DSiBrew

ARM7 BIOS: Difference between revisions

New page: == BIOS and Bootrom == The ARM7 BIOS is splitted up into two parts: # the actual BIOS which is 0x8000 bytes long and starts at 0x0 # the bootrom which is probably also 0x8000 bytes long a...
 
Hallowizer (talk | contribs)
322 edits
m →SVC list: flagged HaltMaybe for checking, since it looks like the idle thread in ARM7 OS calls this in place of the CP15 stuff in ARM9. haven't looked very deep yet though
 
(10 intermediate revisions by 8 users not shown)
Line 1: Line 1:
== BIOS and Bootrom ==
== BIOS and Bootrom ==
The ARM7 BIOS is splitted up into two parts:
The ARM7 BIOS is split into two parts:


# the actual BIOS which is 0x8000 bytes long and starts at 0x0
# the actual BIOS which is 0x8000 bytes long and starts at 0x0
# the bootrom which is probably also 0x8000 bytes long and starts at 0x8000
# the bootrom which is probably also 0x8000 bytes long and starts at 0x8000


*The data of 1) can only be read by instructions within the BIOS. It can therefore be dumped by applying some irq timer trick to find a usable ''ldr'' instruction or by just using the memcpy at 0x6bb0 with the usual arguments.
*The contents of 1) can only be read by instructions within the BIOS. It can therefore be dumped by applying some IRQ timer trick to find a usable ''ldr'' instruction or by just using the memcpy at 0x6bb0 with the usual arguments.
*The data of 2) can only be read until bit 0 in register '''0x04004000 or 0x04004001 (?)''' is cleared. It is enabled after it has been executed and can never be read again until a reset then. It might contains keys and has not been dumped yet.
*The contents of 2) can only be read until bit 0 in register '''0x04004000 or 0x04004001 (?)''' is cleared. It is disabled after it has been executed and can never be read again until the device is reset.


== SWI list ==
== SVC list ==
The BIOS provides the following SVC functions. Every SVC not mentioned here just jumps to an infinite loop at 0x16c (b .)
The BIOS provides the following SVC functions. Every SVC not mentioned here just jumps to an infinite loop at 0x16c (b .)
Caution: In below table, "n/a" in the NAME column seems to mean "not altered" (ie. same as in NDS BIOS). Whilst "n/a" in the DESCRIPTION column seems to mean "not any" (ie. nobody has written a description yet).


{| class="wikitable sortable" width="55%"
{| class="wikitable sortable" width="55%"
Line 38: Line 40:
|-
|-
|06
|06
|HaltMaybe
|HaltMaybe{{check}}
|n/a
|n/a
|-
|-
Line 66: Line 68:
|-
|-
|0e
|0e
|crc16
|CRC16
|n/a
|n/a
|-
|-
Line 134: Line 136:
|-
|-
|24
|24
|sha1_init
|SHA1_init
|n/a
|n/a
|-
|-
|25
|25
|sha1_update
|SHA1_update
|n/a
|n/a
|-
|-
|26
|26
|sha1_finalize
|SHA1_finalize
|n/a
|n/a
|-
|-
|27
|27
|sha1
|SHA1
|n/a
|n/a
|-
|-
|28
|28
|sha1_compare
|SHA1_compare
|n/a
|n/a
|-
|-
|29
|29
|sha1_random_maybe
|SHA1_random_maybe
|n/a
|n/a
|}
|}


== reset vectors et al ==
The first few words of the BIOS cannot be dumped. You can deduce them by tracing the code though (all values are noted in big endian here):
ea000006
ea000006
ea00001f
ea000004
ea000003
eafffffe
ea000013
ea000000


== reset vectors et al ==
== See Also ==


The first few words of the BIOS cannot be dumped. You can guess them by tracing the code though (all values are noted in little endian here):
* [[ARM9 SWI Functions]]
060000ea
* [[Bootloader]] (Stage 1 contained in BIOS ROMs)
060000ea
1f0000ea
040000ea
030000ea
feffffea
130000ea
000000ea
Retrieved from "https://dsibrew.org/wiki/ARM7_BIOS"