deac/osd-contiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
osd-contiki/doc/rf4ce-macphy.dis

1530 lines
61 KiB
Plaintext
Raw Normal View History

this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
In archive MACPHY.a:
rom-symbols-MAC.o: file format elf32-littlearm
ASPMain_patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <Asp_SetPowerLevel>:
0: b501 push {r0, lr}
2: 2813 cmp r0, #19
4: d301 bcc.n a <Asp_SetPowerLevel+0xa>
6: 20e8 movs r0, #232
8: e030 b.n 6c <Asp_SetPowerLevel+0x6c>
a: 4900 ldr r1, [pc, #0] (180 <Asp_SetPowerLevelLockMode+0x40>)
c: 6809 ldr r1, [r1, #0]
e: 227e movs r2, #126
10: 5c8a ldrb r2, [r1, r2]
12: 2a01 cmp r2, #1
14: d105 bne.n 22 <Asp_SetPowerLevel+0x22>
16: 4082 lsls r2, r0
18: 4bff ldr r3, [pc, #1020] (584 <Asp_SetPowerLevelLockMode+0x444>)
1a: 421a tst r2, r3
1c: d101 bne.n 22 <Asp_SetPowerLevel+0x22>
1e: 20e2 movs r0, #226
20: e024 b.n 6c <Asp_SetPowerLevel+0x6c>
22: 4a00 ldr r2, [pc, #0] (184 <Asp_SetPowerLevelLockMode+0x44>)
24: 7010 strb r0, [r2, #0]
26: 4a13 ldr r2, [pc, #76] (74 <Asp_SetPowerLevel+0x74>)
28: 6812 ldr r2, [r2, #0]
2a: 2a00 cmp r2, #0
2c: d00d beq.n 4a <Asp_SetPowerLevel+0x4a>
2e: 0043 lsls r3, r0, #1
30: 18d2 adds r2, r2, r3
32: 3122 adds r1, #34
34: 7809 ldrb r1, [r1, #0]
36: 2900 cmp r1, #0
38: d102 bne.n 40 <Asp_SetPowerLevel+0x40>
3a: 490f ldr r1, [pc, #60] (78 <Asp_SetPowerLevel+0x78>)
3c: 8812 ldrh r2, [r2, #0]
3e: e003 b.n 48 <Asp_SetPowerLevel+0x48>
40: 8811 ldrh r1, [r2, #0]
42: 4a0e ldr r2, [pc, #56] (7c <Asp_SetPowerLevel+0x7c>)
44: 400a ands r2, r1
46: 490c ldr r1, [pc, #48] (78 <Asp_SetPowerLevel+0x78>)
48: 60ca str r2, [r1, #12]
4a: 490d ldr r1, [pc, #52] (80 <Asp_SetPowerLevel+0x80>)
4c: 6809 ldr r1, [r1, #0]
4e: 2900 cmp r1, #0
50: d003 beq.n 5a <Asp_SetPowerLevel+0x5a>
52: 0042 lsls r2, r0, #1
54: 5a89 ldrh r1, [r1, r2]
56: 4a08 ldr r2, [pc, #32] (78 <Asp_SetPowerLevel+0x78>)
58: 6011 str r1, [r2, #0]
5a: 490a ldr r1, [pc, #40] (84 <Asp_SetPowerLevel+0x84>)
5c: 6809 ldr r1, [r1, #0]
5e: 2900 cmp r1, #0
60: d003 beq.n 6a <Asp_SetPowerLevel+0x6a>
62: 0080 lsls r0, r0, #2
64: 5808 ldr r0, [r1, r0]
66: 4904 ldr r1, [pc, #16] (78 <Asp_SetPowerLevel+0x78>)
68: 6408 str r0, [r1, #64]
6a: 2000 movs r0, #0
6c: bc08 pop {r3}
6e: bc02 pop {r1}
70: 4708 bx r1
72: 46c0 nop (mov r8, r8)
74: 00000000 .word 0x00000000
78: 8000a014 .word 0x8000a014
7c: ffffdfff .word 0xffffdfff
...
00000088 <Asp_SetDemodulatorType>:
88: b501 push {r0, lr}
8a: 4907 ldr r1, [pc, #28] (a8 <Asp_SetDemodulatorType+0x20>)
8c: 2800 cmp r0, #0
8e: 6808 ldr r0, [r1, #0]
90: d003 beq.n 9a <Asp_SetDemodulatorType+0x12>
92: 2201 movs r2, #1
94: 4302 orrs r2, r0
96: 600a str r2, [r1, #0]
98: e002 b.n a0 <Asp_SetDemodulatorType+0x18>
9a: 2201 movs r2, #1
9c: 4390 bics r0, r2
9e: 6008 str r0, [r1, #0]
a0: bc08 pop {r3}
a2: bc01 pop {r0}
a4: 4700 bx r0
a6: 46c0 nop (mov r8, r8)
a8: 80009400 .word 0x80009400
000000ac <Asp_EnableComplementaryPAOutput>:
ac: b501 push {r0, lr}
ae: 4900 ldr r1, [pc, #0] (180 <Asp_SetPowerLevelLockMode+0x40>)
b0: 6809 ldr r1, [r1, #0]
b2: 2222 movs r2, #34
b4: 5c8a ldrb r2, [r1, r2]
b6: 4290 cmp r0, r2
b8: d005 beq.n c6 <Asp_EnableComplementaryPAOutput+0x1a>
ba: 3122 adds r1, #34
bc: 7008 strb r0, [r1, #0]
be: 4800 ldr r0, [pc, #0] (184 <Asp_SetPowerLevelLockMode+0x44>)
c0: 7800 ldrb r0, [r0, #0]
c2: f7ff fffe bl 0 <Asp_SetPowerLevel>
c6: bc08 pop {r3}
c8: bc01 pop {r0}
ca: 4700 bx r0
000000cc <Asp_ConfigureRFCtlSignals>:
cc: b570 push {r4, r5, r6, lr}
ce: 0004 lsls r4, r0, #0
d0: 0015 lsls r5, r2, #0
d2: 001e lsls r6, r3, #0
d4: 2c04 cmp r4, #4
d6: d201 bcs.n dc <Asp_ConfigureRFCtlSignals+0x10>
d8: 2903 cmp r1, #3
da: d301 bcc.n e0 <Asp_ConfigureRFCtlSignals+0x14>
dc: 20e8 movs r0, #232
de: e02c b.n 13a <Asp_ConfigureRFCtlSignals+0x6e>
e0: 2c02 cmp r4, #2
e2: d201 bcs.n e8 <Asp_ConfigureRFCtlSignals+0x1c>
e4: 2902 cmp r1, #2
e6: d2f9 bcs.n dc <Asp_ConfigureRFCtlSignals+0x10>
e8: 342a adds r4, #42
ea: 2900 cmp r1, #0
ec: d004 beq.n f8 <Asp_ConfigureRFCtlSignals+0x2c>
ee: 0620 lsls r0, r4, #24
f0: 0e00 lsrs r0, r0, #24
f2: f7ff fffe bl 0 <Gpio_SetPinFunction>
f6: e01f b.n 138 <Asp_ConfigureRFCtlSignals+0x6c>
f8: 0620 lsls r0, r4, #24
fa: 0e00 lsrs r0, r0, #24
fc: f7ff fffe bl 0 <Gpio_SetPinFunction>
100: 2d01 cmp r5, #1
102: d10f bne.n 124 <Asp_ConfigureRFCtlSignals+0x58>
104: 2101 movs r1, #1
106: 0620 lsls r0, r4, #24
108: 0e00 lsrs r0, r0, #24
10a: f7ff fffe bl 0 <Gpio_SetPinDir>
10e: 2101 movs r1, #1
110: 0620 lsls r0, r4, #24
112: 0e00 lsrs r0, r0, #24
114: f7ff fffe bl 0 <Gpio_SetPinReadSource>
118: 0031 lsls r1, r6, #0
11a: 0620 lsls r0, r4, #24
11c: 0e00 lsrs r0, r0, #24
11e: f7ff fffe bl 0 <Gpio_SetPinData>
122: e009 b.n 138 <Asp_ConfigureRFCtlSignals+0x6c>
124: 2100 movs r1, #0
126: 0620 lsls r0, r4, #24
128: 0e00 lsrs r0, r0, #24
12a: f7ff fffe bl 0 <Gpio_SetPinDir>
12e: 2100 movs r1, #0
130: 0620 lsls r0, r4, #24
132: 0e00 lsrs r0, r0, #24
134: f7ff fffe bl 0 <Gpio_SetPinReadSource>
138: 2000 movs r0, #0
13a: bc70 pop {r4, r5, r6}
13c: bc02 pop {r1}
13e: 4708 bx r1
00000140 <Asp_SetPowerLevelLockMode>:
140: b501 push {r0, lr}
142: 4900 ldr r1, [pc, #0] (180 <Asp_SetPowerLevelLockMode+0x40>)
144: 6809 ldr r1, [r1, #0]
146: 227e movs r2, #126
148: 5c8a ldrb r2, [r1, r2]
14a: 4290 cmp r0, r2
14c: d010 beq.n 170 <Asp_SetPowerLevelLockMode+0x30>
14e: 2801 cmp r0, #1
150: d10c bne.n 16c <Asp_SetPowerLevelLockMode+0x2c>
152: 4a09 ldr r2, [pc, #36] (178 <Asp_SetPowerLevelLockMode+0x38>)
154: 7812 ldrb r2, [r2, #0]
156: 2a1a cmp r2, #26
158: d006 beq.n 168 <Asp_SetPowerLevelLockMode+0x28>
15a: 2201 movs r2, #1
15c: 4bff ldr r3, [pc, #1020] (580 <Asp_SetPowerLevelLockMode+0x440>)
15e: 781b ldrb r3, [r3, #0]
160: 409a lsls r2, r3
162: 4b00 ldr r3, [pc, #0] (188 <Asp_SetPowerLevelLockMode+0x48>)
164: 421a tst r2, r3
166: d101 bne.n 16c <Asp_SetPowerLevelLockMode+0x2c>
168: 20e2 movs r0, #226
16a: e002 b.n 172 <Asp_SetPowerLevelLockMode+0x32>
16c: 317e adds r1, #126
16e: 7008 strb r0, [r1, #0]
170: 2000 movs r0, #0
172: bc08 pop {r3}
174: bc02 pop {r1}
176: 4708 bx r1
...
184: 000010ff .word 0x000010ff
MacRamLib.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <MacPhyInit_Initialize>:
0: b510 push {r4, lr}
2: 4840 ldr r0, [pc, #256] (104 <MacPhyInit_Initialize+0x104>)
4: 4940 ldr r1, [pc, #256] (108 <MacPhyInit_Initialize+0x108>)
6: 6001 str r1, [r0, #0]
8: 4840 ldr r0, [pc, #256] (10c <MacPhyInit_Initialize+0x10c>)
a: 4941 ldr r1, [pc, #260] (110 <MacPhyInit_Initialize+0x110>)
c: 6001 str r1, [r0, #0]
e: 4841 ldr r0, [pc, #260] (114 <MacPhyInit_Initialize+0x114>)
10: 4941 ldr r1, [pc, #260] (118 <MacPhyInit_Initialize+0x118>)
12: 6001 str r1, [r0, #0]
14: 4841 ldr r0, [pc, #260] (11c <MacPhyInit_Initialize+0x11c>)
16: 4942 ldr r1, [pc, #264] (120 <MacPhyInit_Initialize+0x120>)
18: 6001 str r1, [r0, #0]
1a: 4842 ldr r0, [pc, #264] (124 <MacPhyInit_Initialize+0x124>)
1c: 4942 ldr r1, [pc, #264] (128 <MacPhyInit_Initialize+0x128>)
1e: 8809 ldrh r1, [r1, #0]
20: 8001 strh r1, [r0, #0]
22: 4842 ldr r0, [pc, #264] (12c <MacPhyInit_Initialize+0x12c>)
24: 4942 ldr r1, [pc, #264] (130 <MacPhyInit_Initialize+0x130>)
26: 8809 ldrh r1, [r1, #0]
28: 8001 strh r1, [r0, #0]
2a: 4842 ldr r0, [pc, #264] (134 <MacPhyInit_Initialize+0x134>)
2c: 4942 ldr r1, [pc, #264] (138 <MacPhyInit_Initialize+0x138>)
2e: 8809 ldrh r1, [r1, #0]
30: 8001 strh r1, [r0, #0]
32: 4842 ldr r0, [pc, #264] (13c <MacPhyInit_Initialize+0x13c>)
34: 4942 ldr r1, [pc, #264] (140 <MacPhyInit_Initialize+0x140>)
36: 8809 ldrh r1, [r1, #0]
38: 8001 strh r1, [r0, #0]
3a: 4842 ldr r0, [pc, #264] (144 <MacPhyInit_Initialize+0x144>)
3c: 4942 ldr r1, [pc, #264] (148 <MacPhyInit_Initialize+0x148>)
3e: 6001 str r1, [r0, #0]
40: 4842 ldr r0, [pc, #264] (14c <MacPhyInit_Initialize+0x14c>)
42: 4943 ldr r1, [pc, #268] (150 <MacPhyInit_Initialize+0x150>)
44: 6001 str r1, [r0, #0]
46: 4843 ldr r0, [pc, #268] (154 <MacPhyInit_Initialize+0x154>)
48: 4943 ldr r1, [pc, #268] (158 <MacPhyInit_Initialize+0x158>)
4a: 6001 str r1, [r0, #0]
4c: 4843 ldr r0, [pc, #268] (15c <MacPhyInit_Initialize+0x15c>)
4e: 4944 ldr r1, [pc, #272] (160 <MacPhyInit_Initialize+0x160>)
50: 6001 str r1, [r0, #0]
52: 4844 ldr r0, [pc, #272] (164 <MacPhyInit_Initialize+0x164>)
54: 4944 ldr r1, [pc, #272] (168 <MacPhyInit_Initialize+0x168>)
56: 6001 str r1, [r0, #0]
58: 4844 ldr r0, [pc, #272] (16c <MacPhyInit_Initialize+0x16c>)
5a: 4945 ldr r1, [pc, #276] (170 <MacPhyInit_Initialize+0x170>)
5c: 7809 ldrb r1, [r1, #0]
5e: 7001 strb r1, [r0, #0]
60: 4844 ldr r0, [pc, #272] (174 <MacPhyInit_Initialize+0x174>)
62: 4945 ldr r1, [pc, #276] (178 <MacPhyInit_Initialize+0x178>)
64: 6001 str r1, [r0, #0]
66: 4845 ldr r0, [pc, #276] (17c <MacPhyInit_Initialize+0x17c>)
68: 4945 ldr r1, [pc, #276] (180 <MacPhyInit_Initialize+0x180>)
6a: 6001 str r1, [r0, #0]
6c: 4845 ldr r0, [pc, #276] (184 <MacPhyInit_Initialize+0x184>)
6e: 4946 ldr r1, [pc, #280] (188 <MacPhyInit_Initialize+0x188>)
70: 6001 str r1, [r0, #0]
72: 4846 ldr r0, [pc, #280] (18c <MacPhyInit_Initialize+0x18c>)
74: 4946 ldr r1, [pc, #280] (190 <MacPhyInit_Initialize+0x190>)
76: 6001 str r1, [r0, #0]
78: 4846 ldr r0, [pc, #280] (194 <MacPhyInit_Initialize+0x194>)
7a: 4947 ldr r1, [pc, #284] (198 <MacPhyInit_Initialize+0x198>)
7c: 6001 str r1, [r0, #0]
7e: 4847 ldr r0, [pc, #284] (19c <MacPhyInit_Initialize+0x19c>)
80: 4947 ldr r1, [pc, #284] (1a0 <MacPhyInit_Initialize+0x1a0>)
82: 7809 ldrb r1, [r1, #0]
84: 7001 strb r1, [r0, #0]
86: 4847 ldr r0, [pc, #284] (1a4 <MacPhyInit_Initialize+0x1a4>)
88: 4947 ldr r1, [pc, #284] (1a8 <MacPhyInit_Initialize+0x1a8>)
8a: 6001 str r1, [r0, #0]
8c: 4847 ldr r0, [pc, #284] (1ac <MacPhyInit_Initialize+0x1ac>)
8e: 4948 ldr r1, [pc, #288] (1b0 <MacPhyInit_Initialize+0x1b0>)
90: 6001 str r1, [r0, #0]
92: 4848 ldr r0, [pc, #288] (1b4 <MacPhyInit_Initialize+0x1b4>)
94: 4948 ldr r1, [pc, #288] (1b8 <MacPhyInit_Initialize+0x1b8>)
96: 6001 str r1, [r0, #0]
98: 4848 ldr r0, [pc, #288] (1bc <MacPhyInit_Initialize+0x1bc>)
9a: 4949 ldr r1, [pc, #292] (1c0 <MacPhyInit_Initialize+0x1c0>)
9c: 6001 str r1, [r0, #0]
9e: 4849 ldr r0, [pc, #292] (1c4 <MacPhyInit_Initialize+0x1c4>)
a0: 4949 ldr r1, [pc, #292] (1c8 <MacPhyInit_Initialize+0x1c8>)
a2: 6001 str r1, [r0, #0]
a4: 4849 ldr r0, [pc, #292] (1cc <MacPhyInit_Initialize+0x1cc>)
a6: 494a ldr r1, [pc, #296] (1d0 <MacPhyInit_Initialize+0x1d0>)
a8: 6001 str r1, [r0, #0]
aa: 484a ldr r0, [pc, #296] (1d4 <MacPhyInit_Initialize+0x1d4>)
ac: 494a ldr r1, [pc, #296] (1d8 <MacPhyInit_Initialize+0x1d8>)
ae: 6001 str r1, [r0, #0]
b0: 484a ldr r0, [pc, #296] (1dc <MacPhyInit_Initialize+0x1dc>)
b2: 494b ldr r1, [pc, #300] (1e0 <MacPhyInit_Initialize+0x1e0>)
b4: 6001 str r1, [r0, #0]
b6: 484b ldr r0, [pc, #300] (1e4 <MacPhyInit_Initialize+0x1e4>)
b8: 494b ldr r1, [pc, #300] (1e8 <MacPhyInit_Initialize+0x1e8>)
ba: 6001 str r1, [r0, #0]
bc: 484b ldr r0, [pc, #300] (1ec <MacPhyInit_Initialize+0x1ec>)
be: 494c ldr r1, [pc, #304] (1f0 <MacPhyInit_Initialize+0x1f0>)
c0: 6001 str r1, [r0, #0]
c2: 484c ldr r0, [pc, #304] (1f4 <MacPhyInit_Initialize+0x1f4>)
c4: 494c ldr r1, [pc, #304] (1f8 <MacPhyInit_Initialize+0x1f8>)
c6: 6809 ldr r1, [r1, #0]
c8: 6001 str r1, [r0, #0]
ca: 484c ldr r0, [pc, #304] (1fc <MacPhyInit_Initialize+0x1fc>)
cc: 494c ldr r1, [pc, #304] (200 <MacPhyInit_Initialize+0x200>)
ce: 6809 ldr r1, [r1, #0]
d0: 6001 str r1, [r0, #0]
d2: 4c4c ldr r4, [pc, #304] (204 <MacPhyInit_Initialize+0x204>)
d4: 207c movs r0, #124
d6: 5c20 ldrb r0, [r4, r0]
d8: 494b ldr r1, [pc, #300] (208 <MacPhyInit_Initialize+0x208>)
da: 7008 strb r0, [r1, #0]
dc: f7ff fffe bl 0 <InitializePhy>
e0: 2001 movs r0, #1
e2: f7ff fffe bl 0 <InitializeMac>
e6: f7ff fffe bl 0 <Asp_SetRandomSeed>
ea: 347c adds r4, #124
ec: 7820 ldrb r0, [r4, #0]
ee: f7ff fffe bl 0 <PhyPlmeSetCurrentChannelRequest>
f2: 4846 ldr r0, [pc, #280] (20c <MacPhyInit_Initialize+0x20c>)
f4: 2104 movs r1, #4
f6: 7001 strb r1, [r0, #0]
f8: 2000 movs r0, #0
fa: f7ff fffe bl 0 <CM_InitOnStartup>
fe: bc10 pop {r4}
100: bc01 pop {r0}
102: 4700 bx r0
...
MemScan_patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <MemScan_InitEd>:
0: b501 push {r0, lr}
2: 4815 ldr r0, [pc, #84] (58 <MemScan_InitEd+0x58>)
4: 2101 movs r1, #1
6: 7001 strb r1, [r0, #0]
8: f7ff fffe bl 0 <CM_ResetClock>
c: 4668 mov r0, sp
e: f7ff fffe bl 0 <MemOh_SeqReadClockReq>
12: 4668 mov r0, sp
14: f7ff fffe bl 0 <CM_SetCurClock>
18: 4810 ldr r0, [pc, #64] (5c <MemScan_InitEd+0x5c>)
1a: 4911 ldr r1, [pc, #68] (60 <MemScan_InitEd+0x60>)
1c: 7809 ldrb r1, [r1, #0]
1e: 7001 strb r1, [r0, #0]
20: 4810 ldr r0, [pc, #64] (64 <MemScan_InitEd+0x64>)
22: 6800 ldr r0, [r0, #0]
24: 4910 ldr r1, [pc, #64] (68 <MemScan_InitEd+0x68>)
26: 7809 ldrb r1, [r1, #0]
28: 2900 cmp r1, #0
2a: d106 bne.n 3a <MemScan_InitEd+0x3a>
2c: 21f0 movs r1, #240
2e: 0089 lsls r1, r1, #2
30: 7882 ldrb r2, [r0, #2]
32: 000b lsls r3, r1, #0
34: 4093 lsls r3, r2
36: 1859 adds r1, r3, r1
38: e000 b.n 3c <MemScan_InitEd+0x3c>
3a: 213c movs r1, #60
3c: 4a0b ldr r2, [pc, #44] (6c <MemScan_InitEd+0x6c>)
3e: 6011 str r1, [r2, #0]
40: 490b ldr r1, [pc, #44] (70 <MemScan_InitEd+0x70>)
42: 2200 movs r2, #0
44: 700a strb r2, [r1, #0]
46: 7840 ldrb r0, [r0, #1]
48: f7ff fffe bl 0 <MemOh_SeqSetCurrentChannel>
4c: f7ff fffe bl 0 <PATCH_Ret_MemScan_InitEd>
50: bc08 pop {r3}
52: bc01 pop {r0}
54: 4700 bx r0
56: 46c0 nop (mov r8, r8)
...
MlmeMain_patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <NWK_MLME_SapHandler>:
0: b531 push {r0, r4, r5, lr}
2: 0004 lsls r4, r0, #0
4: d014 beq.n 30 <NWK_MLME_SapHandler+0x30>
6: 7820 ldrb r0, [r4, #0]
8: 2809 cmp r0, #9
a: d111 bne.n 30 <NWK_MLME_SapHandler+0x30>
c: 1c60 adds r0, r4, #1
e: 7801 ldrb r1, [r0, #0]
10: 2921 cmp r1, #33
12: d10d bne.n 30 <NWK_MLME_SapHandler+0x30>
14: 1c40 adds r0, r0, #1
16: f7ff fffe bl 0 <__aeabi_uread4>
1a: 7800 ldrb r0, [r0, #0]
1c: 281a cmp r0, #26
1e: d107 bne.n 30 <NWK_MLME_SapHandler+0x30>
20: 4821 ldr r0, [pc, #132] (a8 <NWK_MLME_SapHandler+0xa8>)
22: 6800 ldr r0, [r0, #0]
24: 307e adds r0, #126
26: 7800 ldrb r0, [r0, #0]
28: 2801 cmp r0, #1
2a: d101 bne.n 30 <NWK_MLME_SapHandler+0x30>
2c: 25e2 movs r5, #226
2e: e004 b.n 3a <NWK_MLME_SapHandler+0x3a>
30: 0020 lsls r0, r4, #0
32: f7ff fffe bl 0 <Mlme_VerifyNwkInput>
36: 0005 lsls r5, r0, #0
38: d008 beq.n 4c <NWK_MLME_SapHandler+0x4c>
3a: 002a lsls r2, r5, #0
3c: 0021 lsls r1, r4, #0
3e: 2002 movs r0, #2
40: 4b1a ldr r3, [pc, #104] (ac <NWK_MLME_SapHandler+0xac>)
42: 681b ldr r3, [r3, #0]
44: f7ff fffe bl 0 <NWK_MLME_SapHandler>
48: 0028 lsls r0, r5, #0
4a: e029 b.n a0 <NWK_MLME_SapHandler+0xa0>
4c: 7820 ldrb r0, [r4, #0]
4e: 1ec0 subs r0, r0, #3
50: d004 beq.n 5c <NWK_MLME_SapHandler+0x5c>
52: 1ec0 subs r0, r0, #3
54: d007 beq.n 66 <NWK_MLME_SapHandler+0x66>
56: 1ec0 subs r0, r0, #3
58: d009 beq.n 6e <NWK_MLME_SapHandler+0x6e>
5a: e00a b.n 72 <NWK_MLME_SapHandler+0x72>
5c: 2103 movs r1, #3
5e: 0020 lsls r0, r4, #0
60: f7ff fffe bl 0 <Mlme_HandleSetGetReq>
64: e014 b.n 90 <NWK_MLME_SapHandler+0x90>
66: 7860 ldrb r0, [r4, #1]
68: f7ff fffe bl 0 <Mlme_Reset>
6c: e010 b.n 90 <NWK_MLME_SapHandler+0x90>
6e: 2109 movs r1, #9
70: e7f5 b.n 5e <NWK_MLME_SapHandler+0x5e>
72: 0021 lsls r1, r4, #0
74: 480e ldr r0, [pc, #56] (b0 <NWK_MLME_SapHandler+0xb0>)
76: f7ff fffe bl 0 <List_AddTail>
7a: 480e ldr r0, [pc, #56] (b4 <NWK_MLME_SapHandler+0xb4>)
7c: 7800 ldrb r0, [r0, #0]
7e: 2800 cmp r0, #0
80: d006 beq.n 90 <NWK_MLME_SapHandler+0x90>
82: 2101 movs r1, #1
84: 480c ldr r0, [pc, #48] (b8 <NWK_MLME_SapHandler+0xb8>)
86: 7800 ldrb r0, [r0, #0]
88: 4a0c ldr r2, [pc, #48] (bc <NWK_MLME_SapHandler+0xbc>)
8a: 6812 ldr r2, [r2, #0]
8c: f7ff fffe bl 0 <NWK_MLME_SapHandler>
90: 2200 movs r2, #0
92: 0021 lsls r1, r4, #0
94: 2002 movs r0, #2
96: 4b05 ldr r3, [pc, #20] (ac <NWK_MLME_SapHandler+0xac>)
98: 681b ldr r3, [r3, #0]
9a: f7ff fffe bl 0 <NWK_MLME_SapHandler>
9e: 2000 movs r0, #0
a0: bc38 pop {r3, r4, r5}
a2: bc02 pop {r1}
a4: 4708 bx r1
a6: 46c0 nop (mov r8, r8)
...
Disassembly of section .text:
00000000 <__iar_via_R3>:
0: 4718 bx r3
Disassembly of section .text:
00000000 <__iar_via_R2>:
0: 4710 bx r2
MlmeScan_patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <MlmeScan_InitScan>:
0: b5f1 push {r0, r4, r5, r6, r7, lr}
2: 4c43 ldr r4, [pc, #268] (110 <MlmeScan_InitScan+0x110>)
4: 200a movs r0, #10
6: 7020 strb r0, [r4, #0]
8: 2700 movs r7, #0
a: 4d00 ldr r5, [pc, #0] (1fc <MlmeActivePassiveScan_Patched+0xcc>)
c: 702f strb r7, [r5, #0]
e: 4800 ldr r0, [pc, #0] (200 <MlmeActivePassiveScan_Patched+0xd0>)
10: 2104 movs r1, #4
12: 7001 strb r1, [r0, #0]
14: 483f ldr r0, [pc, #252] (114 <MlmeScan_InitScan+0x114>)
16: 7007 strb r7, [r0, #0]
18: 48ff ldr r0, [pc, #1020] (60c <MlmeActivePassiveScan_Patched+0x4dc>)
1a: 7007 strb r7, [r0, #0]
1c: 483e ldr r0, [pc, #248] (118 <MlmeScan_InitScan+0x118>)
1e: 6801 ldr r1, [r0, #0]
20: 7988 ldrb r0, [r1, #6]
22: 4a3e ldr r2, [pc, #248] (11c <MlmeScan_InitScan+0x11c>)
24: 7010 strb r0, [r2, #0]
26: 7848 ldrb r0, [r1, #1]
28: 4aff ldr r2, [pc, #1020] (610 <MlmeActivePassiveScan_Patched+0x4e0>)
2a: 7010 strb r0, [r2, #0]
2c: 4eff ldr r6, [pc, #1020] (618 <MlmeActivePassiveScan_Patched+0x4e8>)
2e: 2203 movs r2, #3
30: 1cc9 adds r1, r1, #3
32: 0030 lsls r0, r6, #0
34: f7ff fffe bl 0 <FLib_MemCpy>
38: 48ff ldr r0, [pc, #1020] (610 <MlmeActivePassiveScan_Patched+0x4e0>)
3a: 7800 ldrb r0, [r0, #0]
3c: 2801 cmp r0, #1
3e: d001 beq.n 44 <MlmeScan_InitScan+0x44>
40: 2802 cmp r0, #2
42: d11e bne.n 82 <MlmeScan_InitScan+0x82>
44: 48ff ldr r0, [pc, #1020] (604 <MlmeActivePassiveScan_Patched+0x4d4>)
46: 4900 ldr r1, [pc, #0] (20c <MlmeActivePassiveScan_Patched+0xdc>)
48: 7802 ldrb r2, [r0, #0]
4a: 700a strb r2, [r1, #0]
4c: 7840 ldrb r0, [r0, #1]
4e: 7048 strb r0, [r1, #1]
50: 4833 ldr r0, [pc, #204] (120 <MlmeScan_InitScan+0x120>)
52: 7007 strb r7, [r0, #0]
54: 2073 movs r0, #115
56: f7ff fffe bl 0 <MM_Alloc>
5a: 4932 ldr r1, [pc, #200] (124 <MlmeScan_InitScan+0x124>)
5c: 6008 str r0, [r1, #0]
5e: 4900 ldr r1, [pc, #0] (218 <MlmeActivePassiveScan_Patched+0xe8>)
60: 6008 str r0, [r1, #0]
62: 2800 cmp r0, #0
64: d016 beq.n 94 <MlmeScan_InitScan+0x94>
66: 306e adds r0, #110
68: 7007 strb r7, [r0, #0]
6a: 6809 ldr r1, [r1, #0]
6c: 316f adds r1, #111
6e: 2000 movs r0, #0
70: f7ff fffe bl 0 <__aeabi_uwrite4>
74: 482c ldr r0, [pc, #176] (b4 <PhyPlmeSetPanId+0xb4>)
76: f7ff fffe bl 0 <PhyPlmeSetPanId>
7a: 4800 ldr r0, [pc, #0] (204 <MlmeActivePassiveScan_Patched+0xd4>)
7c: 2101 movs r1, #1
7e: 7001 strb r1, [r0, #0]
80: e03f b.n 102 <MlmeScan_InitScan+0x102>
82: 2800 cmp r0, #0
84: d10b bne.n 9e <MlmeScan_InitScan+0x9e>
86: 4f27 ldr r7, [pc, #156] (124 <MlmeScan_InitScan+0x124>)
88: 2010 movs r0, #16
8a: f7ff fffe bl 0 <MM_Alloc>
8e: 6038 str r0, [r7, #0]
90: 2800 cmp r0, #0
92: d136 bne.n 102 <MlmeScan_InitScan+0x102>
94: 2000 movs r0, #0
96: f7ff fffe bl 0 <PATCH_Ret_MlmeScan_InitScan>
9a: 2000 movs r0, #0
9c: e035 b.n 10a <MlmeScan_InitScan+0x10a>
9e: 2804 cmp r0, #4
a0: d12f bne.n 102 <MlmeScan_InitScan+0x102>
a2: 4f20 ldr r7, [pc, #128] (124 <MlmeScan_InitScan+0x124>)
a4: 481d ldr r0, [pc, #116] (11c <MlmeScan_InitScan+0x11c>)
a6: 7800 ldrb r0, [r0, #0]
a8: f7ff fffe bl 0 <MM_Alloc>
ac: 6038 str r0, [r7, #0]
ae: 2800 cmp r0, #0
b0: d0f0 beq.n 94 <MlmeScan_InitScan+0x94>
b2: 2001 movs r0, #1
b4: 4917 ldr r1, [pc, #92] (114 <MlmeScan_InitScan+0x114>)
b6: 7008 strb r0, [r1, #0]
b8: 7821 ldrb r1, [r4, #0]
ba: 291a cmp r1, #26
bc: d218 bcs.n f0 <MlmeScan_InitScan+0xf0>
be: 491b ldr r1, [pc, #108] (12c <MlmeScan_InitScan+0x12c>)
c0: 7822 ldrb r2, [r4, #0]
c2: 1c52 adds r2, r2, #1
c4: 7022 strb r2, [r4, #0]
c6: 4b00 ldr r3, [pc, #0] (200 <MlmeActivePassiveScan_Patched+0xd0>)
c8: 781b ldrb r3, [r3, #0]
ca: 2b80 cmp r3, #128
cc: d104 bne.n d8 <MlmeScan_InitScan+0xd8>
ce: 782b ldrb r3, [r5, #0]
d0: 1c5b adds r3, r3, #1
d2: 702b strb r3, [r5, #0]
d4: 2301 movs r3, #1
d6: e000 b.n da <MlmeScan_InitScan+0xda>
d8: 005b lsls r3, r3, #1
da: 4f00 ldr r7, [pc, #0] (200 <MlmeActivePassiveScan_Patched+0xd0>)
dc: 703b strb r3, [r7, #0]
de: 782f ldrb r7, [r5, #0]
e0: 5df7 ldrb r7, [r6, r7]
e2: 421f tst r7, r3
e4: d000 beq.n e8 <MlmeScan_InitScan+0xe8>
e6: 700a strb r2, [r1, #0]
e8: 0612 lsls r2, r2, #24
ea: 0e12 lsrs r2, r2, #24
ec: 2a1a cmp r2, #26
ee: d3e7 bcc.n c0 <MlmeScan_InitScan+0xc0>
f0: 20ff movs r0, #255
f2: 7030 strb r0, [r6, #0]
f4: 7070 strb r0, [r6, #1]
f6: 70b0 strb r0, [r6, #2]
f8: 201a movs r0, #26
fa: 4908 ldr r1, [pc, #32] (11c <MlmeScan_InitScan+0x11c>)
fc: 7809 ldrb r1, [r1, #0]
fe: 1a40 subs r0, r0, r1
100: 7020 strb r0, [r4, #0]
102: 2001 movs r0, #1
104: f7ff fffe bl 0 <PATCH_Ret_MlmeScan_InitScan>
108: 2001 movs r0, #1
10a: bcf8 pop {r3, r4, r5, r6, r7}
10c: bc02 pop {r1}
10e: 4708 bx r1
...
128: 0000ffff .word 0x0000ffff
12c: 00000000 .word 0x00000000
00000130 <MlmeActivePassiveScan_Patched>:
130: b531 push {r0, r4, r5, lr}
132: 2881 cmp r0, #129
134: d14d bne.n 1d2 <MlmeActivePassiveScan_Patched+0xa2>
136: 482b ldr r0, [pc, #172] (1e4 <MlmeActivePassiveScan_Patched+0xb4>)
138: 6800 ldr r0, [r0, #0]
13a: 7840 ldrb r0, [r0, #1]
13c: 2800 cmp r0, #0
13e: d008 beq.n 152 <MlmeActivePassiveScan_Patched+0x22>
140: 48ff ldr r0, [pc, #1020] (5f8 <MlmeActivePassiveScan_Patched+0x4c8>)
142: 7800 ldrb r0, [r0, #0]
144: 49ff ldr r1, [pc, #1020] (618 <MlmeActivePassiveScan_Patched+0x4e8>)
146: 1808 adds r0, r1, r0
148: 7801 ldrb r1, [r0, #0]
14a: 4a00 ldr r2, [pc, #0] (200 <MlmeActivePassiveScan_Patched+0xd0>)
14c: 7812 ldrb r2, [r2, #0]
14e: 4391 bics r1, r2
150: 7001 strb r1, [r0, #0]
152: f7ff fffe bl 0 <MlmeScan_StartScan>
156: 2800 cmp r0, #0
158: d13e bne.n 1d8 <MlmeActivePassiveScan_Patched+0xa8>
15a: 4923 ldr r1, [pc, #140] (1e8 <MlmeActivePassiveScan_Patched+0xb8>)
15c: 4823 ldr r0, [pc, #140] (1ec <MlmeActivePassiveScan_Patched+0xbc>)
15e: f7ff fffe bl 0 <__aeabi_uwrite4>
162: f7ff fffe bl 0 <Mlme_FreeSendPendingMsg>
166: 2400 movs r4, #0
168: 48ff ldr r0, [pc, #1020] (600 <MlmeActivePassiveScan_Patched+0x4d0>)
16a: 7004 strb r4, [r0, #0]
16c: 48ff ldr r0, [pc, #1020] (604 <MlmeActivePassiveScan_Patched+0x4d4>)
16e: 4900 ldr r1, [pc, #0] (20c <MlmeActivePassiveScan_Patched+0xdc>)
170: 780a ldrb r2, [r1, #0]
172: 7002 strb r2, [r0, #0]
174: 784a ldrb r2, [r1, #1]
176: 7042 strb r2, [r0, #1]
178: 9400 str r4, [sp, #0]
17a: 2202 movs r2, #2
17c: 4668 mov r0, sp
17e: f7ff fffe bl 0 <FLib_MemCpy>
182: 9800 ldr r0, [sp, #0]
184: f7ff fffe bl 0 <PhyPlmeSetPanId>
188: 200b movs r0, #11
18a: f7ff fffe bl 0 <MlmeOh_NwkMsg>
18e: 4d18 ldr r5, [pc, #96] (1f0 <MlmeActivePassiveScan_Patched+0xc0>)
190: 6829 ldr r1, [r5, #0]
192: 2900 cmp r1, #0
194: d020 beq.n 1d8 <MlmeActivePassiveScan_Patched+0xa8>
196: 4800 ldr r0, [pc, #0] (210 <MlmeActivePassiveScan_Patched+0xe0>)
198: 7802 ldrb r2, [r0, #0]
19a: 2a00 cmp r2, #0
19c: d001 beq.n 1a2 <MlmeActivePassiveScan_Patched+0x72>
19e: 2200 movs r2, #0
1a0: e000 b.n 1a4 <MlmeActivePassiveScan_Patched+0x74>
1a2: 22ea movs r2, #234
1a4: 704a strb r2, [r1, #1]
1a6: 6829 ldr r1, [r5, #0]
1a8: 4aff ldr r2, [pc, #1020] (610 <MlmeActivePassiveScan_Patched+0x4e0>)
1aa: 7812 ldrb r2, [r2, #0]
1ac: 708a strb r2, [r1, #2]
1ae: 6829 ldr r1, [r5, #0]
1b0: 7800 ldrb r0, [r0, #0]
1b2: 70c8 strb r0, [r1, #3]
1b4: 6829 ldr r1, [r5, #0]
1b6: 3108 adds r1, #8
1b8: 48ff ldr r0, [pc, #1020] (614 <MlmeActivePassiveScan_Patched+0x4e4>)
1ba: 6800 ldr r0, [r0, #0]
1bc: f7ff fffe bl 0 <__aeabi_uwrite4>
1c0: 6828 ldr r0, [r5, #0]
1c2: 7104 strb r4, [r0, #4]
1c4: 2203 movs r2, #3
1c6: 4900 ldr r1, [pc, #0] (21c <MlmeActivePassiveScan_Patched+0xec>)
1c8: 6828 ldr r0, [r5, #0]
1ca: 1d40 adds r0, r0, #5
1cc: f7ff fffe bl 0 <FLib_MemCpy>
1d0: e002 b.n 1d8 <MlmeActivePassiveScan_Patched+0xa8>
1d2: 4808 ldr r0, [pc, #32] (1f4 <MlmeActivePassiveScan_Patched+0xc4>)
1d4: 2100 movs r1, #0
1d6: 7001 strb r1, [r0, #0]
1d8: f7ff fffe bl 0 <PATCH_Ret_MlmeActivePassiveScan>
1dc: bc38 pop {r3, r4, r5}
1de: bc01 pop {r0}
1e0: 4700 bx r0
1e2: 46c0 nop (mov r8, r8)
...
1f4: 00000004 .word 0x00000004
...
204: 0000004e .word 0x0000004e
...
PhyIsr_Patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <MACA_Interrupt>:
0: b513 push {r0, r1, r4, lr}
2: 4877 ldr r0, [pc, #476] (1e0 <MACA_Interrupt+0x1e0>) // r0 gets 0x8000400c
4: 6bc0 ldr r0, [r0, #60] // r0 gets 0x8000406c
6: 0880 lsrs r0, r0, #2 // r0 >> 2
8: 9000 str r0, [sp, #0] // store r0 where the stack points
a: 4668 mov r0, sp // put r0 on the stack pointer
c: f7ff fffe bl 0 <CM_SetCurClock> // call setcurclock
// *MACA_CLR = *MACA_IRQ
10: 4874 ldr r0, [pc, #464] (1e4 <MACA_Interrupt+0x1e4>) // r0 getx 0x80004094
12: 6ac4 ldr r4, [r0, #44] // r4 gets 0x800040c0 (maca_irq)
14: 6304 str r4, [r0, #48] // 0x800040c4 gets r4 (maca_clr)
finish decode status
2010-04-02 01:25:05 +02:00
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
16: 0420 lsls r0, r4, #16 // r0 = r4 << 16 ; r0 = (*MACA_IRQ) << 16
finish decode status
2010-04-02 01:25:05 +02:00
18: d501 bpl.n 1e <MACA_Interrupt+0x1e> //branch if !strt irq (the non transmitting section)
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
if( *MACA_TXLEN == 0 ) {
1a: 4871 ldr r0, [pc, #452] (1e0 <MACA_Interrupt+0x1e0>) // r0 = 0x8000400c
1c: 6d00 ldr r0, [r0, #80] // r0 = *0x8000408c *(MACA_TXLEN)
finish decode status
2010-04-02 01:25:05 +02:00
1e: 07e0 lsls r0, r4, #31
20: d574 bpl.n 10c <MACA_Interrupt+0x10c> // branch if action complete
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
*(0x80004010) switch (*MACA_STATUS & 0xf) {
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
22: 486f ldr r0, [pc, #444] (1e0 <MACA_Interrupt+0x1e0>)
24: 6840 ldr r0, [r0, #4]
26: 0700 lsls r0, r0, #28
28: 0f00 lsrs r0, r0, #28
// case (ext_timeout):
2a: 2808 cmp r0, #8
2c: d248 bcs.n c0 <MACA_Interrupt+0xc0>
if ( 7 <= code) {
2e: 2807 cmp r0, #7
30: d844 bhi.n bc <MACA_Interrupt+0xbc>
//
32: a102 add r1, pc, #8 (adr r1, 3c <MACA_Interrupt+0x3c>)
34: 5c09 ldrb r1, [r1, r0] // r1 = *(0x3c + code)
36: 0049 lsls r1, r1, #1 // (lookup *2)
38: 448f add pc, r1 // jumptable
3a: 46c0 nop
3c: 2b29c904 .word 0x2b29c904
40: 3c3a362f .word 0x3c3a362f
// 0: goto 0x92 1: goto 0x8E 2: goto 0x1CE 3: goto 0x44
// 4: goto 0xb4 5: goto 0xb0 6: goto 0xA8 7: goto 0x9A
// case (code == 3) { // crc failed
// does this test a rom verison? or if we are simulating? (b/c in r.l. *0x50 = 0xbc80ffe7)
44: 4868 ldr r0, [pc, #416] (1e8 <MACA_Interrupt+0x1e8>) // r0 = 0x50
46: 7800 ldrb r0, [r0, #0] // r0 = *(0x50)
48: 2800 cmp r0, #0 // if (*(0x50) == 0) {
4a: d106 bne.n 5a <MACA_Interrupt+0x5a>
4c: 4867 ldr r0, [pc, #412] (1ec <MACA_Interrupt+0x1ec>) // don't know 0x1ec
4e: 2104 movs r1, #4
50: 7001 strb r1, [r0, #0]
// seqinjectevent(11) and return
52: 200b movs r0, #11
54: f7ff fffe bl 0 <SeqInjectEvent>
58: e0bf b.n 1da <MACA_Interrupt+0x1da> // return
} else { // from *0x50 == 0
5a: 4865 ldr r0, [pc, #404] (1f0 <MACA_Interrupt+0x1f0>)
5c: 6800 ldr r0, [r0, #0]
5e: f7ff fffe bl 0 <CommonRxSetup>
62: 2800 cmp r0, #0
64: d003 beq.n 6e <MACA_Interrupt+0x6e> //might be an if rel clock
66: 2001 movs r0, #1
68: f7ff fffe bl 0 <CommonRxSetupControl>
6c: e0b5 b.n 1da <MACA_Interrupt+0x1da>
6e: 485c ldr r0, [pc, #368] (1e0 <MACA_Interrupt+0x1e0>)
70: 2103 movs r1, #3
72: 6341 str r1, [r0, #52] // *(0x80004040) = 3 ; *maca_tmren = allclocks
74: 6d00 ldr r0, [r0, #80] // r0 = *(0x80005C) ; *maca_relclk
76: 3032 adds r0, #50 // r0 += 50
78: 4959 ldr r1, [pc, #356] (1e0 <MACA_Interrupt+0x1e0>)
7a: 6408 str r0, [r1, #64] // r0 = *(0x8000404c) (maca_startclk)
7c: 6d08 ldr r0, [r1, #80] // *maca_relclk = *(maca_startclk)
7e: 21fa movs r1, #250 // r1 = 250
80: 0089 lsls r1, r1, #2 // r1 = 500
82: 1840 adds r0, r0, r1 // r0 = 500 + relclk_value
84: 4956 ldr r1, [pc, #344] (1e0 <MACA_Interrupt+0x1e0>)
86: 6448 str r0, [r1, #68] // *(0x8004050) = 500 + reclk_value; *maca_cplclk = 500 + relclk_value
88: 0008 lsls r0, r1, #0 // r0 = r1
8a: 2102 movs r1, #2 // r1 = 2
8c: e0a4 b.n 1d8 <MACA_Interrupt+0x1d8> //return;
// if (code == 1 ) // time-out
8e: 200c movs r0, #12 // seqinjectevent(12) and return;
90: e7e0 b.n 54 <MACA_Interrupt+0x54>
// if( code == 0) { //success
92: 2014 movs r0, #20 // seqinjectevent(20)
94: f7ff fffe bl 0 <SeqInjectEvent>
98: e09f b.n 1da <MACA_Interrupt+0x1da> goto exit.
// if (code == 7) { // late start
9a: 4853 ldr r0, [pc, #332] (1e8 <MACA_Interrupt+0x1e8>)
9c: 7800 ldrb r0, [r0, #0]
9e: 2800 cmp r0, #0
a0: d000 beq.n a4 <MACA_Interrupt+0xa4>
a2: e09a b.n 1da <MACA_Interrupt+0x1da>
a4: 2016 movs r0, #22
a6: e7d5 b.n 54 <MACA_Interrupt+0x54>
// if (code == 6, no data) {
a8: f7ff fffe bl 0 <ResumeMACASync>
// inject (15) and return
ac: 200f movs r0, #15
ae: e7f1 b.n 94 <MACA_Interrupt+0x94>
// if(code = 5, no ack) {
// inject 16 and return
b0: 2010 movs r0, #16
b2: e7cf b.n 54 <MACA_Interrupt+0x54>
//if (code == 4, aborted)
// seqinjectevent(19) and return
b4: 2013 movs r0, #19
b6: f7ff fffe bl 0 <SeqInjectEvent>
ba: e08e b.n 1da <MACA_Interrupt+0x1da>
// } else { // (from code <= 7 )
finish decode status
2010-04-02 01:25:05 +02:00
// if code > 8, inject(22) and return;
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
bc: 2016 movs r0, #22
be: e7c9 b.n 54 <MACA_Interrupt+0x54>
finish decode status
2010-04-02 01:25:05 +02:00
// from bcs with 8; r0 = code
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
c0: 3808 subs r0, #8
c2: 2807 cmp r0, #7
finish decode status
2010-04-02 01:25:05 +02:00
c4: d820 bhi.n 108 <MACA_Interrupt+0x108> // branch if ((code - 8 > 7) default:
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
c6: a101 add r1, pc, #4 (adr r1, cc <MACA_Interrupt+0xcc>)
c8: 5c09 ldrb r1, [r1, r0]
ca: 448f add pc, r1
cc: 1e1e0e06 .word 0x1e1e0e06
d0: 322a2622 .word 0x322a2622
finish decode status
2010-04-02 01:25:05 +02:00
// 0: goto 0xec 1: goto 0xec 2: goto 0xdc 3: goto 0xd4
// 4: goto 0x100 5: goto 0xf8 6: goto 0xf4 7: goto 0xf0
code == 11, not used
// resumemacasync and inject 17
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
d4: f7ff fffe bl 0 <ResumeMACASync>
d8: 2011 movs r0, #17
da: e7db b.n 94 <MACA_Interrupt+0x94>
finish decode status
2010-04-02 01:25:05 +02:00
// code == 10 not used
// resume maca sync
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
dc: f7ff fffe bl 0 <ResumeMACASync>
e0: 20c0 movs r0, #192
finish decode status
2010-04-02 01:25:05 +02:00
e2: 0140 lsls r0, r0, #5 r0 = 0x1800
e4: 4204 tst r4, r0
e6: d172 bne.n 1ce <MACA_Interrupt+0x1ce> // branch if not 0x1800
// branch resumes macasync and injects 20
// inject 18 and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
e8: 2012 movs r0, #18
ea: e7b3 b.n 54 <MACA_Interrupt+0x54>
finish decode status
2010-04-02 01:25:05 +02:00
//code == 8, exttimeout code == 9 pnd timeout
// inject 22, return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
ec: 2016 movs r0, #22
ee: e7e2 b.n b6 <MACA_Interrupt+0xb6>
finish decode status
2010-04-02 01:25:05 +02:00
// code = 15, dma bus error
// inject 25, return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
f0: 2019 movs r0, #25
f2: e7af b.n 54 <MACA_Interrupt+0x54>
finish decode status
2010-04-02 01:25:05 +02:00
// code = 14, not complete
// inject 22 and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
f4: 2016 movs r0, #22
f6: e7cd b.n 94 <MACA_Interrupt+0x94>
finish decode status
2010-04-02 01:25:05 +02:00
// code = 13, external abort
// resume maca synce
// inject 22 and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
f8: f7ff fffe bl 0 <ResumeMACASync>
fc: 2016 movs r0, #22
fe: e7a9 b.n 54 <MACA_Interrupt+0x54>
finish decode status
2010-04-02 01:25:05 +02:00
// code == 12 pll unlock
// inject 26 and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
100: 201a movs r0, #26
102: f7ff fffe bl 0 <SeqInjectEvent>
106: e068 b.n 1da <MACA_Interrupt+0x1da>
finish decode status
2010-04-02 01:25:05 +02:00
// default: inject(22) and return;
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
108: 2016 movs r0, #22
10a: e7a3 b.n 54 <MACA_Interrupt+0x54>
} else { // from *MACA_TXLEN == 0
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
10c: 4839 ldr r0, [pc, #228] (1f4 <MACA_Interrupt+0x1f4>) // r0 = 0x1001
10e: 4020 ands r0, r4 // r4 is the irq state, mask action complete and timeout
110: 2180 movs r1, #128 // r1 = 128
112: 0149 lsls r1, r1, #5 // r1 = 0x1000
114: 4288 cmp r0, r1
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
116: d101 bne.n 11c <MACA_Interrupt+0x11c>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
// if (timeout) {
// inject(24) and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
118: 2018 movs r0, #24
11a: e7bb b.n 94 <MACA_Interrupt+0x94>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
//}
11c: 2102 movs r1, #2 // r1 = 2
11e: 420c tst r4, r1
// if(poll) {
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
120: d017 beq.n 152 <MACA_Interrupt+0x152>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
}
// do the *0x50 == 0 test
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
122: 4831 ldr r0, [pc, #196] (1e8 <MACA_Interrupt+0x1e8>)
124: 7800 ldrb r0, [r0, #0]
126: 2800 cmp r0, #0
128: d109 bne.n 13e <MACA_Interrupt+0x13e>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
12a: 4833 ldr r0, [pc, #204] (1f8 <MACA_Interrupt+0x1f8>)
12c: f7ff fffe bl 0 <__aeabi_uread4>
130: 2800 cmp r0, #0
132: d000 beq.n 136 <MACA_Interrupt+0x136>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
134: 2001 movs r0, #1 // r0 = 1
136: 492a ldr r1, [pc, #168] (1e0 <MACA_Interrupt+0x1e0>) r1 = *(0x800040b4) reserved
138: 6088 str r0, [r1, #8] *(0x800040b4) + 8 = 1;
// inject(23) and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
13a: 2017 movs r0, #23
13c: e78a b.n 54 <MACA_Interrupt+0x54>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
// rom != 0
// inject(14)
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
13e: 200e movs r0, #14
140: f7ff fffe bl 0 <SeqInjectEvent>
144: 482a ldr r0, [pc, #168] (1f0 <MACA_Interrupt+0x1f0>)
146: 6800 ldr r0, [r0, #0]
148: f7ff fffe bl 0 <CommonRxSetup>
14c: 2800 cmp r0, #0
14e: d044 beq.n 1da <MACA_Interrupt+0x1da>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
// return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
150: e789 b.n 66 <MACA_Interrupt+0x66>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
// when poll == 1
152: 2104 movs r1, #4
154: 420c tst r4, r1 // if (data_indication) {
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
156: d001 beq.n 15c <MACA_Interrupt+0x15c>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
} else {
// inject(14) and return
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
158: 200e movs r0, #14
15a: e77b b.n 54 <MACA_Interrupt+0x54>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
}
// data_indication == 1
15c: 0520 lsls r0, r4, #20 // r0 = saved irq status << 20
15e: d436 bmi.n 1ce <MACA_Interrupt+0x1ce> // branch if negative (so if irq bit 11 is set, failed filter
160: 0460 lsls r0, r4, #17
162: d506 bpl.n 172 <MACA_Interrupt+0x172> // branch if !bit 14, sync detect
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
164: 4820 ldr r0, [pc, #128] (1e8 <MACA_Interrupt+0x1e8>)
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
166: 7800 ldrb r0, [r0, #0] // check if txlen is 0
168: 2800 cmp r0, #0 // if not zero, return (maybe this is an ack to transmit?)
