The best thing right now would actually be to find out which sections of memory we are able to access 
I mean we know we can access things around:
0x10000000-0x11500000 (or so)
0x20000000-0x28000000
But i suspect we have access to even more regions we just don't know about yet ^^
Too bad it immediately crashes once try to access non accessible memory :/
I mean we know we can access things around:
0x10000000-0x11500000 (or so)
0x20000000-0x28000000
But i suspect we have access to even more regions we just don't know about yet ^^
Too bad it immediately crashes once try to access non accessible memory :/
Smea in his HID.c module get the HID registers addresses, maps it to 0x1000000 and then initialize the HID. With the mapped handle he does exactly the same we do with the HID phisical address to check keys pressed.
In his code the CPAD is at 0x10000034 (i.e. Mapped HID address + 0xD*4) and Touchpad is at 0x100000C8 (i.e. Mapped HID address + 0x32 *4). Interesting but not usefull as long as we can't replicate his system calls. I'm making some experiment to make it work (yes I know: smea said it won't work, and Kane said it too - I'm stubborn as a mule) but I have very few time and can't go any faster.
True, this would be a great tool if anyone has the smarts to make one. Oh, and better yet, make a launcher that lets you replace specific lines of the RAM with your own modifications.
so you've already mapped out the good and bad memory regions? or have you found a way to catch the illegal memory access interrupt?
Smealum found a way to modify other processes RAM (to modify list of channels and such), so if it's possible to write to RAM, using a similair method it should be possible to read it too. Unless the HOME screen's RAM region is not protected (which is doubtful)
yeah, but i was under the impression that it wasn't addressed as a continuous block in physical address space but segmented.
if that's not the case after all: yay!
edit: i could/should have RTFM and checked the wiki *innocent whistle*
Kane49 released the tools:
http://gbatemp.net/threads/homebrew-development.360646/page-14#post-4895832
Code to do:
Code:
pf_mount(..)
pf_open("/file")
// loop from FCRAM_BASE to FCRAM_BASE+0x8000000
pf_write(address,..)https://www.dropbox.com/s/zuaj8nfjyeonivx/FCRamDump.rar
Contains two Launchers, one for GW and one for Waffles Loader, dumps the whole FCRAM to SDCard, might take a few tries to boot.
Needs about 30 Minutes for the entire dump.
Contains two Launchers, one for GW and one for Waffles Loader, dumps the whole FCRAM to SDCard, might take a few tries to boot.
Needs about 30 Minutes for the entire dump.
- No one is chatting at the moment.
