The iPhone Wiki - User contributions [en]

IBoot-636.66.33

2010-06-21T12:29:01Z

Rusmac:

== Changes ==
* [[usb_control_msg(0x21, 2) Exploit]] fixed
* There are no longer assert()'s for the usb otg hardware handler functions, normally checked for in usb_core_init();
* Two new tasks: usb-high-current and usb-no-current

== Allowed ==
=== Commands ===
* [[bootx (iBoot command)|bootx]]
* [[reboot (iBoot command)|reboot]]
* [[reboot (iBoot command)|reset]]
* [[bgcolor (iBoot command)|bgcolor]]
* [[setpicture (iBoot command)|setpicture]]
* [[go (iBoot command)|go]]
* [[ramdisk (iBoot command)|ramdisk]]
* [[devicetree (iBoot command)|devicetree]]
* [[getenv (iBoot command)|getenv]]
* [[setenv (iBoot command)|setenv]]
* [[saveenv (iBoot command)|saveenv]]

=== Environmental Vars ===
* [[auto-boot (iBoot variable)|auto-boot]]
* [[boot-args (iBoot variable)|boot-args]]
* boot-partition
* [[boot-path (iBoot variable)|boot-path]]
* [[debug-uarts (iBoot variable)|debug-uarts]]
* [[filesize (iBoot variable)|filesize]]

=== Very Usefull Function ===
* [[kernelcache_loader (iBoot command)|kernelcache_loader]]

Kernelcache loader (iBoot command)

2010-06-21T12:27:22Z

Rusmac: Kernalcache loader(iBootx command) moved to Kernelcache loader (iBoot command): typo in header

