Skip to content

Conversation

borntohonk
Copy link

@borntohonk borntohonk commented Jul 26, 2025

im assuming the syntax is correct

byte desired to be patched: (8), compared against cmp instruction 2 bytes before the byte desired to be patched (-2)

this PR might not be needed, but im submitting it regardless.

the new patch just changes cmp w0, w1 into cmp w0, w0

borntohonk referenced this pull request in borntohonk/sys-patch Aug 20, 2025
@josete2k
Copy link
Collaborator

Sorry, I'm not familiar with github actions so I didn't know how I can feedback you code 😬

I've tested your loader patch in my custom AMS compilation and it doesn't work.

The custom code in the AMS compilation are only ID adds for mario64_v8, tinfoil and tinfoil forwarders and custom bootlogo.

Regular sys-patch and the noerpt are working with no issues.

@borntohonk
Copy link
Author

Sorry, I'm not familiar with github actions so I didn't know how I can feedback you code 😬

I've tested your loader patch in my custom AMS compilation and it doesn't work.

The custom code in the AMS compilation are only ID adds for mario64_v8, tinfoil and tinfoil forwarders and custom bootlogo.

This is not good enough information. You have to provide the source code for your atmosphere alterations.

if it alters anything in https://github.com/Atmosphere-NX/Atmosphere/tree/master/stratosphere/loader/source then that'd be why.

I cannot take your feedback seriously when you don't use regular atmosphere.

@borntohonk
Copy link
Author

borntohonk commented Aug 20, 2025

https://github.com/Atmosphere-NX/Atmosphere/blob/master/stratosphere/loader/source/ldr_meta.cpp#L114-L138

this codeblock is what this patch affects

this python codeblock creates the equivalent patch

@josete2k

(requirements: lz4, pycryptodome, nxo64.py)
https://github.com/borntohonk/Switch-Ghidra-Guides/blob/master/scripts/nxo64.py

import os
import re
import shutil
import subprocess
import sys
import time
from glob import glob
from hashlib import sha256
from io import BytesIO
from pathlib import Path
from urllib.parse import unquote
from urllib.request import urlopen, urlretrieve
from zipfile import ZipFile

import nxo64

Path('./Atmosphere_Loader_Patch/atmosphere/kip_patches/loader_patches').mkdir(parents=True, exist_ok=True)
atmosphere_archive_name = unquote(urlopen('https://api.github.com/repos/Atmosphere-NX/Atmosphere/releases').read().split(b'browser_download_url')[1].split(b'\"')[2].decode('utf-8').split('/')[-1])
urlretrieve(urlopen('https://api.github.com/repos/Atmosphere-NX/Atmosphere/releases').read().split(b'browser_download_url')[1].split(b'\"')[2].decode('utf-8'), atmosphere_archive_name)
atmosphere_zip = glob('./atmosphere-*.zip')[0]
atmosphere_version = re.search('[0-9.]{5}', atmosphere_zip).group()
atmosphere_hash = re.search('[0-9A-Fa-f]{9}', atmosphere_zip).group()
with ZipFile(glob('./atmosphere-*.zip')[0], 'r') as amszip:
    with amszip.open('atmosphere/package3') as package3:
        read_data = package3.read()
        locate_loader = read_data.find(b'Loader')
        loader_size_start = locate_loader - 0xC
        loader_size_end = locate_loader - 0x9
        size = int.from_bytes(read_data[loader_size_start:loader_size_end], 'little')
        loader_offset_start = locate_loader - 0x10
        loader_offset_end = locate_loader - 0xD
        loader_start = int.from_bytes(read_data[loader_offset_start:loader_offset_end], 'little')
        loader_end = loader_start + size
        loader_kip = read_data[loader_start:loader_end]
        if re.compile(b'\x4B\x49\x50\x31\x4C\x6F\x61\x64\x65\x72').search(loader_kip):
            compressed_loader_file = open('loader.kip1', 'wb')
            compressed_loader_file.write(loader_kip)
            compressed_loader_file.close()
            with open('loader.kip1', 'rb') as compressed_loader_kip:
                nxo64.write_file(f'uloader.kip1', nxo64.decompress_kip(compressed_loader_kip))
                with open('uloader.kip1', 'rb') as decompressed_loader_kip:
                    loader_data = decompressed_loader_kip.read()
                    result = re.search(b'\x00\x94\x01\xC0\xBE\x12\x1F\x00', loader_data)
                    patch = '%06X%s%s' % (result.end(), '0001', '00')
                    hash = sha256(open('loader.kip1', 'rb').read()).hexdigest().upper()
                    print('IPS LOADER HASH     : ' + '%s' % hash)
                    print('IPS LOADER PATCH    : ' + patch)
                    ips_file = open('Atmosphere_Loader_Patch/atmosphere/kip_patches/loader_patches/%s.ips' % hash, 'wb')
                    ips_file.write(bytes.fromhex(str('5041544348' + patch + '454F46')))
                    ips_file.close()
                    decompressed_loader_kip.close()
                    package3.close()
                    amszip.close()
                    compressed_loader_kip.close()
                    os.remove('./uloader.kip1')
                    os.remove('./loader.kip1')
                    os.remove(atmosphere_zip)
                    shutil.make_archive('Atmosphere_Loader_Patch', 'zip', 'Atmosphere_Loader_Patch')
        else:
            print(
                'KIP1Loader magic not found! - Script needs to be fixed, loader_kip is not correct!')

