Code:
/* (c) 2013 multiMAN path-substitute routine by dean
Example for 4.30CFW LV2:
MM_FUNCTION : 0x2D2418 (this is where the code of MM_FUNCTION is)
Function_Base : 0x2C3CD4 (this is the intercepted function)
Code change at : Function_Base + 0x24
--- mr r29, r3 // 7C 7D 1B 78 <-- Here is the ONLY 4-byte code change we make to LV2 to call the new function
+++ bl MM_FUNCTION // 48 00 E7 21 <-- 0xE720 (+1 for blr) = (MM_FUNCTION - Function_Base - 0x24)
... and here is the MM_FUNCTION: */
#define MAP_TABLE (0xE8) // address of path-map table (set to 0x80000000007FAE00)
// NEW_PATH (0xF0) // address of the returned spoofed path (set to 0x80000000007FFBE0)
#define ABS2(target) ((target) - .)
.org 0
mr %r29, %r3
li %r27, 1
rldicr %r27, %r27, 63, 0
ori %r27, %r27, (MAP_TABLE)@l
ld %r26, 0(%r27)
cmpwi %r26, 0
beqlr
ld %r31, 8(%r27)
check_next:
ld %r5, 0(%r26)
cmpwi %r5, 0
beq return_1
mr %r3, %r29
ld %r4, 16(%r26)
//strncmp
lbz %r11, 0(%r4)
lbz %r9, 0(%r3)
clrlwi %r0, %r11, 24
cmpw cr7, %r9, %r11
bne cr7, cmp_end
cmpwi cr7, %r0, 0
mtctr %r5
bne cr7, skip_to_next
b ABS2(cmp_end)
cmp_loop:
lbz %r11, 0(%r4)
lbz %r9, 0(%r3)
clrlwi %r0, %r11, 24
cmpw cr7, %r9, %r11
cmpwi cr6, %r0, 0
bne cr7, cmp_end
beq cr6, cmp_end
skip_to_next:
addi %r3, %r3, 1
addi %r4, %r4, 1
bdnz cmp_loop
b ABS2(found_match)
//strncmp end
cmp_end:
addi %r26, %r26, 32
b ABS2(check_next)
found_match:
ld %r4, 24(%r26)
mr %r3, %r31
//strcpy
lbz %r0, 0(%r4)
cmpwi cr7, %r0, 0
stb %r0, 0(%r3)
beq cr7, go_on_1
mr %r9, %r3
next_char_1:
lbzu %r0, 1(%r4)
cmpwi cr7, %r0, 0
stbu %r0, 1(%r9)
bne cr7, next_char_1
//strcpy end
go_on_1:
ld %r5, 8(%r26)
add %r3, %r3, %r5
mr %r4, %r29
ld %r5, 0(%r26)
add %r4, %r4, %r5
//strcpy
lbz %r0, 0(%r4)
cmpwi cr7, %r0, 0
stb %r0, 0(%r3)
beq cr7, go_on_2
mr %r9, %r3
next_char_2:
lbzu %r0, 1(%r4)
cmpwi cr7, %r0, 0
stbu %r0, 1(%r9)
bne cr7, next_char_2
//strcpy end
go_on_2:
mr %r29, %r31
return_1:
mr %r3, %r29
blr That's it. Here are the offsets for other firmwares: