Project: Xbox 360 rebooter

[arnezami]

After working on it for several weeks the time has arrived to release the first (official) version of the Xbox 360 rebooter.

I've created a thread in the general hacking forum for (stupid) questions and discussion. If you have any questions (or have any unverified ideas) please post them there. I've also posted a long explanation of what this is all about (must read for noobs, recommended for others).

Link: Further explanation and discussion thread

As for the technical facts, results and releases of patches/changes etc. they can best be posted in this thread. But please keep it clean from speculations or anything non-technical.

Here is the rebooter (including the source):

http://rapidshare.com/files/62057435/reboot_v0.1.7.rar.html

It contains two binaries: reboot-readcd.bin and reboot-serial.bin which you will need in order to create file to burn on the disc (or to upload through serial). If you want to change the rebooter you need a cross compiler to compile the source. Using the instructions from the Free60 project works (keep in mind there was a minor bug (missing quotes) in the downloaded crosstool script/makefiles). But you can use the binaries directly if you don't feel like cross compiling. (btw I use a vmware player with linux installed to both use IDA and change the source).

Here is makereboot (incuding the source):

http://rapidshare.com/files/62057758/makereboot_v0.1.rar.html

It contains an .exe file, a .bat file (if you are lazy) and a .c file which should also compile on linux if you prefer that.

Basicly you need the following to create a cd/dvd for rebooting:

- CB.xxxx.bin
- CD.xxxx.bin
- xboxkrnl.4532.exe or xboxkrnl.4548.exe (these are the original files coming from the nand dump using flash tool)
- xboxkrnl.4532.edit.exe or xboxkrnl.4548.edit.exe (or any name you want to give them, these kernels you can edit or patch)

Then by executing the following (example) command you can create a file to burn on disc:

Code:

makereboot 7 reboot-readcd.bin CB.1903.bin CD.1888.bin xboxkrnl.4532.exe xboxkrnl.4532.edit.exe @reboot_and_patch

The 7 is the amount of sectors (00's times 0x800) to make sure the code starts at LBA 0x20 (32 decimal). You can easely see if it is correct in for example IsoBuster. The file @reboot_and_patch is the file to be burned on disc.

For a serial upload (not fully tested yet):

Code:

makereboot 0 reboot-serial.bin CB.1888.bin CD.1888.bin xboxkrnl.4548.exe xboxkrnl.4548.edit.exe @reboot_and_patch

The makereboot file adds a kernel patcher to the CD section based upon the difference in the exe files. It adds the 16-byte key and adds the pairing data. If needed it also sets the position of CE (not counting edc) based on the length of CB and CD. The patcher in CD is very simple and has room for about 8kb of changes (mostly because of the 128kb the KK exploit loads, can be changed later on but is enough for now). Also the max size of the code (in the readcd and serial bins) is 0x16800 (= 90kb) right now. Be careful with that. But you can remove all kinds of code (out of the unused Xell parts) which will greatly reduce its size.

In order to share patches its easiest to use ppf patches. I've created a hypervisor patch which extends the POST output SC (0x0D) to show a "progress bar" on screen. So you can roughly see how far it comes into the boot process.

http://www.sendspace.com/file/e8oy74

I've also created a tiny patch forcing the boot process into an on-screen error just after POST 0x79. You should see an E79 error on screen:

http://rapidshare.com/files/62061075/error79.ppf.html

These patches are mainly for educational purpose. A more useful patch would be to be able to output register data or memory data using the same SC (eg using POST code > FF) to the serial port. Mostly because the screen resets at some point and feedback using the screen becomes useless.

I'm using MakePPF3 btw.

http://www.megagames.com/psx/psx_ppf.shtml

To avoid confusion: the ppf patches have to be applied on the kernel .exe not on any .iso.

Right now the rebooting goes beyond POST 0x79 consistently. Leaving out something in the cpu catching code in Xell solved the problem of being stuck at 0x6C. Its again "stuck" now somewhere later in the boot process so we will have to figure out where and why.

Sometimes the leds go blinking between red and green. Might be related to the wireless or cd/dvd re-reading. But we'll have to trace how far it comes and where it stops and why. I also noticed the xbox requires pressing the on/off button two times to turn it off. My gut feeling (but I've been so busy making all this ready for release I haven't investigated the current situation much yet) is that the southbridge/smc isn't aware of the reboot and is giving the cpu "mixed" signals. But thats just a hunge.

I'm too tired now to think of anything more. Believe I've covered everything...

Please post as much experimental data as you can here. Try to be methodical though.

Good luck

Regards,

arnezami

[zouzzz]

Hello and thanks,

My reboot-readcd is OK or not?


Size : 142 Ko (145 408 octets)

[arnezami]

Hello and thanks,

My reboot-readcd is OK or not?


Size : 142 Ko (145 408 octets)

Should look like this (just did this with no changes to the kernel):



Check your files (the reboot-readcd.bin is ~90kb). Also if they are in use or overwritten to 0 bytes somehow (thats what it looks like here, like you maybe mixed up the arguments and wiped the file before this). It gives an error if it doesn't find the file or can't open it btw.

You can also try compiling the source and see if it works then (what OS do you run?).