example output for https://github.com/Atmosphere-NX/Atmosphere/releases/tag/1.9.3 :

IPS LOADER HASH : 2750DA74BB5AB7E8A9EC8341E2CE6BA1C16B791BDC5ECD6C51DE2EF3AFDC9841
IPS LOADER PATCH : 00608E000100

patch location 0x608E patch size 1, patch is: 00

@borntohonk
Copy link
Author

image

in hindsight latest atmosphere does return two results, and it might be sys-patch is assuming the first one is correct.

which might need to be condensed to exclude the first result, so i will adjust that, but your problem should be unrelated.

@josete2k
Copy link
Collaborator

josete2k commented Aug 20, 2025

I've checked and I have ldr_meta.cpp unaltered

This is my main.cpp

https://gist.github.com/josete2k/13c821e944093c4c3257cdfd17142a9d

Tested launching with fusee and PKG3 (latest AMS and 20.3.0)

@borntohonk
Copy link
Author

I've checked and I have ldr_meta.cpp unaltered

This is my main.cpp

https://gist.github.com/josete2k/13c821e944093c4c3257cdfd17142a9d

Tested launching with fusee and PKG3 (latest AMS and 20.3.0)

ldr_meta.cpp calls for a lot of other functions, which gets embedded into the kip..... if you alter loader at all, that will cause complications.

@josete2k
Copy link
Collaborator

Thanks again...

Tested with clean AMS files... same result.

@borntohonk
Copy link
Author

Thanks again...

Tested with clean AMS files... same result.

that doesnt sound right, it should patch at least the first one and report the byte as correctly patched

@borntohonk
Copy link
Author

borntohonk commented Aug 20, 2025

this should set the instruction head to the start of the cmp instruction, and patch byte 3(2) from its offset

(this was incorrect before, i will fix that, while addressing the multiple-results)

(0)1F(1)00(2)016B

{ "noacidsigchk", "009401C0BE121F00", 6, 2, cmp_cond, cmp_patch, cmp_applied, true, FW_VER_ANY }, // 1F00016B - cmp w0, w1 patched to 1F00006B

@josete2k
Copy link
Collaborator

Hmmm ok ok

Seems that's not the same code in the PR...

I'm not at home but it differs

{ "noacidsigchk", "009401C0BE121F00", 8, -2, cmp_cond, cmp_patch, cmp_applied, true, FW_VER_ANY },

From this

{ "noacidsigchk", "009401C0BE121F00", 6, 2, cmp_cond, cmp_patch, cmp_applied, true, FW_VER_ANY },

Thanks again for your support

@borntohonk
Copy link
Author

Hmmm ok ok

Seems that's not the same code in the PR...

I'm not at home but it differs

{ "noacidsigchk", "009401C0BE121F00", 8, -2, cmp_cond, cmp_patch, cmp_applied, true, FW_VER_ANY },

From this

{ "noacidsigchk", "009401C0BE121F00", 6, 2, cmp_cond, cmp_patch, cmp_applied, true, FW_VER_ANY },

Thanks again for your support

its not in PR yet as i am as i already wrote in what you just responded to, addressing the multi-pattern hit.

@borntohonk
Copy link
Author

borntohonk commented Aug 20, 2025

image basically, this is the loader.elf with debug symbols, the code desired to affect with the patch is the second hos::version comparator

https://github.com/Atmosphere-NX/Atmosphere/blob/master/stratosphere/loader/source/ldr_meta.cpp#L116-L123

which is this codeblock

i will tweak the pattern so that it doesnt hit the other one, then this should be fixed.

patched it does this

image

@borntohonk
Copy link
Author

borntohonk commented Aug 20, 2025

pattern valid (tested synthetically) down to atmosphere 1.0.0 @josete2k it should be fixed now, by adding in the instruction bit for the branch arm instruction before the existing pattern, and increasing the sys-patch comparator head from 6 to 9 to accommodate that adjustment.

 { "noacidsigchk", "17..009401C0BE121F00", 9, 2, cmp_cond, cmp_patch, cmp_applied, true, FW_VER_ANY }, // 1F00016B - cmp w0, w1 patched to 1F00006B

@josete2k
Copy link
Collaborator

Tested and working.

Thanks.

@Mahatma753
Copy link

Excuse me for the comment.
The atmosphere file is there, but why is the bootloader file not there anymore?
https://toketeru.com/switch-cfw-atmosphere/5/ ←I was thinking of introducing it by referring to this site,I can't boot because the bootloader file doesn't exist.
If you have any solutions, please let me know.

@borntohonk
Copy link
Author

borntohonk commented Sep 5, 2025

Excuse me for the comment.
The atmosphere file is there, but why is the bootloader file not there anymore?
https://toketeru.com/switch-cfw-atmosphere/5/ ←I was thinking of introducing it by referring to this site,I can't boot because the bootloader file doesn't exist.
If you have any solutions, please let me know.

What does this have to do with my push request?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants