GW 1.0 ROP Loader

file modes:
read 1
write 2
create 4

file position:
begin 0
current 1
end 2

media type:
nand 0
sdmc 1
ctrc 2

mountsdmc - const char*
file ops - const wchar_t*


NVRAM chains

initial patch

--- top --- (low address)

0010F2B9	- begin, THUMB
0001FE00	pop {r0, r2, pc}
00000100

001549E1	pop {r1, pc}
00279400

001334FC	load_nvram(0x1FE00, 0x279400, 0x100);
001E8CD0	r4

0010538C	pop {r3, pc}
F027949C	mainmem virtual addr - r3

00143D60	ADD     SP, SP, R3 - exit to loader chain

--- bottom --- (high address)

*SD must be mounted then fopen, fread, decrypt, jump*

loader patch

--- top --- (low address)

0010F2B9	- begin, THUMB
00272BAE	pop {r0, r2, pc}
BADC0DED	const char* archive_name = "YS:"

0018F19C	nn::fs::MountSdmc("YS:");
0010B690	r3
00FAB000	r4
00200200	r5

0010F2B9	pop {r0, r2, pc}
00279000	this->
00000001	FILE_READ

001549E1	pop {r1, pc}
00276F38	const wchar_t* file_name = L"YS:/Launcher.dat"

001B82AC	nn::fs::FileStream::Initialize(this->, L"YS:/Launcher.dat", FILE_READ);
0018D5DC	r4
00278340	r5
00100200	r6
000048CC	r7
00143D60	r8

0010F2B9	pop {r0, r2, pc}
00279000	this->
002B0000	void* in_buf(for fread)

001002F9	pop {pc}

001002F9	pop {pc}

001002F9	pop {pc}

001002F9	pop {pc}

001002F9	pop {pc}

001002F9	pop {pc}

001549E1	pop {r1, pc}
00000000

001549E1	pop {r1, pc}
00279020	s32* read_in

0010538C	pop {r3, pc}
00009000	size_t read_size

001B3958	nn::fs::FileStream::TryRead(this->, s32* read_in, void* in_buf, size_t read_size);
002104E5	r4
0019DA00	r5
00017500	r6
0021DF86	r7
001AC100	r8
001DDA22	r9

0016FE91	POP     {R0-R4,PC}
00100100	r0  - ptr to 16-byte Launcher.dat decryption key
00144CBC	r1
002B0000	r2	in_buf(to decrypt from)
00009000	r3	read_size(to decrypt)
001549E1	r4

0022EFAC	decryptAES
00105C88	r4
000E0000	r5
00250390	r6
001EFAC0	r7
0016FE91	r8

0010538C	pop {r3, pc}
00036B24

00143D60	ADD     SP, SP, R3 - exit to Launcher.dat

--- bottom --- (high address)



virtual s32 Write(const void* buffer, size_t size, bool flush)
virtual Result TryWrite(s32* pOut, const void* buffer, size_t size, bool flush)
this->
279020
00100000
c000

00 00 10 00
00 10 00 00