The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "Bootx (iBoot command)"

From The iPhone Wiki
Jump to: navigation, search
(→‎iPhone 3GS 8920x from iBoot-636.66)
(added something a little more understandable (IMHO))
Line 1: Line 1:
 
== iPhone 3GS 8920x from iBoot-636.66 ==
  
== iPhone 3GS 8920x from iBoot-636.66 ==
   
  +
==Disassembly==
 
<pre>
  
<pre>
 
N88AP_iBoot:4FF007E8 n88ap__iBoot__bootx_function ; DATA XREF: N88AP_iBoot:n88ap__iBoot__bootx�o
  
N88AP_iBoot:4FF007E8 n88ap__iBoot__bootx_function ; DATA XREF: N88AP_iBoot:n88ap__iBoot__bootx�o
Line 94: Line 95:
 
N88AP_iBoot:4FF00878 ; "kernelcache prepped at address 0x%08x\n"
  
N88AP_iBoot:4FF00878 ; "kernelcache prepped at address 0x%08x\n"
 
N88AP_iBoot:4FF0087C off_4FF0087C DCD dword_4FF2DC40 ; DATA XREF: n88ap__iBoot__bootx_function+68�r
  
N88AP_iBoot:4FF0087C off_4FF0087C DCD dword_4FF2DC40 ; DATA XREF: n88ap__iBoot__bootx_function+68�r
  +
</pre>
  +
  +
==Decompliation==
  +
<pre>
  +
#define kLoadAddress 0x41000000
  +
#define kKernelMaxSize 0xF00000
  +
  +
int cmd_bootx(int argv, CmdArg* argv) {
  +
void* address = NULL;
  +
if(argc > 1 && !strcmp("help", argv[1].string)) {
  +
printf("usage:\n\t%s [<address>]\n", argv[0].string);
  +
return -1;
  +
}
  +
  +
if(range_check(kLoadAddress, kKernelMaxSize) < 0) {
  +
printf("Permission Denied\n");
  +
return -1;
  +
}
  +
  +
printf("Attempting to validate kernelcache @ 0x%08x\n", kLoadAddress);
  +
int err = load_macho_image(kLoadAddress, kKernelMaxSize, &address)
  +
if(err >= 0) {
  +
printf("kernelcache prepped at address 0x%08x\n", address);
  +
jump_to(3, address, gBootArgs);
  +
  +
} else {
  +
printf("error loading kernelcache\n");
  +
}
  +
  +
return err;
  +
}
 
