatile u32*)(0x0510E56C - 0x05100000 + 0x13D80000) = 0x47700000; //bx lr
kernel_memcpy((void*)wupserver_phys, get_wupserver_bin(), get_wupserver_bin_len());
invalidate_dcache((u32)wupserver_phys, get_wupserver_bin_len());
invalidate_icache();

// apply IOS ELF launch hook (thanks dimok!)
*(volatile u32*)0x0812A120 = ARM_BL(0x0812A120, kernel_launch_ios);

// allow any region title launch
*(volatile u32*)(0xE0030498 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0

// allow custom bootLogoTex and bootMovie.h264
*(volatile u32*)(0xE0030D68 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
*(volatile u32*)(0xE0030D34 - 0xE0000000 + 0x12900000) = 0xE3A00000; // mov r0, #0
}

//custom fw.img reboot
if(*(volatile u32*)0x01E70120 == 1)
if(launchmode == LAUNCH_CFW_IMG)
{
int i;
for (i = 0; i < 32; i++)
Expand All @@ -148,12 +168,12 @@ int _main()
((char*)(0x05059938 - 0x05000000 + 0x081C0000))[i] = os_launch_hook[i];
}

// change system.xml to syshax.xml
*(volatile u32*)(0x050600F0 - 0x05060000 + 0x08220000) = 0x79736861; //ysha
*(volatile u32*)(0x050600F4 - 0x05060000 + 0x08220000) = 0x782E786D; //x.xm
// patch default title id to system menu
*(volatile u32*)(0x050B817C - 0x05074000 + 0x08234000) = *(volatile u32*)0x01E70100;
*(volatile u32*)(0x050B8180 - 0x05074000 + 0x08234000) = *(volatile u32*)0x01E70104;

*(volatile u32*)(0x05060114 - 0x05060000 + 0x08220000) = 0x79736861; //ysha
*(volatile u32*)(0x05060118 - 0x05060000 + 0x08220000) = 0x782E786D; //x.xm
// force check USB storage on load
*(volatile u32*)(0xE012202C - 0xE0000000 + 0x12900000) = 0x00000001; // find USB flag

*(volatile u32*)(0x1555500) = 0;

Expand Down
22 changes: 14 additions & 8 deletions dsrom/CBHC/arm_kernel/source/reload.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
#include "utils.h"
#include "reload.h"
#include "elf_patcher.h"
#include "wupserver.h"
#include "getbins.h"

extern char __file_start, __file_end;

Expand Down Expand Up @@ -40,7 +40,7 @@ void kernel_launch_ios(u32 launch_address, u32 L, u32 C, u32 H)
section_write_word(ios_elf_start, 0x05026BA8, 0x47780000); // bx pc
section_write_word(ios_elf_start, 0x05026BAC, 0xE59F1000); // ldr r1, [pc]
section_write_word(ios_elf_start, 0x05026BB0, 0xE12FFF11); // bx r1
section_write_word(ios_elf_start, 0x05026BB4, 0x0510E570); // wupserver code
section_write_word(ios_elf_start, 0x05026BB4, wupserver_addr); // wupserver code

// patch cert verification
section_write_word(ios_elf_start, 0x05052A90, 0xE3A00000); // mov r0, #0
Expand All @@ -55,15 +55,21 @@ void kernel_launch_ios(u32 launch_address, u32 L, u32 C, u32 H)
section_write_word(ios_elf_start, 0x05054D70, 0xE12FFF1E); // bx lr

// change system.xml to syshax.xml
section_write_word(ios_elf_start, 0x050600F0, 0x79736861); //ysha
section_write_word(ios_elf_start, 0x050600F4, 0x782E786D); //x.xm
section_write_word(ios_elf_start, 0x050600F0, 0x79736861); // ysha
section_write_word(ios_elf_start, 0x050600F4, 0x782E786D); // x.xm

section_write_word(ios_elf_start, 0x05060114, 0x79736861); //ysha
section_write_word(ios_elf_start, 0x05060118, 0x782E786D); //x.xm
section_write_word(ios_elf_start, 0x05060114, 0x79736861); // ysha
section_write_word(ios_elf_start, 0x05060118, 0x782E786D); // x.xm