== iPhone 3GS 8920x from iBoot-636.66 ==

==Disassembly for kernelcache Loader==
<pre>
N88AP_iBoot:4FF15E04 ; =============== S U B R O U T I N E =======================================
N88AP_iBoot:4FF15E04
N88AP_iBoot:4FF15E04 ; Attributes: bp-based frame
N88AP_iBoot:4FF15E04
N88AP_iBoot:4FF15E04 ; int __fastcall LoadImage_kernelcache_img3(int memoery_pos, int memory_size)
N88AP_iBoot:4FF15E04 LoadImage_kernelcache_img3 ; CODE XREF: sub_4FF0067C+C8�p
N88AP_iBoot:4FF15E04 ; n88ap__iBoot__bootx_function+4E�p
N88AP_iBoot:4FF15E04
N88AP_iBoot:4FF15E04 var_C4 = -0xC4
N88AP_iBoot:4FF15E04 param_R1 = -0xC0
N88AP_iBoot:4FF15E04 var_BC = -0xBC
N88AP_iBoot:4FF15E04 var_B8 = -0xB8
N88AP_iBoot:4FF15E04 var_B4 = -0xB4
N88AP_iBoot:4FF15E04 var_B0 = -0xB0
N88AP_iBoot:4FF15E04 var_AC = -0xAC
N88AP_iBoot:4FF15E04 var_A8 = -0xA8
N88AP_iBoot:4FF15E04 var_A4 = -0xA4
N88AP_iBoot:4FF15E04 var_A0 = -0xA0
N88AP_iBoot:4FF15E04 var_9C = -0x9C
N88AP_iBoot:4FF15E04 var_98 = -0x98
N88AP_iBoot:4FF15E04 var_94 = -0x94
N88AP_iBoot:4FF15E04 var_90 = -0x90
N88AP_iBoot:4FF15E04 var_8C = -0x8C
N88AP_iBoot:4FF15E04 var_88 = -0x88
N88AP_iBoot:4FF15E04 var_84 = -0x84
N88AP_iBoot:4FF15E04 var_7E = -0x7E
N88AP_iBoot:4FF15E04 var_78 = -0x78
N88AP_iBoot:4FF15E04 var_74 = -0x74
N88AP_iBoot:4FF15E04 param_R2 = -0x70
N88AP_iBoot:4FF15E04 var_6C = -0x6C
N88AP_iBoot:4FF15E04 param_R3 = -0x68
N88AP_iBoot:4FF15E04 var_64 = -0x64
N88AP_iBoot:4FF15E04 var_60 = -0x60
N88AP_iBoot:4FF15E04 var_5C = -0x5C
N88AP_iBoot:4FF15E04 var_58 = -0x58
N88AP_iBoot:4FF15E04 var_54 = -0x54
N88AP_iBoot:4FF15E04 var_34 = -0x34
N88AP_iBoot:4FF15E04 var_24 = -0x24
N88AP_iBoot:4FF15E04 oldR4 = -0x14
N88AP_iBoot:4FF15E04 oldR5 = -0x10
N88AP_iBoot:4FF15E04 oldR6 = -0xC
N88AP_iBoot:4FF15E04 oldR7 = -8
N88AP_iBoot:4FF15E04 oldLR = -4
N88AP_iBoot:4FF15E04
N88AP_iBoot:4FF15E04 000 PUSH {R4-R7,LR} ; Push registers
N88AP_iBoot:4FF15E06 014 ADD R7, SP, #0xC ; Rd = Op1 + Op2
N88AP_iBoot:4FF15E08 014 PUSH.W {R8,R10,R11} ; Push registers
N88AP_iBoot:4FF15E0C 020 SUB SP, SP, #0xA4 ; Rd = Op1 - Op2
N88AP_iBoot:4FF15E0E 0C4 LDR.W R5, =dword_4FF2A308 ; Load from Memory
N88AP_iBoot:4FF15E12 0C4 MOV R8, R2 ; Rd = Op2
N88AP_iBoot:4FF15E14 0C4 MOVS R2, #0 ; Type
N88AP_iBoot:4FF15E16 0C4 LDR R3, [R5] ; Load from Memory
N88AP_iBoot:4FF15E18 0C4 STR R3, [SP,#0xC4+var_24] ; Store to Memory
N88AP_iBoot:4FF15E1A 0C4 BL n88ap__iBoot__MEMZ_STRUCT_INIT ; Branch with Link
N88AP_iBoot:4FF15E1E 0C4 CBNZ R0, loc_4FF15E30 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF15E20 0C4 LDR.W R0, =aKernelcacheImageCorrupt ; "Kernelcache image corrupt\n"
N88AP_iBoot:4FF15E24 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15E28 0C4 MOV.W R0, #0xFFFFFFFF ; Rd = Op2
N88AP_iBoot:4FF15E2C 0C4 B.W loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF15E30 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15E30
N88AP_iBoot:4FF15E30 loc_4FF15E30 ; CODE XREF: LoadImage_kernelcache_img3+1A�j
N88AP_iBoot:4FF15E30 0C4 LDR R3, [R0,#4] ; param_R3
N88AP_iBoot:4FF15E32 0C4 CMP.W R3, #0xF00000 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15E36 0C4 BLS loc_4FF15E48 ; Branch
N88AP_iBoot:4FF15E38 0C4 LDR.W R0, =aKernelcacheTooLarge ; "Kernelcache too large\n"
N88AP_iBoot:4FF15E3C 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15E40 0C4 MOV R0, 0xFFFFFFFE ; mem_info
N88AP_iBoot:4FF15E44 0C4 B.W loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF15E48 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15E48
N88AP_iBoot:4FF15E48 loc_4FF15E48 ; CODE XREF: LoadImage_kernelcache_img3+32�j
N88AP_iBoot:4FF15E48 0C4 MOV.W R3, #0x43000000 ; Rd = Op2
N88AP_iBoot:4FF15E4C 0C4 LDR.W R1, ='krnl' ; TAG_TYPE
N88AP_iBoot:4FF15E50 0C4 STR R3, [SP,#0xC4+var_58] ; Store to Memory
N88AP_iBoot:4FF15E52 0C4 ADD R2, SP, #0xC4+var_58 ; unknown1
N88AP_iBoot:4FF15E54 0C4 MOV.W R3, #0xF00000 ; Rd = Op2
N88AP_iBoot:4FF15E58 0C4 STR R3, [SP,#0xC4+var_5C] ; Store to Memory
N88AP_iBoot:4FF15E5A 0C4 ADD R3, SP, #0xC4+var_5C ; unknown2
N88AP_iBoot:4FF15E5C 0C4 BL n88ap__iBoot__image_load ; Branch with Link
N88AP_iBoot:4FF15E60 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15E62 0C4 BGE loc_4FF15E74 ; Branch
N88AP_iBoot:4FF15E64 0C4 LDR.W R0, =aKernelcacheImageNotValid ; "Kernelcache image not valid\n"
N88AP_iBoot:4FF15E68 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15E6C 0C4 MOV R0, 0xFFFFFFFD
N88AP_iBoot:4FF15E70 0C4 B.W loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF15E74 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15E74
N88AP_iBoot:4FF15E74 loc_4FF15E74 ; CODE XREF: LoadImage_kernelcache_img3+5E�j
N88AP_iBoot:4FF15E74 0C4 LDR R0, [SP,#0xC4+var_58] ; Load from Memory
N88AP_iBoot:4FF15E76 0C4 LDR R0, [R0] ; Load from Memory
N88AP_iBoot:4FF15E78 0C4 BL sub_4FF1F408 ; Branch with Link
N88AP_iBoot:4FF15E7C 0C4 LDR.W R3, ='comp' ; Load from Memory
N88AP_iBoot:4FF15E80 0C4 CMP R0, R3 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15E82 0C4 MOV R4, R0 ; Rd = Op2
N88AP_iBoot:4FF15E84 0C4 IT NE ; If Then
N88AP_iBoot:4FF15E86 0C4 MOVNE R0, 0xFFFFFFFC
N88AP_iBoot:4FF15E8A 0C4 BNE.W loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF15E8E 0C4 B.W loc_4FF16B48 ; Branch
N88AP_iBoot:4FF15E92 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15E92
N88AP_iBoot:4FF15E92 loc_4FF15E92 ; CODE XREF: LoadImage_kernelcache_img3+D56�j
N88AP_iBoot:4FF15E92 0C4 LDR R0, [R6,#4] ; Load from Memory
N88AP_iBoot:4FF15E94 0C4 BL sub_4FF1F408 ; Branch with Link
N88AP_iBoot:4FF15E98 0C4 LDR.W R3, ='lzss' ; param_R3
N88AP_iBoot:4FF15E9C 0C4 CMP R0, R3 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15E9E 0C4 IT NE ; If Then
N88AP_iBoot:4FF15EA0 0C4 LDRNE.W R0, =aUnknownKernelcacheCompressionType ; "unknown kernelcache compression type\n"
N88AP_iBoot:4FF15EA4 0C4 BNE loc_4FF15F30 ; Branch
N88AP_iBoot:4FF15EA6 0C4 ADD.W R11, R6, #0x180 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15EAA 0C4 MOV R1, R6 ; param_R1
N88AP_iBoot:4FF15EAC 0C4 LDR.W R0, =aLoadingKernelCacheAtX___ ; "Loading kernel cache at %#x..."
N88AP_iBoot:4FF15EB0 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15EB4 0C4 MOV R1, R11 ; param_R1
N88AP_iBoot:4FF15EB6 0C4 LDR.W R0, =aDataStartsAtP ; "data starts at %p\n"
N88AP_iBoot:4FF15EBA 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15EBE 0C4 LDR R0, [R6,#0x10] ; Load from Memory
N88AP_iBoot:4FF15EC0 0C4 BL sub_4FF1F408 ; Branch with Link
N88AP_iBoot:4FF15EC4 0C4 RSB.W R3, R6, #3 ; Rd = Op2 - Op1
N88AP_iBoot:4FF15EC8 0C4 ADD R3, R11 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15ECA 0C4 ADDS R3, R3, R0 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15ECC 0C4 STR R0, [SP,#0xC4+var_BC] ; Store to Memory
N88AP_iBoot:4FF15ECE 0C4 BIC.W R3, R3, #3 ; Rd = Op1 & ~Op2
N88AP_iBoot:4FF15ED2 0C4 STR R3, [SP,#0xC4+param_R1] ; Store to Memory
N88AP_iBoot:4FF15ED4 0C4 LDR R0, [R6,#0xC] ; Load from Memory
N88AP_iBoot:4FF15ED6 0C4 BL sub_4FF1F408 ; Branch with Link
N88AP_iBoot:4FF15EDA 0C4 LDR R2, [SP,#0xC4+param_R1] ; Load from Memory
N88AP_iBoot:4FF15EDC 0C4 ADD.W R1, R2, R0 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15EE0 0C4 CMP.W R1, #0xF00000 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15EE4 0C4 MOV R10, R0 ; Rd = Op2
N88AP_iBoot:4FF15EE6 0C4 ITT HI ; If Then
N88AP_iBoot:4FF15EE8 0C4 MOVHI.W R2, #0xF00000 ; Rd = Op2
N88AP_iBoot:4FF15EEC 0C4 LDRHI.W R0, =aUncompressedSizeTooLargeUMaxD ; "uncompressed size too large %u, max %d\n"...
N88AP_iBoot:4FF15EF0 0C4 BHI loc_4FF15F12 ; Branch
N88AP_iBoot:4FF15EF2 0C4 LDR R3, [SP,#0xC4+param_R1] ; Load from Memory
N88AP_iBoot:4FF15EF4 0C4 MOV R2, R11 ; Rd = Op2
N88AP_iBoot:4FF15EF6 0C4 ADD.W R4, R3, R6 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15EFA 0C4 RSB.W R1, R3, #0xF00000 ; Rd = Op2 - Op1
N88AP_iBoot:4FF15EFE 0C4 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF15F00 0C4 LDR R3, [SP,#0xC4+var_BC] ; Load from Memory
N88AP_iBoot:4FF15F02 0C4 BL sub_4FF1D5DC ; Branch with Link
N88AP_iBoot:4FF15F06 0C4 CMP R10, R0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15F08 0C4 MOV R1, R0 ; param_R1
N88AP_iBoot:4FF15F0A 0C4 BEQ loc_4FF15F18 ; Branch
N88AP_iBoot:4FF15F0C 0C4 LDR.W R0, =aSizeMismatchFromLzssDShouldBeD ; "size mismatch from lzss %d, should be %"...
N88AP_iBoot:4FF15F10 0C4 MOV R2, R10 ; param_R2
N88AP_iBoot:4FF15F12
N88AP_iBoot:4FF15F12 loc_4FF15F12 ; CODE XREF: LoadImage_kernelcache_img3+EC�j
N88AP_iBoot:4FF15F12 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15F16 0C4 B loc_4FF15F42 ; Branch
N88AP_iBoot:4FF15F18 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15F18
N88AP_iBoot:4FF15F18 loc_4FF15F18 ; CODE XREF: LoadImage_kernelcache_img3+106�j
N88AP_iBoot:4FF15F18 0C4 LDR R0, [R6,#8] ; Load from Memory
N88AP_iBoot:4FF15F1A 0C4 BL sub_4FF1F408 ; Branch with Link
N88AP_iBoot:4FF15F1E 0C4 MOV R1, R10 ; Rd = Op2
N88AP_iBoot:4FF15F20 0C4 MOV R11, R0 ; Rd = Op2
N88AP_iBoot:4FF15F22 0C4 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF15F24 0C4 BL sub_4FF1CB3C ; Branch with Link
N88AP_iBoot:4FF15F28 0C4 CMP R11, R0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15F2A 0C4 BEQ loc_4FF15F36 ; Branch
N88AP_iBoot:4FF15F2C 0C4 LDR.W R0, =aAdlerMismatch ; "adler mismatch\n"
N88AP_iBoot:4FF15F30
N88AP_iBoot:4FF15F30 loc_4FF15F30 ; CODE XREF: LoadImage_kernelcache_img3+A0�j
N88AP_iBoot:4FF15F30 ; LoadImage_kernelcache_img3+D52�j
N88AP_iBoot:4FF15F30 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15F34 0C4 B loc_4FF15F42 ; Branch
N88AP_iBoot:4FF15F36 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15F36
N88AP_iBoot:4FF15F36 loc_4FF15F36 ; CODE XREF: LoadImage_kernelcache_img3+126�j
N88AP_iBoot:4FF15F36 0C4 LDR.W R0, =aDone ; "done\n"
N88AP_iBoot:4FF15F3A 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15F3E 0C4 STR R4, [SP,#0xC4+var_58] ; Store to Memory
N88AP_iBoot:4FF15F40 0C4 CBNZ R4, loc_4FF15F4A ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF15F42
N88AP_iBoot:4FF15F42 loc_4FF15F42 ; CODE XREF: LoadImage_kernelcache_img3+112�j
N88AP_iBoot:4FF15F42 ; LoadImage_kernelcache_img3+130�j
N88AP_iBoot:4FF15F42 0C4 MOV R0, 0xFFFFFFFB
N88AP_iBoot:4FF15F46 0C4 B.W loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF15F4A ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15F4A
N88AP_iBoot:4FF15F4A loc_4FF15F4A ; CODE XREF: LoadImage_kernelcache_img3+13C�j
N88AP_iBoot:4FF15F4A 0C4 LDR R1, [SP,#0xC4+param_R1] ; param_R1
N88AP_iBoot:4FF15F4C 0C4 LDR.W R3, =0xFEEDFACE ; param_R3
N88AP_iBoot:4FF15F50 0C4 LDR R0, [R1,R6] ; Load from Memory
N88AP_iBoot:4FF15F52 0C4 CMP R0, R3 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15F54 0C4 IT NE ; If Then
N88AP_iBoot:4FF15F56 0C4 MOVNE R0, 0xFFFFFFFA
N88AP_iBoot:4FF15F5A 0C4 BNE.W loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF15F5E 0C4 B.W loc_4FF16B5E ; Branch
N88AP_iBoot:4FF15F62 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15F62
N88AP_iBoot:4FF15F62 loc_4FF15F62 ; CODE XREF: LoadImage_kernelcache_img3+D9A�j
N88AP_iBoot:4FF15F62 0C4 LDR.W R0, =aLoad_macho_imageFailedToLoadDeviceTree ; "load_macho_image: failed to load device"...
N88AP_iBoot:4FF15F66 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF15F6A 0C4 B.W loc_4FF16B34 ; Branch
N88AP_iBoot:4FF15F6E ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15F6E
N88AP_iBoot:4FF15F6E loc_4FF15F6E ; CODE XREF: LoadImage_kernelcache_img3+D96�j
N88AP_iBoot:4FF15F6E 0C4 LDR.W R2, =dword_4FF2CD04 ; Load from Memory
N88AP_iBoot:4FF15F72 0C4 ADD.W R10, R6, #0x1C ; Rd = Op1 + Op2
N88AP_iBoot:4FF15F76 0C4 LDR R0, [R2] ; Load from Memory
N88AP_iBoot:4FF15F78 0C4 BL sub_4FF138BC ; Branch with Link
N88AP_iBoot:4FF15F7C 0C4 LDR.W R3, =dword_4FF2CD10 ; Load from Memory
N88AP_iBoot:4FF15F80 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF15F82 0C4 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF15F84 0C4 STR R6, [R3] ; Store to Memory
N88AP_iBoot:4FF15F86 0C4 LDR R6, [R6,#0x10] ; Load from Memory
N88AP_iBoot:4FF15F88 0C4 STR R1, [SP,#0xC4+var_B8] ; Store to Memory
N88AP_iBoot:4FF15F8A 0C4 STR R6, [SP,#0xC4+var_B0] ; Store to Memory
N88AP_iBoot:4FF15F8C 0C4 B loc_4FF160AC ; Branch
N88AP_iBoot:4FF15F8E ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF15F8E
N88AP_iBoot:4FF15F8E loc_4FF15F8E ; CODE XREF: LoadImage_kernelcache_img3+2AE�j
N88AP_iBoot:4FF15F8E 0C4 LDR.W R2, [R10,#4] ; Load from Memory
N88AP_iBoot:4FF15F92 0C4 STR R2, [SP,#0xC4+var_B4] ; Store to Memory
N88AP_iBoot:4FF15F94 0C4 LDR.W R3, [R10] ; Load from Memory
N88AP_iBoot:4FF15F98 0C4 CMP R3, #2 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15F9A 0C4 STR R3, [SP,#0xC4+var_C4] ; Store to Memory
N88AP_iBoot:4FF15F9C 0C4 BEQ.W loc_4FF16BA2 ; Branch
N88AP_iBoot:4FF15FA0 0C4 CMP R3, #5 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15FA2 0C4 BEQ loc_4FF1607C ; Branch
N88AP_iBoot:4FF15FA4 0C4 CMP R3, #1 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15FA6 0C4 BNE loc_4FF1609C ; Branch
N88AP_iBoot:4FF15FA8 0C4 LDR.W R2, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF15FAC 0C4 LDR.W R3, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF15FB0 0C4 LDR.W R1, [R10,#0x18] ; Load from Memory
N88AP_iBoot:4FF15FB4 0C4 LDR R2, [R2,#4] ; Load from Memory
N88AP_iBoot:4FF15FB6 0C4 LDR R3, [R3,#8] ; Load from Memory
N88AP_iBoot:4FF15FB8 0C4 STR R1, [SP,#0xC4+var_A4] ; Store to Memory
N88AP_iBoot:4FF15FBA 0C4 LDR.W R11, [R10,#0x1C] ; Load from Memory
N88AP_iBoot:4FF15FBE 0C4 STR R2, [SP,#0xC4+var_AC] ; Store to Memory
N88AP_iBoot:4FF15FC0 0C4 LDR.W R2, =dword_4FF2CD10 ; Load from Memory
N88AP_iBoot:4FF15FC4 0C4 STR R3, [SP,#0xC4+var_A8] ; Store to Memory
N88AP_iBoot:4FF15FC6 0C4 LDR.W R1, [R10,#0x20] ; Load from Memory
N88AP_iBoot:4FF15FCA 0C4 LDR R2, [R2] ; Load from Memory
N88AP_iBoot:4FF15FCC 0C4 ADD.W R4, R10, #8 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15FD0 0C4 STR R1, [SP,#0xC4+var_98] ; Store to Memory
N88AP_iBoot:4FF15FD2 0C4 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF15FD4 0C4 LDR.W R1, =a__pagezero ; "__PAGEZERO"
N88AP_iBoot:4FF15FD8 0C4 STR R2, [SP,#0xC4+var_9C] ; Store to Memory
N88AP_iBoot:4FF15FDA 0C4 LDR.W R6, [R10,#0x24] ; Load from Memory
N88AP_iBoot:4FF15FDE 0C4 BL sub_4FF1ECA0 ; Branch with Link
N88AP_iBoot:4FF15FE2 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF15FE4 0C4 BEQ.W loc_4FF16BA2 ; Branch
N88AP_iBoot:4FF15FE8 0C4 LDR R3, [SP,#0xC4+var_A8] ; Load from Memory
N88AP_iBoot:4FF15FEA 0C4 LDR R1, [SP,#0xC4+var_A4] ; Load from Memory
N88AP_iBoot:4FF15FEC 0C4 LDR R2, [SP,#0xC4+var_AC] ; Load from Memory
N88AP_iBoot:4FF15FEE 0C4 ADD.W R0, R3, R1 ; Rd = Op1 + Op2
N88AP_iBoot:4FF15FF2 0C4 SUBS R0, R0, R2 ; Rd = Op1 - Op2
N88AP_iBoot:4FF15FF4 0C4 MOVS R1, #0x20 ; ' ' ; param_R3
N88AP_iBoot:4FF15FF6 0C4 STR R0, [SP,#0xC4+var_A0] ; Store to Memory
N88AP_iBoot:4FF15FF8 0C4 LDR.W R2, =aKernelS ; "Kernel-%s"
N88AP_iBoot:4FF15FFC 0C4 ADD R0, SP, #0xC4+var_54 ; param_R2
N88AP_iBoot:4FF15FFE 0C4 MOV R3, R4 ; Rd = Op2
N88AP_iBoot:4FF16000 0C4 BL sub_4FF1EC48 ; Branch with Link
N88AP_iBoot:4FF16004 0C4 ADD R0, SP, #0xC4+var_54 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16006 0C4 LDR R1, [SP,#0xC4+var_A0] ; Load from Memory
N88AP_iBoot:4FF16008 0C4 MOV R2, R11 ; Rd = Op2
N88AP_iBoot:4FF1600A 0C4 BL N88AP__iBoot__AllocateMemoryRange ; Branch with Link
N88AP_iBoot:4FF1600E 0C4 CMP.W R11, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16012 0C4 BEQ loc_4FF16028 ; Branch
N88AP_iBoot:4FF16014 0C4 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF16016 0C4 LDR.W R1, =a__prelink ; "__PRELINK"
N88AP_iBoot:4FF1601A 0C4 BL sub_4FF1ECA0 ; Branch with Link
N88AP_iBoot:4FF1601E 0C4 CBNZ R0, loc_4FF16028 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF16020 0C4 LDR.W R3, =dword_4FF2CD14 ; Load from Memory
N88AP_iBoot:4FF16024 0C4 LDR R1, [SP,#0xC4+var_C4] ; Load from Memory
N88AP_iBoot:4FF16026 0C4 STR R1, [R3] ; Store to Memory
N88AP_iBoot:4FF16028
N88AP_iBoot:4FF16028 loc_4FF16028 ; CODE XREF: LoadImage_kernelcache_img3+20E�j
N88AP_iBoot:4FF16028 ; LoadImage_kernelcache_img3+21A�j
N88AP_iBoot:4FF16028 0C4 CBZ R6, loc_4FF1603A ; Compare and Branch on Zero
N88AP_iBoot:4FF1602A 0C4 LDR R2, [SP,#0xC4+var_9C] ; Load from Memory
N88AP_iBoot:4FF1602C 0C4 LDR R3, [SP,#0xC4+var_98] ; Load from Memory
N88AP_iBoot:4FF1602E 0C4 LDR R0, [SP,#0xC4+var_A0] ; Load from Memory
N88AP_iBoot:4FF16030 0C4 ADD.W R1, R2, R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16034 0C4 MOV R2, R6 ; Rd = Op2
N88AP_iBoot:4FF16036 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF1603A
N88AP_iBoot:4FF1603A loc_4FF1603A ; CODE XREF: LoadImage_kernelcache_img3:loc_4FF16028�j
N88AP_iBoot:4FF1603A 0C4 CMP R11, R6 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF1603C 0C4 BLE loc_4FF1604E ; Branch
N88AP_iBoot:4FF1603E 0C4 LDR R1, [SP,#0xC4+var_A0] ; Load from Memory
N88AP_iBoot:4FF16040 0C4 RSB.W R2, R6, R11 ; Rd = Op2 - Op1
N88AP_iBoot:4FF16044 0C4 ADD.W R0, R1, R6 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16048 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF1604A 0C4 BLX sub_4FF1ED54 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF1604E
N88AP_iBoot:4FF1604E loc_4FF1604E ; CODE XREF: LoadImage_kernelcache_img3+238�j
N88AP_iBoot:4FF1604E 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF16050 0C4 MOVS R0, #1 ; Rd = Op2
N88AP_iBoot:4FF16052 0C4 MOV R2, R1 ; Rd = Op2
N88AP_iBoot:4FF16054 0C4 BL sub_4FF1E344 ; Branch with Link
N88AP_iBoot:4FF16058 0C4 LDR R2, [SP,#0xC4+var_A4] ; Load from Memory
N88AP_iBoot:4FF1605A 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF1605C 0C4 ADD.W R4, R11, R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16060 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF16064 0C4 CMP R4, R0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16066 0C4 BLS.W loc_4FF16BA2 ; Branch
N88AP_iBoot:4FF1606A 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF1606C 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF16070 0C4 RSB.W R0, R0, R4 ; Rd = Op2 - Op1
N88AP_iBoot:4FF16074 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF16078 0C4 B.W loc_4FF16BA2 ; Branch
N88AP_iBoot:4FF1607C ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF1607C
N88AP_iBoot:4FF1607C loc_4FF1607C ; CODE XREF: LoadImage_kernelcache_img3+19E�j
N88AP_iBoot:4FF1607C 0C4 LDR.W R3, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16080 0C4 LDR.W R1, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16084 0C4 LDR R2, [R3,#8] ; Load from Memory
N88AP_iBoot:4FF16086 0C4 LDR.W R3, [R10,#0x4C] ; Load from Memory
N88AP_iBoot:4FF1608A 0C4 ADD R3, R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1608C 0C4 LDR R2, [R1,#4] ; Load from Memory
N88AP_iBoot:4FF1608E 0C4 RSB.W R2, R2, R3 ; Rd = Op2 - Op1
N88AP_iBoot:4FF16092 0C4 LDR.W R3, =dword_4FF2CBC8 ; Load from Memory
N88AP_iBoot:4FF16096 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16098 0C4 B.W loc_4FF16BA2 ; Branch
N88AP_iBoot:4FF1609C ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF1609C
N88AP_iBoot:4FF1609C loc_4FF1609C ; CODE XREF: LoadImage_kernelcache_img3+1A2�j
N88AP_iBoot:4FF1609C 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF1609E 0C4 BNE.W loc_4FF16B34 ; Branch
N88AP_iBoot:4FF160A2
N88AP_iBoot:4FF160A2 loc_4FF160A2 ; CODE XREF: LoadImage_kernelcache_img3+DA0�j
N88AP_iBoot:4FF160A2 0C4 LDR R2, [SP,#0xC4+var_B4] ; Load from Memory
N88AP_iBoot:4FF160A4 0C4 LDR R3, [SP,#0xC4+var_B8] ; Load from Memory
N88AP_iBoot:4FF160A6 0C4 ADD R10, R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF160A8 0C4 ADDS R3, #1 ; Rd = Op1 + Op2
N88AP_iBoot:4FF160AA 0C4 STR R3, [SP,#0xC4+var_B8] ; Store to Memory
N88AP_iBoot:4FF160AC
N88AP_iBoot:4FF160AC loc_4FF160AC ; CODE XREF: LoadImage_kernelcache_img3+188�j
N88AP_iBoot:4FF160AC 0C4 LDR R1, [SP,#0xC4+var_B8] ; Load from Memory
N88AP_iBoot:4FF160AE 0C4 LDR R2, [SP,#0xC4+var_B0] ; Load from Memory
N88AP_iBoot:4FF160B0 0C4 CMP R1, R2 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF160B2 0C4 BLT.W loc_4FF15F8E ; Branch
N88AP_iBoot:4FF160B6 0C4 LDR.W R3, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF160BA 0C4 LDR.W R10, =dword_4FF2A03C ; Load from Memory
N88AP_iBoot:4FF160BE 0C4 MOVS R6, #1 ; Rd = Op2
N88AP_iBoot:4FF160C0 0C4 LDR.W R2, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF160C4 0C4 LDR.W R1, [R10] ; Load from Memory
N88AP_iBoot:4FF160C8 0C4 STR R6, [R3,#0x18] ; Store to Memory
N88AP_iBoot:4FF160CA 0C4 LDR.W R3, =aRdMd0NandEnableReformat1Progress ; "rd=md0 nand-enable-reformat=1 -progress"...
N88AP_iBoot:4FF160CE 0C4 LDR.W R0, ='Teth' ; Load from Memory
N88AP_iBoot:4FF160D2 0C4 CMP R1, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF160D4 0C4 ITE NE ; If Then
N88AP_iBoot:4FF160D6 0C4 MOVNE R4, R3 ; Rd = Op2
N88AP_iBoot:4FF160D8 0C4 MOVEQ R4, R2 ; Rd = Op2
N88AP_iBoot:4FF160DA 0C4 MOVS R2, #0x10 ; Rd = Op2
N88AP_iBoot:4FF160DC 0C4 ADD R1, SP, #0xC4+var_34 ; Rd = Op1 + Op2
N88AP_iBoot:4FF160DE 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF160E2 0C4 CMP.W R0, #0xFFFFFFFF ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF160E6 0C4 BEQ loc_4FF160FA ; Branch
N88AP_iBoot:4FF160E8 0C4 LDRB.W R3, [SP,#0xC4+var_34] ; Load from Memory
N88AP_iBoot:4FF160EC 0C4 CBZ R3, loc_4FF160FA ; Compare and Branch on Zero
N88AP_iBoot:4FF160EE 0C4 LDR.W R0, =aIsTethered ; "is-tethered"
N88AP_iBoot:4FF160F2 0C4 MOV R1, R6 ; Rd = Op2
N88AP_iBoot:4FF160F4 0C4 MOVS R2, #0 ; Rd = Op2
N88AP_iBoot:4FF160F6 0C4 BL sub_4FF1D084 ; Branch with Link
N88AP_iBoot:4FF160FA
N88AP_iBoot:4FF160FA loc_4FF160FA ; CODE XREF: LoadImage_kernelcache_img3+2E2�j
N88AP_iBoot:4FF160FA ; LoadImage_kernelcache_img3+2E8�j
N88AP_iBoot:4FF160FA 0C4 LDR.W R0, =aIsTethered ; "is-tethered"
N88AP_iBoot:4FF160FE 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF16100 0C4 BL sub_4FF1CD88 ; Branch with Link
N88AP_iBoot:4FF16104 0C4 CBZ R0, loc_4FF16114 ; Compare and Branch on Zero
N88AP_iBoot:4FF16106 0C4 LDR.W R0, =n88ap__iBOOT__gBootArgs.commandLine ; Load from Memory
N88AP_iBoot:4FF1610A 0C4 LDR.W R2, =aSForceUsbPower1 ; "%s force-usb-power=1 "
N88AP_iBoot:4FF1610E 0C4 MOV.W R1, #0x100 ; Rd = Op2
N88AP_iBoot:4FF16112 0C4 B loc_4FF16120 ; Branch
N88AP_iBoot:4FF16114 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16114
N88AP_iBoot:4FF16114 loc_4FF16114 ; CODE XREF: LoadImage_kernelcache_img3+300�j
N88AP_iBoot:4FF16114 0C4 LDR.W R0, =n88ap__iBOOT__gBootArgs.commandLine ; param_R2
N88AP_iBoot:4FF16118 0C4 LDR.W R2, =aS_2 ; "%s "
N88AP_iBoot:4FF1611C 0C4 MOV.W R1, #0x100 ; param_R3
N88AP_iBoot:4FF16120
N88AP_iBoot:4FF16120 loc_4FF16120 ; CODE XREF: LoadImage_kernelcache_img3+30E�j
N88AP_iBoot:4FF16120 0C4 MOV R3, R4 ; Rd = Op2
N88AP_iBoot:4FF16122 0C4 BL sub_4FF1EC48 ; Branch with Link
N88AP_iBoot:4FF16126 0C4 LDR.W R1, =n88ap__iBOOT__gBootArgs.commandLine ; param_R1
N88AP_iBoot:4FF1612A 0C4 LDR.W R0, =aGbootargs_commandlineS ; "gBootArgs.commandLine = [%s]\n"
N88AP_iBoot:4FF1612E 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF16132 0C4 MOVS R2, #0 ; Rd = Op2
N88AP_iBoot:4FF16134 0C4 LDR.W R0, =n88ap__iBOOT__gBootArgs.commandLine ; Load from Memory
N88AP_iBoot:4FF16138 0C4 LDR.W R1, =aS_3 ; "-s"
N88AP_iBoot:4FF1613C 0C4 BL sub_4FF15CE8 ; Branch with Link
N88AP_iBoot:4FF16140 0C4 MOV R2, R0 ; Rd = Op2
N88AP_iBoot:4FF16142 0C4 CBNZ R0, loc_4FF16152 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF16144 0C4 LDR.W R0, =n88ap__iBOOT__gBootArgs.commandLine ; Load from Memory
N88AP_iBoot:4FF16148 0C4 LDR.W R1, =aV_1 ; "-v"
N88AP_iBoot:4FF1614C 0C4 BL sub_4FF15CE8 ; Branch with Link
N88AP_iBoot:4FF16150 0C4 CBZ R0, loc_4FF1615A ; Compare and Branch on Zero
N88AP_iBoot:4FF16152
N88AP_iBoot:4FF16152 loc_4FF16152 ; CODE XREF: LoadImage_kernelcache_img3+33E�j
N88AP_iBoot:4FF16152 0C4 LDR.W R1, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16156 0C4 MOVS R3, #0 ; Rd = Op2
N88AP_iBoot:4FF16158 0C4 STR R3, [R1,#0x18] ; Store to Memory
N88AP_iBoot:4FF1615A
N88AP_iBoot:4FF1615A loc_4FF1615A ; CODE XREF: LoadImage_kernelcache_img3+34C�j
N88AP_iBoot:4FF1615A 0C4 LDR.W R0, =n88ap__iBOOT__gBootArgs.commandLine ; Load from Memory
N88AP_iBoot:4FF1615E 0C4 LDR.W R1, =aDebug ; "debug="
N88AP_iBoot:4FF16162 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF16164 0C4 BL sub_4FF15CE8 ; Branch with Link
N88AP_iBoot:4FF16168 0C4 CBZ R0, loc_4FF1616E ; Compare and Branch on Zero
N88AP_iBoot:4FF1616A 0C4 BL sub_4FF19FD4 ; Branch with Link
N88AP_iBoot:4FF1616E
N88AP_iBoot:4FF1616E loc_4FF1616E ; CODE XREF: LoadImage_kernelcache_img3+364�j
N88AP_iBoot:4FF1616E 0C4 LDR.W R0, =n88ap__iBOOT__gBootArgs.commandLine ; Load from Memory
N88AP_iBoot:4FF16172 0C4 LDR.W R1, =aForceUsbPower1 ; "force-usb-power=1"
N88AP_iBoot:4FF16176 0C4 MOVS R2, #0 ; Rd = Op2
N88AP_iBoot:4FF16178 0C4 BL sub_4FF15CE8 ; Branch with Link
N88AP_iBoot:4FF1617C 0C4 CBZ R0, loc_4FF16186 ; Compare and Branch on Zero
N88AP_iBoot:4FF1617E 0C4 LDR.W R3, =dword_4FF2A148 ; Load from Memory
N88AP_iBoot:4FF16182 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF16184 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16186
N88AP_iBoot:4FF16186 loc_4FF16186 ; CODE XREF: LoadImage_kernelcache_img3+378�j
N88AP_iBoot:4FF16186 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF16188 0C4 MOVS R2, #0x14 ; Rd = Op2
N88AP_iBoot:4FF1618A 0C4 ADD R0, SP, #0xC4+var_94 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1618C 0C4 BLX sub_4FF1ED54 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF16190 0C4 ADD R0, SP, #0xC4+var_94 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16192 0C4 BL sub_4FF17200 ; Branch with Link
N88AP_iBoot:4FF16196 0C4 LDR.W R6, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF1619A 0C4 LDR R3, [SP,#0xC4+var_88] ; Load from Memory
N88AP_iBoot:4FF1619C 0C4 LDR.W R2, =dword_4FF2CD0C ; Load from Memory
N88AP_iBoot:4FF161A0 0C4 MOV.W R11, #0 ; Rd = Op2
N88AP_iBoot:4FF161A4 0C4 STR R3, [R6,#0x1C] ; Store to Memory
N88AP_iBoot:4FF161A6 0C4 LDR R3, [SP,#0xC4+var_90] ; Load from Memory
N88AP_iBoot:4FF161A8 0C4 MOV R1, R11 ; Rd = Op2
N88AP_iBoot:4FF161AA 0C4 STR.W R11, [R2] ; Store to Memory
N88AP_iBoot:4FF161AE 0C4 STR R3, [R6,#0x20] ; Store to Memory
N88AP_iBoot:4FF161B0 0C4 LDR R3, [SP,#0xC4+var_8C] ; Load from Memory
N88AP_iBoot:4FF161B2 0C4 LDR.W R0, =aVramSize ; "vram-size"
N88AP_iBoot:4FF161B6 0C4 STR R3, [R6,#0x24] ; Store to Memory
N88AP_iBoot:4FF161B8 0C4 LDR R3, [SP,#0xC4+var_84] ; Load from Memory
N88AP_iBoot:4FF161BA 0C4 STR R3, [R6,#0x28] ; Store to Memory
N88AP_iBoot:4FF161BC 0C4 LDR R3, [SP,#0xC4+var_94] ; Load from Memory
N88AP_iBoot:4FF161BE 0C4 STR R3, [R6,#0x14] ; Store to Memory
N88AP_iBoot:4FF161C0 0C4 BL sub_4FF1CD88 ; Branch with Link
N88AP_iBoot:4FF161C4 0C4 LDR.W R3, =dword_4FF2CD0C ; Load from Memory
N88AP_iBoot:4FF161C8 0C4 LDR R2, [R6,#0xC] ; Load from Memory
N88AP_iBoot:4FF161CA 0C4 CMP.W R0, #0x300000 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF161CE 0C4 STR R0, [R3] ; Store to Memory
N88AP_iBoot:4FF161D0 0C4 ITTT CC ; If Then
N88AP_iBoot:4FF161D2 0C4 LDRCC.W R1, =dword_4FF2CD0C ; Load from Memory
N88AP_iBoot:4FF161D6 0C4 MOVCC.W R3, #0x300000 ; Rd = Op2
N88AP_iBoot:4FF161DA 0C4 STRCC R3, [R1] ; Store to Memory
N88AP_iBoot:4FF161DC 0C4 LDR.W R1, =dword_4FF2CD0C ; Load from Memory
N88AP_iBoot:4FF161E0 0C4 LDR R3, [R1] ; Load from Memory
N88AP_iBoot:4FF161E2 0C4 RSB.W R3, R3, R2 ; Rd = Op2 - Op1
N88AP_iBoot:4FF161E6 0C4 LDR.W R2, =dword_4FF2CD08 ; Load from Memory
N88AP_iBoot:4FF161EA 0C4 STR R3, [R6,#0xC] ; Store to Memory
N88AP_iBoot:4FF161EC 0C4 LDR R0, [R2] ; Load from Memory
N88AP_iBoot:4FF161EE 0C4 STR R0, [R6,#0x34] ; Store to Memory
N88AP_iBoot:4FF161F0 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF161F4 0C4 LDR R2, [R6,#4] ; Load from Memory
N88AP_iBoot:4FF161F6 0C4 MOV R3, R0 ; Rd = Op2
N88AP_iBoot:4FF161F8 0C4 STR R0, [R6,#0x30] ; Store to Memory
N88AP_iBoot:4FF161FA 0C4 LDR R0, [R6,#8] ; Load from Memory
N88AP_iBoot:4FF161FC 0C4 SUBS R0, R0, R2 ; Rd = Op1 - Op2
N88AP_iBoot:4FF161FE 0C4 ADDS R0, R0, R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16200 0C4 LDR.W R3, =dword_4FF2CD04 ; Load from Memory
N88AP_iBoot:4FF16204 0C4 LDR R1, [R3] ; Load from Memory
N88AP_iBoot:4FF16206 0C4 LDR.W R3, =dword_4FF2CD08 ; Load from Memory
N88AP_iBoot:4FF1620A 0C4 LDR R2, [R3] ; Load from Memory
N88AP_iBoot:4FF1620C 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF16210 0C4 LDR R3, [R6,#4] ; Load from Memory
N88AP_iBoot:4FF16212 0C4 LDR R0, [R6,#8] ; Load from Memory
N88AP_iBoot:4FF16214 0C4 LDR.W R1, =dword_4FF2CD04 ; Load from Memory
N88AP_iBoot:4FF16218 0C4 SUBS R0, R0, R3 ; Rd = Op1 - Op2
N88AP_iBoot:4FF1621A 0C4 LDR R3, [R6,#0x30] ; Load from Memory
N88AP_iBoot:4FF1621C 0C4 ADDS R0, R0, R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1621E 0C4 STR R0, [R1] ; Store to Memory
N88AP_iBoot:4FF16220 0C4 BL sub_4FF138BC ; Branch with Link
N88AP_iBoot:4FF16224 0C4 LDR.W R3, =dword_4FF2CD08 ; Load from Memory
N88AP_iBoot:4FF16228 0C4 LDR.W R2, =dword_4FF2CD04 ; Load from Memory
N88AP_iBoot:4FF1622C 0C4 LDR.W R0, =aDevicetree ; "DeviceTree"
N88AP_iBoot:4FF16230 0C4 LDR R1, [R2] ; Load from Memory
N88AP_iBoot:4FF16232 0C4 LDR R2, [R3] ; Load from Memory
N88AP_iBoot:4FF16234 0C4 BL N88AP__iBoot__AllocateMemoryRange ; Branch with Link
N88AP_iBoot:4FF16238 0C4 LDR.W R3, [R10] ; Load from Memory
N88AP_iBoot:4FF1623C 0C4 CBZ R3, loc_4FF16270 ; Compare and Branch on Zero
N88AP_iBoot:4FF1623E 0C4 LDR.W R10, =dword_4FF2A040 ; Load from Memory
N88AP_iBoot:4FF16242 0C4 LDR.W R0, [R10] ; Load from Memory
N88AP_iBoot:4FF16246 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF1624A 0C4 LDR R1, [R6,#8] ; Load from Memory
N88AP_iBoot:4FF1624C 0C4 LDR R3, [R6,#4] ; Load from Memory
N88AP_iBoot:4FF1624E 0C4 LDR.W R2, [R10] ; Load from Memory
N88AP_iBoot:4FF16252 0C4 SUBS R1, R1, R3 ; Rd = Op1 - Op2
N88AP_iBoot:4FF16254 0C4 MOV R4, R0 ; Rd = Op2
N88AP_iBoot:4FF16256 0C4 LDR.W R0, =dword_4FF2A03C ; Load from Memory
N88AP_iBoot:4FF1625A 0C4 ADDS R1, R1, R4 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1625C 0C4 LDR R0, [R0] ; Load from Memory
N88AP_iBoot:4FF1625E 0C4 BLX sub_4FF1EE64 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF16262 0C4 LDR.W R2, [R10] ; Load from Memory
N88AP_iBoot:4FF16266 0C4 LDR.W R0, =aRamdisk ; "RAMDisk"
N88AP_iBoot:4FF1626A 0C4 MOV R1, R4 ; Rd = Op2
N88AP_iBoot:4FF1626C 0C4 BL N88AP__iBoot__AllocateMemoryRange ; Branch with Link
N88AP_iBoot:4FF16270
N88AP_iBoot:4FF16270 loc_4FF16270 ; CODE XREF: LoadImage_kernelcache_img3+438�j
N88AP_iBoot:4FF16270 0C4 MOV R0, R11 ; Rd = Op2
N88AP_iBoot:4FF16272 0C4 LDR.W R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF16276 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16278 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF1627C 0C4 CBZ R0, loc_4FF1629E ; Compare and Branch on Zero
N88AP_iBoot:4FF1627E 0C4 LDR.W R3, =aModelNumber ; "model-number"
N88AP_iBoot:4FF16282 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16284 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16286 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16288 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1628A 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1628C 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16290 0C4 CBZ R0, loc_4FF1629E ; Compare and Branch on Zero
N88AP_iBoot:4FF16292 0C4 LDR.W R0, ='Mod#' ; Load from Memory
N88AP_iBoot:4FF16296 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16298 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF1629A 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF1629E
N88AP_iBoot:4FF1629E loc_4FF1629E ; CODE XREF: LoadImage_kernelcache_img3+478�j
N88AP_iBoot:4FF1629E ; LoadImage_kernelcache_img3+48C�j
N88AP_iBoot:4FF1629E 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF162A0 0C4 LDR.W R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF162A4 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF162A6 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF162AA 0C4 CBZ R0, loc_4FF162CC ; Compare and Branch on Zero
N88AP_iBoot:4FF162AC 0C4 LDR.W R3, =aRegionInfo ; "region-info"
N88AP_iBoot:4FF162B0 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF162B2 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF162B4 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF162B6 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF162B8 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF162BA 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF162BE 0C4 CBZ R0, loc_4FF162CC ; Compare and Branch on Zero
N88AP_iBoot:4FF162C0 0C4 LDR.W R0, ='Regn' ; Load from Memory
N88AP_iBoot:4FF162C4 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF162C6 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF162C8 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF162CC
N88AP_iBoot:4FF162CC loc_4FF162CC ; CODE XREF: LoadImage_kernelcache_img3+4A6�j
N88AP_iBoot:4FF162CC ; LoadImage_kernelcache_img3+4BA�j
N88AP_iBoot:4FF162CC 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF162CE 0C4 LDR.W R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF162D2 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF162D4 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF162D8 0C4 CBZ R0, loc_4FF162FA ; Compare and Branch on Zero
N88AP_iBoot:4FF162DA 0C4 LDR.W R3, =aSerialNumber ; "serial-number"
N88AP_iBoot:4FF162DE 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF162E0 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF162E2 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF162E4 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF162E6 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF162E8 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF162EC 0C4 CBZ R0, loc_4FF162FA ; Compare and Branch on Zero
N88AP_iBoot:4FF162EE 0C4 LDR.W R0, ='SrNm' ; Load from Memory
N88AP_iBoot:4FF162F2 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF162F4 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF162F6 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF162FA
N88AP_iBoot:4FF162FA loc_4FF162FA ; CODE XREF: LoadImage_kernelcache_img3+4D4�j
N88AP_iBoot:4FF162FA ; LoadImage_kernelcache_img3+4E8�j
N88AP_iBoot:4FF162FA 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF162FC 0C4 LDR.W R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF16300 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16302 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16306 0C4 CBZ R0, loc_4FF16328 ; Compare and Branch on Zero
N88AP_iBoot:4FF16308 0C4 LDR.W R3, =aMlbSerialNumber ; "mlb-serial-number"
N88AP_iBoot:4FF1630C 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1630E 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16310 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16312 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16314 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16316 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1631A 0C4 CBZ R0, loc_4FF16328 ; Compare and Branch on Zero
N88AP_iBoot:4FF1631C 0C4 LDR.W R0, ='MLB#' ; Load from Memory
N88AP_iBoot:4FF16320 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16322 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16324 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF16328
N88AP_iBoot:4FF16328 loc_4FF16328 ; CODE XREF: LoadImage_kernelcache_img3+502�j
N88AP_iBoot:4FF16328 ; LoadImage_kernelcache_img3+516�j
N88AP_iBoot:4FF16328 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF1632A 0C4 LDR.W R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF1632E 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16330 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16334 0C4 CBZ R0, loc_4FF16356 ; Compare and Branch on Zero
N88AP_iBoot:4FF16336 0C4 LDR.W R3, =aConfigNumber ; "config-number"
N88AP_iBoot:4FF1633A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1633C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1633E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16340 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16342 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16344 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16348 0C4 CBZ R0, loc_4FF16356 ; Compare and Branch on Zero
N88AP_iBoot:4FF1634A 0C4 LDR.W R0, ='CFG#' ; Load from Memory
N88AP_iBoot:4FF1634E 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16350 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16352 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF16356
N88AP_iBoot:4FF16356 loc_4FF16356 ; CODE XREF: LoadImage_kernelcache_img3+530�j
N88AP_iBoot:4FF16356 ; LoadImage_kernelcache_img3+544�j
N88AP_iBoot:4FF16356 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16358 0C4 LDR.W R1, =aPram ; "pram"
N88AP_iBoot:4FF1635C 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1635E 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16362 0C4 CBZ R0, loc_4FF16388 ; Compare and Branch on Zero
N88AP_iBoot:4FF16364 0C4 LDR.W R3, =aReg ; "reg"
N88AP_iBoot:4FF16368 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1636A 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1636C 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1636E 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16370 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16372 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16376 0C4 CBZ R0, loc_4FF16388 ; Compare and Branch on Zero
N88AP_iBoot:4FF16378 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1637A 0C4 LDR.W R2, =0x4FFFC000 ; Load from Memory
N88AP_iBoot:4FF1637E 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16380 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16382 0C4 MOV.W R2, #0x4000 ; Rd = Op2
N88AP_iBoot:4FF16386 0C4 STR R2, [R3,#4] ; Store to Memory
N88AP_iBoot:4FF16388
N88AP_iBoot:4FF16388 loc_4FF16388 ; CODE XREF: LoadImage_kernelcache_img3+55E�j
N88AP_iBoot:4FF16388 ; LoadImage_kernelcache_img3+572�j
N88AP_iBoot:4FF16388 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF1638A 0C4 LDR.W R1, =aVram ; "vram"
N88AP_iBoot:4FF1638E 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16390 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16394 0C4 CBZ R0, loc_4FF163BC ; Compare and Branch on Zero
N88AP_iBoot:4FF16396 0C4 LDR.W R3, =aReg ; "reg"
N88AP_iBoot:4FF1639A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1639C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1639E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF163A0 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF163A2 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF163A4 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF163A8 0C4 CBZ R0, loc_4FF163BC ; Compare and Branch on Zero