</pre>
  
</pre>

Revision as of 03:37, 7 March 2010

iPhone 3GS 8920x from iBoot-636.66

Disassembly

N88AP_iBoot:4FF007E8     n88ap__iBoot__bootx_function            ; DATA XREF: N88AP_iBoot:n88ap__iBoot__bootx�o
N88AP_iBoot:4FF007E8
N88AP_iBoot:4FF007E8     kernelcache_prepped_memory_pos= -0x10
N88AP_iBoot:4FF007E8     oldR4           = -0xC
N88AP_iBoot:4FF007E8     oldR7           = -8
N88AP_iBoot:4FF007E8     oldLR           = -4
N88AP_iBoot:4FF007E8
N88AP_iBoot:4FF007E8 000                 PUSH    {R4,R7,LR}      ; Push registers
N88AP_iBoot:4FF007EA 00C                 ADD     R7, SP, #4      ; Rd = Op1 + Op2
N88AP_iBoot:4FF007EC 00C                 SUB     SP, SP, #4      ; Rd = Op1 - Op2
N88AP_iBoot:4FF007EE 010                 CMP     R0, #1          ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF007F0 010                 MOV     R4, R1          ; Rd = Op2
N88AP_iBoot:4FF007F2 010                 BLE     loc_4FF00808    ; Branch
N88AP_iBoot:4FF007F4 010                 LDR     R1, [R1,#0x24]  ; argv[1]
N88AP_iBoot:4FF007F6 010                 LDR     R0, =aHelp      ; "help"
N88AP_iBoot:4FF007F8 010                 BL      strcmp          ; Branch with Link
N88AP_iBoot:4FF007FC 010                 CBNZ    R0, loc_4FF00808 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF007FE 010                 LDR     R1, [R4,#0x10]  ; param_R1
N88AP_iBoot:4FF00800 010                 LDR     R0, =aUsageSAddress ; "usage:\n\t%s [<address>]\n"
N88AP_iBoot:4FF00802 010                 BL      N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF00806 010                 B       loc_4FF0081C    ; Branch
N88AP_iBoot:4FF00808     ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00808
N88AP_iBoot:4FF00808     loc_4FF00808                            ; CODE XREF: n88ap__iBoot__bootx_function+A�j
N88AP_iBoot:4FF00808                                             ; n88ap__iBoot__bootx_function+14�j
N88AP_iBoot:4FF00808 010                 MOV.W   R0, #n88ap_ramdisk ; addr
N88AP_iBoot:4FF0080C 010                 MOV.W   R1, #0xF00000      ; size
N88AP_iBoot:4FF00810 010                 BL      check_range        ; Branch with Link
N88AP_iBoot:4FF00814 010                 CBNZ    R0, loc_4FF00822   ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF00816 010                 LDR     R0, =aPermissionDenied ; "Permission Denied\n"
N88AP_iBoot:4FF00818 010                 BL      N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF0081C
N88AP_iBoot:4FF0081C     loc_4FF0081C                            ; CODE XREF: n88ap__iBoot__bootx_function+1E�j
N88AP_iBoot:4FF0081C 010                 MOV.W   R4, #0xFFFFFFFF ; fail
N88AP_iBoot:4FF00820 010                 B       loc_4FF0085C    ; Branch
N88AP_iBoot:4FF00822     ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00822
N88AP_iBoot:4FF00822     loc_4FF00822                            ; CODE XREF: n88ap__iBoot__bootx_function+2C�j
N88AP_iBoot:4FF00822 010                 MOV.W   R1, #n88ap_ramdisk ; param_R1
N88AP_iBoot:4FF00826 010                 LDR     R0, =aAttemptingToValidateKernelcache0x08x ; "Attempting to validate kernelcache @ 0x"...
N88AP_iBoot:4FF00828 010                 BL      N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF0082C 010                 MOV.W   R0, #n88ap_ramdisk ; memoery_pos
N88AP_iBoot:4FF00830 010                 MOV.W   R1, #0xF00000   ; memory_size
N88AP_iBoot:4FF00834 010                 MOV     R2, SP          ; Rd = Op2
N88AP_iBoot:4FF00836 010                 BL      LoadImage_kernelcache_img3 ; Branch with Link
N88AP_iBoot:4FF0083A 010                 CMP     R0, #0          ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF0083C 010                 MOV     R4, R0          ; Rd = Op2
N88AP_iBoot:4FF0083E 010                 BGE     loc_4FF00848    ; Branch
N88AP_iBoot:4FF00840 010                 LDR     R0, =aErrorLoadingKernelcache ; "error loading kernelcache\n"
N88AP_iBoot:4FF00842 010                 BL      N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF00846 010                 B       loc_4FF0085C    ; Branch
N88AP_iBoot:4FF00848     ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00848