// jump to titleprot code (titleprot_addr+4)
section_write_word(ios_elf_start, 0x05107F70, 0xF005FD0A); //bl (titleprot_addr+4)
// overwrite mcp_d_r code with titleprot
section_write_word(ios_elf_start, titleprot_addr, 0x20004770); // mov r0, #0; bx lr
section_write(ios_elf_start, titleprot_addr+4, get_titleprot_bin(), get_titleprot_bin_len());

// overwrite mcp_d_r code with wupserver
section_write_word(ios_elf_start, 0x0510E56C, 0x47700000); //bx lr
section_write(ios_elf_start, 0x0510E570, get_wupserver_bin(), get_wupserver_bin_len());
section_write_word(ios_elf_start, 0x0510E56C, 0x47700000); // bx lr
section_write(ios_elf_start, wupserver_addr, get_wupserver_bin(), get_wupserver_bin_len());

// apply IOS ELF launch hook (thanks dimok!)
section_write_word(ios_elf_start, 0x0812A120, ARM_BL(0x0812A120, kernel_launch_ios));
Expand Down
8 changes: 0 additions & 8 deletions dsrom/CBHC/arm_kernel/source/wupserver.h
View file

This file was deleted.

21 changes: 14 additions & 7 deletions dsrom/CBHC/main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ static unsigned int getButtonsDown(unsigned int padscore_handle, unsigned int vp
#define SD_HBL_PATH "/vol/external01/wiiu/apps/homebrew_launcher/homebrew_launcher.elf"
#define SD_MOCHA_PATH "/vol/external01/wiiu/apps/mocha/mocha.elf"

static const char *verChar = "CBHC v1.3 by FIX94";
static const char *verChar = "CBHC v1.4 by FIX94";

#define DEFAULT_DISABLED 0
#define DEFAULT_SYSMENU 1
Expand Down Expand Up @@ -230,6 +230,13 @@ uint32_t __main(void)
OSScreenSetBufferEx(1, (void*)(0xF4000000 + screen_buf0_size));
OSScreenEnable(1);

unsigned long long(*OSGetTitleID)();
OSDynLoad_FindExport(coreinit_handle, 0, "OSGetTitleID", &OSGetTitleID);
unsigned int dsvcid = (unsigned int)(OSGetTitleID(0) & 0xFFFFFFFF);

char verInfStr[64];
__os_snprintf(verInfStr,64,"%s (DS Title %08X)", verChar, dsvcid);

unsigned int padscore_handle;
OSDynLoad_Acquire("padscore.rpl", &padscore_handle);

Expand Down Expand Up @@ -265,7 +272,7 @@ uint32_t __main(void)
goto cbhc_menu;

OSScreenClearBuffer(0);
OSScreenPutFont(0, 0, verChar);
OSScreenPutFont(0, 0, verInfStr);
OSScreenPutFont(0, 1, "Autobooting...");
OSScreenFlipBuffers();

Expand All @@ -291,7 +298,7 @@ uint32_t __main(void)
goto doIOSUexploit;

OSScreenClearBuffer(0);
OSScreenPutFont(0, 0, verChar);
OSScreenPutFont(0, 0, verInfStr);
OSScreenPutFont(0, 1, "Entering Menu...");
OSScreenFlipBuffers();
waitCnt = 30;
Expand Down Expand Up @@ -365,8 +372,7 @@ cbhc_menu: ;
if(redraw)
{
OSScreenClearBuffer(0);
OSScreenPutFont(0, 0, verChar);

OSScreenPutFont(0, 0, verInfStr);
char printStr[64];
__os_snprintf(printStr,64,"%c Boot System Menu", 0 == PosX ? '>' : ' ');
OSScreenPutFont(0, 1, printStr);
Expand Down Expand Up @@ -408,8 +414,9 @@ cbhc_menu: ;
OSScreenFlipBuffers();

memcpy((void*)0xF5E70100, &sysmenu, 8);
*(volatile unsigned int*)0xF5E70120 = (launchmode == LAUNCH_CFW_IMG);
DCStoreRange((void*)0xF5E70100, 0x40);
*(volatile unsigned int*)0xF5E70108 = dsvcid;
*(volatile unsigned int*)0xF5E7010C = launchmode;
DCStoreRange((void*)0xF5E70100, 0x20);

int (*OSForceFullRelaunch)(void);
OSDynLoad_FindExport(coreinit_handle, 0, "OSForceFullRelaunch", &OSForceFullRelaunch);
Expand Down
Loading

0 comments on commit 3b005e9

Please sign in to comment.