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
16a: d136 bne.n 1da <MACA_Interrupt+0x1da>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
16c: 481d ldr r0, [pc, #116] (1e4 <MACA_Interrupt+0x1e4>) // r0 = *0x80004108
16e: 2108 movs r1, #8 // r1 = 8
170: e032 b.n 1d8 <MACA_Interrupt+0x1d8> // return
// sync not detectd
// return if bit 7
172: 01c9 lsls r1, r1, #7 // r1 had 4, now r1 = 4 << 7
174: 420c tst r4, r1
176: d030 beq.n 1da <MACA_Interrupt+0x1da> // return if fifo level
178: 4819 ldr r0, [pc, #100] (1e0 <MACA_Interrupt+0x1e0>) r0 = *0x80004070, reserved
17a: 6f40 ldr r0, [r0, #116] r0 = *(*0x80004070 + 116)
17c: 4a19 ldr r2, [pc, #100] (1e4 <MACA_Interrupt+0x1e4>)
17e: 6852 ldr r2, [r2, #4] r2 = *(*0x800040F8 + 4)
180: 2a08 cmp r2, #8
182: d128 bne.n 1d6 <MACA_Interrupt+0x1d6> // branch if r2 != 8 // *0x80004094 = r1 (r1 = 0x200 here), and return
// *0x50 test
184: 4a18 ldr r2, [pc, #96] (1e8 <MACA_Interrupt+0x1e8>)
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
186: 7812 ldrb r2, [r2, #0]
188: 2a00 cmp r2, #0
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
18a: d124 bne.n 1d6 <MACA_Interrupt+0x1d6> //if rom == 0 return
18c: 7941 ldrb r1, [r0, #5] // r1 = *(uint8_t * )0x80004075
18e: 020a lsls r2, r1, #8 // r2 = r1 << 8
190: 7901 ldrb r1, [r0, #4] // r1 = *(uint8_t * )0x80004074
192: 4311 orrs r1, r2 // temp = *(uint8_t *)0x80004075 | *(uint8_t *)0x80004074
194: 79c2 ldrb r2, [r0, #7] // *(uint8_t * )0x80004077 = temp
196: 0213 lsls r3, r2, #8 // r3 = temp << 8
198: 7982 ldrb r2, [r0, #6] // temp = *(uint8_t * )0x80004076
19a: 431a orrs r2, r3
19c: 7883 ldrb r3, [r0, #2] // *(uint8_t * )0x80004072 = r3 | temp
19e: 021b lsls r3, r3, #8 // r3 = r3 << 8
1a0: 7840 ldrb r0, [r0, #1] // r0 = *(uint8_t * )0x80004071
1a2: 4318 orrs r0, r3 // r0 = r0 | r3
1a4: 23c4 movs r3, #196 // r3 = 0xc4
1a6: 011b lsls r3, r3, #4 // r3 = 0xc40
1a8: 4003 ands r3, r0 // r3 = 0xc40 & r0
1aa: 2084 movs r0, #132 // r0 = 0x84
1ac: 0100 lsls r0, r0, #4 // r0 = 0x840
1ae: 4283 cmp r3, r0 // is r3 == 0x840?
1b0: d113 bne.n 1da <MACA_Interrupt+0x1da> // branch if r3 != 0x840
1b2: 4b0c ldr r3, [pc, #48] (1e4 <MACA_Interrupt+0x1e4>) // r3 = *(0x80040c4) *maca_clrirq
1b4: 6f1b ldr r3, [r3, #112] // r3 = *maca_irq + 112
1b6: 429a cmp r2, r3
1b8: d002 beq.n 1c0 <MACA_Interrupt+0x1c0> // branch if r2 == r3
1ba: 4810 ldr r0, [pc, #64] (1fc <MACA_Interrupt+0x1fc>) // r0 = 0xffff + 64
1bc: 4282 cmp r2, r0
1be: d10c bne.n 1da <MACA_Interrupt+0x1da> // return if some rom location == r0
1c0: 4a08 ldr r2, [pc, #32] (1e4 <MACA_Interrupt+0x1e4>) r2 = *(0x800040b4)
1c2: 6ed2 ldr r2, [r2, #108] r2 = *(0x800040b4) + 108
1c4: 4291 cmp r1, r2
1c6: d008 beq.n 1da <MACA_Interrupt+0x1da> // return if r1 == r2
1c8: 480c ldr r0, [pc, #48] (1fc <MACA_Interrupt+0x1fc>) r0 = *(0xffff + 48)
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
1ca: 4281 cmp r1, r0
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
1cc: d005 beq.n 1da <MACA_Interrupt+0x1da> // return if r1 == r0 or resumemacasync, inject(20), and return.
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
// if(code = 2, channel_busy) {
1ce: f7ff fffe bl 0 <ResumeMACASync>
// inject (20) and return
1d2: 2014 movs r0, #20
1d4: e73e b.n 54 <MACA_Interrupt+0x54>
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
// *0x80004094 = r1, and return
1d6: 4803 ldr r0, [pc, #12] (1e4 <MACA_Interrupt+0x1e4>)
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
1d8: 6001 str r1, [r0, #0]
finished reversing interrupt. Found a very interesting magic sequence. There is a lot here to try.
2010-04-02 00:33:09 +02:00
this mac uses seqinject in interrupt and rom resumemacasync
2010-04-01 23:31:26 +02:00
1da: bc1c pop {r2, r3, r4}
1dc: bc01 pop {r0}
1de: 4700 bx r0
1e0: 8000400c .word 0x8000400c
1e4: 80004094 .word 0x80004094
1e8: 00000050 .word 0x00000050
...
1f4: 00001001 .word 0x00001001
1f8: 00000000 .word 0x00000000
1fc: 0000ffff .word 0x0000ffff
PhySettingsRam.o: file format elf32-littlearm
Phy_Patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <InitializePhy>:
0: b5f1 push {r0, r4, r5, r6, r7, lr}
2: 4c00 ldr r4, [pc, #0] (224 <PhyPlmeSetCurrentChannelRequest+0xbc>)
4: 6820 ldr r0, [r4, #0]
6: 0001 lsls r1, r0, #0
8: 3123 adds r1, #35
a: 4d43 ldr r5, [pc, #268] (118 <InitializePhy+0x118>)
c: 780a ldrb r2, [r1, #0]
e: 2a00 cmp r2, #0
10: d135 bne.n 7e <InitializePhy+0x7e>
12: 682a ldr r2, [r5, #0]
14: 4e41 ldr r6, [pc, #260] (11c <InitializePhy+0x11c>)
16: 6296 str r6, [r2, #40]
18: 4b41 ldr r3, [pc, #260] (120 <InitializePhy+0x120>)
1a: 62d3 str r3, [r2, #44]
1c: 4b41 ldr r3, [pc, #260] (124 <InitializePhy+0x124>)
1e: 6313 str r3, [r2, #48]
20: 78c9 ldrb r1, [r1, #3]
22: 6351 str r1, [r2, #52]
24: 4940 ldr r1, [pc, #256] (128 <InitializePhy+0x128>)
26: 6391 str r1, [r2, #56]
28: 302a adds r0, #42
2a: f7ff fffe bl 0 <__aeabi_uread4>
2e: 6829 ldr r1, [r5, #0]
30: 000b lsls r3, r1, #0
32: 333c adds r3, #60
34: 6822 ldr r2, [r4, #0]
36: 2727 movs r7, #39
38: 5dd7 ldrb r7, [r2, r7]
3a: 067f lsls r7, r7, #25
3c: 4338 orrs r0, r7
3e: 6018 str r0, [r3, #0]
40: 483a ldr r0, [pc, #232] (12c <InitializePhy+0x12c>)
42: 6058 str r0, [r3, #4]
44: 200c movs r0, #12
46: 6098 str r0, [r3, #8]
48: 4839 ldr r0, [pc, #228] (130 <InitializePhy+0x130>)
4a: 60d8 str r0, [r3, #12]
4c: 20ff movs r0, #255
4e: 1c80 adds r0, r0, #2
50: 6118 str r0, [r3, #16]
52: 615e str r6, [r3, #20]
54: 48ff ldr r0, [pc, #1020] (624 <PhyPlmeSetCurrentChannelRequest+0x4bc>)
56: 6198 str r0, [r3, #24]
58: 675e str r6, [r3, #116]
5a: 4f31 ldr r7, [pc, #196] (120 <InitializePhy+0x120>)
5c: 679f str r7, [r3, #120]
5e: 31d8 adds r1, #216
60: 4b34 ldr r3, [pc, #208] (134 <InitializePhy+0x134>)
62: 600b str r3, [r1, #0]
64: 4b34 ldr r3, [pc, #208] (138 <InitializePhy+0x138>)
66: 604b str r3, [r1, #4]
68: 608e str r6, [r1, #8]
6a: 60c8 str r0, [r1, #12]
6c: 3228 adds r2, #40
6e: 7810 ldrb r0, [r2, #0]
70: 7851 ldrb r1, [r2, #1]
72: 0609 lsls r1, r1, #24
74: 0c09 lsrs r1, r1, #16
76: 4308 orrs r0, r1
78: 4930 ldr r1, [pc, #192] (13c <InitializePhy+0x13c>)
7a: 6809 ldr r1, [r1, #0]
7c: 6048 str r0, [r1, #4]
7e: 4e30 ldr r6, [pc, #192] (140 <InitializePhy+0x140>)
80: 2700 movs r7, #0
82: 7037 strb r7, [r6, #0]
84: 482f ldr r0, [pc, #188] (144 <InitializePhy+0x144>)
86: 8801 ldrh r1, [r0, #0]
88: 6828 ldr r0, [r5, #0]
8a: f7ff fffe bl 0 <InitFromMemory>
8e: 482e ldr r0, [pc, #184] (148 <InitializePhy+0x148>)
90: 8801 ldrh r1, [r0, #0]
92: 482e ldr r0, [pc, #184] (14c <InitializePhy+0x14c>)
94: 6800 ldr r0, [r0, #0]
96: f7ff fffe bl 0 <InitFromMemory>
9a: 482d ldr r0, [pc, #180] (150 <InitializePhy+0x150>)
9c: 8801 ldrh r1, [r0, #0]
9e: 482d ldr r0, [pc, #180] (154 <InitializePhy+0x154>)
a0: 6800 ldr r0, [r0, #0]
a2: f7ff fffe bl 0 <InitFromMemory>
a6: 482c ldr r0, [pc, #176] (158 <InitializePhy+0x158>)
a8: 8801 ldrh r1, [r0, #0]
aa: 4824 ldr r0, [pc, #144] (13c <InitializePhy+0x13c>)
ac: 6800 ldr r0, [r0, #0]
ae: f7ff fffe bl 0 <InitFromMemory>
b2: 4668 mov r0, sp
b4: f7ff fffe bl 0 <GetInitTranslationTablePtr>
b8: 2101 movs r1, #1
ba: 7031 strb r1, [r6, #0]
bc: 4669 mov r1, sp
be: 780a ldrb r2, [r1, #0]
c0: 0001 lsls r1, r0, #0
c2: 20f8 movs r0, #248
c4: 0240 lsls r0, r0, #9
c6: f7ff fffe bl 0 <InitFromFlash>
ca: 7037 strb r7, [r6, #0]
cc: 4823 ldr r0, [pc, #140] (15c <InitializePhy+0x15c>)
ce: 6801 ldr r1, [r0, #0]
d0: 2210 movs r2, #16
d2: 4391 bics r1, r2
d4: 6001 str r1, [r0, #0]
d6: 6882 ldr r2, [r0, #8]
d8: 4921 ldr r1, [pc, #132] (160 <InitializePhy+0x160>)
da: 4311 orrs r1, r2
dc: 6802 ldr r2, [r0, #0]
de: 2310 movs r3, #16
e0: 4313 orrs r3, r2
e2: 6003 str r3, [r0, #0]
e4: 6081 str r1, [r0, #8]
e6: 491f ldr r1, [pc, #124] (164 <InitializePhy+0x164>)
e8: 60c1 str r1, [r0, #12]
ea: 0a09 lsrs r1, r1, #8
ec: 6101 str r1, [r0, #16]
ee: 4811 ldr r0, [pc, #68] (134 <InitializePhy+0x134>)
f0: 3987 subs r1, #135
f2: 6001 str r1, [r0, #0]
f4: 6820 ldr r0, [r4, #0]
f6: 3023 adds r0, #35
f8: 7800 ldrb r0, [r0, #0]
fa: 2800 cmp r0, #0
fc: d102 bne.n 104 <InitializePhy+0x104>
fe: 4807 ldr r0, [pc, #28] (11c <InitializePhy+0x11c>)
100: 49ff ldr r1, [pc, #1020] (624 <PhyPlmeSetCurrentChannelRequest+0x4bc>)
102: 6001 str r1, [r0, #0]
104: 200f movs r0, #15
106: f7ff fffe bl 0 <Asp_SetPowerLevel>
10a: f7ff fffe bl 0 <Asm_Init>
10e: f7ff fffe bl 0 <PATCH_Ret_InitializePhy>
112: bcf8 pop {r3, r4, r5, r6, r7}
114: bc01 pop {r0}
116: 4700 bx r0
118: 00000000 .word 0x00000000
11c: 80009000 .word 0x80009000
120: 80050300 .word 0x80050300
124: 80009008 .word 0x80009008
128: 8000900c .word 0x8000900c
12c: 80009020 .word 0x80009020
130: 80009004 .word 0x80009004
134: 80003048 .word 0x80003048
138: 00000f7c .word 0x00000f7c
...
