and more assembler...

[rsbs2] / rsb-crc.c

diff --git a/rsb-crc.c b/rsb-crc.c
index fa40c498099e3b3838e8e325f00b844940287bc1..00b341f85c48de4add23b2c3b7b7ef0348d9cd88 100644 (file)
--- a/rsb-crc.c
+++ b/rsb-crc.c
@@ -1,7 +1,10 @@
+#include <stdio.h>
+
 #define POLY 0x04c11db7
 
 /* Theory of operation:
  * (arm-elf-objdump -b binary -m arm -M reg-names-raw -D RSB_S2_SINGLE.bin)
+ * Addresses: 0x4c4, 0x55ae0, 0x59734
  *
  * 440: push  {r4, r5, r6, r7, r8, r9, r10, r11, r14}
  * 444: mov   r11, r0
@@ -62,3 +65,111 @@ unsigned int rsb_crc(unsigned int r11_crc, unsigned char *r10_buf, unsigned int
 
        return r11_crc;
 }
+
+/* Second broken algorithm:
+ *
+ * 55a30: push    {r3, r4, r5, r6, r7, r8, r9, r14}
+ * 55a34: bl      0x55a3c
+ * 55a38: pop     {r3, r4, r5, r6, r7, r8, r9, r15}
+ * 55a3c: mov     r8, #1  ; 0x1
+ * 55a40: mov     r3, #-1073741824        ; 0xc0000000
+ * 55a44: cmp     r0, r3
+ * 55a48: ble     0x55ad8
+ * 55a4c: mov     r3, #32 ; 0x20
+ * 55a50: ldr     r4, [r3, r0]!
+ * 55a54: mov     r8, #2  ; 0x2
+ * 55a58: ldr     r5, [r3, #4]
+ * 55a5c: cmp     r5, r2
+ * 55a60: bne     0x55ad8
+ * 55a64: mov     r8, #3  ; 0x3
+ * 55a68: cmp     r1, r4
+ * 55a6c: movscs  r5, #0  ; 0x0
+ * 55a70: movscc  r5, #1  ; 0x1
+ * 55a74: bne     0x55ad8
+ * 55a78: mov     r8, #4  ; 0x4
+ * 55a7c: mov     r3, r0
+ * 55a80: add     r4, r0, r4
+ * 55a84: mvn     r5, #0  ; 0x0
+ * 55a88: ldr     r7, [pc, #80]   ; 0x55ae0
+ * 55a8c: cmp     r3, r4
+ * 55a90: bcs     0x55ac8
+ * 55a94: bic     r9, r3, #3      ; 0x3
+ * 55a98: ldr     r6, [r9]
+ * 55a9c: and     r9, r3, #3      ; 0x3
+ * 55aa0: lsl     r9, r9, #3
+ * 55aa4: lsr     r6, r6, r9
+ * 55aa8: eor     r5, r5, r6, lsl #24
+ * 55aac: mov     r6, #8  ; 0x8
+ * 55ab0: lsls    r5, r5, #1
+ * 55ab4: eorcs   r5, r5, r7
+ * 55ab8: subs    r6, r6, #1      ; 0x1
+ * 55abc: bne     0x55ab0
+ * 55ac0: add     r3, r3, #1      ; 0x1
+ * 55ac4: b       0x55a8c
+ * 55ac8: mvn     r5, r5
+ * 55acc: ldr     r3, [r4]
+ * 55ad0: subs    r3, r3, r5
+ * 55ad4: moveq   r8, #0  ; 0x0
+ * 55ad8: mov     r0, r8
+ * 55adc: mov     r15, r14
+ * 55ae0: DATA:   0x04c11db7
+ */
+
+unsigned int rsb_crc2(unsigned char *r0_buf, unsigned int r1_buflen, unsigned int r2_magic, unsigned int *crc_out) {
+       int r8_ret = 1;
+       unsigned int r3_pos = 0xc0000000;
+       unsigned int r4_len;
+       unsigned int r5_crc;
+       unsigned int r6;
+       unsigned int r9;
+       unsigned int carry;
+
+#if 0
+       if (r0_buf <= r3_pos)
+               return 1; /* Not in RAM */
+#endif
+
+       r4_len = *(unsigned int*)(r0_buf + 0x20);
+
+       if (*((unsigned int*)(r0_buf + 0x24)) != r2_magic)
+               return 2; /* MAGIC does not match */
+       
+       if (r1_buflen < r4_len)
+               return 3; /* image to small */
+       
+       r8_ret = 4;
+
+       r3_pos = (unsigned int)r0_buf;
+       r4_len += r3_pos;
+       
+       r5_crc = ~0x0;
+
+       while (r3_pos < r4_len) {
+               r9 = r3_pos & (~0x3);
+               r6 = *((unsigned int*)r9);
+               r9 = r3_pos & 0x3;
+               r9 = r9 << 0x3;
+               r6 = r6 >> r9;
+               r5_crc = r5_crc ^ (r6 << 24);
+               r6 = 0x8;
+
+               do {
+                       carry = r5_crc & 0x80000000;
+                       r5_crc = r5_crc << 1;
+                       if (carry)
+                               r5_crc = r5_crc ^ POLY;
+                       r6--;
+               } while(r6);
+               r3_pos++;
+       }
+
+       r5_crc = ~r5_crc;
+       *crc_out = r5_crc;
+
+       r3_pos = *((unsigned int*)r4_len);
+
+       if (r3_pos == r5_crc)
+               r8_ret = 0;
+
+       return r8_ret;
+}