Regards,

arnezami

[Surrido]

can we use a larger NAND after "reboot" into unsigned to store alternative dashboards and other sweets?

if we do hotswap (hardware or software based) for example

[arnezami]

can we use a larger NAND after "reboot" into unsigned to store alternative dashboards and other sweets?

if we do hotswap (hardware or software based) for example

Maybe we can. Say we have install a 32MB nand. We put the 4532 kernel on the first 16MB. The second 16MB we use to install a newer kernel/dash. And if we change the memory mapping the xex-es (or even the kernel) will have no clue its accessing the second part of the nand.

The problem might be stealth: you can access the nand in several ways. If the nand can be accessed (by a xex) the way the tmbinc nand dumper is accessing the nand then it can probably access the lower 16MB of the 32MB nand.

So I guess it depends on whether you want to be stealthy or not. But if you just want to play new games I'm sure there are ways to get around any issues.

But lets first try to accomplish a full reboot. That would be heaven.

Regards,

arnezami

[edit] Oh. If you're asking whether we can simply use a bigger nand in unsigned mode: sure no problem.

[Surrido]

i agree!

the  nands should be able to path each other and switch each other by themselves... 

[TheLegace]

Does that mean people can start working on new kernel now?

Azermani are you going to be working on one?

And with the kernel the signature checks would have to be removed before we could really run unsigned code... am I correct?

[Arakon]

it means that people can work on loading a new, modified kernel. until that works, there's no way to run a modified kernel yet. and without a way to run and test it, there's little sense in modifying stuff blindly.

[gehx]

so this won't work if you have kernel 5787? sorry if this is a dumb question, but I assume most xbl 360's have this kernel now.

[Arakon]

only if you downgrade using the timing attack.

[ivc]

so this won't work if you have kernel 5787? sorry if this is a dumb question, but I assume most xbl 360's have this kernel now.

5787 can be used for the timing attack.

[arnezami]

Ok. Some more info.

Geremia has done some experimenting on the normal boot process (basicly resetting the cpu using the POST outputs as triggers and see what still happens on screen/at the front panel leds). In order to see what happens when exactly.

A few things are becoming a bit clearer now.

The normal boot process starts reading the cd/dvd at POST 0x73. And depending on whether the disc was "known" to the southbridge (by shutting down the xbox with the dvd in the drive) or "new" to the southbridge (by shutting down the xbox with the dvd in the open tray, which closes on turn off but is not read) the duration of post 0x73 is either shorter or longer.

More importantly the bootanimation and the circling leds (which both aren't happening during the rebooting technique) seem to be independent of the cd/dvd reading process (and duration of post 0x73) but appear to be triggered before the cd/dvd reading at post 0x73: if cd reading (post 0x73) is shorter and the cpu is reset (jtag) when post 0x73 ends the leds/bootanim do not occur, but they do when cd reading takes longer (bootanim halts so it appears there is another core doing the bootanim). In other words: there is multi-threading going on. Most likely the kernel goes into "multi-threading mode" after post 0x70 (and there is also a change in clock frequencies on the mobo from that point on).

How these threads/cores are actually triggered is still not quite understood. But the fact that both the bootanim and the circling leds do not occur (but the main boot process posts do) seems to indicate that something is not working as it should regarding the multithreading. Its also possible the GPU is still in a crippled state (because of the exploit) and thats why the bootanim crashes, but that doesn't really explain the absense of the circling leds on the frontpanel.

From what I understand at address 80072DB0 (look in IDA) the cores enter the kernel. And at 80072DBC there is a cmpwi/bne on the processor id I think (only one thread goes into the main kernel bootup). The other threads go into a different direction (if I'm reading it right).

The question now is: why does the bootanim/circling leds not start? How is it normally started? Why does the main thread continue while the bootanim/circling leds doesn't work? Is this all done through interrupts/exceptions? Is something maybe not properly reset? etc.

We could use some more brains on this...

Btw: the sub after output of post 0x72 (look at address: 80060DB0, then go to sub_80061058) seems to be bootanim related but probably only triggers another core/thread.

Anyway we are looking at this stuff but if you have any ideas or have some knowledge please post it here. Any experiments (or suggestions how to get more info out of the xbox normal boot process) can be helpful aswell.

Also a working patch to serial output registers or mem could be helpful (or just the post output through serial to begin with). Shouldn't be very hard to build and is a good exercise to do more complex things later on . And if you plan to do this please tell so we won't do any duplicate work.

Regards,

arnezami

PS. Addresses above are from xboxkrnl.4532.exe loaded as (ppc) binary at 8000000 in IDA.

[NebUz]

Hi
is the reboot file ok?
http://img134.imageshack.us/my.php?image=readcdio6.png

greets
NebUz

[arnezami]

Hi
is the reboot file ok?
http://img134.imageshack.us/my.php?image=readcdio6.png

greets
NebUz

Looks good.

Appears you have applied both ppf patches.

If you burn the file on a cd/dvd rewritable (eg using nero) and look at the cd/dvd in (for example) IsoBuster you can check if the code starts at the right LBA sector.

Here are some old screenshots but they show how you can see where the code should begin (btw right click file for sector view in isobuster):

http://img406.imageshack.us/img406/6851/lba32avv0.png
http://img127.imageshack.us/img127/5972/lba32ns2.png
http://img248.imageshack.us/img248/8835/lba32ni2.png

Code should start at sector 32 (decimal). My Nero burns first file at sector 25. So thats why I use 7 as first parameter to adjust (25 + 7 = 32).

Regards,

arnezami

[arnezami]

Patch to let SC 0xD (POST output) also output to serial (along with showing the "progress bar")

http://www.sendspace.com/file/91ldzi

Serial output now looks like this:

Code:

OK

Xbox 360 reboot v0.1.8 by arnezami (based on code from XeLL 0.1)

Thanks to:             The Anonymous hacker, tmbinc, The Specialist, robinsod,
                       DrMatrix, tser, ge0rg, Yoshihiro, speedy22, SeventhSon,
                       garyopa, Team MODFREAKz, vax11780, Takires, sectroyer,
                       segher, warpjavier, StandardIO and many others at XBH.

Special thanks to:     Geremia



 * Xenos FB with 80x30 (640x480) at 000000001f921000 initialized
 * Attempting to catch all CPUs...
CPUs online: 01..
CPUs online: 15..
 * Success.             
 * Re-reseting interrupt controllers.
 * Re-booting...
P 40
P 59
P 5A
P 60
P 61
P 62
P 63
P 64
P 65
P 66
P 67
P 68
P 69
P 6A
P 6B
P 6C
P 6D
P 6E
P 6F
P 70
P 71
P 72
P 73
P 75
P 76
P 77
P 78
P 79

The "P 40" you see here I did from before starting CD so its not a "real" POST output. During CD/CF POST output is not redirected to serial (and we don't really need it). So you only see the kernel/hv POSTs.

Regards,

arnezami

[arnezami]

Found some time to work on the rebooter again .

Did quite a bit of experimenting but because that didn't deliver me much I decided to get (much) more info out of the booting process. Programming in the HV is a bit of a pain but I have managed to dump the System Calls done by each processor during reboot. I'm using a makeshift "semaphore" to counter the serial port being "spammed" and it works nicely (although at some point it simply can't handle it anymore because of the number of SC's at the same time).

A few things about the syntax:

- Entering of the CPUs into the HV is marked by a 'C'.
- A System Call is marked by a 'S'
- A POST output is marked by a 'P'

In front of each of these serial outputs there is the PIR (cpu number). In the beginning its only CPU 0. The two other main cores (CPU 2 and CPU 4) enter the hv later on (POST 0x68) and also all secondary threads of each of these cores (CPU 1, CPU 3, CPU 5).

As for the SC numbers and their meaning: go here and/or here. Or look at the kernel/hv in IDA (loaded at address 0x00000000) and look at the table at 0x1F68 (make each of them a "double word" in IDA).

Here are the POSTs 0x58 - 0x67:

Code:

* Re-booting...
0:C 00
0:P 59
0:P 5A
0:S 0F
0:S 03
0:S 0D
0:P 60
0:S 0D
0:P 61
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 04
0:S 0D
0:P 62
0:S 0D
0:P 63
0:S 0D
0:P 64
0:S 03
0:S 0D
0:P 65
0:S 0B
0:S 0D
0:P 66
0:S 0D
0:P 67

Keep in mind that when a POST output is done in the kernel (POST 0x60+) this is done using the SC 0x0D so thats why you always see a "S 0D" just before a "P xx" after POST 0x5A.

Now the above is fairly interesting but it gets much more interesting when all CPUs enter the kernel/hv.

First POST 0x68:

Code:

0:S 0D
0:P 68
0:S 01
5:C 05
3:C 03
1:C 01
2:C 02
4:C 04
0:S 42
0:S 0A
4:S 0A
2:S 0A
0:S 42

As you can see CPU 0 calls SC 01 which triggers the other CPUs. CPU's 0, 2 and 4 are calling SC 0x0A when they enter the kernel and I think that is to catch their secondary threads. Although the rebooter already unleashed them (CPU's 1, 3, 5) so this might cause a problem later on. Not sure. I'm also not using the IPI but I let the CPU's look at a memory address (changed by the hv) instead. This seems to work nicely, but has to be investigated.

Anyway. Here is where it gets much more interesting. POST 0x69 - 0x78:

Code:

0:S 0D
0:P 69
0:S 2E
0:S 0D
0:P 6A
0:S 0D
0:P 6B
0:S 0D
0:P 6C
0:S 04
1:S 04
0:S 04
1:S 04
5:S 04
1:S 04
5:S 04
1:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
0:S 04
1:S 04
3:S 04
2:S 04
5:S 04
4:S 04
0:S 0F
0:S 04
1:S 04
4:S 04
2:S 04
0:S 0F
0:S 52
0:S 04
1:S 04
3:S 04
2:S 04
5:S 04
4:S 04
0:S 0D
0:P 6D
0:S 0F
2:S 0F
2:S 0F
2:S 0F
0:S 4C
0:S 04
1:S 04
5:S 04
1:S 04
5:S 04
4:S 04
0:S 04
4:S 04
3:S 04
4:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
0:S 0D
0:P 6E
0:S 04
1:S 04
4:S 04
2:S 04
0:S 30
0:S 37
0:S 0D
0:P 6F
0:S 0F
0:S 0F
1:S 02
0:S 20
3:S 02
2:S 02
0:S 0D
0:P 70
0:S 30
0:S 04
0:S 0C
0:S 0D
0:P 71
0:S 0C
0:S 0D
0:P 72
0:S 0B
0:S 0B
0:S 0B
0:S 0F
0:S 0F
0:S 37
0:S 0B
0:S 0F
0:S 37
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 37
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
0:S 11
0:S 04
1:S 04
5:S 04
3:S 04
0:S 04
1:S 04
3:S 04
2:S 04
5:S 04
4:S 04
0:S 04
1:S 04
0:S 04
1:S 04
2:S 04
3:S 04
2:S 04
5:S 04
0:S 0D
0:P 73
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 25
0:S 26
0:S 37
0:S 04
1:S 04
0:S 04
1:S 04
4:S 04
5:S 04
5:S 04
0:S 30
0:S 0D
0:P 75
0:S 0D
0:P 76
0:S 0D
0:P 77
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 30
0:S 30
0:S 0D
0:P 78

As you can see the other CPUs really start doing their stuff. Mostly memory related it seems. This is pretty fresh and still have to digest a lot of this and match it with the code in the kernel. But its clear you can't simply debug one CPU without taking into account what the other CPUs are doing.

Also keep in mind the above does not contain a dump the External Interupts (0x500) exception (only 0xC00) which -if also dumped- might give a better idea whats going on with the xbox 360 as a whole.

This is the part after POST 0x79. Things get really crowded here. I believe the screen is reset here somewhere.

Code:

0:S 0D
0:P 79
0:S 0B
0:S 0B
0:S 0F
0:S 0B
0:S 0F
2:S 0F
0:S 37
0:S 0B
0:S 0F
0:S 0F
0:S 37
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 37
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
4:S 04
3:S 04
4:S 04
3:S 04
4:S 04
5:S 04
4:S 04
5:S 04
2:S 04
5:S 04
2:S 04
3:S 04
4:S 04
3:S 04
2:S 04
5:S 04
2:S 04
3:S 04
2:S 04
5:S 04
4:S 04
5:S 04
2:S 04
3:S 04
0:S 11
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 12
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 0F
0:S 13
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0F

[ removed some 0:S 0F... ]

2:S 0F
2:S 0F
2:S 0F
0:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
0:S 04
1:S 04
0:S 04
5:S 04
0:S 04
1:S 04
4:S 04
5:S 04
4:S 04
1:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
0:S 04
1:S 04
4:S 04
1:S 04
4:S 04
1:S 04
4:S 04
5:S 04
4:S 04
1:S 04
4:S 04
1:S 04
0:S 04
5:S 04
4:S 04
1:S 04
4:S 04
5:S 04
0:S 04
1:S 04
0:S 04
1:S 04
4:S 04
5:S 04
4:S 04
5:S 04
0:S 04
5:S 04
0:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
1:S 04
4:S 04
5:S 04
4:S 04
1:S 04
4:S 04
5:S 04
0:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
2:3:S 04
2:
3:S 0
2:S:S 04
3 04042
3 0 042:S S 04
3:S4
2
3:S4
2:3:S404
3 04
4
S 0 04
:S S4

3 04042:S:S4
4
3 S404
3 0 0
2:S:S4
2
3:04
2
3:04
4
:S 0404
:S:S
2
3:S404
S 0404
:S 0 04
:S 0 04
:S 0 04
3:S4
2:S:04

3 0 042:S:S4
2
3 04
4
3 040

0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
2:S 04
3:S 04
5:S  044
:S S 4

53:S  04
S:04
45
S S40

S S40

:2 S40

:S:S40
5
S:0
44
S:0
4
:2 S40

:3:0

:S:0
44
S:S4
45
S:S40

:S:0
45
S:S
4:3 S40
5
S:0 04
:3 0 0

S 04
0:S 0B
0:S 0B

[ removed some 0:S 0B ... ]

0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0B
0:S 0F
2:S 0F
2:S 0F

[ removed some 0/2:S 0F ... ]

2:S 0F
2:S 0F
2:S 0F
0:S 0F
2:S 0F
1:S 04
0:S 04

[ removed some 0/1:S 04 ... ]

0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
2:S 04
3:S 04
45S:S 4
4:2:0 04

2:3:S004
S :S 0

345:S  04
3: 0404
4:
3 :S 0
4S 0
043:45:S 04

3:S4
44:23:S  4
4 0 04

54:S 0404
4:SS 044
4:
30S
04:
20S
04:
30S
04:
 :4
04
S304
5:
 :4
04
S30S
05
S 04
4:
304
4:S2:S
04
 :4 04:
 0S
4:
 :4 04:
 :4 04:
 :4 05
S :S
04
S :4 05
S :4
4:
3:4
4:S20S
04:
3:4
4
S20S
04:
 04
5
S204 04
S304
4:
 :4
4:
 0S
4:
2:4
4:S 0S
05
S :4 04:S30S
04:S20S
04:
 :4
05
S20S
4:
 :S
05
S20S
04
S304
5
S20S
04
 0S
04
20S 04:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
3:S 04
2:S 04
3:S 04
2:S 04
5:S 04
4:S 04
3:S 04
4:S 04
3:S 04
2:S 04
5:S 04
2:S 04
3:S 04
4:S 04
3:S 04
4:S 04
3:S 04
2:S 04
5:S 04
4:S 04
3:S 04
2:S 04
3:S 04
4:S 04
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 14
0:S 15
0:S 04
1:S 04
5:S 04
1:S 04
0:S 04
1:S 04
0:S 04
2:S 04
5:S 04
1:S 04
0:S 04
4:S 04
0:S 04
4:S 04
0:S 04
2:S 04
3:S 04
1:S 04
5:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
5:S 04
2:S 04
5:S 04
2:S 04
0:S 04
1:S 04
0:S 04
2:S 04
5:S 04
1:S 04
3:S 04
4:S 04
0:S 04
1:S 04
0:S 04
2:S 04
3:S 04
4:S 04
3:S 04
4:S 04
3:S 04
2:S 04
0:S 04
1:S 04
5:S 04
2:S 04
3:S 04
1:S 04
5:S 04
1:S 04
0:S 04
2:S 04
3:S 04
4:S 04
3:S 04
1:S 04
5:S 04
1:S 04
0:S 04
1:S 04
45:S 0404:: 044
2:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
0:S 04
1:S 04
0:S 04
1:S 04
2:S 04
3:S 04
2:S 04
3:S 04
5:S 04
4:S 04
5:S 04
4:S 04
0:S 04
1:S 04
2:S 04
3:S 04
0:S 16
0:S 17
0:S 18
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
3:S 04
0:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
0:S 04
3:S 04
0:S 04
1:S 04
0:S 04
3:S 04
2:S 04
1:S 04
2:S 04
3:S 04
2:S 04
3:S 04
0:S 04
1:S 04
2:S 04
3:S 04
0:S 04
1:S 04
0:S 04
3:S 04
0:S 04
3:S 04
0:S 04
3:S 04
0:S 04
3:S 04
0:S 04
1:S 04
0:S 04
1:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
1:S 04
2:S 04
1:S 04
2:S 04
3:S 04
2:S 04
3:S 04
0:S 04
3:S 04
2:S 04
3:S 04
0:S 04
3:S 04
0:S 04
1:S 04
2:S 04
3:S 04
4:S 04
3:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
3:S 04
2:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
5:S 04
4:S 04
0:S 47
0:S 04
1:S 04
2:S 04
3:S 04
2:S 04
3:S 04
5:S 04
0:S 49
0:S 0C
0:S 0C
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
1:S 04
0:S 04
5:S 04
4:S 04
2:S 04
3:S 04
5:S 04
3:S 04
5:S 04
3:S 04
2:S 04
3:S 04
2:S 04
4:S 04
2:S 04
4:S 04
5:S 04
4:S 04
4:S 30
4:S 0F
4:S 0F
4:S 3A
4:S 30
4:S 3A
4:S 3A
4:S 3A
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 37
2:S 3C
2:S 3C
2:S 3C
2:S 3D
2:S 3D
2:S 3D
2:S 3C
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 37
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 37
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F
2:S 0F

I'm thinkng of halting a few CPUs at certain points to get a better idea of what happens where so we can hopefully figure out whats not right yet.

As an aside. I have removed the following code from the cpu-catching part (from Xell):

Code:

  201 for (i=1; i<6; ++i)
  202 {
  203 *(volatile uint64_t*)(0x8000020000050070ULL + i * 0x1000) = 0x7c;
  204 *(volatile uint64_t*)(0x8000020000050068ULL + i * 0x1000) = 0;
  205 (void)*(volatile uint64_t*)(0x8000020000050008ULL + i * 0x1000);
  206 while (*(volatile uint64_t*)(0x8000020000050050ULL + i * 0x1000) != 0x7C);
  207 }
  208

If I don't remove that code it stops at POST 0x6C. I don't have much knowledge about the Interupt Controller (this is my "documentation") and could really use some help here .

[edit]Even when I remove that code POST 0x6C still takes far longer than during normal boot. So there is something still not right here.

Will keep on working on getting more info out of the rebooting process. But with the above some of you might already be able to analyse what is going on. That way we can figure out a strategy to tackle this problem. If you have any suggestions on what kind of information might also be useful feel free to ask.

Regards,

arnezami

PS. Maybe somebody can convert the above outputs into a more readable form by replacing the "S xx" numbers by the corresponding SC names etc.

[arnezami]

Almost forgot:

http://www.sendspace.com/file/e86d62

ppf to dump the SCs.

Don't use it in combination with the other ppfs.

[Ramzi]

I updated the outputs above to contain the SC names

Here are the POSTs 0x58 - 0x67:

Code:

* Re-booting...
0:C 00 ; Entering into CPU 0
0:P 59 ; POST 0x59
0:P 5A ; POST 0x5A
0:S 0F ; HvxGetImagePageTableEntry
0:S 03 ; KeFlushEntireTb
0:S 0D ; HvxPostOutput
0:P 60 ; POST 0x60
0:S 0D ; HvxPostOutput
0:P 61 ; POST 0x61
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
0:S 0D ; HvxPostOutput
0:P 62 ; POST 0x62
0:S 0D ; HvxPostOutput
0:P 63 ; POST 0x63
0:S 0D ; HvxPostOutput
0:P 64 ; POST 0x64
0:S 03 ; KeFlushEntireTb
0:S 0D ; HvxPostOutput
0:P 65 ; POST 0x65
0:S 0B ; called in ReserveKernelPtes
0:S 0D ; HvxPostOutput
0:P 66 ; POST 0x66
0:S 0D ; HvxPostOutput
0:P 67 ; POST 0x67

First POST 0x68:

Code:

0:S 0D ; HvxPostOutput
0:P 68 ; POST 0x68
0:S 01 ; HvxStartupProcessors
5:C 05 ; Entering CPU 5
3:C 03 ; Entering CPU 3
1:C 01 ; Entering CPU 1
2:C 02 ; Entering CPU 2
4:C 04 ; Entering CPU 4
0:S 42 ; HvxEnableTimebase
0:S 0A ; HvxSetTimeBaseToZero
4:S 0A ; HvxSetTimeBaseToZero
2:S 0A ; HvxSetTimeBaseToZero
0:S 42 ; HvxEnableTimebase

POST 0x69 – 0x78

Code:

0:S 0D ; HvxPostOutput
0:P 69 ; POST 0x69
0:S 2E ; HvxKeysInitialize
0:S 0D ; HvxPostOutput
0:P 6A ; POST 0x6A
0:S 0D ; HvxPostOutput
0:P 6B ; POST 0x6B
0:S 0D ; HvxPostOutput
0:P 6C ; POST 0x6C
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
0:S 0F ; HvxGetImagePageTableEntry
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
0:S 0F ; HvxGetImagePageTableEntry
0:S 52 ; HvxSecurityLoadSettings
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
0:S 0D ; HvxPostOutput
0:P 6D ; POST 0x6D
0:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
0:S 4C ; HvxKeysExLoadKeyVault
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
0:S 0D ; HvxPostOutput
0:P 6E ; POST 0x6E
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
0:S 30 ; HvxKeysGetStatus
0:S 37 ; HvxKeysGetKey
0:S 0D ; HvxPostOutput
0:P 6F ; POST 0x6F
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
1:S 02 ; “unknown KiQuiesce”
0:S 20 ; HvxSetPowerMode
3:S 02 ; “unknown KiQuiesce”
2:S 02 ; “unknown KiQuiesce”
0:S 0D ; HvxPostOutput
0:P 70 ; POST 0x70
0:S 30 ; HvxKeysGetStatus
0:S 04 ; called in FlushMultipleTb
0:S 0C ; HvxFlushDcacheRange
0:S 0D ; HvxPostOutput
0:P 71 ; POST 0x71
0:S 0C ; HvxFlushDcacheRange
0:S 0D ; HvxPostOutput
0:P 72 ; POST 0x72
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 37 ; HvxKeysGetKey
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; HvxGetImagePageTableEntry
0:S 37 ; HvxKeysGetKey
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 37 ; HvxKeysGetKey
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
0:S 11 ; HvxCreateImageMapping
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
0:S 0D ; HvxPostOutput
0:P 73 ; POST 0x73
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 25 ; HvxDvdAuthBuildNVPage
0:S 26 ; HvxDvdAuthVerifyNVPage
0:S 37 ; HvxKeysGetKey
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
0:S 30 ; HvxKeysGetStatus
0:S 0D ; HvxPostOutput
0:P 75 ; POST 0x75
0:S 0D ; HvxPostOutput
0:P 76 ; POST 0x76
0:S 0D ; HvxPostOutput
0:P 77 ; POST 0x77
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 30 ; HvxKeysGetStatus
0:S 30 ; HvxKeysGetStatus
0:S 0D ; HvxPostOutput
0:P 78 ; POST 0x78

[Ramzi]

After 0x79: (some of the output seems corrupt so i didn't add the SC names to those sections)

Code:

0:S 0D ; HvxPostOutput
0:P 79 ; POST 0x79
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; HvxGetImagePageTableEntry
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
0:S 37 ; HvxKeysGetKey
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 37 ; HvxKeysGetKey
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 37 ; HvxKeysGetKey
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
0:S 11 ; HvxCreateImageMapping
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 12 ; HvxMapImagePage
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
0:S 13 ; HvxCompleteImageMapping
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; called in ReserveKernelPtes

[ removed some 0:S 0F... ]

2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
[removed a whole bunch of S04 (called in FlushMultipleTb)
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
2:3:S 04
2:
3:S 0
2:S:S 04
3 04042
3 0 042:S S 04
3:S4
2
3:S4
2:3:S404
3 04
4
S 0 04
:S S4

3 04042:S:S4
4
3 S404
3 0 0
2:S:S4
2
3:04
2
3:04
4
:S 0404
:S:S
2
3:S404
S 0404
:S 0 04
:S 0 04
:S 0 04
3:S4
2:S:04

3 0 042:S:S4
2
3 04
4
3 040

0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
5:S  044
:S S 4

53:S  04
S:04
45
S S40

S S40

:2 S40

:S:S40
5
S:0
44
S:0
4
:2 S40

:3:0

:S:0
44
S:S4
45
S:S40

:S:0
45
S:S
4:3 S40
5
S:0 04
:3 0 0

S 04
0:S 0B
0:S 0B

[ removed some 0:S 0B ... ]

0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0B ; called in ReserveKernelPtes
0:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry

[ removed some 0/2:S 0F ... ]

2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
0:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb

[ removed some 0/1:S 04 ... ]