N88AP_iBoot:4FF163AA 0C4 LDR.W R2, =dword_4FF2CD0C ; Load from Memory
N88AP_iBoot:4FF163AE 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF163B0 0C4 LDR R1, [R2] ; Load from Memory
N88AP_iBoot:4FF163B2 0C4 RSB.W R2, R1, #0x50000000 ; Rd = Op2 - Op1
N88AP_iBoot:4FF163B6 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF163B8 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF163BA 0C4 STR R1, [R3,#4] ; Store to Memory
N88AP_iBoot:4FF163BC
N88AP_iBoot:4FF163BC loc_4FF163BC ; CODE XREF: LoadImage_kernelcache_img3+590�j
N88AP_iBoot:4FF163BC ; LoadImage_kernelcache_img3+5A4�j
N88AP_iBoot:4FF163BC 0C4 LDR.W R0, =aNetworkType ; "network-type"
N88AP_iBoot:4FF163C0 0C4 BL sub_4FF1CD9C ; Branch with Link
N88AP_iBoot:4FF163C4 0C4 CBZ R0, loc_4FF163D4 ; Compare and Branch on Zero
N88AP_iBoot:4FF163C6 0C4 LDR.W R1, =aEthernet ; "ethernet"
N88AP_iBoot:4FF163CA 0C4 BL sub_4FF1ECA0 ; Branch with Link
N88AP_iBoot:4FF163CE 0C4 CBZ R0, loc_4FF163D4 ; Compare and Branch on Zero
N88AP_iBoot:4FF163D0 0C4 MOVS R6, #1 ; Rd = Op2
N88AP_iBoot:4FF163D2 0C4 B loc_4FF163D6 ; Branch
N88AP_iBoot:4FF163D4 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF163D4
N88AP_iBoot:4FF163D4 loc_4FF163D4 ; CODE XREF: LoadImage_kernelcache_img3+5C0�j
N88AP_iBoot:4FF163D4 ; LoadImage_kernelcache_img3+5CA�j
N88AP_iBoot:4FF163D4 0C4 MOVS R6, #0 ; Rd = Op2
N88AP_iBoot:4FF163D6
N88AP_iBoot:4FF163D6 loc_4FF163D6 ; CODE XREF: LoadImage_kernelcache_img3+5CE�j
N88AP_iBoot:4FF163D6 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF163D8 0C4 LDR.W R1, =aChosen ; "chosen"
N88AP_iBoot:4FF163DC 0C4 ADD R2, SP, #0xC4+var_64 ; Rd = Op1 + Op2
N88AP_iBoot:4FF163DE 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF163E2 0C4 CBNZ R0, loc_4FF163EE ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF163E4 0C4 LDR.W R0, =aUpdatedevicetreeFailedToFindTheChosenNode ; "UpdateDeviceTree: failed to find the /c"...
N88AP_iBoot:4FF163E8 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF163EC 0C4 B loc_4FF16AD4 ; Branch
N88AP_iBoot:4FF163EE ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF163EE
N88AP_iBoot:4FF163EE loc_4FF163EE ; CODE XREF: LoadImage_kernelcache_img3+5DE�j
N88AP_iBoot:4FF163EE 0C4 LDR.W R3, =aDebugEnabled ; "debug-enabled"
N88AP_iBoot:4FF163F2 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF163F4 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF163F6 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF163F8 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF163FA 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF163FC 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16400 0C4 CBZ R0, loc_4FF16410 ; Compare and Branch on Zero
N88AP_iBoot:4FF16402 0C4 MOVS R0, #0x20 ; ' ' ; Rd = Op2
N88AP_iBoot:4FF16404 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF16408 0C4 CBZ R0, loc_4FF16410 ; Compare and Branch on Zero
N88AP_iBoot:4FF1640A 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1640C 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF1640E 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16410
N88AP_iBoot:4FF16410 loc_4FF16410 ; CODE XREF: LoadImage_kernelcache_img3+5FC�j
N88AP_iBoot:4FF16410 ; LoadImage_kernelcache_img3+604�j
N88AP_iBoot:4FF16410 0C4 LDR.W R3, =aDevelopmentCert ; "development-cert"
N88AP_iBoot:4FF16414 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF16416 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16418 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1641A 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1641C 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1641E 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16422 0C4 CBZ R0, loc_4FF16434 ; Compare and Branch on Zero
N88AP_iBoot:4FF16424 0C4 MOV.W R0, #BlackRa1n__iPhoneTypeInfo ; Rd = Op2
N88AP_iBoot:4FF16428 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF1642C 0C4 CBZ R0, loc_4FF16434 ; Compare and Branch on Zero
N88AP_iBoot:4FF1642E 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16430 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF16432 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16434
N88AP_iBoot:4FF16434 loc_4FF16434 ; CODE XREF: LoadImage_kernelcache_img3+61E�j
N88AP_iBoot:4FF16434 ; LoadImage_kernelcache_img3+628�j
N88AP_iBoot:4FF16434 0C4 LDR.W R3, =aProductionCert ; "production-cert"
N88AP_iBoot:4FF16438 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF1643A 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1643C 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1643E 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16440 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16442 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16446 0C4 CBZ R0, loc_4FF16458 ; Compare and Branch on Zero
N88AP_iBoot:4FF16448 0C4 MOV.W R0, #0x200000 ; Rd = Op2
N88AP_iBoot:4FF1644C 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF16450 0C4 CBZ R0, loc_4FF16458 ; Compare and Branch on Zero
N88AP_iBoot:4FF16452 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16454 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF16456 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16458
N88AP_iBoot:4FF16458 loc_4FF16458 ; CODE XREF: LoadImage_kernelcache_img3+642�j
N88AP_iBoot:4FF16458 ; LoadImage_kernelcache_img3+64C�j
N88AP_iBoot:4FF16458 0C4 LDR.W R3, =aGidAesKey ; "gid-aes-key"
N88AP_iBoot:4FF1645C 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF1645E 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16460 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16462 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16464 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16466 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1646A 0C4 CBZ R0, loc_4FF1647C ; Compare and Branch on Zero
N88AP_iBoot:4FF1646C 0C4 MOV.W R0, #0x40000 ; Rd = Op2
N88AP_iBoot:4FF16470 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF16474 0C4 CBZ R0, loc_4FF1647C ; Compare and Branch on Zero
N88AP_iBoot:4FF16476 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16478 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF1647A 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF1647C
N88AP_iBoot:4FF1647C loc_4FF1647C ; CODE XREF: LoadImage_kernelcache_img3+666�j
N88AP_iBoot:4FF1647C ; LoadImage_kernelcache_img3+670�j
N88AP_iBoot:4FF1647C 0C4 LDR.W R3, =aUidAesKey ; "uid-aes-key"
N88AP_iBoot:4FF16480 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF16482 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16484 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16486 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16488 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1648A 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1648E 0C4 CBZ R0, loc_4FF164A0 ; Compare and Branch on Zero
N88AP_iBoot:4FF16490 0C4 MOV.W R0, #0x80000 ; Rd = Op2
N88AP_iBoot:4FF16494 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF16498 0C4 CBZ R0, loc_4FF164A0 ; Compare and Branch on Zero
N88AP_iBoot:4FF1649A 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1649C 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF1649E 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF164A0
N88AP_iBoot:4FF164A0 loc_4FF164A0 ; CODE XREF: LoadImage_kernelcache_img3+68A�j
N88AP_iBoot:4FF164A0 ; LoadImage_kernelcache_img3+694�j
N88AP_iBoot:4FF164A0 0C4 LDR.W R3, =aSecureBoot ; "secure-boot"
N88AP_iBoot:4FF164A4 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF164A6 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF164A8 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF164AA 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF164AC 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF164AE 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF164B2 0C4 CBZ R0, loc_4FF164C4 ; Compare and Branch on Zero
N88AP_iBoot:4FF164B4 0C4 MOV.W R0, #0x10000000 ; Rd = Op2
N88AP_iBoot:4FF164B8 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF164BC 0C4 CBZ R0, loc_4FF164C4 ; Compare and Branch on Zero
N88AP_iBoot:4FF164BE 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF164C0 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF164C2 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF164C4
N88AP_iBoot:4FF164C4 loc_4FF164C4 ; CODE XREF: LoadImage_kernelcache_img3+6AE�j
N88AP_iBoot:4FF164C4 ; LoadImage_kernelcache_img3+6B8�j
N88AP_iBoot:4FF164C4 0C4 LDR R3, =aSoftwareBehavior ; "software-behavior"
N88AP_iBoot:4FF164C6 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF164C8 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF164CA 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF164CC 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF164CE 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF164D0 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF164D4 0C4 CBZ R0, loc_4FF164E0 ; Compare and Branch on Zero
N88AP_iBoot:4FF164D6 0C4 LDR R0, ='SwBh' ; Load from Memory
N88AP_iBoot:4FF164D8 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF164DA 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF164DC 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF164E0
N88AP_iBoot:4FF164E0 loc_4FF164E0 ; CODE XREF: LoadImage_kernelcache_img3+6D0�j
N88AP_iBoot:4FF164E0 0C4 LDR R3, =aSystemTrusted ; "system-trusted"
N88AP_iBoot:4FF164E2 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF164E4 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF164E6 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF164E8 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF164EA 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF164EC 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF164F0 0C4 CBZ R0, loc_4FF16502 ; Compare and Branch on Zero
N88AP_iBoot:4FF164F2 0C4 MOV.W R0, #0x20000000 ; Rd = Op2
N88AP_iBoot:4FF164F6 0C4 BL sub_4FF19FAC ; Branch with Link
N88AP_iBoot:4FF164FA 0C4 CBZ R0, loc_4FF16502 ; Compare and Branch on Zero
N88AP_iBoot:4FF164FC 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF164FE 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF16500 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16502
N88AP_iBoot:4FF16502 loc_4FF16502 ; CODE XREF: LoadImage_kernelcache_img3+6EC�j
N88AP_iBoot:4FF16502 ; LoadImage_kernelcache_img3+6F6�j
N88AP_iBoot:4FF16502 0C4 LDR R3, =aBoardId ; "board-id"
N88AP_iBoot:4FF16504 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF16506 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16508 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1650A 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1650C 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1650E 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16512 0C4 CBZ R0, loc_4FF1651C ; Compare and Branch on Zero
N88AP_iBoot:4FF16514 0C4 LDR R4, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16516 0C4 BL sub_4FF184E4 ; Branch with Link
N88AP_iBoot:4FF1651A 0C4 STR R0, [R4] ; Store to Memory
N88AP_iBoot:4FF1651C
N88AP_iBoot:4FF1651C loc_4FF1651C ; CODE XREF: LoadImage_kernelcache_img3+70E�j
N88AP_iBoot:4FF1651C 0C4 LDR R3, =aChipId ; "chip-id"
N88AP_iBoot:4FF1651E 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF16520 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16522 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16524 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16526 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16528 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1652C 0C4 CBZ R0, loc_4FF16536 ; Compare and Branch on Zero
N88AP_iBoot:4FF1652E 0C4 LDR R4, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16530 0C4 BL sub_4FF1F8F8 ; Branch with Link
N88AP_iBoot:4FF16534 0C4 STR R0, [R4] ; Store to Memory
N88AP_iBoot:4FF16536
N88AP_iBoot:4FF16536 loc_4FF16536 ; CODE XREF: LoadImage_kernelcache_img3+728�j
N88AP_iBoot:4FF16536 0C4 LDR R3, =aUniqueChipId ; "unique-chip-id"
N88AP_iBoot:4FF16538 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF1653A 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1653C 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1653E 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16540 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16542 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16546 0C4 CBZ R0, loc_4FF16552 ; Compare and Branch on Zero
N88AP_iBoot:4FF16548 0C4 LDR R4, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1654A 0C4 BL sub_4FF1F904 ; Branch with Link
N88AP_iBoot:4FF1654E 0C4 STMIA.W R4, {R0,R1} ; Store Block to Memory
N88AP_iBoot:4FF16552
N88AP_iBoot:4FF16552 loc_4FF16552 ; CODE XREF: LoadImage_kernelcache_img3+742�j
N88AP_iBoot:4FF16552 0C4 LDR R3, =aFirmwareVersion ; "firmware-version"
N88AP_iBoot:4FF16554 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF16556 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16558 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1655A 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1655C 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1655E 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16562 0C4 CBZ R0, loc_4FF1656E ; Compare and Branch on Zero
N88AP_iBoot:4FF16564 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16566 0C4 LDR R1, =aIboot636_66 ; "iBoot-636.66"
N88AP_iBoot:4FF16568 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF1656A 0C4 BL sub_4FF1ED1C ; Branch with Link
N88AP_iBoot:4FF1656E
N88AP_iBoot:4FF1656E loc_4FF1656E ; CODE XREF: LoadImage_kernelcache_img3+75E�j
N88AP_iBoot:4FF1656E 0C4 LDR R3, =aBootpResponse ; "bootp-response"
N88AP_iBoot:4FF16570 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF16572 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16574 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16576 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16578 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1657A 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1657E 0C4 CBZ R0, loc_4FF165E2 ; Compare and Branch on Zero
N88AP_iBoot:4FF16580 0C4 LDR R4, =dword_4FF2CD18 ; Load from Memory
N88AP_iBoot:4FF16582 0C4 ADD R1, SP, #0xC4+var_74 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16584 0C4 MOV.W R10, #2 ; Rd = Op2
N88AP_iBoot:4FF16588 0C4 LDR R0, =aIpaddr ; "ipaddr"
N88AP_iBoot:4FF1658A 0C4 STRB.W R10, [R4] ; Store to Memory
N88AP_iBoot:4FF1658E 0C4 MOVS R3, #0 ; Rd = Op2
N88AP_iBoot:4FF16590 0C4 STR R3, [SP,#0xC4+var_74] ; Store to Memory
N88AP_iBoot:4FF16592 0C4 BL sub_4FF1D170 ; Branch with Link
N88AP_iBoot:4FF16596 0C4 ADD.W R0, R4, #0x10 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1659A 0C4 ADD R1, SP, #0xC4+var_74 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1659C 0C4 MOVS R2, #4 ; Rd = Op2
N88AP_iBoot:4FF1659E 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF165A2 0C4 LDR R0, =aGateway ; "gateway"
N88AP_iBoot:4FF165A4 0C4 BL sub_4FF1CD9C ; Branch with Link
N88AP_iBoot:4FF165A8 0C4 CBZ R0, loc_4FF165D6 ; Compare and Branch on Zero
N88AP_iBoot:4FF165AA 0C4 ADD R1, SP, #0xC4+var_74 ; Rd = Op1 + Op2
N88AP_iBoot:4FF165AC 0C4 LDR R0, =aGateway ; "gateway"
N88AP_iBoot:4FF165AE 0C4 BL sub_4FF1D170 ; Branch with Link
N88AP_iBoot:4FF165B2 0C4 LDR R1, =dword_4FF25954 ; Load from Memory
N88AP_iBoot:4FF165B4 0C4 MOVS R2, #4 ; Rd = Op2
N88AP_iBoot:4FF165B6 0C4 ADD.W R0, R4, #0xEC ; Rd = Op1 + Op2
N88AP_iBoot:4FF165BA 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF165BE 0C4 LDR R1, =dword_4FF2595C ; Load from Memory
N88AP_iBoot:4FF165C0 0C4 MOV R2, R10 ; Rd = Op2
N88AP_iBoot:4FF165C2 0C4 ADD.W R0, R4, #0xF0 ; Rd = Op1 + Op2
N88AP_iBoot:4FF165C6 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF165CA 0C4 ADD.W R0, R4, #0xF2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF165CE 0C4 ADD R1, SP, #0xC4+var_74 ; Rd = Op1 + Op2
N88AP_iBoot:4FF165D0 0C4 MOVS R2, #4 ; Rd = Op2
N88AP_iBoot:4FF165D2 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF165D6
N88AP_iBoot:4FF165D6 loc_4FF165D6 ; CODE XREF: LoadImage_kernelcache_img3+7A4�j
N88AP_iBoot:4FF165D6 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF165D8 0C4 MOV R1, R4 ; Rd = Op2
N88AP_iBoot:4FF165DA 0C4 MOV.W R2, #0x12C ; Rd = Op2
N88AP_iBoot:4FF165DE 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF165E2
N88AP_iBoot:4FF165E2 loc_4FF165E2 ; CODE XREF: LoadImage_kernelcache_img3+77A�j
N88AP_iBoot:4FF165E2 0C4 LDR R0, =n88ap__iBOOT__gBootArgs.commandLine ; Load from Memory
N88AP_iBoot:4FF165E4 0C4 LDR R1, =aRd_1 ; "rd="
N88AP_iBoot:4FF165E6 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF165E8 0C4 BL sub_4FF15CE8 ; Branch with Link
N88AP_iBoot:4FF165EC 0C4 CBNZ R0, loc_4FF1660C ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF165EE 0C4 LDR R3, =aRootMatching ; "root-matching"
N88AP_iBoot:4FF165F0 0C4 LDR R0, [SP,#0xC4+var_64] ; Load from Memory
N88AP_iBoot:4FF165F2 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF165F4 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF165F6 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF165F8 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF165FA 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF165FE 0C4 CBZ R0, loc_4FF1660C ; Compare and Branch on Zero
N88AP_iBoot:4FF16600 0C4 LDR R0, [SP,#0xC4+param_R2] ; param_R2
N88AP_iBoot:4FF16602 0C4 LDR R1, [SP,#0xC4+param_R3] ; param_R3
N88AP_iBoot:4FF16604 0C4 LDR R2, =aDictKeyIoproviderclassKeyStringIomediaStringK ; "<dict><key>IOProviderClass</key><string"...
N88AP_iBoot:4FF16606 0C4 MOVS R3, #1 ; Rd = Op2
N88AP_iBoot:4FF16608 0C4 BL sub_4FF1EC48 ; Branch with Link
N88AP_iBoot:4FF1660C
N88AP_iBoot:4FF1660C loc_4FF1660C ; CODE XREF: LoadImage_kernelcache_img3+7E8�j
N88AP_iBoot:4FF1660C ; LoadImage_kernelcache_img3+7FA�j
N88AP_iBoot:4FF1660C 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF1660E 0C4 LDR R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF16610 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16612 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16616 0C4 CBZ R0, loc_4FF16634 ; Compare and Branch on Zero
N88AP_iBoot:4FF16618 0C4 LDR R3, =aPlatformName ; "platform-name"
N88AP_iBoot:4FF1661A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1661C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1661E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16620 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16622 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16624 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16628 0C4 CBZ R0, loc_4FF16634 ; Compare and Branch on Zero
N88AP_iBoot:4FF1662A 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1662C 0C4 LDR R1, =aS5l8920x ; "s5l8920x"
N88AP_iBoot:4FF1662E 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16630 0C4 BL sub_4FF1ED1C ; Branch with Link
N88AP_iBoot:4FF16634
N88AP_iBoot:4FF16634 loc_4FF16634 ; CODE XREF: LoadImage_kernelcache_img3+812�j
N88AP_iBoot:4FF16634 ; LoadImage_kernelcache_img3+824�j
N88AP_iBoot:4FF16634 0C4 ADD.W R0, SP, #0xC4+var_7E ; Rd = Op1 + Op2
N88AP_iBoot:4FF16638 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF1663A 0C4 MOVS R2, #6 ; Rd = Op2
N88AP_iBoot:4FF1663C 0C4 BLX sub_4FF1ED54 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF16640 0C4 LDR R0, =aEthaddr ; "ethaddr"
N88AP_iBoot:4FF16642 0C4 BL sub_4FF1CD9C ; Branch with Link
N88AP_iBoot:4FF16646 0C4 CBZ R0, loc_4FF16654 ; Compare and Branch on Zero
N88AP_iBoot:4FF16648 0C4 ADD.W R1, SP, #0xC4+var_7E ; Rd = Op1 + Op2
N88AP_iBoot:4FF1664C 0C4 LDR R0, =aEthaddr ; "ethaddr"
N88AP_iBoot:4FF1664E 0C4 BL sub_4FF1D0C4 ; Branch with Link
N88AP_iBoot:4FF16652 0C4 B loc_4FF16664 ; Branch
N88AP_iBoot:4FF16654 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16654
N88AP_iBoot:4FF16654 loc_4FF16654 ; CODE XREF: LoadImage_kernelcache_img3+842�j
N88AP_iBoot:4FF16654 0C4 STR R0, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF16656 0C4 MOVS R0, #6 ; Rd = Op2
N88AP_iBoot:4FF16658 0C4 ADD.W R1, SP, #0xC4+var_7E ; Rd = Op1 + Op2
N88AP_iBoot:4FF1665C 0C4 MOV R2, R0 ; Rd = Op2
N88AP_iBoot:4FF1665E 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16660 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF16664
N88AP_iBoot:4FF16664 loc_4FF16664 ; CODE XREF: LoadImage_kernelcache_img3+84E�j
N88AP_iBoot:4FF16664 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16666 0C4 LDR R1, =dword_4FF214E8 ; Load from Memory
N88AP_iBoot:4FF16668 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1666A 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF1666E 0C4 CBZ R0, loc_4FF1668E ; Compare and Branch on Zero
N88AP_iBoot:4FF16670 0C4 LDR R3, =aLocalMacAddress ; "local-mac-address"
N88AP_iBoot:4FF16672 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16674 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16676 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16678 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1667A 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1667C 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16680 0C4 CBZ R0, loc_4FF1668E ; Compare and Branch on Zero
N88AP_iBoot:4FF16682 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16684 0C4 ADD.W R1, SP, #0xC4+var_7E ; Rd = Op1 + Op2
N88AP_iBoot:4FF16688 0C4 MOVS R2, #6 ; Rd = Op2
N88AP_iBoot:4FF1668A 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF1668E
N88AP_iBoot:4FF1668E loc_4FF1668E ; CODE XREF: LoadImage_kernelcache_img3+86A�j
N88AP_iBoot:4FF1668E ; LoadImage_kernelcache_img3+87C�j
N88AP_iBoot:4FF1668E 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16690 0C4 LDR R1, =aEthernet ; "ethernet"
N88AP_iBoot:4FF16692 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16694 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16698 0C4 CBZ R0, loc_4FF166DC ; Compare and Branch on Zero
N88AP_iBoot:4FF1669A 0C4 LDR R3, =aLocalMacAddress ; "local-mac-address"
N88AP_iBoot:4FF1669C 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1669E 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF166A0 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF166A2 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166A4 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166A6 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF166AA 0C4 CBZ R0, loc_4FF166DC ; Compare and Branch on Zero
N88AP_iBoot:4FF166AC 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF166AE 0C4 ADD.W R1, SP, #0xC4+var_7E ; Rd = Op1 + Op2
N88AP_iBoot:4FF166B2 0C4 MOVS R2, #6 ; Rd = Op2
N88AP_iBoot:4FF166B4 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF166B8 0C4 CBZ R6, loc_4FF166DC ; Compare and Branch on Zero
N88AP_iBoot:4FF166BA 0C4 LDR R3, =aCompatible ; "compatible"
N88AP_iBoot:4FF166BC 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF166BE 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF166C0 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF166C2 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166C4 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166C6 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF166CA 0C4 CBZ R0, loc_4FF166DC ; Compare and Branch on Zero
N88AP_iBoot:4FF166CC 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF166CE 0C4 LDR R1, =aXxx ; "xxx"
N88AP_iBoot:4FF166D0 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF166D2 0C4 BL sub_4FF1ED1C ; Branch with Link
N88AP_iBoot:4FF166D6 0C4 LDR R0, =aEthernetDisabled ; "Ethernet disabled\n"
N88AP_iBoot:4FF166D8 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF166DC
N88AP_iBoot:4FF166DC loc_4FF166DC ; CODE XREF: LoadImage_kernelcache_img3+894�j
N88AP_iBoot:4FF166DC ; LoadImage_kernelcache_img3+8A6�j
N88AP_iBoot:4FF166DC ; LoadImage_kernelcache_img3+8B4�j
N88AP_iBoot:4FF166DC ; LoadImage_kernelcache_img3+8C6�j
N88AP_iBoot:4FF166DC 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF166DE 0C4 LDR R1, =aArmIoSdio ; "arm-io/sdio"
N88AP_iBoot:4FF166E0 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166E2 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF166E6 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF166E8 0C4 BEQ loc_4FF16768 ; Branch
N88AP_iBoot:4FF166EA 0C4 LDR R3, =aLocalMacAddress ; "local-mac-address"
N88AP_iBoot:4FF166EC 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF166EE 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF166F0 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF166F2 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166F4 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF166F6 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF166FA 0C4 CBZ R0, loc_4FF1671C ; Compare and Branch on Zero
N88AP_iBoot:4FF166FC 0C4 LDR R0, =aWifiaddr ; "wifiaddr"
N88AP_iBoot:4FF166FE 0C4 BL sub_4FF1CD9C ; Branch with Link
N88AP_iBoot:4FF16702 0C4 CBZ R0, loc_4FF1670E ; Compare and Branch on Zero
N88AP_iBoot:4FF16704 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16706 0C4 LDR R0, =aWifiaddr ; "wifiaddr"
N88AP_iBoot:4FF16708 0C4 BL sub_4FF1D0C4 ; Branch with Link
N88AP_iBoot:4FF1670C 0C4 B loc_4FF1671C ; Branch
N88AP_iBoot:4FF1670E ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF1670E
N88AP_iBoot:4FF1670E loc_4FF1670E ; CODE XREF: LoadImage_kernelcache_img3+8FE�j
N88AP_iBoot:4FF1670E 0C4 STR R0, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF16710 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16712 0C4 MOVS R0, #1 ; Rd = Op2
N88AP_iBoot:4FF16714 0C4 MOVS R2, #6 ; Rd = Op2
N88AP_iBoot:4FF16716 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16718 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF1671C
N88AP_iBoot:4FF1671C loc_4FF1671C ; CODE XREF: LoadImage_kernelcache_img3+8F6�j
N88AP_iBoot:4FF1671C ; LoadImage_kernelcache_img3+908�j
N88AP_iBoot:4FF1671C 0C4 LDR R3, =aTxCalibration ; "tx-calibration"
N88AP_iBoot:4FF1671E 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16720 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16722 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16724 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16726 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16728 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1672C 0C4 CBZ R0, loc_4FF16746 ; Compare and Branch on Zero
N88AP_iBoot:4FF1672E 0C4 LDR R0, =aInstallingWifiCalibration ; "Installing WIFI Calibration\n"
N88AP_iBoot:4FF16730 0C4 MOVS R3, #0 ; param_R3
N88AP_iBoot:4FF16732 0C4 STR R3, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF16734 0C4 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF16738 0C4 MOVS R0, #2 ; Rd = Op2
N88AP_iBoot:4FF1673A 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1673C 0C4 MOV.W R2, #0x400 ; Rd = Op2
N88AP_iBoot:4FF16740 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16742 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF16746
N88AP_iBoot:4FF16746 loc_4FF16746 ; CODE XREF: LoadImage_kernelcache_img3+928�j
N88AP_iBoot:4FF16746 0C4 LDR R3, =aVendorId ; "vendor-id"
N88AP_iBoot:4FF16748 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1674A 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1674C 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF1674E 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16750 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16752 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16756 0C4 CBZ R0, loc_4FF16768 ; Compare and Branch on Zero
N88AP_iBoot:4FF16758 0C4 MOVS R3, #0 ; Rd = Op2
N88AP_iBoot:4FF1675A 0C4 MOVS R0, #3 ; Rd = Op2
N88AP_iBoot:4FF1675C 0C4 STR R3, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF1675E 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16760 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16762 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16764 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF16768
N88AP_iBoot:4FF16768 loc_4FF16768 ; CODE XREF: LoadImage_kernelcache_img3+8E4�j
N88AP_iBoot:4FF16768 ; LoadImage_kernelcache_img3+952�j
N88AP_iBoot:4FF16768 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF1676A 0C4 LDR R1, =aArmIoUart3Bluetooth ; "arm-io/uart3/bluetooth"
N88AP_iBoot:4FF1676C 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1676E 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16772 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16774 0C4 BEQ.W loc_4FF16960 ; Branch
N88AP_iBoot:4FF16778 0C4 LDR R3, =aLocalMacAddress ; "local-mac-address"
N88AP_iBoot:4FF1677A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1677C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1677E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16780 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16782 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16784 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16788 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF1678A 0C4 BEQ.W loc_4FF1693E ; Branch
N88AP_iBoot:4FF1678E 0C4 LDR R0, =aBtaddr ; "btaddr"
N88AP_iBoot:4FF16790 0C4 BL sub_4FF1CD9C ; Branch with Link
N88AP_iBoot:4FF16794 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16796 0C4 BEQ.W loc_4FF16930 ; Branch
N88AP_iBoot:4FF1679A 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF1679C 0C4 LDR R0, =aBtaddr ; "btaddr"
N88AP_iBoot:4FF1679E 0C4 BL sub_4FF1D0C4 ; Branch with Link
N88AP_iBoot:4FF167A2 0C4 B loc_4FF1693E ; Branch
N88AP_iBoot:4FF167A2 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF167A4 0C4 off_4FF167A4 DCD dword_4FF2A308 ; DATA XREF: LoadImage_kernelcache_img3+A�r
N88AP_iBoot:4FF167A8 ; int off_4FF167A8
N88AP_iBoot:4FF167A8 0C4 off_4FF167A8 DCD aKernelcacheImageCorrupt
N88AP_iBoot:4FF167A8 ; DATA XREF: LoadImage_kernelcache_img3+1C�r
N88AP_iBoot:4FF167A8 ; "Kernelcache image corrupt\n"
N88AP_iBoot:4FF167AC ; int off_4FF167AC
N88AP_iBoot:4FF167AC 0C4 off_4FF167AC DCD aKernelcacheTooLarge
N88AP_iBoot:4FF167AC ; DATA XREF: LoadImage_kernelcache_img3+34�r
N88AP_iBoot:4FF167AC ; "Kernelcache too large\n"
N88AP_iBoot:4FF167B0 ; char *dword_4FF167B0
N88AP_iBoot:4FF167B0 0C4 dword_4FF167B0 DCD 'krnl' ; DATA XREF: LoadImage_kernelcache_img3+48�r
N88AP_iBoot:4FF167B4 ; int off_4FF167B4
N88AP_iBoot:4FF167B4 0C4 off_4FF167B4 DCD aKernelcacheImageNotValid
N88AP_iBoot:4FF167B4 ; DATA XREF: LoadImage_kernelcache_img3+60�r
N88AP_iBoot:4FF167B4 ; "Kernelcache image not valid\n"
N88AP_iBoot:4FF167B8 0C4 dword_4FF167B8 DCD 'comp' ; DATA XREF: LoadImage_kernelcache_img3+78�r
N88AP_iBoot:4FF167BC ; int dword_4FF167BC
N88AP_iBoot:4FF167BC 0C4 dword_4FF167BC DCD 'lzss' ; DATA XREF: LoadImage_kernelcache_img3+94�r
N88AP_iBoot:4FF167C0 0C4 off_4FF167C0 DCD aUnknownKernelcacheCompressionType
N88AP_iBoot:4FF167C0 ; DATA XREF: LoadImage_kernelcache_img3+9C�r
N88AP_iBoot:4FF167C0 ; "unknown kernelcache compression type\n"
N88AP_iBoot:4FF167C4 ; int off_4FF167C4
N88AP_iBoot:4FF167C4 0C4 off_4FF167C4 DCD aLoadingKernelCacheAtX___
N88AP_iBoot:4FF167C4 ; DATA XREF: LoadImage_kernelcache_img3+A8�r
N88AP_iBoot:4FF167C4 ; "Loading kernel cache at %#x..."
N88AP_iBoot:4FF167C8 ; int off_4FF167C8
N88AP_iBoot:4FF167C8 0C4 off_4FF167C8 DCD aDataStartsAtP ; DATA XREF: LoadImage_kernelcache_img3+B2�r
N88AP_iBoot:4FF167C8 ; "data starts at %p\n"
N88AP_iBoot:4FF167CC 0C4 off_4FF167CC DCD aUncompressedSizeTooLargeUMaxD
N88AP_iBoot:4FF167CC ; DATA XREF: LoadImage_kernelcache_img3+E8�r
N88AP_iBoot:4FF167CC ; "uncompressed size too large %u, max %d\n"...
N88AP_iBoot:4FF167D0 ; int off_4FF167D0
N88AP_iBoot:4FF167D0 0C4 off_4FF167D0 DCD aSizeMismatchFromLzssDShouldBeD
N88AP_iBoot:4FF167D0 ; DATA XREF: LoadImage_kernelcache_img3+108�r
N88AP_iBoot:4FF167D0 ; "size mismatch from lzss %d, should be %"...
N88AP_iBoot:4FF167D4 ; int off_4FF167D4
N88AP_iBoot:4FF167D4 0C4 off_4FF167D4 DCD aAdlerMismatch ; DATA XREF: LoadImage_kernelcache_img3+128�r
N88AP_iBoot:4FF167D4 ; "adler mismatch\n"
N88AP_iBoot:4FF167D8 ; int off_4FF167D8
N88AP_iBoot:4FF167D8 0C4 off_4FF167D8 DCD aDone ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF15F36�r
N88AP_iBoot:4FF167D8 ; "done\n"
N88AP_iBoot:4FF167DC ; int dword_4FF167DC
N88AP_iBoot:4FF167DC 0C4 dword_4FF167DC DCD 0xFEEDFACE ; DATA XREF: LoadImage_kernelcache_img3+148�r
N88AP_iBoot:4FF167E0 ; int off_4FF167E0
N88AP_iBoot:4FF167E0 0C4 off_4FF167E0 DCD aLoad_macho_imageFailedToLoadDeviceTree
N88AP_iBoot:4FF167E0 ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF15F62�r
N88AP_iBoot:4FF167E0 ; "load_macho_image: failed to load device"...
N88AP_iBoot:4FF167E4 0C4 off_4FF167E4 DCD dword_4FF2CD04 ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF15F6E�r
N88AP_iBoot:4FF167E4 ; LoadImage_kernelcache_img3+3FC�r
N88AP_iBoot:4FF167E4 ; LoadImage_kernelcache_img3+410�r
N88AP_iBoot:4FF167E4 ; LoadImage_kernelcache_img3+424�r
N88AP_iBoot:4FF167E8 0C4 off_4FF167E8 DCD dword_4FF2CD10 ; DATA XREF: LoadImage_kernelcache_img3+178�r
N88AP_iBoot:4FF167E8 ; LoadImage_kernelcache_img3+1BC�r
N88AP_iBoot:4FF167EC 0C4 off_4FF167EC DCD dword_4FF2CBCC ; DATA XREF: LoadImage_kernelcache_img3+1A4�r
N88AP_iBoot:4FF167EC ; LoadImage_kernelcache_img3+1A8�r
N88AP_iBoot:4FF167EC ; LoadImage_kernelcache_img3:loc_4FF1607C�r
N88AP_iBoot:4FF167EC ; LoadImage_kernelcache_img3+27C�r
N88AP_iBoot:4FF167EC ; LoadImage_kernelcache_img3+2B2�r ...
N88AP_iBoot:4FF167F0 0C4 off_4FF167F0 DCD a__pagezero ; DATA XREF: LoadImage_kernelcache_img3+1D0�r
N88AP_iBoot:4FF167F0 ; "__PAGEZERO"
N88AP_iBoot:4FF167F4 0C4 off_4FF167F4 DCD aKernelS ; DATA XREF: LoadImage_kernelcache_img3+1F4�r
N88AP_iBoot:4FF167F4 ; "Kernel-%s"
N88AP_iBoot:4FF167F8 0C4 off_4FF167F8 DCD a__prelink ; DATA XREF: LoadImage_kernelcache_img3+212�r
N88AP_iBoot:4FF167F8 ; "__PRELINK"
N88AP_iBoot:4FF167FC 0C4 off_4FF167FC DCD dword_4FF2CD14 ; DATA XREF: LoadImage_kernelcache_img3+21C�r
N88AP_iBoot:4FF16800 0C4 off_4FF16800 DCD dword_4FF2CBC8 ; DATA XREF: LoadImage_kernelcache_img3+28E�r
N88AP_iBoot:4FF16804 0C4 off_4FF16804 DCD dword_4FF2A03C ; DATA XREF: LoadImage_kernelcache_img3+2B6�r
N88AP_iBoot:4FF16804 ; LoadImage_kernelcache_img3+452�r
N88AP_iBoot:4FF16808 0C4 off_4FF16808 DCD dword_4FF214E8 ; DATA XREF: LoadImage_kernelcache_img3+2BC�r
N88AP_iBoot:4FF16808 ; LoadImage_kernelcache_img3+46E�r
N88AP_iBoot:4FF16808 ; LoadImage_kernelcache_img3+49C�r
N88AP_iBoot:4FF16808 ; LoadImage_kernelcache_img3+4CA�r
N88AP_iBoot:4FF16808 ; LoadImage_kernelcache_img3+4F8�r ...
N88AP_iBoot:4FF1680C 0C4 off_4FF1680C DCD aRdMd0NandEnableReformat1Progress
N88AP_iBoot:4FF1680C ; DATA XREF: LoadImage_kernelcache_img3+2C6�r
N88AP_iBoot:4FF1680C ; "rd=md0 nand-enable-reformat=1 -progress"...
N88AP_iBoot:4FF16810 0C4 dword_4FF16810 DCD 'Teth' ; DATA XREF: LoadImage_kernelcache_img3+2CA�r
N88AP_iBoot:4FF16814 0C4 off_4FF16814 DCD aIsTethered ; DATA XREF: LoadImage_kernelcache_img3+2EA�r
N88AP_iBoot:4FF16814 ; LoadImage_kernelcache_img3:loc_4FF160FA�r
N88AP_iBoot:4FF16814 ; "is-tethered"
N88AP_iBoot:4FF16818 ; int off_4FF16818
N88AP_iBoot:4FF16818 0C4 off_4FF16818 DCD n88ap__iBOOT__gBootArgs.commandLine
N88AP_iBoot:4FF16818 ; DATA XREF: LoadImage_kernelcache_img3+302�r
N88AP_iBoot:4FF16818 ; LoadImage_kernelcache_img3:loc_4FF16114�r
N88AP_iBoot:4FF16818 ; LoadImage_kernelcache_img3+322�r
N88AP_iBoot:4FF16818 ; LoadImage_kernelcache_img3+330�r
N88AP_iBoot:4FF16818 ; LoadImage_kernelcache_img3+340�r ...
N88AP_iBoot:4FF1681C 0C4 off_4FF1681C DCD aSForceUsbPower1 ; DATA XREF: LoadImage_kernelcache_img3+306�r
N88AP_iBoot:4FF1681C ; "%s force-usb-power=1 "
N88AP_iBoot:4FF16820 0C4 off_4FF16820 DCD aS_2 ; DATA XREF: LoadImage_kernelcache_img3+314�r
N88AP_iBoot:4FF16820 ; "%s "
N88AP_iBoot:4FF16824 ; int off_4FF16824
N88AP_iBoot:4FF16824 0C4 off_4FF16824 DCD aGbootargs_commandlineS
N88AP_iBoot:4FF16824 ; DATA XREF: LoadImage_kernelcache_img3+326�r
N88AP_iBoot:4FF16824 ; "gBootArgs.commandLine = [%s]\n"
N88AP_iBoot:4FF16828 0C4 off_4FF16828 DCD aS_3 ; DATA XREF: LoadImage_kernelcache_img3+334�r
N88AP_iBoot:4FF16828 ; "-s"
N88AP_iBoot:4FF1682C 0C4 off_4FF1682C DCD aV_1 ; DATA XREF: LoadImage_kernelcache_img3+344�r
N88AP_iBoot:4FF1682C ; "-v"
N88AP_iBoot:4FF16830 0C4 off_4FF16830 DCD aDebug ; DATA XREF: LoadImage_kernelcache_img3+35A�r
N88AP_iBoot:4FF16830 ; "debug="
N88AP_iBoot:4FF16834 0C4 off_4FF16834 DCD aForceUsbPower1 ; DATA XREF: LoadImage_kernelcache_img3+36E�r
N88AP_iBoot:4FF16834 ; "force-usb-power=1"
N88AP_iBoot:4FF16838 0C4 off_4FF16838 DCD dword_4FF2A148 ; DATA XREF: LoadImage_kernelcache_img3+37A�r
N88AP_iBoot:4FF1683C 0C4 off_4FF1683C DCD dword_4FF2CD0C ; DATA XREF: LoadImage_kernelcache_img3+398�r
N88AP_iBoot:4FF1683C ; LoadImage_kernelcache_img3+3C0�r
N88AP_iBoot:4FF1683C ; LoadImage_kernelcache_img3+3CE�r
N88AP_iBoot:4FF1683C ; LoadImage_kernelcache_img3+3D8�r
N88AP_iBoot:4FF1683C ; LoadImage_kernelcache_img3+5A6�r
N88AP_iBoot:4FF16840 0C4 off_4FF16840 DCD aVramSize ; DATA XREF: LoadImage_kernelcache_img3+3AE�r
N88AP_iBoot:4FF16840 ; "vram-size"
N88AP_iBoot:4FF16844 0C4 off_4FF16844 DCD dword_4FF2CD08 ; DATA XREF: LoadImage_kernelcache_img3+3E2�r
N88AP_iBoot:4FF16844 ; LoadImage_kernelcache_img3+402�r
N88AP_iBoot:4FF16844 ; LoadImage_kernelcache_img3+420�r
N88AP_iBoot:4FF16848 0C4 off_4FF16848 DCD aDevicetree ; DATA XREF: LoadImage_kernelcache_img3+428�r
N88AP_iBoot:4FF16848 ; "DeviceTree"
N88AP_iBoot:4FF1684C 0C4 off_4FF1684C DCD dword_4FF2A040 ; DATA XREF: LoadImage_kernelcache_img3+43A�r
N88AP_iBoot:4FF16850 0C4 off_4FF16850 DCD aRamdisk ; DATA XREF: LoadImage_kernelcache_img3+462�r
N88AP_iBoot:4FF16850 ; "RAMDisk"
N88AP_iBoot:4FF16854 0C4 off_4FF16854 DCD aModelNumber ; DATA XREF: LoadImage_kernelcache_img3+47A�r
N88AP_iBoot:4FF16854 ; "model-number"
N88AP_iBoot:4FF16858 0C4 dword_4FF16858 DCD 'Mod#' ; DATA XREF: LoadImage_kernelcache_img3+48E�r
N88AP_iBoot:4FF1685C 0C4 off_4FF1685C DCD aRegionInfo ; DATA XREF: LoadImage_kernelcache_img3+4A8�r
N88AP_iBoot:4FF1685C ; "region-info"
N88AP_iBoot:4FF16860 0C4 dword_4FF16860 DCD 'Regn' ; DATA XREF: LoadImage_kernelcache_img3+4BC�r
N88AP_iBoot:4FF16864 0C4 off_4FF16864 DCD aSerialNumber ; DATA XREF: LoadImage_kernelcache_img3+4D6�r
N88AP_iBoot:4FF16864 ; "serial-number"
N88AP_iBoot:4FF16868 0C4 dword_4FF16868 DCD 'SrNm' ; DATA XREF: LoadImage_kernelcache_img3+4EA�r
N88AP_iBoot:4FF1686C 0C4 off_4FF1686C DCD aMlbSerialNumber ; DATA XREF: LoadImage_kernelcache_img3+504�r
N88AP_iBoot:4FF1686C ; "mlb-serial-number"
N88AP_iBoot:4FF16870 0C4 dword_4FF16870 DCD 'MLB#' ; DATA XREF: LoadImage_kernelcache_img3+518�r
N88AP_iBoot:4FF16874 0C4 off_4FF16874 DCD aConfigNumber ; DATA XREF: LoadImage_kernelcache_img3+532�r
N88AP_iBoot:4FF16874 ; "config-number"
N88AP_iBoot:4FF16878 0C4 dword_4FF16878 DCD 'CFG#' ; DATA XREF: LoadImage_kernelcache_img3+546�r
N88AP_iBoot:4FF1687C 0C4 off_4FF1687C DCD aPram ; DATA XREF: LoadImage_kernelcache_img3+554�r
N88AP_iBoot:4FF1687C ; "pram"
N88AP_iBoot:4FF16880 0C4 off_4FF16880 DCD aReg ; DATA XREF: LoadImage_kernelcache_img3+560�r
N88AP_iBoot:4FF16880 ; LoadImage_kernelcache_img3+592�r
N88AP_iBoot:4FF16880 ; "reg"
N88AP_iBoot:4FF16884 0C4 off_4FF16884 DCD 0x4FFFC000 ; DATA XREF: LoadImage_kernelcache_img3+576�r
N88AP_iBoot:4FF16888 0C4 off_4FF16888 DCD aVram ; DATA XREF: LoadImage_kernelcache_img3+586�r
N88AP_iBoot:4FF16888 ; "vram"
N88AP_iBoot:4FF1688C 0C4 off_4FF1688C DCD aNetworkType ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF163BC�r
N88AP_iBoot:4FF1688C ; "network-type"
N88AP_iBoot:4FF16890 0C4 off_4FF16890 DCD aEthernet ; DATA XREF: LoadImage_kernelcache_img3+5C2�r
N88AP_iBoot:4FF16890 ; LoadImage_kernelcache_img3+88C�r
N88AP_iBoot:4FF16890 ; "ethernet"
N88AP_iBoot:4FF16894 0C4 off_4FF16894 DCD aChosen ; DATA XREF: LoadImage_kernelcache_img3+5D4�r
N88AP_iBoot:4FF16894 ; "chosen"
N88AP_iBoot:4FF16898 ; int off_4FF16898
N88AP_iBoot:4FF16898 0C4 off_4FF16898 DCD aUpdatedevicetreeFailedToFindTheChosenNode
N88AP_iBoot:4FF16898 ; DATA XREF: LoadImage_kernelcache_img3+5E0�r
N88AP_iBoot:4FF16898 ; "UpdateDeviceTree: failed to find the /c"...
N88AP_iBoot:4FF1689C 0C4 off_4FF1689C DCD aDebugEnabled ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF163EE�r
N88AP_iBoot:4FF1689C ; "debug-enabled"
N88AP_iBoot:4FF168A0 0C4 off_4FF168A0 DCD aDevelopmentCert ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16410�r
N88AP_iBoot:4FF168A0 ; "development-cert"
N88AP_iBoot:4FF168A4 0C4 off_4FF168A4 DCD aProductionCert ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16434�r
N88AP_iBoot:4FF168A4 ; "production-cert"
N88AP_iBoot:4FF168A8 0C4 off_4FF168A8 DCD aGidAesKey ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16458�r
N88AP_iBoot:4FF168A8 ; "gid-aes-key"
N88AP_iBoot:4FF168AC 0C4 off_4FF168AC DCD aUidAesKey ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF1647C�r
N88AP_iBoot:4FF168AC ; "uid-aes-key"
N88AP_iBoot:4FF168B0 0C4 off_4FF168B0 DCD aSecureBoot ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF164A0�r
N88AP_iBoot:4FF168B0 ; "secure-boot"
N88AP_iBoot:4FF168B4 0C4 off_4FF168B4 DCD aSoftwareBehavior ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF164C4�r
N88AP_iBoot:4FF168B4 ; "software-behavior"
N88AP_iBoot:4FF168B8 0C4 dword_4FF168B8 DCD 'SwBh' ; DATA XREF: LoadImage_kernelcache_img3+6D2�r
N88AP_iBoot:4FF168BC 0C4 off_4FF168BC DCD aSystemTrusted ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF164E0�r
N88AP_iBoot:4FF168BC ; "system-trusted"
N88AP_iBoot:4FF168C0 0C4 off_4FF168C0 DCD aBoardId ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16502�r
N88AP_iBoot:4FF168C0 ; "board-id"
N88AP_iBoot:4FF168C4 0C4 off_4FF168C4 DCD aChipId ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF1651C�r
N88AP_iBoot:4FF168C4 ; "chip-id"
N88AP_iBoot:4FF168C8 0C4 off_4FF168C8 DCD aUniqueChipId ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16536�r
N88AP_iBoot:4FF168C8 ; "unique-chip-id"
N88AP_iBoot:4FF168CC 0C4 off_4FF168CC DCD aFirmwareVersion ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16552�r
N88AP_iBoot:4FF168CC ; "firmware-version"
N88AP_iBoot:4FF168D0 0C4 off_4FF168D0 DCD aIboot636_66 ; DATA XREF: LoadImage_kernelcache_img3+762�r
N88AP_iBoot:4FF168D0 ; "iBoot-636.66"
N88AP_iBoot:4FF168D4 0C4 off_4FF168D4 DCD aBootpResponse ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF1656E�r
N88AP_iBoot:4FF168D4 ; "bootp-response"
N88AP_iBoot:4FF168D8 0C4 off_4FF168D8 DCD dword_4FF2CD18 ; DATA XREF: LoadImage_kernelcache_img3+77C�r
N88AP_iBoot:4FF168DC 0C4 off_4FF168DC DCD aIpaddr ; DATA XREF: LoadImage_kernelcache_img3+784�r
N88AP_iBoot:4FF168DC ; "ipaddr"
N88AP_iBoot:4FF168E0 0C4 off_4FF168E0 DCD aGateway ; DATA XREF: LoadImage_kernelcache_img3+79E�r
N88AP_iBoot:4FF168E0 ; LoadImage_kernelcache_img3+7A8�r
N88AP_iBoot:4FF168E0 ; "gateway"
N88AP_iBoot:4FF168E4 0C4 off_4FF168E4 DCD dword_4FF25954 ; DATA XREF: LoadImage_kernelcache_img3+7AE�r
N88AP_iBoot:4FF168E8 0C4 off_4FF168E8 DCD dword_4FF2595C ; DATA XREF: LoadImage_kernelcache_img3+7BA�r
N88AP_iBoot:4FF168EC 0C4 off_4FF168EC DCD aRd_1 ; DATA XREF: LoadImage_kernelcache_img3+7E0�r
N88AP_iBoot:4FF168EC ; "rd="
N88AP_iBoot:4FF168F0 0C4 off_4FF168F0 DCD aRootMatching ; DATA XREF: LoadImage_kernelcache_img3+7EA�r
N88AP_iBoot:4FF168F0 ; "root-matching"
N88AP_iBoot:4FF168F4 0C4 off_4FF168F4 DCD aDictKeyIoproviderclassKeyStringIomediaStringK
N88AP_iBoot:4FF168F4 ; DATA XREF: LoadImage_kernelcache_img3+800�r
N88AP_iBoot:4FF168F4 ; "<dict><key>IOProviderClass</key><string"...
N88AP_iBoot:4FF168F8 0C4 off_4FF168F8 DCD aPlatformName ; DATA XREF: LoadImage_kernelcache_img3+814�r
N88AP_iBoot:4FF168F8 ; "platform-name"
N88AP_iBoot:4FF168FC 0C4 off_4FF168FC DCD aS5l8920x ; DATA XREF: LoadImage_kernelcache_img3+828�r
N88AP_iBoot:4FF168FC ; "s5l8920x"
N88AP_iBoot:4FF16900 0C4 off_4FF16900 DCD aEthaddr ; DATA XREF: LoadImage_kernelcache_img3+83C�r
N88AP_iBoot:4FF16900 ; LoadImage_kernelcache_img3+848�r
N88AP_iBoot:4FF16900 ; "ethaddr"
N88AP_iBoot:4FF16904 0C4 off_4FF16904 DCD aLocalMacAddress ; DATA XREF: LoadImage_kernelcache_img3+86C�r
N88AP_iBoot:4FF16904 ; LoadImage_kernelcache_img3+896�r
N88AP_iBoot:4FF16904 ; LoadImage_kernelcache_img3+8E6�r
N88AP_iBoot:4FF16904 ; LoadImage_kernelcache_img3+974�r
N88AP_iBoot:4FF16904 ; "local-mac-address"
N88AP_iBoot:4FF16908 0C4 off_4FF16908 DCD aCompatible ; DATA XREF: LoadImage_kernelcache_img3+8B6�r
N88AP_iBoot:4FF16908 ; "compatible"
N88AP_iBoot:4FF1690C 0C4 off_4FF1690C DCD aXxx ; DATA XREF: LoadImage_kernelcache_img3+8CA�r
N88AP_iBoot:4FF1690C ; "xxx"
N88AP_iBoot:4FF16910 ; int off_4FF16910
N88AP_iBoot:4FF16910 0C4 off_4FF16910 DCD aEthernetDisabled ; DATA XREF: LoadImage_kernelcache_img3+8D2�r
N88AP_iBoot:4FF16910 ; "Ethernet disabled\n"
N88AP_iBoot:4FF16914 0C4 off_4FF16914 DCD aArmIoSdio ; DATA XREF: LoadImage_kernelcache_img3+8DA�r
N88AP_iBoot:4FF16914 ; "arm-io/sdio"
N88AP_iBoot:4FF16918 0C4 off_4FF16918 DCD aWifiaddr ; DATA XREF: LoadImage_kernelcache_img3+8F8�r
N88AP_iBoot:4FF16918 ; LoadImage_kernelcache_img3+902�r
N88AP_iBoot:4FF16918 ; "wifiaddr"
N88AP_iBoot:4FF1691C 0C4 off_4FF1691C DCD aTxCalibration ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF1671C�r
N88AP_iBoot:4FF1691C ; "tx-calibration"
N88AP_iBoot:4FF16920 ; int off_4FF16920
N88AP_iBoot:4FF16920 0C4 off_4FF16920 DCD aInstallingWifiCalibration
N88AP_iBoot:4FF16920 ; DATA XREF: LoadImage_kernelcache_img3+92A�r
N88AP_iBoot:4FF16920 ; "Installing WIFI Calibration\n"
N88AP_iBoot:4FF16924 0C4 off_4FF16924 DCD aVendorId ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16746�r
N88AP_iBoot:4FF16924 ; "vendor-id"
N88AP_iBoot:4FF16928 0C4 off_4FF16928 DCD aArmIoUart3Bluetooth
N88AP_iBoot:4FF16928 ; DATA XREF: LoadImage_kernelcache_img3+966�r
N88AP_iBoot:4FF16928 ; "arm-io/uart3/bluetooth"
N88AP_iBoot:4FF1692C 0C4 off_4FF1692C DCD aBtaddr ; DATA XREF: LoadImage_kernelcache_img3+98A�r
N88AP_iBoot:4FF1692C ; LoadImage_kernelcache_img3+998�r
N88AP_iBoot:4FF1692C ; "btaddr"
N88AP_iBoot:4FF16930 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16930
N88AP_iBoot:4FF16930 loc_4FF16930 ; CODE XREF: LoadImage_kernelcache_img3+992�j
N88AP_iBoot:4FF16930 0C4 STR R0, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF16932 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16934 0C4 MOVS R0, #4 ; Rd = Op2
N88AP_iBoot:4FF16936 0C4 MOVS R2, #6 ; Rd = Op2
N88AP_iBoot:4FF16938 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1693A 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF1693E
N88AP_iBoot:4FF1693E loc_4FF1693E ; CODE XREF: LoadImage_kernelcache_img3+986�j
N88AP_iBoot:4FF1693E ; LoadImage_kernelcache_img3+99E�j
N88AP_iBoot:4FF1693E 0C4 LDR R3, =aVendorId ; "vendor-id"
N88AP_iBoot:4FF16940 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16942 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16944 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16946 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16948 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1694A 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1694E 0C4 CBZ R0, loc_4FF16960 ; Compare and Branch on Zero
N88AP_iBoot:4FF16950 0C4 MOVS R3, #0 ; Rd = Op2
N88AP_iBoot:4FF16952 0C4 MOVS R0, #5 ; Rd = Op2
N88AP_iBoot:4FF16954 0C4 STR R3, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF16956 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16958 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF1695A 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1695C 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF16960
N88AP_iBoot:4FF16960 loc_4FF16960 ; CODE XREF: LoadImage_kernelcache_img3+970�j
N88AP_iBoot:4FF16960 ; LoadImage_kernelcache_img3+B4A�j
N88AP_iBoot:4FF16960 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16962 0C4 LDR R1, =aBaseband ; "baseband"
N88AP_iBoot:4FF16964 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16966 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF1696A 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF1696C 0C4 BEQ loc_4FF169CC ; Branch
N88AP_iBoot:4FF1696E 0C4 LDR R3, =aBatteryId ; "battery-id"
N88AP_iBoot:4FF16970 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16972 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16974 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16976 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16978 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF1697A 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF1697E 0C4 CBZ R0, loc_4FF16988 ; Compare and Branch on Zero
N88AP_iBoot:4FF16980 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16982 0C4 LDR R1, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16984 0C4 BL sub_4FF10090 ; Branch with Link
N88AP_iBoot:4FF16988
N88AP_iBoot:4FF16988 loc_4FF16988 ; CODE XREF: LoadImage_kernelcache_img3+B7A�j
N88AP_iBoot:4FF16988 0C4 LDR R3, =aDeviceImei ; "device-imei"
N88AP_iBoot:4FF1698A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF1698C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF1698E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16990 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16992 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16994 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16998 0C4 CBZ R0, loc_4FF169AA ; Compare and Branch on Zero
N88AP_iBoot:4FF1699A 0C4 MOVS R3, #0 ; Rd = Op2
N88AP_iBoot:4FF1699C 0C4 MOVS R0, #7 ; Rd = Op2
N88AP_iBoot:4FF1699E 0C4 STR R3, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF169A0 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF169A2 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF169A4 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169A6 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF169AA
N88AP_iBoot:4FF169AA loc_4FF169AA ; CODE XREF: LoadImage_kernelcache_img3+B94�j
N88AP_iBoot:4FF169AA 0C4 LDR R3, =aSnum ; "snum"
N88AP_iBoot:4FF169AC 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF169AE 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF169B0 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF169B2 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169B4 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169B6 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF169BA 0C4 CBZ R0, loc_4FF169CC ; Compare and Branch on Zero
N88AP_iBoot:4FF169BC 0C4 MOVS R3, #0 ; Rd = Op2
N88AP_iBoot:4FF169BE 0C4 MOVS R0, #8 ; Rd = Op2
N88AP_iBoot:4FF169C0 0C4 STR R3, [SP,#0xC4+var_78] ; Store to Memory
N88AP_iBoot:4FF169C2 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF169C4 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF169C6 0C4 ADD R3, SP, #0xC4+var_78 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169C8 0C4 BL sub_4FF1A638 ; Branch with Link
N88AP_iBoot:4FF169CC
N88AP_iBoot:4FF169CC loc_4FF169CC ; CODE XREF: LoadImage_kernelcache_img3+B68�j
N88AP_iBoot:4FF169CC ; LoadImage_kernelcache_img3+BB6�j
N88AP_iBoot:4FF169CC 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF169CE 0C4 LDR R1, =aCharger ; "charger"
N88AP_iBoot:4FF169D0 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169D2 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF169D6 0C4 CBZ R0, loc_4FF16A0C ; Compare and Branch on Zero
N88AP_iBoot:4FF169D8 0C4 LDR R3, =aBatteryId ; "battery-id"
N88AP_iBoot:4FF169DA 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF169DC 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF169DE 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF169E0 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169E2 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169E4 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF169E8 0C4 CBZ R0, loc_4FF169F2 ; Compare and Branch on Zero
N88AP_iBoot:4FF169EA 0C4 LDR R0, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF169EC 0C4 LDR R1, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF169EE 0C4 BL sub_4FF10090 ; Branch with Link
N88AP_iBoot:4FF169F2
N88AP_iBoot:4FF169F2 loc_4FF169F2 ; CODE XREF: LoadImage_kernelcache_img3+BE4�j
N88AP_iBoot:4FF169F2 0C4 LDR R3, =aBootVoltage ; "boot-voltage"
N88AP_iBoot:4FF169F4 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF169F6 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF169F8 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF169FA 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169FC 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF169FE 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16A02 0C4 CBZ R0, loc_4FF16A0C ; Compare and Branch on Zero
N88AP_iBoot:4FF16A04 0C4 LDR R4, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16A06 0C4 BL sub_4FF04B90 ; Branch with Link
N88AP_iBoot:4FF16A0A 0C4 STR R0, [R4] ; Store to Memory
N88AP_iBoot:4FF16A0C
N88AP_iBoot:4FF16A0C loc_4FF16A0C ; CODE XREF: LoadImage_kernelcache_img3+BD2�j
N88AP_iBoot:4FF16A0C ; LoadImage_kernelcache_img3+BFE�j
N88AP_iBoot:4FF16A0C 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16A0E 0C4 LDR R1, =aArmIoSpi1MultiTouch ; "arm-io/spi1/multi-touch"
N88AP_iBoot:4FF16A10 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A12 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16A16 0C4 CBZ R0, loc_4FF16A50 ; Compare and Branch on Zero
N88AP_iBoot:4FF16A18 0C4 LDR R3, =aMultiTouchCalibration ; "multi-touch-calibration"
N88AP_iBoot:4FF16A1A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16A1C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A1E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16A20 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A22 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A24 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16A28 0C4 CBZ R0, loc_4FF16A34 ; Compare and Branch on Zero
N88AP_iBoot:4FF16A2A 0C4 LDR R0, ='MtCl' ; Load from Memory
N88AP_iBoot:4FF16A2C 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16A2E 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16A30 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF16A34
N88AP_iBoot:4FF16A34 loc_4FF16A34 ; CODE XREF: LoadImage_kernelcache_img3+C24�j
N88AP_iBoot:4FF16A34 0C4 LDR R3, =aProxCalibration ; "prox-calibration"
N88AP_iBoot:4FF16A36 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16A38 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A3A 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16A3C 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A3E 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A40 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16A44 0C4 CBZ R0, loc_4FF16A50 ; Compare and Branch on Zero
N88AP_iBoot:4FF16A46 0C4 LDR R0, ='PxCl' ; Load from Memory
N88AP_iBoot:4FF16A48 0C4 LDR R1, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16A4A 0C4 LDR R2, [SP,#0xC4+param_R3] ; Load from Memory
N88AP_iBoot:4FF16A4C 0C4 BL sub_4FF17C24 ; Branch with Link
N88AP_iBoot:4FF16A50
N88AP_iBoot:4FF16A50 loc_4FF16A50 ; CODE XREF: LoadImage_kernelcache_img3+C12�j
N88AP_iBoot:4FF16A50 ; LoadImage_kernelcache_img3+C40�j
N88AP_iBoot:4FF16A50 0C4 BL sub_4FF189A4 ; Branch with Link
N88AP_iBoot:4FF16A54 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16A56 0C4 BLT loc_4FF16AD4 ; Branch
N88AP_iBoot:4FF16A58 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16A5A 0C4 LDR R1, =aChosenIboot ; "chosen/iBoot"
N88AP_iBoot:4FF16A5C 0C4 ADD R2, SP, #0xC4+var_60 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A5E 0C4 BL sub_4FF13964 ; Branch with Link
N88AP_iBoot:4FF16A62 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16A64 0C4 BEQ loc_4FF16AD4 ; Branch
N88AP_iBoot:4FF16A66 0C4 BL sub_4FF19F20 ; Branch with Link
N88AP_iBoot:4FF16A6A 0C4 LDR R3, =aStartTime ; "start-time"
N88AP_iBoot:4FF16A6C 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A6E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16A70 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A72 0C4 MOV R10, R0 ; Rd = Op2
N88AP_iBoot:4FF16A74 0C4 MOV R11, R1 ; Rd = Op2
N88AP_iBoot:4FF16A76 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16A78 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A7A 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16A7E 0C4 CBZ R0, loc_4FF16A88 ; Compare and Branch on Zero
N88AP_iBoot:4FF16A80 0C4 LDR R3, =dword_4FF2DC60 ; Load from Memory
N88AP_iBoot:4FF16A82 0C4 LDR R2, [R3] ; Load from Memory
N88AP_iBoot:4FF16A84 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16A86 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16A88
N88AP_iBoot:4FF16A88 loc_4FF16A88 ; CODE XREF: LoadImage_kernelcache_img3+C7A�j
N88AP_iBoot:4FF16A88 0C4 LDR R3, =aDebugWaitStart ; "debug-wait-start"
N88AP_iBoot:4FF16A8A 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16A8C 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A8E 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16A90 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A92 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16A94 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16A98 0C4 CBZ R0, loc_4FF16AA2 ; Compare and Branch on Zero
N88AP_iBoot:4FF16A9A 0C4 LDR R3, =dword_4FF2DC48 ; Load from Memory
N88AP_iBoot:4FF16A9C 0C4 LDR R2, [R3] ; Load from Memory
N88AP_iBoot:4FF16A9E 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16AA0 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16AA2
N88AP_iBoot:4FF16AA2 loc_4FF16AA2 ; CODE XREF: LoadImage_kernelcache_img3+C94�j
N88AP_iBoot:4FF16AA2 0C4 LDR R3, =aLoadKernelStart ; "load-kernel-start"
N88AP_iBoot:4FF16AA4 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16AA6 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AA8 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16AAA 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AAC 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AAE 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16AB2 0C4 CBZ R0, loc_4FF16ABC ; Compare and Branch on Zero
N88AP_iBoot:4FF16AB4 0C4 LDR R3, =dword_4FF2DC50 ; Load from Memory
N88AP_iBoot:4FF16AB6 0C4 LDR R2, [R3] ; Load from Memory
N88AP_iBoot:4FF16AB8 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16ABA 0C4 STR R2, [R3] ; Store to Memory
N88AP_iBoot:4FF16ABC
N88AP_iBoot:4FF16ABC loc_4FF16ABC ; CODE XREF: LoadImage_kernelcache_img3+CAE�j
N88AP_iBoot:4FF16ABC 0C4 LDR R3, =aPopulateRegistryTime ; "populate-registry-time"
N88AP_iBoot:4FF16ABE 0C4 LDR R0, [SP,#0xC4+var_60] ; Load from Memory
N88AP_iBoot:4FF16AC0 0C4 ADD R1, SP, #0xC4+var_6C ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AC2 0C4 STR R3, [SP,#0xC4+var_6C] ; Store to Memory
N88AP_iBoot:4FF16AC4 0C4 ADD R2, SP, #0xC4+param_R2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AC6 0C4 ADD R3, SP, #0xC4+param_R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AC8 0C4 BL sub_4FF1390C ; Branch with Link
N88AP_iBoot:4FF16ACC 0C4 CBZ R0, loc_4FF16AD4 ; Compare and Branch on Zero
N88AP_iBoot:4FF16ACE 0C4 LDR R3, [SP,#0xC4+param_R2] ; Load from Memory
N88AP_iBoot:4FF16AD0 0C4 STR.W R10, [R3] ; Store to Memory
N88AP_iBoot:4FF16AD4
N88AP_iBoot:4FF16AD4 loc_4FF16AD4 ; CODE XREF: LoadImage_kernelcache_img3+5E8�j
N88AP_iBoot:4FF16AD4 ; LoadImage_kernelcache_img3+C52�j
N88AP_iBoot:4FF16AD4 ; LoadImage_kernelcache_img3+C60�j
N88AP_iBoot:4FF16AD4 ; LoadImage_kernelcache_img3+CC8�j
N88AP_iBoot:4FF16AD4 0C4 MOV.W R0, #0x1000 ; Rd = Op2
N88AP_iBoot:4FF16AD8 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF16ADC 0C4 LDR R3, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16ADE 0C4 LDR R4, =dword_4FF2DC40 ; Load from Memory
N88AP_iBoot:4FF16AE0 0C4 MOV.W R2, #0x1000 ; Rd = Op2
N88AP_iBoot:4FF16AE4 0C4 LDR R1, [R3,#8] ; Load from Memory
N88AP_iBoot:4FF16AE6 0C4 LDR R3, [R3,#4] ; Load from Memory
N88AP_iBoot:4FF16AE8 0C4 SUBS R1, R1, R3 ; Rd = Op1 - Op2
N88AP_iBoot:4FF16AEA 0C4 ADDS R1, R1, R0 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16AEC 0C4 LDR R0, =aBootargs ; "BootArgs"
N88AP_iBoot:4FF16AEE 0C4 STR R1, [R4] ; Store to Memory
N88AP_iBoot:4FF16AF0 0C4 BL N88AP__iBoot__AllocateMemoryRange ; Branch with Link
N88AP_iBoot:4FF16AF4 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16AF6 0C4 BL sub_4FF15CC8 ; Branch with Link
N88AP_iBoot:4FF16AFA 0C4 LDR R1, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16AFC 0C4 LDR R3, [R1,#4] ; Load from Memory
N88AP_iBoot:4FF16AFE 0C4 LDR R2, [R1,#8] ; Load from Memory
N88AP_iBoot:4FF16B00 0C4 SUBS R2, R2, R3 ; Rd = Op1 - Op2
N88AP_iBoot:4FF16B02 0C4 LDR R3, =0xFFFFC000 ; Load from Memory
N88AP_iBoot:4FF16B04 0C4 ADD.W R0, R0, #0x3000 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16B08 0C4 ANDS R0, R3 ; Rd = Op1 & Op2
N88AP_iBoot:4FF16B0A 0C4 ADD.W R3, R2, R0 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16B0E 0C4 MOV.W R2, #0x1000 ; Rd = Op2
N88AP_iBoot:4FF16B12 0C4 STR R3, [R1,#0x10] ; Store to Memory
N88AP_iBoot:4FF16B14 0C4 LDR R0, [R4] ; Load from Memory
N88AP_iBoot:4FF16B16 0C4 MOVS R1, #0 ; Rd = Op2
N88AP_iBoot:4FF16B18 0C4 BLX sub_4FF1ED54 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF16B1C 0C4 LDR R1, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16B1E 0C4 MOV.W R2, #0x138 ; Rd = Op2
N88AP_iBoot:4FF16B22 0C4 LDR R0, [R4] ; Load from Memory
N88AP_iBoot:4FF16B24 0C4 BLX sub_4FF1EE70 ; Branch with Link and Exchange (immediate address)
N88AP_iBoot:4FF16B28 0C4 LDR R0, =0x40000090 ; Load from Memory
N88AP_iBoot:4FF16B2A 0C4 BL N88AP__iBOOT__iBootSleepValid ; Branch with Link
N88AP_iBoot:4FF16B2E 0C4 LDR R3, =dword_4FF2CBC8 ; Load from Memory
N88AP_iBoot:4FF16B30 0C4 LDR R3, [R3] ; Load from Memory
N88AP_iBoot:4FF16B32 0C4 CBNZ R3, loc_4FF16B40 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF16B34
N88AP_iBoot:4FF16B34 loc_4FF16B34 ; CODE XREF: LoadImage_kernelcache_img3+166�j
N88AP_iBoot:4FF16B34 ; LoadImage_kernelcache_img3+29A�j
N88AP_iBoot:4FF16B34 0C4 MOVS R0, #1 ; Rd = Op2
N88AP_iBoot:4FF16B36 0C4 BL sub_4FF1A10C ; Branch with Link
N88AP_iBoot:4FF16B3A 0C4 MOV R0, 0xFFFFFFF9
N88AP_iBoot:4FF16B3E 0C4 B loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF16B40 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16B40
N88AP_iBoot:4FF16B40 loc_4FF16B40 ; CODE XREF: LoadImage_kernelcache_img3+D2E�j
N88AP_iBoot:4FF16B40 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16B42 0C4 STR.W R3, [R8] ; Store to Memory
N88AP_iBoot:4FF16B46 0C4 B loc_4FF16BA8 ; Branch
N88AP_iBoot:4FF16B48 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16B48
N88AP_iBoot:4FF16B48 loc_4FF16B48 ; CODE XREF: LoadImage_kernelcache_img3+8A�j
N88AP_iBoot:4FF16B48 0C4 LDR R6, [SP,#0xC4+var_58] ; Load from Memory
N88AP_iBoot:4FF16B4A 0C4 LDR R0, [R6] ; Load from Memory
N88AP_iBoot:4FF16B4C 0C4 BL sub_4FF1F408 ; Branch with Link
N88AP_iBoot:4FF16B50 0C4 CMP R0, R4 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16B52 0C4 IT NE ; If Then
N88AP_iBoot:4FF16B54 0C4 LDRNE R0, =aUnknownKernelcacheSignature ; "unknown kernelcache signature\n"
N88AP_iBoot:4FF16B56 0C4 BNE.W loc_4FF15F30 ; Branch
N88AP_iBoot:4FF16B5A 0C4 B.W loc_4FF15E92 ; Branch
N88AP_iBoot:4FF16B5E ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16B5E
N88AP_iBoot:4FF16B5E loc_4FF16B5E ; CODE XREF: LoadImage_kernelcache_img3+15A�j
N88AP_iBoot:4FF16B5E 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16B60 0C4 MOVS R2, #1 ; Rd = Op2
N88AP_iBoot:4FF16B62 0C4 MOV R1, R0 ; Rd = Op2
N88AP_iBoot:4FF16B64 0C4 BL sub_4FF19FF0 ; Branch with Link
N88AP_iBoot:4FF16B68 0C4 LDR R2, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16B6A 0C4 MOV.W R3, #1 ; Rd = Op2
N88AP_iBoot:4FF16B6E 0C4 LDR R6, [SP,#0xC4+var_58] ; Load from Memory
N88AP_iBoot:4FF16B70 0C4 STRH R3, [R2] ; Store to Memory
N88AP_iBoot:4FF16B72 0C4 BL sub_4FF1E3F8 ; Branch with Link
N88AP_iBoot:4FF16B76 0C4 LDR R1, =dword_4FF2CBCC ; Load from Memory
N88AP_iBoot:4FF16B78 0C4 MOV.W R3, #0xC0000000 ; Rd = Op2
N88AP_iBoot:4FF16B7C 0C4 STR R3, [R1,#4] ; Store to Memory
N88AP_iBoot:4FF16B7E 0C4 ADD.W R3, R3, #0x80000000 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16B82 0C4 STR R3, [R1,#8] ; Store to Memory
N88AP_iBoot:4FF16B84 0C4 ADD.W R3, R3, #0xD0000000 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16B88 0C4 STR R3, [R1,#0xC] ; Store to Memory
N88AP_iBoot:4FF16B8A 0C4 ADDS R0, #1 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16B8C 0C4 STRH R0, [R1,#2] ; Store to Memory
N88AP_iBoot:4FF16B8E 0C4 LDR R0, =dword_4FF2CD04 ; Load from Memory
N88AP_iBoot:4FF16B90 0C4 LDR R1, =dword_4FF2CD08 ; Load from Memory
N88AP_iBoot:4FF16B92 0C4 BL sub_4FF13AEC ; Branch with Link
N88AP_iBoot:4FF16B96 0C4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16B98 0C4 MOV R4, R0 ; Rd = Op2
N88AP_iBoot:4FF16B9A 0C4 BGE.W loc_4FF15F6E ; Branch
N88AP_iBoot:4FF16B9E 0C4 B.W loc_4FF15F62 ; Branch
N88AP_iBoot:4FF16BA2 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16BA2
N88AP_iBoot:4FF16BA2 loc_4FF16BA2 ; CODE XREF: LoadImage_kernelcache_img3+198�j
N88AP_iBoot:4FF16BA2 ; LoadImage_kernelcache_img3+1E0�j
N88AP_iBoot:4FF16BA2 ; LoadImage_kernelcache_img3+262�j
N88AP_iBoot:4FF16BA2 ; LoadImage_kernelcache_img3+274�j
N88AP_iBoot:4FF16BA2 ; LoadImage_kernelcache_img3+294�j
N88AP_iBoot:4FF16BA2 0C4 MOVS R0, #0 ; Rd = Op2
N88AP_iBoot:4FF16BA4 0C4 B.W loc_4FF160A2 ; Branch
N88AP_iBoot:4FF16BA8 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16BA8
N88AP_iBoot:4FF16BA8 loc_4FF16BA8 ; CODE XREF: LoadImage_kernelcache_img3+28�j
N88AP_iBoot:4FF16BA8 ; LoadImage_kernelcache_img3+40�j
N88AP_iBoot:4FF16BA8 ; LoadImage_kernelcache_img3+6C�j
N88AP_iBoot:4FF16BA8 ; LoadImage_kernelcache_img3+86�j
N88AP_iBoot:4FF16BA8 ; LoadImage_kernelcache_img3+142�j ...
N88AP_iBoot:4FF16BA8 0C4 LDR R2, [SP,#0xC4+var_24] ; Load from Memory
N88AP_iBoot:4FF16BAA 0C4 LDR R3, [R5] ; Load from Memory
N88AP_iBoot:4FF16BAC 0C4 CMP R2, R3 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16BAE 0C4 BEQ loc_4FF16BB4 ; Branch
N88AP_iBoot:4FF16BB0 0C4 BL N88AP__iBOOT____stack_chk_fail ; Branch with Link
N88AP_iBoot:4FF16BB4 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16BB4
N88AP_iBoot:4FF16BB4 loc_4FF16BB4 ; CODE XREF: LoadImage_kernelcache_img3+DAA�j
N88AP_iBoot:4FF16BB4 0C4 SUB.W SP, R7, #0x18 ; Rd = Op1 - Op2
N88AP_iBoot:4FF16BB8 0C4 POP.W {R8,R10,R11} ; Pop registers
N88AP_iBoot:4FF16BBC 0B8 POP {R4-R7,PC} ; Pop registers
N88AP_iBoot:4FF16BBC ; End of function LoadImage_kernelcache_img3
N88AP_iBoot:4FF16BBC
N88AP_iBoot:4FF16BBC ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16BBE DCW 0xBF00
N88AP_iBoot:4FF16BC0 off_4FF16BC0 DCD aVendorId ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF1693E�r
N88AP_iBoot:4FF16BC0 ; "vendor-id"
N88AP_iBoot:4FF16BC4 off_4FF16BC4 DCD aBaseband ; DATA XREF: LoadImage_kernelcache_img3+B5E�r
N88AP_iBoot:4FF16BC4 ; "baseband"
N88AP_iBoot:4FF16BC8 off_4FF16BC8 DCD aBatteryId ; DATA XREF: LoadImage_kernelcache_img3+B6A�r
N88AP_iBoot:4FF16BC8 ; LoadImage_kernelcache_img3+BD4�r
N88AP_iBoot:4FF16BC8 ; "battery-id"
N88AP_iBoot:4FF16BCC off_4FF16BCC DCD aDeviceImei ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16988�r
N88AP_iBoot:4FF16BCC ; "device-imei"
N88AP_iBoot:4FF16BD0 off_4FF16BD0 DCD aSnum ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF169AA�r
N88AP_iBoot:4FF16BD0 ; "snum"
N88AP_iBoot:4FF16BD4 off_4FF16BD4 DCD aCharger ; DATA XREF: LoadImage_kernelcache_img3+BCA�r
N88AP_iBoot:4FF16BD4 ; "charger"
N88AP_iBoot:4FF16BD8 off_4FF16BD8 DCD aBootVoltage ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF169F2�r
N88AP_iBoot:4FF16BD8 ; "boot-voltage"
N88AP_iBoot:4FF16BDC off_4FF16BDC DCD aArmIoSpi1MultiTouch
N88AP_iBoot:4FF16BDC ; DATA XREF: LoadImage_kernelcache_img3+C0A�r
N88AP_iBoot:4FF16BDC ; "arm-io/spi1/multi-touch"
N88AP_iBoot:4FF16BE0 off_4FF16BE0 DCD aMultiTouchCalibration
N88AP_iBoot:4FF16BE0 ; DATA XREF: LoadImage_kernelcache_img3+C14�r
N88AP_iBoot:4FF16BE0 ; "multi-touch-calibration"
N88AP_iBoot:4FF16BE4 dword_4FF16BE4 DCD 'MtCl' ; DATA XREF: LoadImage_kernelcache_img3+C26�r
N88AP_iBoot:4FF16BE8 off_4FF16BE8 DCD aProxCalibration ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16A34�r
N88AP_iBoot:4FF16BE8 ; "prox-calibration"
N88AP_iBoot:4FF16BEC dword_4FF16BEC DCD 'PxCl' ; DATA XREF: LoadImage_kernelcache_img3+C42�r
N88AP_iBoot:4FF16BF0 off_4FF16BF0 DCD aChosenIboot ; DATA XREF: LoadImage_kernelcache_img3+C56�r
N88AP_iBoot:4FF16BF0 ; "chosen/iBoot"
N88AP_iBoot:4FF16BF4 off_4FF16BF4 DCD aStartTime ; DATA XREF: LoadImage_kernelcache_img3+C66�r
N88AP_iBoot:4FF16BF4 ; "start-time"
N88AP_iBoot:4FF16BF8 off_4FF16BF8 DCD dword_4FF2DC60 ; DATA XREF: LoadImage_kernelcache_img3+C7C�r
N88AP_iBoot:4FF16BFC off_4FF16BFC DCD aDebugWaitStart ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16A88�r
N88AP_iBoot:4FF16BFC ; "debug-wait-start"
N88AP_iBoot:4FF16C00 off_4FF16C00 DCD dword_4FF2DC48 ; DATA XREF: LoadImage_kernelcache_img3+C96�r
N88AP_iBoot:4FF16C04 off_4FF16C04 DCD aLoadKernelStart ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16AA2�r
N88AP_iBoot:4FF16C04 ; "load-kernel-start"
N88AP_iBoot:4FF16C08 off_4FF16C08 DCD dword_4FF2DC50 ; DATA XREF: LoadImage_kernelcache_img3+CB0�r
N88AP_iBoot:4FF16C0C off_4FF16C0C DCD aPopulateRegistryTime
N88AP_iBoot:4FF16C0C ; DATA XREF: LoadImage_kernelcache_img3:loc_4FF16ABC�r
N88AP_iBoot:4FF16C0C ; "populate-registry-time"
N88AP_iBoot:4FF16C10 off_4FF16C10 DCD dword_4FF2CBCC ; DATA XREF: LoadImage_kernelcache_img3+CD8�r
N88AP_iBoot:4FF16C10 ; LoadImage_kernelcache_img3+CF6�r
N88AP_iBoot:4FF16C10 ; LoadImage_kernelcache_img3+D18�r
N88AP_iBoot:4FF16C10 ; LoadImage_kernelcache_img3+D64�r
N88AP_iBoot:4FF16C10 ; LoadImage_kernelcache_img3+D72�r
N88AP_iBoot:4FF16C14 off_4FF16C14 DCD dword_4FF2DC40 ; DATA XREF: LoadImage_kernelcache_img3+CDA�r
N88AP_iBoot:4FF16C18 off_4FF16C18 DCD aBootargs ; DATA XREF: LoadImage_kernelcache_img3+CE8�r
N88AP_iBoot:4FF16C18 ; "BootArgs"
N88AP_iBoot:4FF16C1C dword_4FF16C1C DCD 0xFFFFC000 ; DATA XREF: LoadImage_kernelcache_img3+CFE�r
N88AP_iBoot:4FF16C20 dword_4FF16C20 DCD 0x40000090 ; DATA XREF: LoadImage_kernelcache_img3+D24�r
N88AP_iBoot:4FF16C24 off_4FF16C24 DCD dword_4FF2CBC8 ; DATA XREF: LoadImage_kernelcache_img3+D2A�r
N88AP_iBoot:4FF16C28 off_4FF16C28 DCD aUnknownKernelcacheSignature
N88AP_iBoot:4FF16C28 ; DATA XREF: LoadImage_kernelcache_img3+D50�r
N88AP_iBoot:4FF16C28 ; "unknown kernelcache signature\n"
N88AP_iBoot:4FF16C2C off_4FF16C2C DCD dword_4FF2CD04 ; DATA XREF: LoadImage_kernelcache_img3+D8A�r
N88AP_iBoot:4FF16C30 off_4FF16C30 DCD dword_4FF2CD08 ; DATA XREF: LoadImage_kernelcache_img3+D8C�r
N88AP_iBoot:4FF16C34
N88AP_iBoot:4FF16C34 ; =============== S U B R O U T I N E =======================================
N88AP_iBoot:4FF16C34
N88AP_iBoot:4FF16C34
N88AP_iBoot:4FF16C34 sub_4FF16C34 ; CODE XREF: N88AP__iBoot__load_bank_partitions+6E�p
N88AP_iBoot:4FF16C34 ; N88AP__iBoot__load_bank_partitions+D0�p
N88AP_iBoot:4FF16C34 ; N88AP__iBoot__nvram_save+D2�p
N88AP_iBoot:4FF16C34 ; N88AP__iBoot__nvram_save+120�p
N88AP_iBoot:4FF16C34 ; N88AP__iBoot__nvram_save+178�p
N88AP_iBoot:4FF16C34 000 LDRB R3, [R0] ; Load from Memory
N88AP_iBoot:4FF16C36 000 ADDS R2, R0, #2 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16C38 000 ADD.W R12, R0, #0x10 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16C3C 000 B loc_4FF16C46 ; Branch
N88AP_iBoot:4FF16C3E ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16C3E
N88AP_iBoot:4FF16C3E loc_4FF16C3E ; CODE XREF: sub_4FF16C34+18�j
N88AP_iBoot:4FF16C3E 000 LDRB.W R0, [R2,#-1] ; Load from Memory
N88AP_iBoot:4FF16C42 000 ADD R0, R3 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16C44 000 UXTH R3, R0 ; Unsigned extend halfword to word
N88AP_iBoot:4FF16C46
N88AP_iBoot:4FF16C46 loc_4FF16C46 ; CODE XREF: sub_4FF16C34+8�j
N88AP_iBoot:4FF16C46 000 MOV R1, R2 ; Rd = Op2
N88AP_iBoot:4FF16C48 000 ADDS R2, #1 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16C4A 000 CMP R12, R1 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16C4C 000 BHI loc_4FF16C3E ; Branch
N88AP_iBoot:4FF16C4E 000 B loc_4FF16C58 ; Branch
N88AP_iBoot:4FF16C50 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16C50
N88AP_iBoot:4FF16C50 loc_4FF16C50 ; CODE XREF: sub_4FF16C34+26�j
N88AP_iBoot:4FF16C50 000 AND.W R2, R3, #0xFF ; Rd = Op1 & Op2
N88AP_iBoot:4FF16C54 000 ADD.W R3, R2, R3,LSR#8 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16C58
N88AP_iBoot:4FF16C58 loc_4FF16C58 ; CODE XREF: sub_4FF16C34+1A�j
N88AP_iBoot:4FF16C58 000 CMP R3, #0xFF ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16C5A 000 BHI loc_4FF16C50 ; Branch
N88AP_iBoot:4FF16C5C 000 UXTB R0, R3 ; Unsigned extend byte to word
N88AP_iBoot:4FF16C5E 000 BX LR ; Branch to/from Thumb mode
N88AP_iBoot:4FF16C5E ; End of function sub_4FF16C34
N88AP_iBoot:4FF16C5E
N88AP_iBoot:4FF16C60
N88AP_iBoot:4FF16C60 ; =============== S U B R O U T I N E =======================================
N88AP_iBoot:4FF16C60
N88AP_iBoot:4FF16C60
N88AP_iBoot:4FF16C60 sub_4FF16C60 ; CODE XREF: N88AP__iBoot__load_bank_partitions+1F2�p
N88AP_iBoot:4FF16C60 ; N88AP__iBoot__nvram_save+1B2�p
N88AP_iBoot:4FF16C60 000 PUSH {R4,LR} ; Push registers
N88AP_iBoot:4FF16C62 008 LDR.W R12, =off_4FF2A2FC ; Load from Memory
N88AP_iBoot:4FF16C66 008 LDR.W R9, =dword_4FF2CE64 ; Load from Memory
N88AP_iBoot:4FF16C6A 008 LDR.W LR, =dword_4FF2CE60 ; Load from Memory
N88AP_iBoot:4FF16C6E 008 LDR.W R3, [R12,#4] ; Load from Memory
N88AP_iBoot:4FF16C72 008 LDR.W R4, [R9] ; Load from Memory
N88AP_iBoot:4FF16C76 008 LDR.W R1, [LR] ; Load from Memory
N88AP_iBoot:4FF16C7A 008 B loc_4FF16C96 ; Branch
N88AP_iBoot:4FF16C7C ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16C7C
N88AP_iBoot:4FF16C7C loc_4FF16C7C ; CODE XREF: sub_4FF16C60+38�j
N88AP_iBoot:4FF16C7C 008 CBZ R4, loc_4FF16C86 ; Compare and Branch on Zero
N88AP_iBoot:4FF16C7E 008 LDR R0, [R3,#0x20] ; Load from Memory
N88AP_iBoot:4FF16C80 008 LDR R2, [R4,#0x20] ; Load from Memory
N88AP_iBoot:4FF16C82 008 CMP R0, R2 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16C84 008 BCS loc_4FF16C88 ; Branch
N88AP_iBoot:4FF16C86
N88AP_iBoot:4FF16C86 loc_4FF16C86 ; CODE XREF: sub_4FF16C60:loc_4FF16C7C�j
N88AP_iBoot:4FF16C86 008 MOV R4, R3 ; Rd = Op2
N88AP_iBoot:4FF16C88
N88AP_iBoot:4FF16C88 loc_4FF16C88 ; CODE XREF: sub_4FF16C60+24�j
N88AP_iBoot:4FF16C88 008 CBZ R1, loc_4FF16C92 ; Compare and Branch on Zero
N88AP_iBoot:4FF16C8A 008 LDR R0, [R3,#0x20] ; Load from Memory
N88AP_iBoot:4FF16C8C 008 LDR R2, [R1,#0x20] ; Load from Memory
N88AP_iBoot:4FF16C8E 008 CMP R0, R2 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16C90 008 BLS loc_4FF16C94 ; Branch
N88AP_iBoot:4FF16C92
N88AP_iBoot:4FF16C92 loc_4FF16C92 ; CODE XREF: sub_4FF16C60:loc_4FF16C88�j
N88AP_iBoot:4FF16C92 008 MOV R1, R3 ; Rd = Op2
N88AP_iBoot:4FF16C94
N88AP_iBoot:4FF16C94 loc_4FF16C94 ; CODE XREF: sub_4FF16C60+30�j
N88AP_iBoot:4FF16C94 008 LDR R3, [R3,#4] ; Load from Memory
N88AP_iBoot:4FF16C96
N88AP_iBoot:4FF16C96 loc_4FF16C96 ; CODE XREF: sub_4FF16C60+1A�j
N88AP_iBoot:4FF16C96 008 CMP R3, R12 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16C98 008 BNE loc_4FF16C7C ; Branch
N88AP_iBoot:4FF16C9A 008 STR.W R4, [R9] ; Store to Memory
N88AP_iBoot:4FF16C9E 008 STR.W R1, [LR] ; Store to Memory
N88AP_iBoot:4FF16CA2 008 POP {R4,PC} ; Pop registers
N88AP_iBoot:4FF16CA2 ; End of function sub_4FF16C60
N88AP_iBoot:4FF16CA2
N88AP_iBoot:4FF16CA2 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16CA4 off_4FF16CA4 DCD off_4FF2A2FC ; DATA XREF: sub_4FF16C60+2�r
N88AP_iBoot:4FF16CA8 off_4FF16CA8 DCD dword_4FF2CE64 ; DATA XREF: sub_4FF16C60+6�r
N88AP_iBoot:4FF16CAC off_4FF16CAC DCD dword_4FF2CE60 ; DATA XREF: sub_4FF16C60+A�r
N88AP_iBoot:4FF16CB0
N88AP_iBoot:4FF16CB0 ; =============== S U B R O U T I N E =======================================
N88AP_iBoot:4FF16CB0
N88AP_iBoot:4FF16CB0 ; Attributes: bp-based frame
N88AP_iBoot:4FF16CB0
N88AP_iBoot:4FF16CB0 sub_4FF16CB0 ; CODE XREF: N88AP__iBoot__load_bank_partitions+1FC�p
N88AP_iBoot:4FF16CB0 ; N88AP__iBoot__nvram_save+2C�p
N88AP_iBoot:4FF16CB0
N88AP_iBoot:4FF16CB0 oldR4 = -0x14
N88AP_iBoot:4FF16CB0 oldR5 = -0x10
N88AP_iBoot:4FF16CB0 oldR6 = -0xC
N88AP_iBoot:4FF16CB0 oldR7 = -8
N88AP_iBoot:4FF16CB0 oldLR = -4
N88AP_iBoot:4FF16CB0
N88AP_iBoot:4FF16CB0 000 PUSH {R4-R7,LR} ; Push registers
N88AP_iBoot:4FF16CB2 014 ADD R7, SP, #0xC ; Rd = Op1 + Op2
N88AP_iBoot:4FF16CB4 014 LDR R4, [R0,#0xC] ; Load from Memory
N88AP_iBoot:4FF16CB6 014 ADD.W R5, R0, #8 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16CBA 014 MOV R6, R1 ; Rd = Op2
N88AP_iBoot:4FF16CBC 014 B loc_4FF16CCC ; Branch
N88AP_iBoot:4FF16CBE ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF16CBE
N88AP_iBoot:4FF16CBE loc_4FF16CBE ; CODE XREF: sub_4FF16CB0+1E�j
N88AP_iBoot:4FF16CBE 014 ADD.W R1, R4, #0x14 ; Rd = Op1 + Op2
N88AP_iBoot:4FF16CC2 014 MOV R0, R6 ; Rd = Op2
N88AP_iBoot:4FF16CC4 014 BL sub_4FF1ECA0 ; Branch with Link
N88AP_iBoot:4FF16CC8 014 CBZ R0, loc_4FF16CD2 ; Compare and Branch on Zero
N88AP_iBoot:4FF16CCA 014 LDR R4, [R4,#4] ; Load from Memory
N88AP_iBoot:4FF16CCC
N88AP_iBoot:4FF16CCC loc_4FF16CCC ; CODE XREF: sub_4FF16CB0+C�j
N88AP_iBoot:4FF16CCC 014 CMP R4, R5 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF16CCE 014 BNE loc_4FF16CBE ; Branch
N88AP_iBoot:4FF16CD0 014 MOVS R4, #0 ; Rd = Op2
N88AP_iBoot:4FF16CD2
N88AP_iBoot:4FF16CD2 loc_4FF16CD2 ; CODE XREF: sub_4FF16CB0+18�j
N88AP_iBoot:4FF16CD2 014 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF16CD4 014 POP {R4-R7,PC} ; Pop registers
N88AP_iBoot:4FF16CD4 ; End of function sub_4FF16CB0
N88AP_iBoot:4FF16CD4

</pre>

Kernelcache loader (iBoot command)

2010-06-21T12:25:50Z

Rusmac:

Talk:S5L8930

2010-04-06T20:23:45Z

Rusmac:

==Merge?==
Should this and the A4 page be merged? They're practically the same in content. --[[User:Dialexio|Dialexio]] 17:18, 6 April 2010 (UTC)

Talk:S5L8930

2010-04-06T20:22:56Z

Rusmac:

==Merge?==
Should this and the A4 page be merged? They're practically the same in content. --[[User:Dialexio|Dialexio]] 17:18, 6 April 2010 (UTC)
I agree. [[User:Rusmac|Rusmac]] 20:22, 6 April 2010 (UTC)

A4

2010-04-05T18:02:19Z

Rusmac: it's PowerVR SGX 535, see macrumors link for more info

A4 is a SoC developed by Apple in-house chip design department. It is used in [[k48ap|iPad]].

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''RAM''': 256 MB
* '''A/V Playback''': PowerVR VXD

== Links ==
* [http://www.apple.com/ipad/specs/ iPad Technical Specifications]
* http://www.macrumors.com/2010/04/04/ipad-tech-specs-cortex-a8-256mb-ram-powervr-sgx-535/

A4

2010-04-05T08:57:48Z

Rusmac: Removed some unneeded links (since this is A8 core)

A4 is a SoC developed by Apple in-house chip design department. It is used in [[k48ap|iPad]].

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 545
* '''A/V Playback''': PowerVR VXD

== Links ==
* [http://www.apple.com/ipad/specs/ iPad Technical Specifications]

IBoot (Bootloader)

2010-02-02T20:34:54Z

Rusmac:

{{DISPLAYTITLE:iBoot}}
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Revisions ==
* [[iBoot-99]] (1A420 a.k.a. Prototype)
* [[iBoot-159]] (1.0.x)
* [[iBoot-204]] (1.1 and 1.1.1 3A109a)
* [[iBoot-204.0.2]] (1.1.1 3A110a)
* [[iBoot-204.2.9]] (1.1.2)
* [[iBoot-204.3.14]] (1.1.3 and 1.1.4)
* [[iBoot-204.3.16]] (1.1.5)
* [[iBoot-320.20]] (2.0.x)
* [[iBoot-385.22]] (2.1 and 2.1.1)
* [[iBoot-385.49]] (2.2 and 2.2.1)
* [[iBoot-596.24]] (3.0 and 3.0.1)
* [[iBoot-636.65]] (3.1 and 3.1.1)
* [[iBoot-636.66]] (3.1.1 7C146 and 3.1.2)
* [[iBoot-636.66.33]] (3.1.3)

==Commands used as an exploit vector==
* Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.
* For firmware 3.0 and 3.0.1, the [[iBoot Environment Variable Overflow]] is used by [[purplera1n]] and [[redsn0w]] (as of version 0.8) in order to flash an oversized [[LLB]] that exploits the [[0x24000 Segment Overflow]] vulnerability.
* For firmware 3.1, 3.1.1, and 3.1.2, the [[usb_control_msg(0x21, 2) Exploit]] is used by [[greenpois0n]] and [[blackra1n]] in order to flash an oversized LLB that exploits the 0x24000 Segment Overflow vulnerability.

==OpeniBoot==
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source [http://github.com/planetbeing/iphonelinux/tree/master/openiboot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.

==Remappings==
<pre>
// n88
0x4FF00000 => 0x0
0x40000000 => 0xC0000000
</pre>

== See also ==
* [[iBoot (Enums)]]

K48AP

2010-01-28T14:36:37Z

Rusmac:

[[Image:ipad_hero_20100127.jpg|thumb|right|250px|iPad]]This is the iPad. Announced on January 27, 2010. $499 for WiFi-only variant. Features 1 GHz Apple A4 CPU and 9.7" display. Runs iPhone OS 3.2.

== Application processor ==
It uses Apple-designed 1 GHz [[A4|A4]] CPU.

== Specifications ==
'''Screen:''' 1024x768px

'''Size:''' 9.56 inches (242.8 mm) (height) x 7.47 inches (189.7 mm) (width) x 0.5 inch (13.4 mm) (depth)

'''Weight:''' 1.5 pounds (0.68 kg) Wi-Fi model; 1.6 pounds (0.73 kg) Wi-Fi + 3G model

'''Battery:''' Up to 10 hours of Internet use, one month of standby

'''3G:''' UMTS/HSDPA (850, 1900, 2100 MHz), GSM/EDGE (850, 900, 1800, 1900 MHz), data only

NitroKey

2009-12-09T19:22:47Z

Rusmac:

[[NitroKey]] was a product released in late February of 2009, by the company "NitroKey," in order to aid those with a tethered jailbroken [[N72ap|iPod touch 2G]] to boot their iPods. It consisted of a small dongle that looked EXACTLY like the end of an iPod cable, with no cord on it. The product was being sold for an outrageous price of $55.00 to those unfortunate enough to have made the decision to purchase one, as it went obsolete not two weeks after its release.

They also released a stolen version of the [[24kPwn]] untethered [[N72ap|iPod Touch 2G]] jailbreak, giving Apple enough time to fix the 3rd generation iPod Touch so that it CAN NOT be directly jailbroken from its release. In addition, NitroKey's irresponsible handling gave Apple enough time to add the [[ECID]] tag to the [[IMG3 File Format|IMG3 format]] in the [[N88AP|iPhone 3GS]], preventing a permanent untethered [[jailbreak]] without a new [[iBoot]] exploit in every firmware.

NitroKey has also leaked a [[baseband]] hole which was meant to be kept in secret - [[AT+FNS]]. [http://nitrokey.com/Hash.html] The hash was posted by NitroKey one day after the exploit was found and shared with the [[dev team]] by [[User:Oranav|Oranav]], making things very suspicious. Apple has now patched the hole, needlessly burning an exploit that could have been used as an unlock vector for a future firmware.

May those bastards burn in hell for all eternity.

Bootrom 359.3.2

2009-11-21T10:50:26Z

Rusmac:

[[S5L8920]] bootrom revision for the [[N88ap|iPhone 3GS]] sold starting September 2009.

'''NOT vulnerable to the [[24kPwn]] exploit.'''

05.11.07

2009-11-10T21:03:48Z

Rusmac: New page: Vulnerable to AT+XEMN Heap Overflow exploit which is used to inject blacksn0w unlock payload.

Vulnerable to [[AT+XEMN Heap Overflow]] exploit which is used to inject [[blacksn0w]] unlock payload.

Main Page

2009-11-08T11:58:52Z

Rusmac:

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%" style="background-color:orange;"><tr>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</b></td>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></td>
</tr>
</table><br />

{{col-begin}}
{{col-2}}
{{HeadingA|Software}}
* [[/|Filesystem]]
* [[Firmware]]
* [[Keys]]
** [[AES Keys]]
** [[Apple Certificate]]
** [[Baseband RSA Keys|RSA Keys]]
** [[Baseband TEA Keys|TEA Keys]]
** [[NCK]]
* [[Protocols]]
** [[Normal Mode]]
** [[Recovery Mode (Protocols)|Recovery Mode]]
** [[Restore Mode]]
** [[DFU (Protocol)|DFU]]
** [[Baseband Bootrom Protocol]]
** [[Interactive Mode|Baseband Bootloader Protocol]]
* [[System Log|System Log (syslog)]]

{{col-2}}
{{HeadingB|Hardware}}
====iPhone====
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]

====iPod Touch====
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

====Processors====
* [[S5L8900]] ([[iPhone]], [[iPod Touch]], [[iPhone 3G]])
* [[S5L8720]] ([[iPod touch 2G]])
* [[S5L8920]] ([[N88AP|iPhone 3GS]])
* [[S5L8922]] ([[N18ap|iPod Touch 3G]])
* [[Baseband Device]]

====Other====
* [[Bluetooth]]
{{col-end}}

{{col-begin}}
{{col-2}}
{{HeadingA|Development}}
====Application Development====
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

====Application Copy Protection====
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]
* [[Defeating Cracks]]
{{col-2}}
{{HeadingB|Help}}
====Guides====
* [[Tutorials]]
* [[Useful Links]]

====Definitions====
* [[Glossary]]
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]
{{col-end}}

<table border="1" width="100%" style="background-color:orange;">
<tr>
<td colspan="4" style="background-color:orange; text-align:center;">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table>

__NOTOC____NOEDITSECTION__

Main Page

2009-11-07T21:49:03Z

Rusmac: Reverted edits by Siterapi5tpois0n (Talk); changed back to last version by Revolution

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%"><tr>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</b></td>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></td>
</tr>
<tr>
<td colspan="4">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><br />
==Software==
* [[/|Filesystem]]
* [[Firmware]]
* [[Keys]]
* [[Protocols]]
* [[System Log]]

==Hardware==
=== iPhone ===
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]

=== iPod touch ===
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

==App Processor ([[Jailbreak]])==
The [[iPhone]], [[iPod touch]], and [[iPhone 3G]] make use of the [[S5L8900]] platform as application processor. Current models, such as the [[iPod touch 2G]] and the [[N88AP|iPhone 3GS]], use newer processors. The [[S5L8720]] and [[S5L8920]] are used, respectively. The [[N18ap|iPod Touch 3G]] operates using the [[S5L8922]] application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband ([[Unlock]])==
The [[Baseband Device]] is where the [[unlock]] applies.