15c: 80009a00 .word 0x80009a00
160: 0000f7df .word 0x0000f7df
164: 000fffff .word 0x000fffff
00000168 <PhyPlmeSetCurrentChannelRequest>:
168: b573 push {r0, r1, r4, r5, r6, lr}
16a: 380b subs r0, #11
16c: 0704 lsls r4, r0, #28
16e: 0f24 lsrs r4, r4, #28
170: 4824 ldr r0, [pc, #144] (204 <PhyPlmeSetCurrentChannelRequest+0x9c>)
172: 7004 strb r4, [r0, #0]
174: 4dff ldr r5, [pc, #1020] (620 <PhyPlmeSetCurrentChannelRequest+0x4b8>)
176: 6828 ldr r0, [r5, #0]
178: 1901 adds r1, r0, r4
17a: 4e23 ldr r6, [pc, #140] (208 <PhyPlmeSetCurrentChannelRequest+0xa0>)
17c: 7830 ldrb r0, [r6, #0]
17e: 7c4a ldrb r2, [r1, #17]
180: 4290 cmp r0, r2
182: d202 bcs.n 18a <PhyPlmeSetCurrentChannelRequest+0x22>
184: f7ff fffe bl 0 <Asp_SetPowerLevel>
188: e007 b.n 19a <PhyPlmeSetCurrentChannelRequest+0x32>
18a: 466a mov r2, sp
18c: 7010 strb r0, [r2, #0]
18e: 7c48 ldrb r0, [r1, #17]
190: f7ff fffe bl 0 <Asp_SetPowerLevel>
194: 4668 mov r0, sp
196: 7800 ldrb r0, [r0, #0]
198: 7030 strb r0, [r6, #0]
19a: 4e1c ldr r6, [pc, #112] (20c <PhyPlmeSetCurrentChannelRequest+0xa4>)
19c: 6830 ldr r0, [r6, #0]
19e: 491c ldr r1, [pc, #112] (210 <PhyPlmeSetCurrentChannelRequest+0xa8>)
1a0: 4001 ands r1, r0
1a2: 6031 str r1, [r6, #0]
1a4: 6828 ldr r0, [r5, #0]
1a6: 1901 adds r1, r0, r4
1a8: 312e adds r1, #46
1aa: 7809 ldrb r1, [r1, #0]
1ac: 60f1 str r1, [r6, #12]
1ae: 00a1 lsls r1, r4, #2
1b0: 1840 adds r0, r0, r1
1b2: 303e adds r0, #62
1b4: f7ff fffe bl 0 <__aeabi_uread4>
1b8: 6130 str r0, [r6, #16]
1ba: 2106 movs r1, #6
1bc: 6331 str r1, [r6, #48]
1be: 4815 ldr r0, [pc, #84] (214 <PhyPlmeSetCurrentChannelRequest+0xac>)
1c0: 4344 muls r4, r0
1c2: 4815 ldr r0, [pc, #84] (218 <PhyPlmeSetCurrentChannelRequest+0xb0>)
1c4: 6800 ldr r0, [r0, #0]
1c6: 0600 lsls r0, r0, #24
1c8: 1820 adds r0, r4, r0
1ca: 4914 ldr r1, [pc, #80] (21c <PhyPlmeSetCurrentChannelRequest+0xb4>)
1cc: 1840 adds r0, r0, r1
1ce: 21f8 movs r1, #248
1d0: 0609 lsls r1, r1, #24
1d2: 0142 lsls r2, r0, #5
1d4: d504 bpl.n 1e0 <PhyPlmeSetCurrentChannelRequest+0x78>
1d6: 4001 ands r1, r0
1d8: 2080 movs r0, #128
1da: 0500 lsls r0, r0, #20
1dc: 1809 adds r1, r1, r0
1de: e000 b.n 1e2 <PhyPlmeSetCurrentChannelRequest+0x7a>
1e0: 4001 ands r1, r0
1e2: 0ec8 lsrs r0, r1, #27
1e4: 0200 lsls r0, r0, #8
1e6: 1d80 adds r0, r0, #6
1e8: 6330 str r0, [r6, #48]
1ea: 6830 ldr r0, [r6, #0]
1ec: 2180 movs r1, #128
1ee: 05c9 lsls r1, r1, #23
1f0: 4301 orrs r1, r0
1f2: 6031 str r1, [r6, #0]
1f4: 48ff ldr r0, [pc, #1020] (624 <PhyPlmeSetCurrentChannelRequest+0x4bc>)
1f6: 6030 str r0, [r6, #0]
1f8: f7ff fffe bl 0 <PATCH_Ret_PhyPlmeSetCurrentChannelRequest>
1fc: bc7c pop {r2, r3, r4, r5, r6}
1fe: bc01 pop {r0}
200: 4700 bx r0
202: 46c0 nop (mov r8, r8)
...
20c: 80009800 .word 0x80009800
210: bfffffff .word 0xbfffffff
214: 037ef9db .word 0x037ef9db
218: 00000000 .word 0x00000000
21c: 04c49ba6 .word 0x04c49ba6
220: 00000000 .word 0x00000000
224: c0050300 .word 0xc0050300
SeqSM_patched.o: file format elf32-littlearm
Disassembly of section .text:
00000000 <SeqTxPollState_Patched>:
0: b570 push {r4, r5, r6, lr}
2: 380b subs r0, #11
4: 280f cmp r0, #15
6: d80b bhi.n 20 <SeqTxPollState_Patched+0x20>
8: a101 add r1, pc, #4 (adr r1, 10 <SeqTxPollState_Patched+0x10>)
a: 5c09 ldrb r1, [r1, r0]
c: 448f add pc, r1
e: 46c0 nop (mov r8, r8)
10: d61092dc .word 0xd61092dc
14: 5e5e5eb4 .word 0x5e5e5eb4
18: 92105e5e .word 0x92105e5e
1c: 5e5e165e .word 0x5e5e165e
20: 48ff ldr r0, [pc, #1020] (644 <SeqTxAutoRxState_Patched+0x504>)
22: 2100 movs r1, #0
24: 7001 strb r1, [r0, #0]
26: f7ff fffe bl 0 <PATCH_Ret_SeqTxPollState>
2a: bc70 pop {r4, r5, r6}
2c: bc01 pop {r0}
2e: 4700 bx r0
30: 700d strb r5, [r1, #0]
32: 2800 cmp r0, #0
34: d014 beq.n 60 <SeqTxPollState_Patched+0x60>
36: 3094 adds r0, #148
38: 493e ldr r1, [pc, #248] (134 <SeqTxPollState_Patched+0x134>)
3a: 6809 ldr r1, [r1, #0]
3c: 0889 lsrs r1, r1, #2
3e: 6001 str r1, [r0, #0]
40: f7ff fffe bl 0 <PhyPlmeGetLQI>
44: 6831 ldr r1, [r6, #0]
46: 7048 strb r0, [r1, #1]
48: f7ff fffe bl 0 <GetHeaderLength>
4c: 6831 ldr r1, [r6, #0]
4e: 7088 strb r0, [r1, #2]
50: 4838 ldr r0, [pc, #224] (134 <SeqTxPollState_Patched+0x134>)
52: 6b00 ldr r0, [r0, #48]
54: 6831 ldr r1, [r6, #0]
56: 7008 strb r0, [r1, #0]
58: 6830 ldr r0, [r6, #0]
5a: f7ff fffe bl 0 <MemIh_SeqDataInd>
5e: 6035 str r5, [r6, #0]
60: 6820 ldr r0, [r4, #0]
62: 2181 movs r1, #129
64: 7041 strb r1, [r0, #1]
66: 4834 ldr r0, [pc, #208] (138 <SeqTxPollState_Patched+0x138>)
68: 2101 movs r1, #1
6a: 7001 strb r1, [r0, #0]
6c: e05e b.n 12c <SeqTxPollState_Patched+0x12c>
6e: 4900 ldr r1, [pc, #0] (238 <SeqTxAutoRxState_Patched+0xf8>)
70: 48ff ldr r0, [pc, #1020] (638 <SeqTxAutoRxState_Patched+0x4f8>)
72: f7ff fffe bl 0 <__aeabi_uwrite4>
76: 4e00 ldr r6, [pc, #0] (234 <SeqTxAutoRxState_Patched+0xf4>)
78: 6830 ldr r0, [r6, #0]
7a: f7ff fffe bl 0 <MM_Free>
7e: 2000 movs r0, #0
80: 6030 str r0, [r6, #0]
82: 4c00 ldr r4, [pc, #0] (244 <SeqTxAutoRxState_Patched+0x104>)
84: 6820 ldr r0, [r4, #0]
86: 300c adds r0, #12
88: f7ff fffe bl 0 <__aeabi_uread4>
8c: f7ff fffe bl 0 <MM_Free>
90: 6821 ldr r1, [r4, #0]
92: 310c adds r1, #12
94: 2000 movs r0, #0
96: f7ff fffe bl 0 <__aeabi_uwrite4>
9a: 6820 ldr r0, [r4, #0]
9c: f7ff fffe bl 0 <MemIh_SeqActionFailInd>
a0: e7c1 b.n 1ba <SeqTxAutoRxState_Patched+0x7a>
a2: 4900 ldr r1, [pc, #0] (238 <SeqTxAutoRxState_Patched+0xf8>)
a4: 48ff ldr r0, [pc, #1020] (638 <SeqTxAutoRxState_Patched+0x4f8>)
a6: f7ff fffe bl 0 <__aeabi_uwrite4>
aa: 4e00 ldr r6, [pc, #0] (234 <SeqTxAutoRxState_Patched+0xf4>)
ac: 6830 ldr r0, [r6, #0]
ae: f7ff fffe bl 0 <MM_Free>
b2: 2000 movs r0, #0
b4: 6030 str r0, [r6, #0]
b6: 4800 ldr r0, [pc, #0] (244 <SeqTxAutoRxState_Patched+0x104>)
b8: 6800 ldr r0, [r0, #0]
ba: 2185 movs r1, #133
bc: 7041 strb r1, [r0, #1]
be: 4800 ldr r0, [pc, #0] (240 <SeqTxAutoRxState_Patched+0x100>)
c0: 2101 movs r1, #1