0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
45S:S 4
4:2:0 04

2:3:S004
S :S 0

345:S  04
3: 0404
4:
3 :S 0
4S 0
043:45:S 04

3:S4
44:23:S  4
4 0 04

54:S 0404
4:SS 044
4:
30S
04:
20S
04:
30S
04:
 :4
04
S304
5:
 :4
04
S30S
05
S 04
4:
304
4:S2:S
04
 :4 04:
 0S
4:
 :4 04:
 :4 04:
 :4 05
S :S
04
S :4 05
S :4
4:
3:4
4:S20S
04:
3:4
4
S20S
04:
 04
5
S204 04
S304
4:
 :4
4:
 0S
4:
2:4
4:S 0S
05
S :4 04:S30S
04:S20S
04:
 :4
05
S20S
4:
 :S
05
S20S
04
S304
5
S20S
04
 0S
04
20S 04:S 04
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
[removed a whole bunch of S04 (called in FlushMultipleTb)
3:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 14 ; HvxLoadImageData
0:S 15 ; HvxFinishImageDataLoad
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
[removed a whole bunch of S04 (called in FlushMultipleTb)
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
0:S 16 ; HvxStartResolveImports
0:S 17 ; HvxResolveImports
0:S 18 ; HvxFinishImageLoad
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
[removed a whole bunch of S04 (called in FlushMultipleTb)
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
0:S 47 ; HvxEncryptedReserveAllocation
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
0:S 49 ; HvxEncryptedEncryptAllocation
0:S 0C ; HvxFlushDcacheRange
0:S 0C ; HvxFlushDcacheRange
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
1:S 04 ; called in FlushMultipleTb
0:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
3:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
2:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
5:S 04 ; called in FlushMultipleTb
4:S 04 ; called in FlushMultipleTb
4:S 30 ; HvxKeysGetStatus
4:S 0F ; HvxGetImagePageTableEntry
4:S 0F ; HvxGetImagePageTableEntry
4:S 3A ; HvxKeysHmacSha
4:S 30 ; HvxKeysGetStatus
4:S 3A ; HvxKeysHmacSha
4:S 3A ; HvxKeysHmacSha
4:S 3A ; HvxKeysHmacSha
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 37 ; HvxKeysGetKey
2:S 3C ; HvxKeysDes2Cbc
2:S 3C ; HvxKeysDes2Cbc
2:S 3C ; HvxKeysDes2Cbc
2:S 3D ; HvxKeysDesCbc
2:S 3D ; HvxKeysDesCbc
2:S 3D ; HvxKeysDesCbc
2:S 3C ; HvxKeysDes2Cbc
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 37 ; HvxKeysGetKey
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 37 ; HvxKeysGetKey
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry
2:S 0F ; HvxGetImagePageTableEntry

Also, arnezami, do you think you can also post the code, not just the patch for the binary, for printing out the SC calls in the rebooter?

[arnezami]

Also, arnezami, do you think you can also post the code, not just the patch for the binary, for printing out the SC calls in the rebooter?

Thanks a lot Ramzi .

Sure I can post the code itself (and explain a little).

This is the routine that handles the SC table (which is called from the code at 0xC00 = where a CPU automatically jumps to when there is a SC command):

Code:

000013D8                 cmplwi  %r0, 0x61
000013DC                 bc      6, lt, loc_D7C
000013E0                 mtocrf  cr4, %r4
000013E4                 mflr    %sp
000013E8                 std     %r4, 0x28(%r13)
000013EC                 std     %sp, 0x20(%r13)
000013F0                 rldicr  %sp, %r0, 2,61
000013F4                 lwz     %r4, 0x1F68(%sp)   // start of SC table
000013F8                 mtlr    %r4
000013FC                 ld      %r4, 0x48(%r13)
00001400                 mfspr   %sp, 0x131
00001404                 addi    %sp, %sp, 0x1F00
00001408                 b       loc_ECC            // patch
0000140C                 li      %rtoc, 2
00001410                 rldicr  %rtoc, %rtoc, 32,31
00001414                 blrl
00001418                 li      %r0, 0
0000141C                 li      %r4, 0
00001420                 li      %r5, 0
00001424                 li      %r6, 0
00001428                 li      %r7, 0
0000142C                 li      %r8, 0
00001430                 li      %r9, 0
00001434                 li      %r10, 0
00001438                 li      %r11, 0
0000143C                 li      %r12, 0
00001440                 ld      %rtoc, 0(%sp)
00001444                 ld      %sp, 0x20(%r13)
00001448                 mtlr    %sp
0000144C                 ld      %sp, 0x38(%r13)
00001450                 mfsprg0 %r13
00001454                 rfid

As you can see its patched at 0x1408 to branch (b not bl so I'm not fiddling with the Link Register which is used at 0x1414) to my code at 0xECC. At that address I use the stack to be able to use some registers later on. And I call my get semaphore (sub_68C), serial output (sub_1530) and release semaphore (sub_3C0) functions with 'S' as input:

Code:

00000ECC                 std     %r11, -8(%sp)
00000ED0                 std     %r12, -0x30(%sp)
00000ED4                 std     %r4, -0x18(%sp)
00000ED8                 std     %r3, -0x10(%sp)
00000EDC                 stdu    %sp, -0x90(%sp)
00000EE0                 mflr    %r4
00000EE4                 mr      %r11, %r0
00000EE8                 li      %r3, 0x53 # 'S'
00000EEC                 bl      sub_68C
00000EF0                 bl      sub_1530
00000EF4                 bl      sub_3C0
00000EF8                 nop
00000EFC                 mtlr    %r4
00000F00                 addi    %sp, %sp, 0x90
00000F04                 ld      %r3, -0x10(%sp)
00000F08                 ld      %r4, -0x18(%sp)
00000F0C                 ld      %r11, -8(%sp)
00000F10                 ld      %r12, -0x30(%sp)
00000F14                 stdu    %rtoc, -8(%sp)
00000F18                 b       loc_140C