N88AP_iBoot:4FF00848     loc_4FF00848                            ; CODE XREF: n88ap__iBoot__bootx_function+56�j
N88AP_iBoot:4FF00848 010                 LDR     R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; param_R1
N88AP_iBoot:4FF0084A 010                 LDR     R0, =aKernelcachePreppedAtAddress0x08x ; "kernelcache prepped at address 0x%08x\n"
N88AP_iBoot:4FF0084C 010                 BL      N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF00850 010                 LDR     R2, =dword_4FF2DC40 ; Load from Memory
N88AP_iBoot:4FF00852 010                 MOVS    R0, #3          ; Rd = Op2
N88AP_iBoot:4FF00854 010                 LDR     R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; Load from Memory
N88AP_iBoot:4FF00856 010                 LDR     R2, [R2]        ; Load from Memory
N88AP_iBoot:4FF00858 010                 BL      jump_to_addr    ; Branch with Link
N88AP_iBoot:4FF0085C
N88AP_iBoot:4FF0085C     loc_4FF0085C                            ; CODE XREF: n88ap__iBoot__bootx_function+38�j
N88AP_iBoot:4FF0085C                                             ; n88ap__iBoot__bootx_function+5E�j
N88AP_iBoot:4FF0085C 010                 MOV     R0, R4          ; Rd = Op2
N88AP_iBoot:4FF0085E 010                 SUB.W   SP, R7, #4      ; Rd = Op1 - Op2
N88AP_iBoot:4FF00862 010                 POP     {R4,R7,PC}      ; Pop registers
N88AP_iBoot:4FF00862     ; End of function n88ap__iBoot__bootx_function
N88AP_iBoot:4FF00862
N88AP_iBoot:4FF00862     ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00864     off_4FF00864    DCD aHelp               ; DATA XREF: n88ap__iBoot__bootx_function+E�r
N88AP_iBoot:4FF00864                                             ; "help"
N88AP_iBoot:4FF00868     ; int off_4FF00868
N88AP_iBoot:4FF00868     off_4FF00868    DCD aUsageSAddress      ; DATA XREF: n88ap__iBoot__bootx_function+18�r
N88AP_iBoot:4FF00868                                             ; "usage:\n\t%s [<address>]\n"
N88AP_iBoot:4FF0086C     ; int off_4FF0086C
N88AP_iBoot:4FF0086C     off_4FF0086C    DCD aPermissionDenied   ; DATA XREF: n88ap__iBoot__bootx_function+2E�r
N88AP_iBoot:4FF0086C                                             ; "Permission Denied\n"
N88AP_iBoot:4FF00870     ; int off_4FF00870
N88AP_iBoot:4FF00870     off_4FF00870    DCD aAttemptingToValidateKernelcache0x08x
N88AP_iBoot:4FF00870                                             ; DATA XREF: n88ap__iBoot__bootx_function+3E�r
N88AP_iBoot:4FF00870                                             ; "Attempting to validate kernelcache @ 0x"...
N88AP_iBoot:4FF00874     ; int off_4FF00874
N88AP_iBoot:4FF00874     off_4FF00874    DCD aErrorLoadingKernelcache
N88AP_iBoot:4FF00874                                             ; DATA XREF: n88ap__iBoot__bootx_function+58�r
N88AP_iBoot:4FF00874                                             ; "error loading kernelcache\n"
N88AP_iBoot:4FF00878     ; int off_4FF00878
N88AP_iBoot:4FF00878     off_4FF00878    DCD aKernelcachePreppedAtAddress0x08x
N88AP_iBoot:4FF00878                                             ; DATA XREF: n88ap__iBoot__bootx_function+62�r
N88AP_iBoot:4FF00878                                             ; "kernelcache prepped at address 0x%08x\n"
N88AP_iBoot:4FF0087C     off_4FF0087C    DCD dword_4FF2DC40      ; DATA XREF: n88ap__iBoot__bootx_function+68�r

Decompliation

#define kLoadAddress 0x41000000
#define kKernelMaxSize 0xF00000

int cmd_bootx(int argv, CmdArg* argv) {
    void* address = NULL;
    if(argc > 1 && !strcmp("help", argv[1].string)) {
        printf("usage:\n\t%s [<address>]\n", argv[0].string);
        return -1;
    }
    
    if(range_check(kLoadAddress, kKernelMaxSize) < 0) {
        printf("Permission Denied\n");
        return -1;
    }
    
    printf("Attempting to validate kernelcache @ 0x%08x\n", kLoadAddress);
    int err = load_macho_image(kLoadAddress, kKernelMaxSize, &address)
    if(err >= 0) {
        printf("kernelcache prepped at address 0x%08x\n", address);
        jump_to(3, address, gBootArgs);
        
    } else {
        printf("error loading kernelcache\n");
    }
    
    return err;
}
Retrieved from "https://www.theiphonewiki.com/w/index.php?title=Bootx_(iBoot_command)&oldid=5866"