ARM11 RAM Edit

/*
 * uvloader.c - Userland Vita Loader entry point
 * Copyright 2012 Yifan Lu
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#define START_SECTION __attribute__ ((section (".text.start"), naked))

// make sure code is PIE
#ifndef __PIE__
#error "Must compile with -fPIE"
#endif

int(*IFile_Open)(void *this, const short *path, int flags) = 0x0022FE08;
int(*IFile_Write)(void *this, unsigned int *written, void *src, unsigned int len) = 0x00168764;
int (*GX_SetTextureCopy)(void *input_buffer, void *output_buffer, unsigned int size, int in_x, int in_y, int out_x, int out_y, int flags) = 0x0011DD48;
int (*GSPGPU_FlushDataCache)(void *addr, unsigned int len) = 0x00191504;
int (*svcSleepThread)(unsigned long long nanoseconds) = 0x0023FFE8;

int uvl_entry();

/********************************************//**
 *  \brief Starting point from exploit
 *
 *  Call this from your exploit to run UVLoader.
 *  It will first cache all loaded modules and
 *  attempt to resolve its own NIDs which
 *  should only depend on sceLibKernel.
 *  \returns Zero on success, otherwise error
 ***********************************************/

int START_SECTION
uvl_start ()
{
    __asm__ volatile (".word 0xE1A00000");
    uvl_entry();
    __asm__ volatile ("bx lr");
}

/********************************************//**
 *  \brief Entry point of UVLoader
 *
 *  \returns Zero on success, otherwise error
 ***********************************************/
int
uvl_entry ()
{
    unsigned int addr;
    void *this = 0x08F10000;
    int *written = 0x08F01000;
    int *buf = 0x18410000;

    unsigned int offset;
    int i;

    //IFile_Open(this, L"dmc:/mem-0xFFFF0000.bin", 6);
    svcSleepThread(0x400000LL);

    //copy block of memory to buffer
    addr = 0x17A00000;
    GSPGPU_FlushDataCache(addr, 0x10000);
    GX_SetTextureCopy(addr, buf, 0x10000, 0, 0, 0, 0, 8);
    GSPGPU_FlushDataCache(buf, 0x10000);

    //finds the encouter data of Petalburg Woods(AS, OR untested)
    offset = 0;
    for (i = 0; i < 0x4000; i++)
    {
        if ((buf[i] == 0x01070000) && (buf[i + 1] == 0x01070404))
        {
            offset = i;
        }
    }

    //if it found somthing overwrite data
    if (offset != 0)
    {
        buf[offset] = 0x02D10000;
        for (i = (offset + 1); i < (offset + 61); i++)
        {
            buf[i] = 0x02D10202;
        }
        buf[offset + 61] = 0x00000202;
    }

    //flush back to memory and also write to file for debuging
    svcSleepThread(0x400000LL);
    GSPGPU_FlushDataCache(buf, 0x10000);
    GX_SetTextureCopy(buf, addr, 0x10000, 0, 0, 0, 0, 8);
    GSPGPU_FlushDataCache(addr, 0x10000);
    //IFile_Write(this, written, buf, 0x10000);
    svcSleepThread(0x400000LL);

    /*// FCRAM dump
    for (addr = 0x14000000; addr < 0x1A800000; addr += 0x10000)
    {
        //dumps a 0x10000 bytes of ram to sd card
        GSPGPU_FlushDataCache(addr, 0x10000);
        GX_SetTextureCopy(addr, buf, 0x10000, 0, 0, 0, 0, 8);
        GSPGPU_FlushDataCache(buf, 0x10000);
        svcSleepThread(0x400000LL);
        IFile_Write(this, written, buf, 0x10000);

        //flashes mostly black screen on the bottom screen for a few frames, this is so i know the program is running and not frozen
        GSPGPU_FlushDataCache(0x18000000, 0x00038400);
        GX_SetTextureCopy(0x18000000, 0x1F48F000, 0x00038400, 0, 0, 0, 0, 8);
        svcSleepThread(0x400000LL);
        GSPGPU_FlushDataCache(0x18000000, 0x00038400);
        GX_SetTextureCopy(0x18000000, 0x1F4C7800, 0x00038400, 0, 0, 0, 0, 8);
        svcSleepThread(0x400000LL);
    }*/

    return 0;
}



/********************************************//**
 *  \brief Exiting point for loaded application
 *
 *  This hooks on to exit() call and cleans up
 *  after the application is unloaded.
 *  \returns Zero on success, otherwise error
 ***********************************************/
int
uvl_exit (int status)
{
    return 0;
}