Tweet
Edit, I apologize for the incorrect terms, I was up late last night and wasn't thinking correctly. The 'hook' I specified below is actually the engine and the jalr is actually the hook. I will now fix them.
Note: With my dump of the kernel, the address 80078000 is all nops.
The following code is written in Code Designer, so the 'call' operations are just jals to the specified part of the function. The address at the top marks the address that the whole code will start with. What I am wondering is why it freezes when I launch the game. The hook is in the kernel and replaces a jalr k0. When I run the code without the jalr k0 (that was included in my engine) in CodeMajic, it operates perfectly. However, with my app, it doesn't work with or without the jalr k0 from my hook. This makes me feel that the fault is not behind the jalr k0, but rather the engine placement. I believe that the jal $80078000 (Where my engine is installed), doesn't jump to my engine, it instead jumps to another address. The result is the freezing of the game. My question is, is there something I am doing wrong with the actual hook, or is it the jal $80078000? Thank you.
Here is the engine code, along with the hook in the main.c.
jal hook and installation of the engine inside the main.c. The engine is loaded from a *.c file that specifies Engine with all its values in hexadecimal.
Note: With my dump of the kernel, the address 80078000 is all nops.
The following code is written in Code Designer, so the 'call' operations are just jals to the specified part of the function. The address at the top marks the address that the whole code will start with. What I am wondering is why it freezes when I launch the game. The hook is in the kernel and replaces a jalr k0. When I run the code without the jalr k0 (that was included in my engine) in CodeMajic, it operates perfectly. However, with my app, it doesn't work with or without the jalr k0 from my hook. This makes me feel that the fault is not behind the jalr k0, but rather the engine placement. I believe that the jal $80078000 (Where my engine is installed), doesn't jump to my engine, it instead jumps to another address. The result is the freezing of the game. My question is, is there something I am doing wrong with the actual hook, or is it the jal $80078000? Thank you.
Here is the engine code, along with the hook in the main.c.
Code:
address $80078000 _init: addiu sp, sp, $FFF0 sq ra, $0000(sp) jalr k0 nop call _start lq ra, $0000(sp) jr ra addiu sp, sp, $0010 _start: addiu sp, sp, $FE00 sq at, $0000(sp) sq v0, $0010(sp) sq v1, $0020(sp) sq a0, $0030(sp) sq a1, $0040(sp) sq a2, $0050(sp) sq a3, $0060(sp) sq t0, $0070(sp) sq t1, $0080(sp) sq t2, $0090(sp) sq t3, $00a0(sp) sq t4, $00b0(sp) sq t5, $00c0(sp) sq t6, $00d0(sp) sq t7, $00e0(sp) sq s0, $00f0(sp) sq s1, $0100(sp) sq s2, $0110(sp) sq s3, $0120(sp) sq s4, $0130(sp) sq s5, $0140(sp) sq s6, $0150(sp) sq s7, $0160(sp) sq t8, $0170(sp) sq t9, $0180(sp) sq k0, $0190(sp) sq k1, $01a0(sp) sq fp, $01b0(sp) sq gp, $01c0(sp) sq ra, $01d0(sp) lui t1, $0034 //The code for rapid fire that I will test sw zero, $7e8c(t1) lq at, $0000(sp) lq v0, $0010(sp) lq v1, $0020(sp) lq a0, $0030(sp) lq a1, $0040(sp) lq a2, $0050(sp) lq a3, $0060(sp) lq t0, $0070(sp) lq t1, $0080(sp) lq t2, $0090(sp) lq t3, $00a0(sp) lq t4, $00b0(sp) lq t5, $00c0(sp) lq t6, $00d0(sp) lq t7, $00e0(sp) lq s0, $00f0(sp) lq s1, $0100(sp) lq s2, $0110(sp) lq s3, $0120(sp) lq s4, $0130(sp) lq s5, $0140(sp) lq s6, $0150(sp) lq s7, $0160(sp) lq t8, $0170(sp) lq t9, $0180(sp) lq k0, $0190(sp) lq k1, $01a0(sp) lq fp, $01b0(sp) lq gp, $01c0(sp) lq ra, $01d0(sp) jr ra addiu sp, sp, $0200
Code:
//Install the engine in memory
u32 EngineStore = 0x80078000;
u32 EngineRead = (void*)Engine;
for (i = 0; i < sizeof(Engine); i += 4)
{
scr_printf("A"); //So I know it successfully installed the hook
ee_kmode_enter();
*(u32*)EngineStore = *(u32*)EngineRead;
ee_kmode_exit();
EngineStore += 4;
EngineRead += 4;
}
//Install hook in memory, (main.c).
ee_kmode_enter();
*(u32*)0x800002FC = 0xEC01E000; //jal $80078000
ee_kmode_exit();
Comment