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Application Copy Protection==
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other==
* [[Bluetooth]]
* [[Glossary]]
* [[Tutorials]]
* [[Useful Links]]

Main Page

2009-11-06T22:03:03Z

Rusmac: Reverted edits by Chronichacker (Talk); changed back to last version by Geohot

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%"><tr>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</b></td>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></td>
</tr>
<tr>
<td colspan="4">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><br />
==Software==
* [[/|Filesystem]]
* [[Firmware]]
* [[Keys]]
* [[Protocols]]
* [[System Log]]

==Hardware==
=== iPhone ===
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]

=== iPod touch ===
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

==App Processor ([[Jailbreak]])==
The [[iPhone]], [[iPod touch]], and [[iPhone 3G]] make use of the [[S5L8900]] platform as application processor. Current models, such as the [[iPod touch 2G]] and the [[N88AP|iPhone 3GS]], use newer processors. The [[S5L8720]] and [[S5L8920]] are used, respectively. The [[N18ap|iPod Touch 3G]] operates using the [[S5L8922]] application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband ([[Unlock]])==
The [[Baseband Device]] is where the [[unlock]] applies.

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Application Copy Protection==
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other==
* [[Bluetooth]]
* [[Glossary]]
* [[Tutorials]]
* [[Useful Links]]

User:Geohot

2009-11-06T22:01:59Z

Rusmac: Reverted edits by Chronichacker (Talk); changed back to last version by Rusmac

The founder of this wiki. Published the first hardware unlock of the iPhone and software unlocked BL 4.6.

Found the [[AT+stkprof Exploit]] for baseband 02.28.00.

Found the [http://iphonejtag.blogspot.com/2009/04/58-exploit.html BL 5.8 exploit].

Found the [[iBoot Environment Variable Overflow]] exploit.

Released the [[purplera1n]], [[purplesn0w]] and [[blackra1n]] tools.

[http://iphonejtag.blogspot.com/ Blog]

[http://twitter.com/geohot Twitter]

Ramdisk Hack

2009-11-06T20:33:01Z

Rusmac: Replacing page with 'This allows unsigned ramdisks to be booted. It was first publicized by ZiPhone ==Credit== The dev team ==Exploit== Passing pmd*= boot-args specifying a ramdisk in ra...'

This allows unsigned ramdisks to be booted. It was first publicized by [[ZiPhone]]

==Credit==
[[The dev team]]

==Exploit==
Passing pmd*= boot-args specifying a ramdisk in ram > 0x9C000000 allows any ramdisk to be booted.

==Implementation==
* [[PwnageTool]]
* [[ZiPhone]]
* iPlus
* iLibertyX / [[iLiberty+]]
* iFree
* iPhone Forensics Toolkit
* iNdependence

[[Category:Jailbreaks]]
[[Category:Exploits]]

Help:Contents

2009-11-06T20:26:34Z

Rusmac: reverting vandalism

[http://en.wikipedia.org/wiki/Wikipedia:How_to_edit_a_page How to edit a page]

[http://en.wikipedia.org/wiki/Help:Editing Help for formatting text]

Please remember to read the [[Ground Rules]]

IDroid

2009-11-06T20:26:00Z

Rusmac: reverting vandalism

{{DISPLAYTITLE:iPhoneLinux}}
[[Image:Openiboot.png|thumb|right|200px|Device running the OpeniBoot console.]]
[http://iphonelinux.org iPhonelinux] is a project which goals are to port linux on the iPhone and make a Free (free software) OS alternative to the Apple proprietary "[http://en.wikipedia.org/wiki/IPhone_OS iPhone OS]".

iPhonelinux is not actually a hack/exploit neither an unlock, but it is based on the [[Pwnage]] exploit.

There are three steps in the iPhonelinux roadmap : OpeniBoot, linux kernel and long term (GUI, phone...)

== OpeniBoot ==
The Goals of OpeniBoot is to run low-level code, to have low and critical drivers (nand and nor driver, NVRAM...), debugger and development environment (chainloading, upgrading itself and USB mass storage).

== Linux ==
A linux Bootloader, a working linux kernel (just a question of cross-compiler), porting drivers, run wifi and command line thru SSH.

== Long-Term Plans ==
Multi-touch driver, Baseband driver, port X server and create an SDK.
Then have a viable alternative of the iPhone OS.

== Binaries ==

These are utility binaries precompiled on Ubuntu 8.10. They require:

- libpthread
- libncurses
- libusb
- libreadline

You may elect to build them from source by pulling from
iphonelinux/openiboot's git repository.

== Disclaimer ==

BE WARNED THAT THESE STEPS ARE NOT INTENDED FOR NOVICES. YOU ATTEMPT THIS AT
YOUR OWN RISK. AT THIS TIME, WE CANNOT AFFORD THE EFFORT REQUIRED TO GIVE
SUPPORT TO NOVICES AND/OR RESCUE THEM FROM THEIR OWN ACTIONS.

Although unlikely, if the installation goes wrong, you may have to perform a
DFU restore on your iPhone. If you do not know how to do that, you should not
follow these steps. You should also know how to use iRecovery (or similar) and
the fsboot command to "kick an iPhone out of recovery mode". If you do not
know how to do that, you should not follow these steps.

The installation of openiboot itself is safe, but openiboot has the facility
to erase device-specific information from your NOR flash. If you did not make
a backup, and execute the commands necessary to make openiboot erase that
information, it is gone forever and your device may never boot properly again.

The instructions below will show you how to make such a backup before any
changes are made.

== Installing OpeniBoot ==

=== Prerequisites ===
* Having an iPhone (first gen), iPhone 3G or an iPod 1G (the 2G iPod won't work).<br />
* Being on 2.x+ to have support IMG3 (the iPhonelinux-demo provides IMG3 files, not IMG2 files).<br />
* Being Pwned : Pwnage comes with jailbreak on 2.x+, so If you used Pwnage Tool, QuickPwn or xPwn, you are good.
* Required libraries (install as a package for Uuntu).:
** libpthread
** libncurses
** libusb
** libreadline

=== Installation ===

1. Put your iPhone in [[Recovery Mode]].

2. sudo ./loadibec openiboot-2g.img3, or -3g, -ipod, depending on your platform.

3. sudo ./oibc

4. nor_read 0x09000000 0x0 1048576

5. ~norbackup.dump:1048576. This will create a file called norbackup.dump in your current directory. GUARD IT WITH YOUR LIFE.

6. install

7. After 'install' has finished, type in: reboot.

8. You ought to see the openiboot menu.

===See===
* [[QuickOIB]]

== Booting Linux ==

Use the Hold button to navigate the menu. Push the Home button
when openiboot client is selected.
sudo ./oibc
!zImage
kernel
!rootfs.arm.ext2.gz
ramdisk 3588
boot "console=tty console=ttyUSB root=/dev/ram0 rw"
sudo ./linux

You should now get a login prompt. Nothing that's happening will show up on
the LCD automatically, but you can redirect it to the display with the
following command:

sh 2>&1 > /dev/tty0

Enjoy!

== iPhone Linux Resources ==

- Framebuffer driver
- Serial driver
- Serial over USB driver
- Interrupts, MMU, clock, etc.

=== OpeniBoot Resources ===

- Read-only support for the NAND

=== OpeniBoot Missing Resources ===

- Write support for the NAND
- Wireless networking
- Touchscreen
- Sound
- Accelerometer
- Baseband support

===QuickOIB===

[[QuickOIB]] is a tool that allows the user to temporarily install OpeniBoot in a device.
It was developed by pH and work perfectly with Mac OS X and Ubuntu 8.10

=== Support ===

The current userland we're using, in the interest of expedience, is a Busybox installation created with buildroot, but glibc works fine as well, and we're going to build a more permanent userland solution.

A demonstration video can be seen here: http://www.vimeo.com/2373142

Download here: http://localhostr.com/files/b00133/iphonelinux-demo.tar.gz

Project leader: '''planetbeing'''

Contributors: '''CPICH, cmw, poorlad, ius, saurik'''

If you're experienced with '''hacking/porting Linux''' and especially if you're experienced with porting '''Android''', I'd definitely like to hear from you. Come chill in the ''#iphonelinux'' channel on ''irc.osx86.hu'' . If you're not experienced, and still want to help, you can digg/slashdot this posting to heaven so our little project gets more visibility. Thanks. :)

App Store

2009-11-06T20:25:42Z

Rusmac: reverting vandalism

The [[App Store]] is an application for the [[iPhone]] and [[iPod touch]] designed/created by Apple. It allows users to browse and download applications, which were developed by using the [[iPhone SDK]] and published through Apple after successful review. Apple offers 70 percent of the money from the Apps go to the owner, whilst Apple retains 30 percent. The [[App Store]] first opened on July 11, 2008 through a Software Update (2.0) which was free to iPhone users but cost a small amount to iPod touch users.

PMB8878

2009-11-06T20:24:14Z

Rusmac: reverting vandalism

This is the baseband processor used in the [[iPhone 3G]] and the [[iPhone 3GS]]. It is upgraded with [[BBUpdaterExtreme]]. It is also known as the PMB8878.

==Datasheet==
Anyone got one? Infineon provides [http://www.infineon.com/dgdl/X-GOLD608_XMM6080.pdf?location=Products.Mobile_Phone_Baseband_ICs.WCDMA___HSDPA.X-GOLD__608_-_PMB_8878.PRODUCT_TYPE_DOCUMENTS.X-GOLD608_XMM6080.pdf&folderId=db3a304312fcb1bc0113000c158f0004&fileId=db3a30431936bc4b011957c66fee3850 this], which isn't really useful.

==Secpack 2.0==
This is the security region in the files sent to the [[X-Gold 608]]. This is the first 0xCF8 is new fls and eep files.

===Layout===
0x634--Memory Map
0x714--Descriptor
0xCD4--Post secpack pointer to name
0xCEC--Data length

==Endpack==
The fls and eep files also have a footer tacked onto the end containing the loader and signature.

==Memory Map==
FLASH 0x20000000 0x1000000
CODE 0x20000000 0x40000 0b0010(bootstrapper)
CODE 0x20040000 0xDC0000 0b0100(main firmware)
FFS 0x20A00000 0x100000 0b1100(empty)
DYNFFS 0x20A00000 0x100000 0b1100(empty)
FFS 0x20B00000 0x40000 0b1011(empty)
DYN_EEP 0x20E40000 0x80000 0b0110
SECPACK 0x20EC0000 0x40000
SECZONE 0x20F80000 0x40000
STATIC_EEP 0x20FC0000 0x40000 0b0111
RAM 0x40000000 0x800000

==MMU relocation table==
===Bootloader===
[[Image:Bltbl.png]]

===Firmware===
[[Image:Bbmmu.png]]

==Complete memory dump==
[http://depositfiles.com/files/i5119hpzm 0x00000000-0x0001FFFF]

[http://depositfiles.com/files/mxslfu4dp 0x20000000-0x20FFFFFF]

[http://depositfiles.com/files/6wiet73wn 0x40000000-0x407FFFFF]

[http://depositfiles.com/files/fioppsphe 0xFFFF0000-0xFFFFFFFF]

== Known Firmware Versions ==
[[1.43.00]] 2.0 (Build 5A331 - Internal Beta)
[[1.45.00]] 2.0 (Build 5A347 - Gold Master)
[[1.48.02]] 2.0.1 (Build 5B108)
[[2.04.03]] 2.1 (Build 5F90)
[[2.08.01]] 2.0.2 (Build 5C1)
[[2.11.07]] 2.1 (Build 5F136)
[[2.28.00]] 2.2 (Build 5G77)
[[2.30.03]] 2.2.1 (Build 5H11)
[[4.20.01]] 3.0 beta 1 (Build 7A238j)
[[4.22.01]] 3.0 beta 2 (Build 7A259g)
[[4.24.02]] 3.0 beta 3 (Build 7A280f)
[[4.26.08]] 3.0 (Build 7A341) and 3.0.1 (Build 7A400)
[[5.08.01]] 3.1 beta 1 (Build 7C97d)
[[5.10.01]] 3.1 beta 2 (Build 7C106c)
[[5.11.04]] 3.1 beta 3 (Build 7C116a)
[[5.11.07]] 3.1 (Build 7C144) and 3.1.2 (Build 7D11)

==Accessing [[Interactive Mode]]==
Interactive mode isn't accessed by sending characters to the baseband. Instead a GPIO pin is raised with a kernel call to preupdate reset.
result = IOConnectCallScalarMethod(conn, 0, 0, 0, 0, 0); //reset(kAppleBasebandConnectMethodResetModem)
result = IOConnectCallScalarMethod(conn, 1, 0, 0, 0, 0); //power set(kAppleBasebandConnectMethodRadioOn)
result = IOConnectCallScalarMethod(conn, 2, ?, 0, 0, 0); //configuring mux
result = IOConnectCallScalarMethod(conn, 7, 0, 0, 0, 0); //powercycle
result = IOConnectCallScalarMethod(conn, 8, 0, 0, 0, 0); //preupdate reset
result = IOConnectCallScalarMethod(conn, 9, 0, 0, 0, 0); //kAppleBasebandConnectMethodNotifyBasebandPoweringDown

[[Category:Baseband]]

05.08.01

2009-11-06T20:22:35Z

Rusmac: reverting vandalism

This baseband makes [[ultrasn0w]] useless in its current form because it closes the [[AT+XLOG Vulnerability]]. Apple also tightened the security in this baseband by removing about 120 AT commands, probably in the fear of new holes to be found.

MobileDevice Library

2009-11-06T20:22:13Z

Rusmac: reverting vandalism

MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over the USB connection.

===PC Windows : iTunesMobileDevice.dll===

* Location : Location is stored in '''iTunesMobileDeviceDLL''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support\Shared''' key. Usually - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll.

* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using iTunes prior 9.0).

* For iTunes 9.0 location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' key, usually C:\Program Files\Common Files\Apple\Apple Application Support\. CoreFoundation.dll from Mobile Device Support\bin should not be used.

===Mac OSX : MobileDevice.framework===

* Location : /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command : "nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice"

===MobileDevice Header (mobiledevice.h)===

Reverse engineered C header for MobileDevice Library.

<pre>
/* ----------------------------------------------------------------------------
* MobileDevice.h - interface to MobileDevice.framework
* ------------------------------------------------------------------------- */
#pragma once

#ifndef MOBILEDEVICE_H
#define MOBILEDEVICE_H

#ifdef __cplusplus
extern "C" {
#endif

#ifndef __GCC__
#pragma pack
#define __PACK
#else
#define __PACK __attribute__((__packed__))
#endif

#if defined(WIN32)
#define __DLLIMPORT [DllImport("iTunesMobileDevice.dll")]
using namespace System::Runtime::InteropServices;
#include <CoreFoundation.h>
typedef unsigned int mach_error_t;
#elif defined(__APPLE__)
#define __DLLIMPORT
#include <CoreFoundation/CoreFoundation.h>
#include <mach/error.h>
#endif

/* Error codes */
#define MDERR_APPLE_MOBILE (err_system(0x3a))
#define MDERR_IPHONE (err_sub(0))

/* Apple Mobile (AM*) errors */
#define MDERR_OK ERR_SUCCESS
#define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01)
#define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03)
#define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04)
#define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b)
#define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25)

/* Apple File Connection (AFC*) errors */
#define MDERR_AFC_OUT_OF_MEMORY 0x03

/* USBMux errors */
#define MDERR_USBMUX_ARG_NULL 0x16
#define MDERR_USBMUX_FAILED 0xffffffff

/* Messages passed to device notification callbacks: passed as part of
* am_device_notification_callback_info. */
#define ADNCI_MSG_CONNECTED 1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNSUBSCRIBED 3

#define AMD_IPHONE_PRODUCT_ID 0x1290
//#define AMD_IPHONE_SERIAL ""

/* Services, found in /System/Library/Lockdown/Services.plist */
#define AMSVC_AFC CFSTR("com.apple.afc")
#define AMSVC_BACKUP CFSTR("com.apple.mobilebackup")
#define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy")
#define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount")
#define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy")
#define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr")
#define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update")
#define AMSVC_SYNC CFSTR("com.apple.mobilesync")
#define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr")
#define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay")
#define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler")

typedef unsigned int afc_error_t;
typedef unsigned int usbmux_error_t;

struct am_recovery_device;

struct am_device_notification_callback_info {
struct am_device *dev; /* 0 device */
unsigned int msg; /* 4 one of ADNCI_MSG_* */
struct am_device_notification* subscription;
} __PACK;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* This is a CoreFoundation object of class AMRecoveryModeDevice. */
struct am_recovery_device {
unsigned char unknown0[8]; /* 0 */
am_restore_device_notification_callback callback; /* 8 */
void *user_info; /* 12 */
unsigned char unknown1[12]; /* 16 */
unsigned int readwrite_pipe; /* 28 */
unsigned char read_pipe; /* 32 */
unsigned char write_ctrl_pipe; /* 33 */
unsigned char read_unknown_pipe; /* 34 */
unsigned char write_file_pipe; /* 35 */
unsigned char write_input_pipe; /* 36 */
} __PACK;

/* A CoreFoundation object of class AMRestoreModeDevice. */
struct am_restore_device {
unsigned char unknown[32];
int port;
} __PACK;

/* The type of the device notification callback function. */
typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, int cookie);

/* The type of the _AMDDeviceAttached function.
* TODO: change to correct type. */
typedef void *amd_device_attached_callback;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* Structure that contains internal data used by AMDevice... functions. Never try
* to access its members directly! Use AMDeviceCopyDeviceIdentifier,
* AMDeviceGetConnectionID, AMDeviceRetain, AMDeviceRelease instead. */
struct am_device {
unsigned char unknown0[16]; /* 0 - zero */
unsigned int device_id; /* 16 */
unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */
char *serial; /* 24 - set to UDID, Unique Device Identifier */
unsigned int unknown1; /* 28 */
unsigned int unknown2; /* 32 - reference counter, increased by AMDeviceRetain, decreased by AMDeviceRelease*/
unsigned int lockdown_conn; /* 36 */
unsigned char unknown3[8]; /* 40 */
#if (__ITUNES_VER > 740)
unsigned int unknown4; /* 48 - used to store CriticalSection Handle*/
#endif
#if (__ITUNES_VER >= 800)
unsigned char unknown5[24]; /* 52 */
#endif
} __PACK;

struct am_device_notification {
unsigned int unknown0; /* 0 */
unsigned int unknown1; /* 4 */
unsigned int unknown2; /* 8 */
am_device_notification_callback callback; /* 12 */
unsigned int cookie; /* 16 */
} __PACK;

struct afc_connection {
unsigned int handle; /* 0 */
unsigned int unknown0; /* 4 */
unsigned char unknown1; /* 8 */
unsigned char padding[3]; /* 9 */
unsigned int unknown2; /* 12 */
unsigned int unknown3; /* 16 */
unsigned int unknown4; /* 20 */
unsigned int fs_block_size; /* 24 */
unsigned int sock_block_size; /* 28: always 0x3c */
unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */
void *afc_lock; /* 36 */
unsigned int context; /* 40 */
} __PACK;

struct afc_device_info {
unsigned char unknown[12]; /* 0 */
} __PACK;

struct afc_directory {
unsigned char unknown[0]; /* size unknown */
} __PACK;

struct afc_dictionary {
unsigned char unknown[0]; /* size unknown */
} __PACK;

typedef unsigned long long afc_file_ref;

struct usbmux_listener_1 { /* offset value in iTunes */
unsigned int unknown0; /* 0 1 */
unsigned char *unknown1; /* 4 ptr, maybe device? */
amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */
unsigned int unknown3; /* 12 */
unsigned int unknown4; /* 16 */
unsigned int unknown5; /* 20 */
} __PACK;

struct usbmux_listener_2 {
unsigned char unknown0[4144];
} __PACK;

struct am_bootloader_control_packet {
unsigned char opcode; /* 0 */
unsigned char length; /* 1 */
unsigned char magic[2]; /* 2: 0x34, 0x12 */
unsigned char payload[0]; /* 4 */
} __PACK;

/* ----------------------------------------------------------------------------
* Public routines
* ------------------------------------------------------------------------- */

/* Registers a notification with the current run loop. The callback gets
* copied into the notification struct, as well as being registered with the
* current run loop. Cookie gets copied into cookie in the same.
* (Cookie is a user info parameter that gets passed as an arg to
* the callback) unused0 and unused1 are both 0 when iTunes calls this.
*
* Never try to acces directly or copy contents of dev and subscription fields
* in am_device_notification_callback_info. Treat them as abstract handles.
* When done with connection use AMDeviceRelease to free resources allocated for am_device.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if CFRunLoopAddSource() failed
* MDERR_OUT_OF_MEMORY if we ran out of memory
*/
__DLLIMPORT mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback,
unsigned int unused0, unsigned int unused1,
unsigned int cookie,
struct am_device_notification **subscription);

/* Unregisters notifications. Buggy (iTunes 8.2): if you subscribe, unsubscribe and subscribe again, arriving
notifications will contain cookie and subscription from 1st call to subscribe, not the 2nd one. iTunes
calls this function only once on exit.
*/
__DLLIMPORT mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification* subscription);

/* Returns device_id field of am_device structure
*/
__DLLIMPORT unsigned int AMDeviceGetConnectionID(struct am_device *device);

/* Returns serial field of am_device structure
*/
__DLLIMPORT CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device);

/* Connects to the iPhone. Pass in the am_device structure that the
* notification callback will give to you.
*
* Returns:
* MDERR_OK if successfully connected
* MDERR_SYSCALL if setsockopt() failed
* MDERR_QUERY_FAILED if the daemon query failed
* MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff
*/
__DLLIMPORT mach_error_t AMDeviceConnect(struct am_device *device);

/* Calls PairingRecordPath() on the given device, than tests whether the path
* which that function returns exists. During the initial connect, the path
* returned by that function is '/', and so this returns 1.
*
* Returns:
* 0 if the path did not exist
* 1 if it did
*/
__DLLIMPORT mach_error_t AMDeviceIsPaired(struct am_device *device);
__DLLIMPORT mach_error_t AMDevicePair(struct am_device *device);

/* iTunes calls this function immediately after testing whether the device is
* paired. It creates a pairing file and establishes a Lockdown connection.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the supplied device is null
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceValidatePairing(struct am_device *device);

/* Creates a Lockdown session and adjusts the device structure appropriately
* to indicate that the session has been started. iTunes calls this function
* after validating pairing.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceStartSession(struct am_device *device);

/* Reads various device settings. One of domain or cfstring arguments should be NULL.
*
* Possible values for cfstring:
* ActivationState
* ActivationStateAcknowledged
* BasebandBootloaderVersion
* BasebandVersion
* BluetoothAddress
* BuildVersion
* DeviceCertificate
* DeviceClass
* DeviceName
* DevicePublicKey
* FirmwareVersion
* HostAttached
* IntegratedCircuitCardIdentity
* InternationalMobileEquipmentIdentity
* InternationalMobileSubscriberIdentity
* ModelNumber
* PhoneNumber
* ProductType
* ProductVersion
* ProtocolVersion
* RegionInfo
* SBLockdownEverRegisteredKey
* SIMStatus
* SerialNumber
* SomebodySetTimeZone
* TimeIntervalSince1970
* TimeZone
* TimeZoneOffsetFromUTC
* TrustedHostAttached
* UniqueDeviceID
* Uses24HourClock
* WiFiAddress
* iTunesHasConnected
*
* Possible values for domain:
* com.apple.mobile.battery
*/
__DLLIMPORT CFStringRef AMDeviceCopyValue(struct am_device *device, CFStringRef domain, CFStringRef cfstring);

/* Starts a service and returns a socket file descriptor that can be used in order to further
* access the service. You should stop the session and disconnect before using
* the service. iTunes calls this function after starting a session. It starts
* the service and the SSL connection. service_name should be one of the AMSVC_*
* constants.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if the setsockopt() call failed
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef
service_name, int *socket_fd);

/* Stops a session. You should do this before accessing services.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStopSession(struct am_device *device);

/* Decrements reference counter and, if nothing left, releases resources hold
* by connection, invalidates pointer to device
*/
__DLLIMPORT void AMDeviceRelease(struct am_device *device);

/* Increments reference counter
*/
__DLLIMPORT void AMDeviceRetain(struct am_device *device);

/* Opens an Apple File Connection. You must start the appropriate service
* first with AMDeviceStartService(). In iTunes, io_timeout is 0.
*
* Returns:
* MDERR_OK if successful
* MDERR_AFC_OUT_OF_MEMORY if malloc() failed
*/
__DLLIMPORT afc_error_t AFCConnectionOpen(int socket_fd, unsigned int io_timeout,
struct afc_connection **conn);

/* Pass in a pointer to an afc_dictionary structure. It will be filled. You can
* iterate it using AFCKeyValueRead. When done use AFCKeyValueClose. Possible keys:
* FSFreeBytes - free bytes on system device for afc2, user device for afc
* FSBlockSize - filesystem block size
* FSTotalBytes - size of device
* Model - iPhone1,1 etc.

*/
__DLLIMPORT afc_error_t AFCDeviceInfoOpen(struct afc_connection *conn, struct
afc_dictionary **info);

/* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric
* value, or if the file '/AFCDEBUG' is present and contains a value. */
#if defined(__APPLE__)
void AFCPlatformInit();
#endif

/* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in.
* Note that this normally only accesses the iTunes sandbox/partition as the
* root, which is /var/root/Media. Pathnames are specified with '/' delimiters
* as in Unix style. Use UTF-8 to specify non-ASCII symbols in path.
*
* Returns:
* MDERR_OK if successful
*/
__DLLIMPORT afc_error_t AFCDirectoryOpen(struct afc_connection *conn, char *path, struct
afc_directory **dir);

/* Acquires the next entry in a directory previously opened with
* AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end
* of the directory has been reached. '.' and '..' will be returned as the
* first two entries in each directory except the root; you may want to skip
* over them.
*
* Returns:
* MDERR_OK if successful, even if no entries remain
*/
__DLLIMPORT afc_error_t AFCDirectoryRead(struct afc_connection *conn, struct afc_directory *dir,
char **dirent);
__DLLIMPORT afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir);
__DLLIMPORT afc_error_t AFCDirectoryCreate(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRemovePath(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRenamePath(afc_connection *conn, char *oldpath, char *newpath);

/* Creates symbolic or hard link
* linktype - int64: 1 means hard link, 2 - soft (symbolic) link
* target - absolute or relative path to link target
* linkname - absolute path where to create new link
*/
__DLLIMPORT afc_error_t AFCLinkPath(struct afc_connection *conn, long long int linktype, const char *target,
const char *linkname);

/* Opens file for reading or writing without locking it in any way. afc_file_ref should not be shared between threads -
* opening file in one thread and closing it in another will lead to possible crash.
* path - UTF-8 encoded absolute path to file
* mode 2 = read, mode 3 = write; unknown = 0
* ref - receives file handle
*/
__DLLIMPORT afc_error_t AFCFileRefOpen(struct afc_connection *conn, char *path, unsigned
long long int mode, afc_file_ref *ref);
/* Reads specified amount (len) of bytes from file into buf. Puts actual count of read bytes into len on return
*/
__DLLIMPORT afc_error_t AFCFileRefRead(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int *len);
/* Writes specified amount (len) of bytes from buf into file.
*/
__DLLIMPORT afc_error_t AFCFileRefWrite(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int len);
/* Moves the file pointer to a specified location.
* offset - Number of bytes from origin (int64)
* origin - 0 = from beginning, 1 = from current position, 2 = from end
*/
__DLLIMPORT afc_error_t AFCFileRefSeek(struct afc_connection *conn, afc_file_ref ref,
unsigned long long offset, int origin, int unused);

/* Gets the current position of a file pointer into offset argument.
*/
__DLLIMPORT afc_error_t AFCFileRefTell(struct afc_connection *conn, afc_file_ref ref,
unsigned long long* offset);

__DLLIMPORT afc_error_t AFCFileRefLock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefUnlock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefClose(struct afc_connection *conn, afc_file_ref ref);

/* Opens dictionary describing specified file or directory (iTunes below 8.2 allowed using AFCGetFileInfo
to get the same information)
*/
__DLLIMPORT afc_error_t AFCFileInfoOpen(struct afc_connection *conn, char *path, struct
afc_dictionary **info);

/* Reads next entry from dictionary. When last entry is read, function returns NULL in key argument
Possible keys:
"st_size": val - size in bytes
"st_blocks": val - size in blocks
"st_nlink": val - number of hardlinks
"st_ifmt": val - "S_IFDIR" for folders
"S_IFLNK" for symlinks
"LinkTarget": val - path to symlink target
*/
__DLLIMPORT afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char **
val);
/* Closes dictionary
*/
__DLLIMPORT afc_error_t AFCKeyValueClose(struct afc_dictionary *dict);

/* Returns the context field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetContext(struct afc_connection *conn);

/* Returns the fs_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetFSBlockSize(struct afc_connection *conn);

/* Returns the io_timeout field of the given AFC connection. In iTunes this is
* 0. */
__DLLIMPORT unsigned int AFCConnectionGetIOTimeout(struct afc_connection *conn);

/* Returns the sock_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetSocketBlockSize(struct afc_connection *conn);

/* Closes the given AFC connection. */
__DLLIMPORT afc_error_t AFCConnectionClose(struct afc_connection *conn);

/* Registers for device notifications related to the restore process. unknown0
* is zero when iTunes calls this. In iTunes,
* the callbacks are located at:
* 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0)
* 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg)
* 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0)
* 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg)
*/
__DLLIMPORT unsigned int AMRestoreRegisterForDeviceNotifications(
am_restore_device_notification_callback dfu_connect_callback,
am_restore_device_notification_callback recovery_connect_callback,
am_restore_device_notification_callback dfu_disconnect_callback,
am_restore_device_notification_callback recovery_disconnect_callback,
unsigned int unknown0,
void *user_info);

/* Causes the restore functions to spit out (unhelpful) progress messages to
* the file specified by the given path. iTunes always calls this right before
* restoring with a path of
* "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an
* unused number.
*/
__DLLIMPORT unsigned int AMRestoreEnableFileLogging(char *path);

/* Initializes a new option dictionary to default values. Pass the constant
* kCFAllocatorDefault as the allocator. The option dictionary looks as
* follows:
* {
* NORImageType => 'production',
* AutoBootDelay => 0,
* KernelCacheType => 'Release',
* UpdateBaseband => true,
* DFUFileType => 'RELEASE',
* SystemImageType => 'User',
* CreateFilesystemPartitions => true,
* FlashNOR => true,
* RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress'
* BootImageType => 'User'
* }
*
* Returns:
* the option dictionary if successful
* NULL if out of memory
*/
__DLLIMPORT CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator);

/* ----------------------------------------------------------------------------
* Less-documented public routines
* ------------------------------------------------------------------------- */

__DLLIMPORT unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0,
unsigned int connection_id, unsigned int unknown1);
__DLLIMPORT unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path,
CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int
unknown0, CFStringRef *firmware_dir_path, CFStringRef *
kernelcache_restore_path, unsigned int unknown1, CFStringRef *
ramdisk_path);
__DLLIMPORT unsigned int AMRestoreModeDeviceReboot(struct am_restore_device *rdev); // Added by JB 30.07.2008
__DLLIMPORT mach_error_t AMDeviceEnterRecovery(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceDisconnect(struct am_device *device);

/* to use this, start the service "com.apple.mobile.notification_proxy", handle will be the socket to use */
typedef void (*NOTIFY_CALLBACK)(CFSTR notification, USERDATA data);
__DLLIMPORT mach_error_t AMDPostNotification(SOCKET socket, CFStringRef notification, CFStringRef userinfo);
__DLLIMPORT mach_error_t AMDObserveNotification(SOCKET socket, CFSTR notification);
__DLLIMPORT mach_error_t AMDListenForNotifications(SOCKET socket, NOTIFY_CALLBACK cb, USERDATA data);
__DLLIMPORT mach_error_t AMDShutdownNotificationProxy(SOCKET socket);

/*edits by geohot*/
__DLLIMPORT mach_error_t AMDeviceDeactivate(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceActivate(struct am_device *device, CFDictionaryRef dict);
__DLLIMPORT mach_error_t AMDeviceRemoveValue(struct am_device *device, unsigned int, CFStringRef cfstring);

/* ----------------------------------------------------------------------------
* Semi-private routines
* ------------------------------------------------------------------------- */

/* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure
* pointer, which will be filled with the resulting usbmux_listener_2.
*
* Returns:
* MDERR_OK if completed successfully
* MDERR_USBMUX_ARG_NULL if one of the arguments was NULL
* MDERR_USBMUX_FAILED if the listener was not created successfully
*/
__DLLIMPORT usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct
usbmux_listener_2 **eax_fp12);

/* ----------------------------------------------------------------------------
* Less-documented semi-private routines
* ------------------------------------------------------------------------- */
__DLLIMPORT usbmux_error_t USBMuxListenerHandleData(void *);

/* ----------------------------------------------------------------------------
* Private routines - here be dragons
* ------------------------------------------------------------------------- */

/* AMRestorePerformRestoreModeRestore() calls this function with a dictionary
* in order to perform certain special restore operations
* (RESTORED_OPERATION_*). It is thought that this function might enable
* significant access to the phone. */

/*
typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev,
CFDictionaryRef op) __attribute__ ((regparm(2)));
t_performOperation _performOperation = (t_performOperation)0x3c39fa4b;
*/

/* ----------------------------------------------------------------------------
* Less-documented private routines
* ------------------------------------------------------------------------- */

/*
typedef int (*t_socketForPort)(struct am_restore_device *rdev, unsigned int port)
__attribute__ ((regparm(2)));
t_socketForPort _socketForPort = (t_socketForPort)(void *)0x3c39f36c;

typedef void (*t_restored_send_message)(int port, CFDictionaryRef msg);
t_restored_send_message _restored_send_message = (t_restored_send_message)0x3c3a4e40;

typedef CFDictionaryRef (*t_restored_receive_message)(int port);
t_restored_receive_message _restored_receive_message = (t_restored_receive_message)0x3c3a4d40;

typedef unsigned int (*t_sendControlPacket)(struct am_recovery_device *rdev, unsigned
int msg1, unsigned int msg2, unsigned int unknown0, unsigned int *unknown1,
unsigned char *unknown2) __attribute__ ((regparm(3)));
t_sendControlPacket _sendControlPacket = (t_sendControlPacket)0x3c3a3da3;;

typedef unsigned int (*t_sendCommandToDevice)(struct am_recovery_device *rdev,
CFStringRef cmd) __attribute__ ((regparm(2)));
t_sendCommandToDevice _sendCommandToDevice = (t_sendCommandToDevice)0x3c3a3e3b;

typedef unsigned int (*t_AMRUSBInterfaceReadPipe)(unsigned int readwrite_pipe, unsigned
int read_pipe, unsigned char *data, unsigned int *len);
t_AMRUSBInterfaceReadPipe _AMRUSBInterfaceReadPipe = (t_AMRUSBInterfaceReadPipe)0x3c3a27e8;

typedef unsigned int (*t_AMRUSBInterfaceWritePipe)(unsigned int readwrite_pipe, unsigned
int write_pipe, void *data, unsigned int len);
t_AMRUSBInterfaceWritePipe _AMRUSBInterfaceWritePipe = (t_AMRUSBInterfaceWritePipe)0x3c3a27cb;
*/

int performOperation(am_restore_device *rdev, CFMutableDictionaryRef message);
int socketForPort(am_restore_device *rdev, unsigned int portnum);
int sendCommandToDevice(am_recovery_device *rdev, CFStringRef cfs, int block);
int sendFileToDevice(am_recovery_device *rdev, CFStringRef filename);

#ifdef __cplusplus
}
#endif

#endif

/* -*- mode:c; indent-tabs-mode:nil; c-basic-offset:2; tab-width:2; */
</pre>

===AFC Connection===
...

===Locking the Device for Sync===
When iTunes sends a new song to the device, the device shows a "Sync in progress" screen and when complete, the Music app on the device re-reads the iTunesDB file so it picks up the new song.

To get this behaviour, first start the notification service:
<pre>SOCKET socket;
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);</pre>

Now we post a notificaton message to signal that we are going to start a sync:
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncWillStart"), NULL);</pre>

Next we open the itunes lock file:
<pre>afc_file_ref lockref;
AFCFileRefOpen(conn, "/com.apple.itunes.lock_sync", 2, &lockref);</pre>

Now post a notification to say we are going to lock this file, and try and lock it.
If the AFCFileRefLock call fails, pause and repeat.
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncLockRequest"), NULL);
mach_error_t error = AFCFileRefLock(conn, lockref);</pre>

When the file is successfully locked, post another notification, and stop the notification service.
<pre>AMDPostNotification(socket,CFSTR("com.apple.itunes-mobdev.syncDidStart"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

Now the sync can proceed, so copy your files across and make the changes to the iTunesDB.

To release the lock, start the notification system again, unlock and close the lock file, and send a sync finished notification message:

<pre>AFCFileRefUnlock(conn, lockref);
AFCFileRefClose(conn, lockref);
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);
AMDPostNotification(socket, &CFSTR("com.apple.itunes-mobdev.syncDidFinish"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

To handle "Slide to Cancel" and terminate sync when user slides cancel switch, use AMDObserveNotification to subscribe notifications about “com.apple.itunes-client.syncCancelRequest”. Then start listening for notifications (AMDListenForNotifications) until you get “AMDNotificationFaceplant”.
When notification got, you should unlock and close lock file handle (don’t sure if you need to post “syncDidFinish” to proxy, seems it doesn’t matter) and terminate sync gracefully.
The same notification is also got when you unplug your device, so you should always be ready for errors.

NOTE: You may find that starting the notification_proxy service once and once only at the start of your app and using the same socket in calls to AMDPostNotification works better. iTunes opens and closes the notification_proxy regularly, but it appears to be a bit flakey when you open/close it all the time.

===Private Functions===

====How to find address of privates functions in iTunesMobileDevice.dll or MobileDevice.framework ?====
...

===Libraries Implementations===

* [http://code.google.com/p/iphuc/ iPhuc (Command line utility)]
* [http://code.google.com/p/iphucwin32/ iPhuc Win32 (Command line utility)]
* [http://code.google.com/p/manzana/ manzana (.Net Library)]
* [http://code.google.com/p/independence/source/browse/trunk/libPhoneInteraction/ libPhoneInteraction (C Library)]

N18AP

2009-11-06T20:21:42Z

Rusmac: reverting vandalism

{{DISPLAYTITLE:iPod touch 3G}}
This is the 3rd Generation [[N45ap|iPod Touch]]. It was announced on September 9th, 2009. It makes a small improvement over the [[N72ap|previous generation]]; adding a faster processor, doubling the ram, increasing storage capacity, etc.

==Application Processor==
It makes use of the [[S5L8922]] application processor. No other known device uses this processor; however, the iPhone 3GS uses the similar [[S5L8920]].

==Wifi Chip==
[[BCM4329]] Wifi B/G/N, Bluetooth, FM Transmit/Receive

==Specifications==

DFU 0x1227

2009-11-06T20:20:47Z

Rusmac: reverting vandalism

This is the protocol used to talk to [[DFU]] and [[WTF]] version 2.

==Protocol==
Same as sending a file to the 2.x [[Recovery Mode (Protocols)|Recovery Mode]]

==Code==
hexdump(fbuf, usb_control_msg(idev, 0x80, 6, 0x200, 0, fbuf, 0x100, 1000));
printf("WTF: "); fgets(buf,100,stdin); buf[strlen(buf)-1]=0;
FILE *f=fopen(buf, "rb"); int s,c=0;
if(f>0) {
do{s=fread(fbuf, 1, 0x800, f);
if(usb_control_msg(idev, 0x21, 1, c, 0, fbuf, s, 1000)==s) printf(".");
else printf("x");
if(usb_control_msg(idev, 0xA1, 3, 0, 0, fbuf, 6, 1000)!=6||fbuf[4]!=5) printf("%d",fbuf[4]);
c++;
}while(s>0);
printf("\n");
usb_control_msg(idev, 0xA1, 3, 0, 0, buf, 6, 1000);
hexdump(buf,6);
usb_control_msg(idev, 0xA1, 3, 0, 0, buf, 6, 1000);
hexdump(buf,6);
usb_reset(idev);
fclose(f); } else printf("file not found\n");
system("PAUSE");
return 0;

Tethered jailbreak

2009-11-06T20:20:34Z

Rusmac: reverting vandalism

A tethered jailbreak is one that requires your computer to boot the device.

== Tethered Devices ==
These are devices that a tethered jailbreak must be used for in all current public tools
* [[N72ap|iPod touch 2G]] with updated bootrom
* [[N18ap|iPod touch 3G]]
* [[N88ap|iPhone 3GS]] with updated bootrom

Kirkwood 7A341 (iPhone1,2)

2009-11-06T20:20:18Z

Rusmac: reverting vandalism

== Decryption Keys ==
=== Root Filesystem ===
* '''VFDecrypt''': 8d5d1fea02d627c9e9b0d994c3cfdeaab9780c86ac908db15461efe44eddd19f8924b6b2

=== Update Ramdisk - 018-5303-002.dmg===
* '''Key''': 5a0f82979f336baa58ed37926bd89dfe
* '''IV''': 0dc67d4f50ac62ee142b99baa569d0f4

=== Restore Ramdisk - 018-5305-002.dmg ===
* '''Key''': 9962589aabb4d5ec56b7a867ab5b11b0
* '''IV''': caca33f1aca029320d60873a4deed68d

=== DeviceTree ===
* '''Key''': 1852158326954e1379ee3aebe1d5c50c
* '''IV''': 5e6bca89f06c8dc4f3868fa4caba9d40

=== iBoot ===
* '''Key''': 4a8d6657297ca45cf6bec0854ee0a2e8
* '''IV''': 674a95015a8d33cd2f1f259ebe01aca7

=== Logo ===
* '''Key''': f9841fa3197f0bd9fd162ce170c5f6f9
* '''IV''': 30c0cb05ae49d0484392261b2c8b21a8

=== Recovery Logo ===
* '''Key''': 5a56972f4750335c448f3219269ed202
* '''IV''': 848d4cef8e4d8182c3f10062cf5347fe

=== Kernel ===
* '''Key''': 02418105dfb3be2af2a76248e026f702
* '''IV ''': a4db9183cd79722b4146c9de09ab29c5

==Patches==
Putting this here for developers that would like to to utilize "extras" like /dev/kmem access, tfp0, etc.

===Kernel===
<pre>
// thumb patches
0x08DE72: 8D 43 => 00 00 // w^x patch #1
0x090B6E: A2 43 => 00 00 // w^x patch #2
0x19B8BC: 0C D1 => 0C E0 // allow tfp0
0x381E22: FA 23 DB 00 => 01 23 5B 42 // allow aes uid key usage
0x381E34: FA 23 9B 00 => 01 23 5B 42 // allow aes gid key usage
0x3DEF8E: 40 42 => 00 20 // img3 signature check

// flag patches
0x213638: 00 00 00 00 => 01 00 00 00 // setup_kmem flag

// arm patches
0x3F908C: 00 40 A0 E3 => 01 40 A0 E3 // codesign check actual code patch
0x3FCB40: FF 40 A0 E3 => 00 40 A0 E3
</pre>

Baseband Commands

2009-11-06T20:20:04Z

Rusmac: reverting vandalism

==About==
In this page, you'll find some Baseband Commands. You can use them with Minicom 2.2, that can be found on Cydia.

==Setting up Minicom 2.2==
# After installing Minicom from Cydia, make sure the folder /usr/etc exists. SSH into your iPhone and then, type: ''minicom -s''.
# Now, select ''Serial Port Setup'' in the Menu and press Enter. Then, press "a" and set Serial Device to ''/dev/tty.debug''.
# Press Esc, and in the Main Menu, select ''Save setup as dfl''. Now, select "exit".
# To run minicom using ssh, just run minicom -w

==Running Minicom 2.2 from MobileTerminal==
'''Note''': minicom does work on MobileTerminal only on root (use su) and only after it has been configured (through the steps above).
# Open MobileTerminal.
# Run the command su, enter your root password (default alpine) and then run minicom -w.
# To exit minicom, slide your finger on the screen ("gesture") to the bottom right (if you haven't changed this setting in MobileTerminal settings), then press A, X and enter.

==How to run Baseband Commands==

First, run Minicom. Then, type "at" and press Enter. Then, you can type the command that you want, have fun.

==Baseband Commands==
===Getting Information===
* '''at+xgendata''': Display some baseband informations
* '''at&v''': Display the profiles in the Baseband (Active Profile, Stored Profile 0 and Stored Profile 1)
* '''at+clac''': Show some baseband commands
* '''at&h''': Show more Baseband Commands

===Unlock===
* '''at+clck''': Traditional unlock command
* '''at+xlock''': Wildcard unlock
* '''at+xsimstate''': Print lock state (write at+xsimstate=1 to turn on, at+xsimstate=0 to turn off)

===SMS===
* '''at+cmgf''': SMS operating mode (at+cmgf=0 - PDU, at+cmgf=1 - text)
* '''at+cmgs''': Send SMS (write at+cmgs="[PHONE NUMBER]"[ENTER][MESSAGE][CTRL-Z] while [ENTER] is an enter (\r\n) and [CTRL-Z] is ASCII 26)

Decrypting Firmwares

2009-11-06T20:19:53Z

Rusmac: reverting vandalism

==1.0.x==
If you want to decrypt 1.0.x iPhone ramdisk you must remove some trash from the beginning of them. You can do this in Terminal.app (on Mac OS X you can find them in /Applications/Utilities/).

Unzip firmware image (change extension .ipsw to .zip and double click on archive) and find restore ramdisk. In Terminal.app enter simple command:

''dd if=restore_ramdisk.dmg of=restore_ramdisk.stripped.dmg bs=512 skip=4 count=37464 conv=sync''

Where '''restore_ramdisk.dmg''' is image of restore ramdisk (for example 1.0 iPhone firmware restore ramdisk is 694-5259-38.dmg), and '''restore_ramdisk.stripped.dmg''' is 'decrypted' image, that you can mount and explore from Finder.

Note: If after mounting stripped ramdisk you see errors, ignore them.

==1.1.x==
To decrypt the 1.1.x ramdisk, strip the first 0x800 bytes. I'm not proficient in dd, but the above command could be modified for this, or it could be done in a hex editor. Once that's complete, run this command:

''openssl enc -d -in ramdisk.dmg -out de.dmg -aes-128-cbc -K 188458A6D15034DFE386F23B61D43774 -iv 0''

This uses the iPhone's 0x837 key which was first leaked by Zibri and had its purpose revealed on Geohot's blog.

==2.x+==
The ramdisk on both 2.x and 3.x firmwares is a simple [[IMG3_File_Format|img3 file]], that you can decrypt using [http://code.google.com/p/img3decrypt/ img3decrypt] or [http://github.com/planetbeing/xpwn/tree/master xpwntool]. You must download one of these utilities. For easier access, put them in '''/usr/local/bin'''

If you're using img3decrypt use this:
''img3decrypt e restore_ramdisk.dmg restore_ramdisk_decrypted.dmg Ramdisk_IV Ramdisk_Key''

Use this if you're using xpwntool:
''xpwntool restore_ramdisk.dmg restore_ramdisk_decrypted.dmg -k Ramdisk_Key -iv Ramdisk_IV''

Where '''restore_ramdisk.dmg''' is image of restore ramdisk (for example 3.0 beta 1 iPhone GSM firmware restore ramdisk is 018-4793-1.dmg), and '''restore_ramdisk_decrypted.dmg''' is decrypted image, that you can mount and explore from Finder. Ramdisk_IV and Ramdisk_Key is a decrypted keys that you can find in [[VFDecrypt_Keys:_3.x|vfdecrypt page]] or in Info.plist from PwnageTool FirmwareBundles folder (when Dev Team include support for this firmware).

Because of the new HFS Compression used in Snow Leopard and 3.0 DMGs, you may see zero-sized files in the DMG if you don't use Snow Leopard. In order to extract those, check [[Talk:Ramdisk Decryption]].

Restore Ramdisk

2009-11-06T20:19:07Z

Rusmac: reverting vandalism

Wipes everything out on the [[NAND]] and reflashes it with the OS provided in the [[IPSW]]. After, it will flash the [[NOR]] with the firmware files in the [[IPSW]], and if it is an [[iPhone]], re-flash the [[Baseband Device|Baseband]] as well (provided it is not an earlier [[Baseband Device|baseband]] version)

You need to restore from a backup to get any of your contacts, applications, etc. back after a complete restore with this.

BurnIn

2009-11-06T20:17:54Z

Rusmac: reverting vandalism

[[Image:Burnin2.jpg|thumb|left|"Drag To Unlock" screen. Text is "Drag To Unlock" and "Shut Down"|150px]]
[[Image:Burnin1.jpg|thumb|After "Drag To Unlock" screen, when you "Drag To Unlock", you get this screen. In order, "Start Burnin", "Reset Test Enviroment", and "Quit"|150px]]
[[Image:Burnin3.jpg|thumb|left|boot logo|150px]]
'''BurnIn''' is codename for a tool used by Apple. Nothing is really known about it, but somebody on Hackint0sh got their iPhone back with [[BurnIn]] on it, suggesting that it is a diagnotstics or a repair tool.

== What it does ==
Leftover strings on firmware 2.1 have told me this; Apple restores a special firmware to the iPhone, but it is based on a regular firmware. At boot, /AppleInternal/Applications/SwitchBoard/BurnIn.app/BurnIn will run. It checks /AppleInternal/Diags/purpleskank/config.plist for configuration information, such as version (v3.0 in this case), where to store the logs (/Library/Logs/BurnIn/ in this case), what level to set the backlight to, and also, some kind of cleanup script is defined (/AppleInternal/Diags/Utilities/burnin_cleanup.sh). What it actually does is still not known though. Two log files are also left by it, by doing whatever is done. They are /Library/Logs/BurnIn/burning_log.xml and /Library/Logs/BurnIn/burnin_log.txt.

On the old iPhone prototypes, BurnIn is launched by the /AppleInternal/Applications/SkankPhone.app/SkankPhone, a SpringBoard replacement. It starts the /AppleInternal/Diags/purpleskank/factoryharness, which loads the configuration from config.plist file in the same directory. Factoryharness loads the index.plist file from location specified in config.plist (default is /AppleInternal/Diags/purpleskank/tables/index.plist) and begins to execute the tests specified in index.plist ("Burnin process"). When tests are successful, logs from burnin process are saved to /AppleInternal/Diags/Logs/ (or to other directory that can be set in config.plist). In case of failure, a failures.plist file is created in Logs directory. If Burnin process has not been completed, file state.plist is parsed by factoryharness and it continues the burnin process. If burnin process has failed, Skankphone.app shows a FAILURE screen and displays contents of burnin_log.txt. To get rid of that screen, user must select the Reset Test Environment option in SkankPhone - it executes the /AppleInternal/Diags/Utilities/burnin_cleanup.sh.

==BurnIn on iPod touch==
The day of the launch, numerous iPod touches shipped with BurnIn on it. In order to get it off them, you just did a restore. A few of these were sold on eBay.

<div style="clear:both;"></div>

<gallery caption="BurnIn on iPod touch" widths="100px" heights="100px" perrow="5">
Image:0.jpg|boot logo
Image:1.jpg|The main menu.
Image:2.jpg|Wi-Fi antenna test.
Image:3.jpg|The "Bluetooth" screen.
Image:4.jpg|The "Battery" screen.
Image:5.jpg|The "Accelerometer" menu.
Image:6.jpg|The "Buttons" menu.
Image:7.jpg|Speaker screen.
Image:8.jpg|"Touch" screen.
Image:9.jpg|The "Serial Number" screen.
Image:10.jpg|Tests the ambient light sensor.
Image:11.jpg|A test for any connected headphones.
Image:12.jpg|The temperature inside the device.
</gallery>

Video: http://www.youtube.com/watch?v=nVMY1aC1kk4

Cydia Substrate

2009-11-06T20:17:13Z

Rusmac: reverting vandalism

== Basic Info ==
Mobile Substrate is [[saurik]]'s [[extension]] for [[SpringBoard]] that allows 3rd party SpringBoard addons to run. Examples are the five-icon dock and [[Winterboard]]. However, possibly one of the most useful is SBSettings that allows many tweaks to the SpringBoard, as well as enabling and disabling SpringBoard/Mobile Substrate extensions

== And with all this extra code......... ==
As allways, even with PCs, extra code means crashing and Mobile Substrate can solve this too. Should the SpringBoard crash for any reason (which us quite common once let loose on [[Cydia]] as there are absolutely loads of SpringBoard extensions) Mobile Substrate will temporarily put the SpringBoard into Safe Mode with SpringBoard extensions such as WinterBoard diabled allowing you to continue using your device until it is convenient to [[respring]]

== More Info ==
[http://www.saurik.com saurik's Web Site]

[http://www.google.com/search?q=Mobile+Substrate Google]

[http://iphonedevwiki.howett.net/index.php?title=MobileSubstrate MobileSubstrate Development Info]

Baseband Bootrom Protocol

2009-11-06T20:16:48Z

Rusmac: reverting vandalism

This is the protocol used to talk to the old, and probably the new baseband, at the bootrom level. The old bootrom didn't have an sig checking, the new one does.

==Protocol==
AT
0x30
2 byte length
n byte data
2 byte checksum
sends A5 on success, 5A on failure

===3G===
Correct me if I am wrong, but it looks like the last part should be this for the 3G bootrom...
sends 01 on success, FF on failure

==Implementations==
[http://lpahome.com/geohot/gbootloader.rar bootrom.h in gbootloader]

[[Category:Protocols (Baseband)]]

AppStore.app

2009-11-06T20:15:44Z

Rusmac: reverting vandalism

== Introduction ==
AppStore.app is the application Apple has added to iPhone & iPhone3G 2.x firmwares for distributing applications made using Apple's iPhone SDK. The following is just some initial information gathered by mxweas

== Findings ==

=== Initialization of AppStore ===

GET http://phobos.apple.com:80/bag.xml?ix=2
User-Agent: iTunes-iphone/2.0
X-Apple-Connection-Type: WiFi
X-Apple-Store-Front: 143441-1,2
->302 Moved Temporarily - http://ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore.woa/wa/initiateSession?ix=2

GET http://ax.phobos.apple.com.edgesuite.net:80/WebObjects/MZStore.woa/wa/initiateSession?ix=2
User-Agent: iTunes-iphone/2.0
X-Apple-Connection-Type: WiFi
X-Apple-Store-Front: 143441-1,2
->?

== Your Name ==
# Take the application icon and drag it from iTunes to your desktop
# It will be an ipa file. Unzip it.
# Open Payload/<application>.app/SC_Info/<application>.sinf in a hex editor

Do the above and look at offset 0x0c0. You will see your name, or the name of the person who crappily cracked your application :P

[[Category:Software]]

S5L8720 (VROM)

2009-11-06T20:13:49Z

Rusmac: reverting vandalism

The [[N72ap|iPod touch 2G]] bootrom runs on [[iBoot]] v240.4, which is from somewhere after 1.1.4 and after 2.0 beta 4. It maps itself to 0x0, and stores any global variables (Permissions flags, min / max addrs, image / bdev list, USB power on state, etc.) at 0x22000000.

==Notes==
===Firmware Parsing===
* It seems to only support AES-128 KBAGs, versus current iBoots which also support AES-192 and AES-256 KBAGs. Interestingly, it seems to make space for up to an AES-256 [[KBAG]] (0x30; 0x10 for IV, 0x20 for key) when creating a buffer for it, but the code itself does a check and will error if it is not AES-128.

AT+XEMN Heap Overflow

2009-11-06T20:12:45Z

Rusmac: reverting vandalism

AT+XEMN is a command on baseband 5.11.07 (pushed out with the 3.1 release), which when exploited correctly, causes a heap overflow allowing the crash to be moulded into an injection vector. This injection vector can then be used to inject an unlocking payload to provide a coveted Software SIM Unlock on the official 3.1(.2) firmware running 5.11.07

== Credit ==
* '''Vulnerability''': [[User:Oranav|Oranav]] (July) and [[User:iH8sn0w|iH8sn0w]] (September) (discovered independently)<br>
* '''Exploit''': [[User:geohot|geohot]]

== Implementation ==
This exploit is used in [[blacksn0w]].

== Exception Dump ==
+XLOG: Exception Number: 1
Trap Class: 0xDDDD (SW GENERATED TRAP)
Identification: 140 (0x008C)
Date: 22.10.2009
Time: 00:30
File: atform/text/_malloc.c
Line: 1036
Logdata:
2E 0C 76 ED 40 14 31 64 61 74 63 3A 31 00 64 63 ..v.@.1datc:1.dc
20 44 F4 E9 20 20 20 20 20 20 20 20 20 20 20 20 D..
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20

== Timeline ==
=== July 2009 ===
*[[User:Oranav|Oranav]] discovers this crash and gives is to the [[iPhone Dev Team]].
*Upon initial investigation, The [[iPhone Dev Team]], mistakenly concludes that the crash is non-exploitable.

=== September 2009 ===
*iH8sn0w discovered this command independently but kept it a secret for about a month. [http://twitter.com/iH8sn0w/status/4353547726 ]

=== October 2009 ===
*When the Dev-Team stated that iH8sn0w did not have a unlock, he posted the command on Twitter. [http://twitter.com/iH8sn0w/status/4954333558]
*Shortly after, Oranav posted his Hash from July. [http://pastebin.ca/1485104]
*MuscleNerd tells iHacker that the crash was received awhile ago and is thought to be non-exploitable. [http://twitter.com/MuscleNerd/status/4978871033][http://twitter.com/iHacker/status/4978821448]
*[[User:Geohot|Geohot]] attempts to exploit this crash, but intially also finds it to be non-exploitable. [http://twitter.com/geohot/status/4979506974]
*Geohot does more investigation and discovers that this crash is indeed exploitable, and that it's a heap overflow. [http://twitter.com/geohot/status/5196861045]
*Geohot achieves arbitrary code execution and begins work on unlock which will be called blacksn0w. [http://iphonejtag.blogspot.com/2009/10/heap-of-trouble.html]
*Geohot posts a video of an unlocked 05.11.07 device. [http://www.youtube.com/watch?v=g23e9e9zOVI]

=== November 2009 ===
*Geohot releases [[blacksn0w]] to the masses.

[[Category:Baseband Exploits]]

AFC

2009-11-06T20:11:52Z

Rusmac: reverting vandalism

AFC is a service that runs on every iPhone / iPod, which [[iTunes]] uses to exchange files with the device. It is jailed to the directory /private/var/mobile/Media, which is on the second (non-OS) partition. The AFC service is handled by /usr/libexec/afcd, and runs over the [[Normal Mode|usbmux protocol]].

=== AFC2 ===
AFC2 is a an additional AFC service, configured to allow access to the whole filesystem. Installing it and patching the fstab file for full write access is considered a bare-bones [[jailbreak]]. The AFC2 service is added by editing the /System/Library/Lockdown/Services.plist file and adding a service that runs under root with access to /.

/private/var/backups

2009-11-06T20:10:56Z

Rusmac: reverting vandalism

== Summary ==

== Parents ==
<ul>
<li>[[/var]]</li>
</ul>

== Children ==

== Files ==

Kernelcache

2009-11-06T20:09:51Z

Rusmac: reverting vandalism

The kernelcache is basically the kernel itself as well as all of its extensions (AppleImage3NORAccess, IOAESAccelerator, IOPKEAccelerator, etc.) into one file, then packed / encrypted in an [[IMG3 File Format|IMG3]] (Firmware 2.0 and above) or [[8900 File Format|8900]] (Firmware 1.0 - 1.1.4) container.

Minus 0x20000 with Back Extend Erase

2009-11-06T20:08:51Z

Rusmac: Undo revision 5409 by Chroniccommand (Talk)

This is the exploit used to unlock all phones with a 4.6 bootloader.

==Credit==
[[User:Geohot|geohot]]

==Description==

Writing -0x20000 before the firmware starts allows you to write anything you want.

0x3C0000 can't have a valid secpack to allow booting. The explicit addresses 0xA03D0000-0xA03F0000 will always erase. This exploit relied on two things, the secaddrs are copied before the secpack is validated(stupid), and the erase command extends the range to whatever is in the secpack. So erase 0xA03D0000-0xA03F0000, the erase command sees 0xA03C0000 to 0xA03F0000 in the secpack; BOOM secpack erased.

==Implementations==
*[[gunlock]]
*[[BootNeuter]]

[[Category:Unlocking Methods]]
[[Category:Baseband Exploits]]

CERT

2009-11-06T20:07:33Z

Rusmac: Undo revision 5412 by Chroniccommand (Talk)

Apple's certificates on [[IMG2]] and [[IMG3]] files. Some hardware tags like [[CHIP]] and [[PROD]] are actually within this section and technically not in the signature checked area, but that does not matter as in parseCertificatesAndSignature(); in iBoot, they are compared against a hardcoded value for whatever they should be set to.

==Parsed==
*openssl asn1parse -inform DER -in cert
0:d=0 hl=4 l=1211 cons: SEQUENCE
4:d=1 hl=4 l= 931 cons: SEQUENCE
8:d=2 hl=2 l= 3 cons: cont [ 0 ]
10:d=3 hl=2 l= 1 prim: INTEGER :02
13:d=2 hl=2 l= 1 prim: INTEGER :02
16:d=2 hl=2 l= 13 cons: SEQUENCE
18:d=3 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
29:d=3 hl=2 l= 0 prim: NULL
31:d=2 hl=2 l= 98 cons: SEQUENCE
33:d=3 hl=2 l= 11 cons: SET
35:d=4 hl=2 l= 9 cons: SEQUENCE
37:d=5 hl=2 l= 3 prim: OBJECT :countryName
42:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
46:d=3 hl=2 l= 19 cons: SET
48:d=4 hl=2 l= 17 cons: SEQUENCE
50:d=5 hl=2 l= 3 prim: OBJECT :organizationName
55:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Apple Inc.
67:d=3 hl=2 l= 38 cons: SET
69:d=4 hl=2 l= 36 cons: SEQUENCE
71:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
76:d=5 hl=2 l= 29 prim: PRINTABLESTRING :Apple Certification Authority
107:d=3 hl=2 l= 22 cons: SET
109:d=4 hl=2 l= 20 cons: SEQUENCE
111:d=5 hl=2 l= 3 prim: OBJECT :commonName
116:d=5 hl=2 l= 13 prim: PRINTABLESTRING :Apple Root CA
131:d=2 hl=2 l= 30 cons: SEQUENCE
133:d=3 hl=2 l= 13 prim: UTCTIME :060425214036Z
148:d=3 hl=2 l= 13 prim: UTCTIME :350209214036Z
163:d=2 hl=2 l= 98 cons: SEQUENCE
165:d=3 hl=2 l= 11 cons: SET
167:d=4 hl=2 l= 9 cons: SEQUENCE
169:d=5 hl=2 l= 3 prim: OBJECT :countryName
174:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
178:d=3 hl=2 l= 19 cons: SET
180:d=4 hl=2 l= 17 cons: SEQUENCE
182:d=5 hl=2 l= 3 prim: OBJECT :organizationName
187:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Apple Inc.
199:d=3 hl=2 l= 38 cons: SET
201:d=4 hl=2 l= 36 cons: SEQUENCE
203:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
208:d=5 hl=2 l= 29 prim: PRINTABLESTRING :Apple Certification Authority
239:d=3 hl=2 l= 22 cons: SET
241:d=4 hl=2 l= 20 cons: SEQUENCE
243:d=5 hl=2 l= 3 prim: OBJECT :commonName
248:d=5 hl=2 l= 13 prim: PRINTABLESTRING :Apple Root CA
263:d=2 hl=4 l= 290 cons: SEQUENCE
267:d=3 hl=2 l= 13 cons: SEQUENCE
269:d=4 hl=2 l= 9 prim: OBJECT :rsaEncryption
280:d=4 hl=2 l= 0 prim: NULL
282:d=3 hl=4 l= 271 prim: BIT STRING
557:d=2 hl=4 l= 378 cons: cont [ 3 ]
561:d=3 hl=4 l= 374 cons: SEQUENCE
565:d=4 hl=2 l= 14 cons: SEQUENCE
567:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Key Usage
572:d=5 hl=2 l= 1 prim: BOOLEAN :255
575:d=5 hl=2 l= 4 prim: OCTET STRING [HEX DUMP]:03020106
581:d=4 hl=2 l= 15 cons: SEQUENCE
583:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
588:d=5 hl=2 l= 1 prim: BOOLEAN :255
591:d=5 hl=2 l= 5 prim: OCTET STRING [HEX DUMP]:30030101FF
598:d=4 hl=2 l= 29 cons: SEQUENCE
600:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
605:d=5 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:04142BD06947947609FEF46B8D2E40A6F7474D7F085E
629:d=4 hl=2 l= 31 cons: SEQUENCE
631:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
636:d=5 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:301680142BD06947947609FEF46B8D2E40A6F7474D7F085E
662:d=4 hl=4 l= 273 cons: SEQUENCE
666:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Certificate Policies
671:d=5 hl=4 l= 264 prim: OCTET STRING [HEX DUMP]:308201043082010006092A864886F7636405013081F2302A06082B06010505070201161E68747470733A2F2F7777772E6170706C652E636F6D2F6170706C6563612F3081C306082B060105050702023081B61A81B352656C69616E6365206F6E207468697320636572746966696361746520627920616E7920706172747920617373756D657320616363657074616E6365206F6620746865207468656E206170706C696361626C65207374616E64617264207465726D7320616E6420636F6E646974696F6E73206F66207573652C20636572746966696361746520706F6C69637920616E642063657274696669636174696F6E2070726163746963652073746174656D656E74732E
939:d=1 hl=2 l= 13 cons: SEQUENCE
941:d=2 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
952:d=2 hl=2 l= 0 prim: NULL
954:d=1 hl=4 l= 257 prim: BIT STRING
1215:d=0 hl=4 l=1016 cons: SEQUENCE
1219:d=1 hl=4 l= 736 cons: SEQUENCE
1223:d=2 hl=2 l= 3 cons: cont [ 0 ]
1225:d=3 hl=2 l= 1 prim: INTEGER :02
1228:d=2 hl=2 l= 1 prim: INTEGER :10
1231:d=2 hl=2 l= 13 cons: SEQUENCE
1233:d=3 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
1244:d=3 hl=2 l= 0 prim: NULL
1246:d=2 hl=2 l= 98 cons: SEQUENCE
1248:d=3 hl=2 l= 11 cons: SET
1250:d=4 hl=2 l= 9 cons: SEQUENCE
1252:d=5 hl=2 l= 3 prim: OBJECT :countryName
1257:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
1261:d=3 hl=2 l= 19 cons: SET
1263:d=4 hl=2 l= 17 cons: SEQUENCE
1265:d=5 hl=2 l= 3 prim: OBJECT :organizationName
1270:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Apple Inc.
1282:d=3 hl=2 l= 38 cons: SET
1284:d=4 hl=2 l= 36 cons: SEQUENCE
1286:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
1291:d=5 hl=2 l= 29 prim: PRINTABLESTRING :Apple Certification Authority
1322:d=3 hl=2 l= 22 cons: SET
1324:d=4 hl=2 l= 20 cons: SEQUENCE
1326:d=5 hl=2 l= 3 prim: OBJECT :commonName
1331:d=5 hl=2 l= 13 prim: PRINTABLESTRING :Apple Root CA
1346:d=2 hl=2 l= 30 cons: SEQUENCE
1348:d=3 hl=2 l= 13 prim: UTCTIME :070105192159Z
1363:d=3 hl=2 l= 13 prim: UTCTIME :220105192159Z
1378:d=2 hl=2 l= 126 cons: SEQUENCE
1380:d=3 hl=2 l= 11 cons: SET
1382:d=4 hl=2 l= 9 cons: SEQUENCE
1384:d=5 hl=2 l= 3 prim: OBJECT :countryName
1389:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
1393:d=3 hl=2 l= 19 cons: SET
1395:d=4 hl=2 l= 17 cons: SEQUENCE
1397:d=5 hl=2 l= 3 prim: OBJECT :organizationName
1402:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Apple Inc.
1414:d=3 hl=2 l= 38 cons: SET
1416:d=4 hl=2 l= 36 cons: SEQUENCE
1418:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
1423:d=5 hl=2 l= 29 prim: PRINTABLESTRING :Apple Certification Authority
1454:d=3 hl=2 l= 50 cons: SET
1456:d=4 hl=2 l= 48 cons: SEQUENCE
1458:d=5 hl=2 l= 3 prim: OBJECT :commonName
1463:d=5 hl=2 l= 41 prim: PRINTABLESTRING :Apple Secure Boot Certification Authority
1506:d=2 hl=4 l= 290 cons: SEQUENCE
1510:d=3 hl=2 l= 13 cons: SEQUENCE
1512:d=4 hl=2 l= 9 prim: OBJECT :rsaEncryption
1523:d=4 hl=2 l= 0 prim: NULL
1525:d=3 hl=4 l= 271 prim: BIT STRING
1800:d=2 hl=3 l= 156 cons: cont [ 3 ]
1803:d=3 hl=3 l= 153 cons: SEQUENCE
1806:d=4 hl=2 l= 14 cons: SEQUENCE
1808:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Key Usage
1813:d=5 hl=2 l= 1 prim: BOOLEAN :255
1816:d=5 hl=2 l= 4 prim: OCTET STRING [HEX DUMP]:03020186
1822:d=4 hl=2 l= 15 cons: SEQUENCE
1824:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
1829:d=5 hl=2 l= 1 prim: BOOLEAN :255
1832:d=5 hl=2 l= 5 prim: OCTET STRING [HEX DUMP]:30030101FF
1839:d=4 hl=2 l= 29 cons: SEQUENCE
1841:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
1846:d=5 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:0414493D3653C9D715E186614EACABAB1856635DC3C6
1870:d=4 hl=2 l= 31 cons: SEQUENCE
1872:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
1877:d=5 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:301680142BD06947947609FEF46B8D2E40A6F7474D7F085E
1903:d=4 hl=2 l= 54 cons: SEQUENCE
1905:d=5 hl=2 l= 3 prim: OBJECT :X509v3 CRL Distribution Points
1910:d=5 hl=2 l= 47 prim: OCTET STRING [HEX DUMP]:302D302BA029A0278625687474703A2F2F7777772E6170706C652E636F6D2F6170706C6563612F726F6F742E63726C
1959:d=1 hl=2 l= 13 cons: SEQUENCE
1961:d=2 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
1972:d=2 hl=2 l= 0 prim: NULL
1974:d=1 hl=4 l= 257 prim: BIT STRING
2235:d=0 hl=4 l= 927 cons: SEQUENCE
2239:d=1 hl=4 l= 563 cons: SEQUENCE
2243:d=2 hl=2 l= 3 cons: cont [ 0 ]
2245:d=3 hl=2 l= 1 prim: INTEGER :02
2248:d=2 hl=2 l= 9 prim: INTEGER :FB01FB0000000001
2259:d=2 hl=2 l= 13 cons: SEQUENCE
2261:d=3 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
2272:d=3 hl=2 l= 0 prim: NULL
2274:d=2 hl=2 l= 126 cons: SEQUENCE
2276:d=3 hl=2 l= 11 cons: SET
2278:d=4 hl=2 l= 9 cons: SEQUENCE
2280:d=5 hl=2 l= 3 prim: OBJECT :countryName
2285:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
2289:d=3 hl=2 l= 19 cons: SET
2291:d=4 hl=2 l= 17 cons: SEQUENCE
2293:d=5 hl=2 l= 3 prim: OBJECT :organizationName
2298:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Apple Inc.
2310:d=3 hl=2 l= 38 cons: SET
2312:d=4 hl=2 l= 36 cons: SEQUENCE
2314:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
2319:d=5 hl=2 l= 29 prim: PRINTABLESTRING :Apple Certification Authority
2350:d=3 hl=2 l= 50 cons: SET
2352:d=4 hl=2 l= 48 cons: SEQUENCE
2354:d=5 hl=2 l= 3 prim: OBJECT :commonName
2359:d=5 hl=2 l= 41 prim: PRINTABLESTRING :Apple Secure Boot Certification Authority
2402:d=2 hl=2 l= 30 cons: SEQUENCE
2404:d=3 hl=2 l= 13 prim: UTCTIME :070106052052Z
2419:d=3 hl=2 l= 13 prim: UTCTIME :170106052052Z
2434:d=2 hl=2 l= 116 cons: SEQUENCE
2436:d=3 hl=2 l= 11 cons: SET
2438:d=4 hl=2 l= 9 cons: SEQUENCE
2440:d=5 hl=2 l= 3 prim: OBJECT :countryName
2445:d=5 hl=2 l= 2 prim: PRINTABLESTRING :US
2449:d=3 hl=2 l= 19 cons: SET
2451:d=4 hl=2 l= 17 cons: SEQUENCE
2453:d=5 hl=2 l= 3 prim: OBJECT :organizationName
2458:d=5 hl=2 l= 10 prim: PRINTABLESTRING :Apple Inc.
2470:d=3 hl=2 l= 50 cons: SET
2472:d=4 hl=2 l= 48 cons: SEQUENCE
2474:d=5 hl=2 l= 3 prim: OBJECT :organizationalUnitName
2479:d=5 hl=2 l= 41 prim: PRINTABLESTRING :Apple Secure Boot Certification Authority
2522:d=3 hl=2 l= 28 cons: SET
2524:d=4 hl=2 l= 26 cons: SEQUENCE
2526:d=5 hl=2 l= 3 prim: OBJECT :commonName
2531:d=5 hl=2 l= 19 prim: PRINTABLESTRING :S5L8900 Secure Boot
2552:d=2 hl=3 l= 159 cons: SEQUENCE
2555:d=3 hl=2 l= 13 cons: SEQUENCE
2557:d=4 hl=2 l= 9 prim: OBJECT :rsaEncryption
2568:d=4 hl=2 l= 0 prim: NULL
2570:d=3 hl=3 l= 141 prim: BIT STRING
2714:d=2 hl=2 l= 90 cons: cont [ 3 ]
2716:d=3 hl=2 l= 88 cons: SEQUENCE
2718:d=4 hl=2 l= 11 cons: SEQUENCE
2720:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Key Usage
2725:d=5 hl=2 l= 4 prim: OCTET STRING [HEX DUMP]:03020780
2731:d=4 hl=2 l= 9 cons: SEQUENCE
2733:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints
2738:d=5 hl=2 l= 2 prim: OCTET STRING [HEX DUMP]:3000
2742:d=4 hl=2 l= 29 cons: SEQUENCE
2744:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier
2749:d=5 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:041419DFD743A6C35716ED8642DDB29408A16AEDDFDE
2773:d=4 hl=2 l= 31 cons: SEQUENCE
2775:d=5 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier
2780:d=5 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:30168014493D3653C9D715E186614EACABAB1856635DC3C6
2806:d=1 hl=2 l= 13 cons: SEQUENCE
2808:d=2 hl=2 l= 9 prim: OBJECT :sha1WithRSAEncryption
2819:d=2 hl=2 l= 0 prim: NULL
2821:d=1 hl=4 l= 341 prim: BIT STRING

[[Category:Firmware Tags]]
[[Category:Firmware Parsing]]

Category:Bootrom Exploits

2009-11-05T13:45:53Z

Rusmac: New page: Exploits in the S5L8xxx bootrom - separate category just to help make things a bit more organized.

Exploits in the S5L8xxx bootrom - separate category just to help make things a bit more organized.

0x24000 Segment Overflow

2009-11-05T13:43:41Z

Rusmac:

Also known by its codename, 24kPwn, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].

As of October 2009, seven months after the exposure of this hole, Apple is now selling updated [[iPhone 3GS]] and [[N72ap|iPod Touch 2G]] units with a new bootrom, erasing the vulnerability used by this exploit.

==Credit==
A "hybrid" dev team, in alphabetical order: '''chronic''', '''CPICH''', '''ius''', '''MuscleNerd''', '''planetbeing''', '''pod2g''', '''posixninja''', et al. (anyone wishing to be unnamed)

==Background==

Upon boot-up, the [[S5L8720]] and [[S5L8920]] SoC have a MIU configuration which maps the [[VROM (S5L8720)|Secure ROM]] to 0x0, providing the newly turned on device with an ARM exception vector and the first code to execute. This MIU configuration also maps a small amount of SRAM to 0x22000000 for the [[S5L8720]], and 0x84000000 for the [[S5L8920]]. Statically allocated variables, heap, and stack must use the SRAM, as "[[VROM (S5L8720)|Secure ROM]]" is unwritable. A region of memory starting from (SRAM Start)+24000 is used for this purpose. The region of memory from the start of SRAM to (SRAM Start)+0x24000 is used as a buffer for loading the [[LLB|next stage bootloader]] code. The [[LLB]] code is stored in [[NOR]], along with code for all other bootloader stages, as well as art resources (boot logos) and the [[DeviceTree|OpenFirmware device tree]] to provide to the XNU [[kernel]]. The first portion (first 0x160 bytes) of memory at (SRAM Start)+0x24000 is used for initialized statically allocated variables. Shortly after boot, values for that region are initialized from [[VROM (S5L8720)|Secure ROM]].

==Vulnerability==

The code that reads the [[LLB]] img3 from [[NOR]] into memory does not check the size of the [[LLB]] image being loaded, instead taking the size directly from the non-signature checked portion of its img3 header on the [[NOR]] (see ROM offset 0x2178). Any image greater than 0x24000 bytes in length will begin overwriting the portion of memory used to store Secure ROM statically allocated variables. Immediately vulnerable data includes USB data structures for [[DFU]] mode, a pointer to the bdev list structure, task list structures for the Secure ROM's scheduler, as well as the addresses of the hardware SHA1 registers. All of the above are potential avenues for exploitation. The method described below uses the SHA1 register addresses.

This vulnerability was discovered independently by '''pod2g''' and '''MuscleNerd'''.

== Exploit==

The goal of the exploit is to gain arbitrary code execution capability.

The exploit, as proposed by '''planetbeing''', uses the overflow to overwrite one of the addresses of the SHA1 registers. The particular register is the only one that directly copies data to be hashed into the hardware (or into an arbitrary memory location, once the destination address has been overwritten). Code execution is achieved by writing data into the stack, specifically by overwriting the LR of the function performing the write to the "SHA1 register" so that instead of returning to the main SHA1 routine, it returns to a chosen location in memory that contains the payload code. The location chosen is within the range of memory that is filled with the [[LLB]] img3, so that the payload code can be placed within the [[LLB]] img3.

The challenge is determining what to put in as the SHA1 register location so that the right portion of stack can be overwritten with the payload LR. This can be challenging without having access to any sort of exception dump (crash register dumps in the bootrom had been disabled by Apple). '''planetbeing''' performed a static analysis of a very detailed IDB produced by '''chronic''' and '''CPICH''' and determined the theoretical call stack for both of the invocations of the SHA1 hardware within the bootrom code [http://pastie.org/414981].

In-situ verification of the LR location was performed by '''posixninja'''. '''CPICH''' discovered a way to alter the img3 DER so that the second invocation of the SHA1 hardware was not performed without affecting the first, allowing better confirmation that this step was performed properly.

The final SHA1 register address was chosen so that the first dword of the DATA tag of the [[LLB]] img3 would replace sub_5E54's LR. This is because this is the first dword of the img3 that can be altered without substantially changing the img3's structure (and possibly disrupting earlier parsing code). The LR replacement must be done the first time the exploit is triggered (by the invocation of sub_5E54), or else the bootrom would crash. Since sub_5E54 takes 0x40 bytes of data at a time, the replacement LR thus must be within the first 0x40 bytes of data to be hashed. Data to be hashed starts at 0xC bytes from the start of the img3, and the first dword of the DATA tag is 0x20 bytes from the start of the img3. Thus, the SHA1 register address chosen should be 0x20 - 0xC = 0x14 bytes before sub_5E54's LR. So, it must be 0x2202FE24. Note that the exploit will also trash up to 0x2202FE24 + 0x40 = 0x2202FE64. So a sizeable portion of doComputeSHA1's stack will be trashed as well.

The final exploit img3 was verified by '''posixninja''' under '''planetbeing''''s instructions to allow arbitrary code execution. It was a regular Img3 with padding up to 0x24000 bytes. The next 0x100 bytes were taken from the original initialization values for 0x22024000. However, 0x240FC, the offset of the SHA1 register address, was altered to 0x2202FE24. The first dword of the DATA tag (offset 0x20) was altered to 0x22023000. Payload code was placed at offset 0x23000.

==Payload==

The goal of the payload is to allow an unsigned [[LLB]] to be loaded.

There are several ways that can be used, including directly calling the JumpToMemory function which is designed to prepare the SoC and invoke the [[LLB]] code. However, it's designed to be used on decrypted, unpacked code, and the [[LLB]] code currently resides in an encrypted from within the img3's DATA tag. The simplest solution is thus to use the bootrom's own machinery to decrypt and execute the code.

The final payload evolved out of a discussion between '''pod2g''' and '''planetbeing''', based on an IDB documented by '''pod2g''', '''chronic''', '''CPICH''', et al. The lowest impact solution is to apply the pwnage patch to the rsaCheck subroutine of the bootrom, and returning from the payload from computing the SHA1 without crashing the bootrom. However, in this case, since bootrom text is unwritable, this was not a viable solution.

The next lowest impact solution is to return from the entire parseFirmwareFooter function with a successful value, instead of the failure value it would normally return if signature checks fail. This would skip any remaining code in that subroutine. This solution did not work in-situ. Failures checking the epoch tags prevented the firmware from being executed. The cause of this was not investigated.

The final payload was to return past the verification of epoch and other tags in the [[LLB]] img3 to a spot right before the DATA tag was loaded from memory and decrypted. R5 was set to 0 to ensure decryption would not be skipped. The original value for the first DATA dword (before we had to overwrite it with the exploit LR) is written back to 0x22000020 by the payload, and the original SHA1 register value was written back to 0x2202FE24 to ensure the payload only activates once.

==Deployment==

Although the exploitive [[LLB]] can be manually written to [[NOR]] by bootstrapping from a tethered jailbreak, the easiest way is to use the Apple restore process itself. Apple's Restore process will write arbitrary img3s onto the [[NOR]], even if they fail signature checks. However, the "total size" value of the img3 is fixed up by the kernel before it is written to [[NOR]]. This would negate the exploit. However, '''MuscleNerd''' discovered that this could be bypassed by including the padding in another tag, such as CERT. Then, the written exploit [[LLB]] would have the "correct", exploitive total size.

==Timing Impact==
This exploit would have allowed the [[pwnage]] of the next generation iPhone without the discovery of an additional code execution vulnerability (required to write the exploit [[LLB]]), provided that the bug still existed in the next generation's bootrom. Even though it was too late to patch the bootrom, it was not too late for Apple to repair the restore process in the stock IPSW, removing the method used to get the exploitive [[LLB]] onto the device. Before, Apple would have no reason to fix this, since writing arbitrary data to [[NOR]] does not negate their chain of trust. However, now that a way has been found, they were able to prioritize a fix for this oversight thus making the permanent [[pwnage]] of future devices significantly more difficult.

Thanks to irresponsible handling of the exploit by a third-party company known as [[NitroKey]] who were interested in making financial gain from the work of others, this eventuality became a near-certainty and pretty much erased the possibility of a day-of-release jailbreak for the [[iPhone 3GS]] and the third-generation iPod touch. In addition, to counteract the exploit, with the early exposure of the exploit, Apple were able to add the [[ECID]] tag to the [[IMG3 File Format|IMG3 format]] in the iPhone 3GS. The early leak of the exploit allowed Apple to understand that an iBoot exploit would be necessary to flash the required oversized LLB and through doing so, Apple have prevented this exploit from allowing the iPhone 3GS to be permanently jailbroken through this exploit unless new iBoot exploits (allowing unsigned code to be run) can be found in every firmware release or a signed copy of an (older) vulnerable version of iBoot is stored.

May the bastards of NitroKey burn in hell for all eternity.

==3GS Implementation==

The exploit remains the same in spirit.

The call tree and stacks analysis is very similar although a few bytes here and there changed it slightly. It was again done manually but afterward, and out of fun, an IDA Python Script was written to automate the process. The new static analysis can be seen here [http://pastie.org/551212], and the IDA Python Script for it there [http://github.com/iZsh/IDA-Python-Scripts/].

The main differences are:

* the SRAM is at 0x84000000 instead of 0x22000000
* the Original value of the first DATA dword is written back to 0x84000040 (which was overwritten by the LR address)
* the SHA1 register original value is written back to 0x840241CC
* '''The decrypt flag is not held in R5 anymore''', but in a local variable of the function "my_process_module" (sub_2564). An extra static analysis tells us this variable is held at 0x84033F30, thus that's where you have to store your 0x0 value before returning to this function.

[[Category:Bootrom Exploits]]

Pwnage 2.0

2009-11-05T13:42:40Z

Rusmac:

This exploit in the [[VROM (S5L8900)|S5L8900 bootrom]] is really the ultimate exploit, since it allows unsigned code to be run at the lowest level. It is available in all devices that use the [[S5L8900]] - the [[M68ap|iPhone]], [[N45ap|iPod Touch]] and [[N82ap|iPhone 3G]].

==Credit==
[[iPhone Dev Team]]

==Exploit==
There is a stack overflow in the certificate parsing code. By passing a malformed certificate, unsigned code can be run.

==Implementations==
*[[PwnageTool]]
*[[QuickPwn]]
*[[WinPwn]]
*[[redsn0w]]
*[http://lpahome.com/geohot/iran.rar iran]

[[Category:Bootrom Exploits]]

Baseband Device

2009-11-04T16:05:08Z

Rusmac:

This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the ARM core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in it's NVRAM.

The [[iPhone]]'s baseband processor is the [[S-Gold 2]].
The [[iPhone 3G]] and the [[iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose.

You can check some [[Baseband Commands]] too (by pH and EvilPenguin).

==Seczone==
This is the area in the baseband where the lock state is stored.

===Layout===
0x400--NCK token
0xB00--IMEI
0xB10--IMEI signature
0xC00--Locks table

===Encryption===
Many of the sections are encrypted using TEA based off the CHIPID and NORID. See [[NCK Brute Force]] for more info.

==Exploits==
* [[SIM hacks]]
===[[S-Gold 2]]===
* [[Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Minus 0x20000 with Back Extend Erase]]
===[[X-Gold 608]]===
* [[JerrySIM]]
* [[AT+stkprof]]
* [[AT+XLOG Vulnerability]]
* [[AT+XEMN Heap Overflow]]

==Theoretical Attacks==
* [[NCK Brute Force]]
* [[Baseband JTAG]]

==Boot Chain==
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

[[Category:Baseband]]

Baseband Device

2009-11-04T15:59:02Z

Rusmac:

This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the ARM core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in it's NVRAM.

The [[iPhone]]'s baseband processor is the [[S-Gold 2]].
The [[iPhone 3G]] and the [[iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose.

You can check some [[Baseband Commands]] too (by pH and EvilPenguin).

==Seczone==
This is the area in the baseband where the lock state is stored.

===Layout===
0x400--NCK token
0xB00--IMEI
0xB10--IMEI signature
0xC00--Locks table

===Encryption===
Many of the sections are encrypted using TEA based off the CHIPID and NORID. See [[NCK Brute Force]] for more info.

==Exploits==
* [[SIM hacks]]
* [[Fakeblank|Hardware Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Minus 0x20000 with Back Extend Erase]]
* [[JerrySIM]]
* [[AT+stkprof]]
* [[AT+XLOG Vulnerability]]
* [[AT+XEMN Heap Overflow]]

==Theoretical Attacks==
* [[NCK Brute Force]]
* [[Baseband JTAG]]

==Boot Chain==
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

[[Category:Baseband]]

AT+stkprof

2009-11-04T15:57:31Z

Rusmac: At+stkprof moved to AT+stkprof

Used as an injection vector for the first [[iPhone 3G]] [[Unlock 2.0|unlock]] [[yellowsn0w|payload]].

==Credit==
[[geohot]]

==Exploit==
There is a stack-based buffer overflow in the at+stkprof command that allows unsigned code execution on the [[X-Gold 608|iPhone 3G baseband]].

==Implementation==
The [[dev team]] used this exploit in the first public iPhone 3G unlock called [[yellowsn0w]]. It can be downloaded from Cydia, and is a daemon that will run in the background. It will inject their payload whenever the baseband is reset.

The source code (for old version 0.9.1) is also available here [http://xs1.iphwn.org/releases/yellowsn0w.tar.bz2]

===New Implementation (yellowsn0w 0.9.8)===
In the newest yellowsn0w, this command is still used as the injection vector for the exploit, but it is used differently. It is still the at+stkprof command, but it seems to send their stuff all in one go.

<pre>
at+stkprof=1,"064a541c044b1878222803d0107001320133f8e720470000bf
9f154000170100546e5640200000005c130100266e5640ddddddddeeeeeeeeb8
905120000000001010101020202020611301000c000000";"\x10\x32\x0F\x27
\xBA\x43\x17\x1C\x0E\xA4\x0B\xA5\x01\x35\x21\x78\x78\x29\x0C\xD0
\xA8\x47\x0B\x01\x61\x78\xA8\x47\xC0\x46\xC0\x46\xC0\x46\xC0\x46
\xC9\x18\x11\x70\x02\x34\x01\x32\xEF\xE7\xC0\x46\xC0\x46\x01\x37
\x38\x47\x30\x30\x41\x29\x01\xDA09pG79pG024803A1013101601FBD0000
4C711140F0B51C4B80268BB03601188008911A4C301CA047002509909820A047
071CC56080204000A047802214495200144B041C9847099B0193442303930A23
013405930C23221C06930F49009502960495381C00230D4CA047021C002804D1
0B4908980B4B984703E00B490898094B98470BB0F0BD000044B33B40AC201420
641A0100A0583C20481A010040B53F20541A010000DD4620581A010064657674
65616D31000000004F4B21004552524F522025640000000030B5114D85B0114B
281C6946FF229847009B0D2B11D101990D4B0A681A6004334A681A608A680B4B
13600B4B53600B4B93600123CB6020230093281C6946FF22074B9847DFE70000
5427234098591620BC792F4000FF0001010402040304040468D53E20xx"
</pre>

Information on how this was used can be found [[Yellowsn0w#Payload_w.2F_Comments_.28by_Darkmen.29_.3D|here]]

[[Category:Baseband Exploits]]

Talk:AT+stkprof

2009-11-04T15:57:31Z

Rusmac: Talk:At+stkprof moved to Talk:AT+stkprof

== damn ==

props Darkmen, that is some epic shit right there :)

== wrong topic ==

it's on the wrong topic

== ah ==

yeah now that i think of it, thats for the yellowsn0w payload. ill move it.

== just for general knowledge ==

How did the exploit was found? By disassembling the baseband firmware code and analyzing it? Or fuzzing or something like that?

:I typed stuff until it crashed...--[[User:Geohot|geohot]] 17:05, 12 April 2009 (UTC)

::Random AT commands?

== New Implementation (yellowsn0w 0.9.6) is wrong ==

It isn't the code they're using. Even the syntax is wrong (it gets a length as the first parameter)

However, extracting it from the yellowsn0w binary is easy.

~Oranav

At+stkprof

2009-11-04T15:57:31Z

Rusmac: At+stkprof moved to AT+stkprof

#REDIRECT [[AT+stkprof]]

Baseband Device

2009-11-04T15:51:04Z

Rusmac:

This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the ARM core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in it's NVRAM.

The [[iPhone]]'s baseband processor is the [[S-Gold 2]].
The [[iPhone 3G]] and the [[iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose.

You can check some [[Baseband Commands]] too (by pH and EvilPenguin)

==Seczone==
This is the area in the baseband where the lock state is stored.

===Layout===
0x400--NCK token
0xB00--IMEI
0xB10--IMEI signature
0xC00--Locks table

===Encryption===
Many of the sections are encrypted using TEA based off the CHIPID and NORID. See [[NCK Brute Force]] for more info.

==Exploits==
* [[SIM hacks]]
* [[Fakeblank|Hardware Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Jerrysim]]
* [[Minus 0x20000 with Back Extend Erase]]
* [[At+stkprof]]
* [[AT+XLOG Vulnerability]]

==Theoretical Attacks==
* [[NCK Brute Force]]
* [[Baseband JTAG]]

==Boot Chain==
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

[[Category:Baseband]]