c2: e7af b.n 24 <SeqTxPollState_Patched+0x24>
c4: 49ff ldr r1, [pc, #1020] (634 <SeqTxAutoRxState_Patched+0x4f4>)
c6: 4800 ldr r0, [pc, #0] (23c <SeqTxAutoRxState_Patched+0xfc>)
c8: f7ff fffe bl 0 <__aeabi_uwrite4>
cc: 4eff ldr r6, [pc, #1020] (630 <SeqTxAutoRxState_Patched+0x4f0>)
ce: 6830 ldr r0, [r6, #0]
d0: f7ff fffe bl 0 <MM_Free>
d4: 2000 movs r0, #0
d6: 6030 str r0, [r6, #0]
d8: 48ff ldr r0, [pc, #1020] (640 <SeqTxAutoRxState_Patched+0x500>)
da: 6800 ldr r0, [r0, #0]
dc: 2186 movs r1, #134
de: 7041 strb r1, [r0, #1]
e0: 48ff ldr r0, [pc, #1020] (63c <SeqTxAutoRxState_Patched+0x4fc>)
e2: 2101 movs r1, #1
e4: e79e b.n 24 <SeqTxPollState_Patched+0x24>
e6: 4815 ldr r0, [pc, #84] (13c <SeqTxPollState_Patched+0x13c>)
e8: 2101 movs r1, #1
ea: e79b b.n 24 <SeqTxPollState_Patched+0x24>
ec: 49ff ldr r1, [pc, #1020] (634 <SeqTxAutoRxState_Patched+0x4f4>)
ee: 4800 ldr r0, [pc, #0] (23c <SeqTxAutoRxState_Patched+0xfc>)
f0: f7ff fffe bl 0 <__aeabi_uwrite4>
f4: 4cff ldr r4, [pc, #1020] (640 <SeqTxAutoRxState_Patched+0x500>)
f6: 6820 ldr r0, [r4, #0]
f8: 300c adds r0, #12
fa: f7ff fffe bl 0 <__aeabi_uread4>
fe: f7ff fffe bl 0 <MM_Free>
102: 6821 ldr r1, [r4, #0]
104: 310c adds r1, #12
106: 2000 movs r0, #0
108: f7ff fffe bl 0 <__aeabi_uwrite4>
10c: 4eff ldr r6, [pc, #1020] (630 <SeqTxAutoRxState_Patched+0x4f0>)
10e: 6830 ldr r0, [r6, #0]
110: 490a ldr r1, [pc, #40] (13c <SeqTxPollState_Patched+0x13c>)
112: 2500 movs r5, #0
114: 780a ldrb r2, [r1, #0]
116: 2a00 cmp r2, #0
118: d18a bne.n 30 <SeqTxPollState_Patched+0x30>
11a: f7ff fffe bl 0 <MM_Free>
11e: 6035 str r5, [r6, #0]
120: 4805 ldr r0, [pc, #20] (138 <SeqTxPollState_Patched+0x138>)
122: 2101 movs r1, #1
124: 7001 strb r1, [r0, #0]
126: 6820 ldr r0, [r4, #0]
128: 2184 movs r1, #132
12a: 7041 strb r1, [r0, #1]
12c: 48ff ldr r0, [pc, #1020] (63c <SeqTxAutoRxState_Patched+0x4fc>)
12e: 2101 movs r1, #1
130: e778 b.n 24 <SeqTxPollState_Patched+0x24>
132: 46c0 nop (mov r8, r8)
134: 80004068 .word 0x80004068
...
00000140 <SeqTxAutoRxState_Patched>:
140: b570 push {r4, r5, r6, lr}
142: 4936 ldr r1, [pc, #216] (21c <SeqTxAutoRxState_Patched+0xdc>)
144: 7809 ldrb r1, [r1, #0]
146: 2902 cmp r1, #2
148: d102 bne.n 150 <SeqTxAutoRxState_Patched+0x10>
14a: 2180 movs r1, #128
14c: 0189 lsls r1, r1, #6
14e: e000 b.n 152 <SeqTxAutoRxState_Patched+0x12>
150: 2100 movs r1, #0
152: 24c0 movs r4, #192
154: 00e4 lsls r4, r4, #3
156: 430c orrs r4, r1
158: 380b subs r0, #11
15a: 280f cmp r0, #15
15c: d855 bhi.n 20a <SeqTxAutoRxState_Patched+0xca>
15e: a101 add r1, pc, #4 (adr r1, 164 <SeqTxAutoRxState_Patched+0x24>)
160: 5c09 ldrb r1, [r1, r0]
162: 448f add pc, r1
164: 72a4840e .word 0x72a4840e
168: 72727272 .word 0x72727272
16c: 84a49a72 .word 0x84a49a72
170: 72727272 .word 0x72727272
174: 4eff ldr r6, [pc, #1020] (630 <SeqTxAutoRxState_Patched+0x4f0>)
176: 4d00 ldr r5, [pc, #0] (244 <SeqTxAutoRxState_Patched+0x104>)
178: 6828 ldr r0, [r5, #0]
17a: 300c adds r0, #12
17c: f7ff fffe bl 0 <__aeabi_uread4>
180: 6030 str r0, [r6, #0]
182: f7ff fffe bl 0 <MM_Free>
186: 2000 movs r0, #0
188: 6030 str r0, [r6, #0]
18a: 6828 ldr r0, [r5, #0]
18c: f7ff fffe bl 0 <CommonRxSetup>
190: 2800 cmp r0, #0
192: d018 beq.n 1c6 <SeqTxAutoRxState_Patched+0x86>
194: 49ff ldr r1, [pc, #1020] (634 <SeqTxAutoRxState_Patched+0x4f4>)
196: 4822 ldr r0, [pc, #136] (220 <SeqTxAutoRxState_Patched+0xe0>)
198: f7ff fffe bl 0 <__aeabi_uwrite4>
19c: 6828 ldr r0, [r5, #0]
19e: 2108 movs r1, #8
1a0: 7001 strb r1, [r0, #0]
1a2: 4820 ldr r0, [pc, #128] (224 <SeqTxAutoRxState_Patched+0xe4>)
1a4: 21fe movs r1, #254
1a6: 03c9 lsls r1, r1, #15
1a8: 6001 str r1, [r0, #0]
1aa: 481f ldr r0, [pc, #124] (228 <SeqTxAutoRxState_Patched+0xe8>)
1ac: 2102 movs r1, #2
1ae: 6341 str r1, [r0, #52]
1b0: 6828 ldr r0, [r5, #0]
1b2: 1d80 adds r0, r0, #6
1b4: f7ff fffe bl 0 <__aeabi_uread4>
1b8: 0080 lsls r0, r0, #2
1ba: 491b ldr r1, [pc, #108] (228 <SeqTxAutoRxState_Patched+0xe8>)
1bc: 6448 str r0, [r1, #68]
1be: 2004 movs r0, #4
1c0: 4320 orrs r0, r4
1c2: 6008 str r0, [r1, #0]
1c4: e024 b.n 210 <SeqTxAutoRxState_Patched+0xd0>
1c6: f7ff fffe bl 0 <SetupWaitForRxBufferFree>
1ca: 2800 cmp r0, #0
1cc: d01d beq.n 20a <SeqTxAutoRxState_Patched+0xca>
1ce: 4900 ldr r1, [pc, #0] (238 <SeqTxAutoRxState_Patched+0xf8>)
1d0: 4816 ldr r0, [pc, #88] (22c <SeqTxAutoRxState_Patched+0xec>)
1d2: f7ff fffe bl 0 <__aeabi_uwrite4>
1d6: e01b b.n 26e <SeqTxAutoRxState_Patched+0x12e>
1d8: 49ff ldr r1, [pc, #1020] (634 <SeqTxAutoRxState_Patched+0x4f4>)
1da: 4800 ldr r0, [pc, #0] (23c <SeqTxAutoRxState_Patched+0xfc>)
1dc: f7ff fffe bl 0 <__aeabi_uwrite4>
1e0: 48ff ldr r0, [pc, #1020] (640 <SeqTxAutoRxState_Patched+0x500>)
1e2: 6800 ldr r0, [r0, #0]
1e4: f7ff fffe bl 0 <MemIh_SeqActionFailInd>
1e8: e012 b.n 25c <SeqTxAutoRxState_Patched+0x11c>
1ea: 4900 ldr r1, [pc, #0] (238 <SeqTxAutoRxState_Patched+0xf8>)
1ec: 48ff ldr r0, [pc, #1020] (638 <SeqTxAutoRxState_Patched+0x4f8>)
1ee: f7ff fffe bl 0 <__aeabi_uwrite4>
1f2: 4800 ldr r0, [pc, #0] (244 <SeqTxAutoRxState_Patched+0x104>)
1f4: 6800 ldr r0, [r0, #0]
1f6: 2185 movs r1, #133
1f8: 7041 strb r1, [r0, #1]
1fa: 4800 ldr r0, [pc, #0] (240 <SeqTxAutoRxState_Patched+0x100>)
1fc: 2101 movs r1, #1
1fe: e006 b.n 20e <SeqTxAutoRxState_Patched+0xce>
200: 48ff ldr r0, [pc, #1020] (640 <SeqTxAutoRxState_Patched+0x500>)
202: 6800 ldr r0, [r0, #0]
204: f7ff fffe bl 0 <MemIh_SeqActionFailInd>
208: e7b4 b.n 1b0 <SeqTxAutoRxState_Patched+0x70>
20a: 4800 ldr r0, [pc, #0] (248 <SeqTxAutoRxState_Patched+0x108>)
20c: 2100 movs r1, #0
20e: 7001 strb r1, [r0, #0]
210: f7ff fffe bl 0 <PATCH_Ret_SeqTxAutoRxState>
214: bc70 pop {r4, r5, r6}
216: bc01 pop {r0}
218: 4700 bx r0
21a: 46c0 nop (mov r8, r8)
21c: 0000007b .word 0x0000007b
220: 00000000 .word 0x00000000
224: 8000408c .word 0x8000408c
228: 8000400c .word 0x8000400c
...
244: 00000004 .word 0x00000004
Reference in a new issue Copy permalink