Similarly when the CPU have just entered the HV and right after its stack pointer has been initialized I patched the code (at 0x1D88):

Code:

00001D84                 addi    %sp, %r4, 0x1F00           // initialize stack pointer
00001D88                 b       loc_17B0                   // patch
00001D8C                 rldicr  %rtoc, %rtoc, 32,31
00001D90                 cmplwi  %r21, 0
00001D94                 beql    Execute_59_and_5A
00001D98                 li      %r5, 0
00001D9C                 slbia

Here I put some code at 0x17B0 which is shown here (here I didn't have to make sure my registers weren't destroyed because some of them were reset anyway in the function that does POST 0x59 and 0x5A). This again call the three functions:

Code:

000017B0                 mr      %r11, %r21
000017B4                 bl      sub_68C
000017B8                 li      %r3, 0x43 # 0x80000102 # 'C'
000017BC                 nop
000017C0                 nop
000017C4                 bl      sub_1530
000017C8                 bl      sub_3C0
000017CC                 li      %rtoc, 2
000017D0                 b       loc_1D8C

And similar for capturing of output to the POST bus. This is the function that does that:

Code:

00002D68                 mflr    %r12
00002D6C                 std     %r12, -8(%sp)
00002D70                 std     %r31, -0x10(%sp)
00002D74                 stdu    %sp, -0x60(%sp)
00002D78                 mr      %r11, %r3
00002D7C                 lis     %r3, loc_61000@h
00002D80                 rldicr  %r31, %r11, 56,7
00002D84                 ori     %r3, %r3, loc_61000@l
00002D88                 bl      sub_B38                                   
00002D8C                 std     %r31, ((qword_61010-0x1000)@l)(%r3)       // output to POST bus
00002D90                 eieio
00002D94                 b       loc_17D8                    // patch
00002D98                 li      %r3, 0
00002D9C                 addi    %sp, %sp, 0x60
00002DA0                 ld      %r12, -8(%sp)
00002DA4                 mtlr    %r12
00002DA8                 ld      %r31, -0x10(%sp)
00002DAC                 blr

And the my code at 0x17D8:

Code:

000017DC                 bl      sub_68C
000017E0                 li      %r3, 0x50 # 'P'
000017E4                 nop
000017E8                 nop
000017EC                 bl      sub_1530
000017F0                 bl      sub_3C0
000017F4                 nop
000017F8                 b       loc_2D98

As for the semaphore stuff. This is to make sure a cpu waits for another cpu if the output to serial is in use (had to split the because there wasn't enough room in the HV):

Code:

0000068C                 mflr    %r12
00000690                 std     %r12, var_30(%sp)
00000694                 std     %r11, var_8(%sp)
00000698                 std     %r3, var_10(%sp)
0000069C                 std     %r4, var_18(%sp)
000006A0                 std     %r5, var_20(%sp)
000006A4                 std     %r6, var_28(%sp)
000006A8                 stdu    %sp, var_90(%sp)
000006AC                 lis     %r6, 0x8000
000006B0                 ori     %r6, %r6, 0x102
000006B4                 rldicr  %r6, %r6, 32,31
000006B8                 oris    %r6, %r6, 1
000006BC                 ori     %r6, %r6, 0xBC74   // semaphore at address: 0x800001020001BC74
000006C0                 mfspr   %r11, pir
000006C4                 lwz     %r4, 0(%r6)
000006C8                 cmpwi   %r4, 7
000006CC                 bne     loc_6C4            // wait until released (= 0x7)
000006D0                 stw     %r11, 0(%r6)       // store own pir value at semaphore
000006D4                 mr      %r3, %r6
000006D8                 li      %r4, 0x80
000006DC                 lis     %r5, 0xFFFF
000006E0                 ori     %r5, %r5, 0xFFF1
000006E4                 and     %r5, %r5, %r3
000006E8                 subf    %r3, %r5, %r3
000006EC                 add     %r4, %r4, %r3
000006F0                 li      %r3, 0
000006F4                 nop
000006F8                 nop
000006FC                 b       loc_8B8

Code:

000008B8                 dcbst   %r3, %r5      // flush the cache
000008BC                 addic   %r5, %r5, 0x80
000008C0                 subic.  %r4, %r4, 0x80
000008C4                 bge     loc_8B8
000008C8                 isync
000008CC                 lwz     %r4, 0(%r6)            // make sure your pir is really stored (otherwise try again).
000008D0                 cmpld   %r4, %r11
000008D4                 bne     loc_6C4
000008D8                 addi    %sp, %sp, 0x90
000008DC                 ld      %r11, -0x90+arg_88(%sp)
000008E0                 ld      %r3, -0x90+arg_80(%sp)
000008E4                 ld      %r4, -0x90+arg_78(%sp)
000008E8                 ld      %r5, -0x90+arg_70(%sp)
000008EC                 ld      %r6, -0x90+arg_68(%sp)
000008F0                 ld      %r12, -0x90+arg_60(%sp)
000008F4                 mtlr    %r12
000008F8                 blr

As you can see I use address 0x800001020001BC74 (0x1BC74 in the HV: in IDA when you load at 0x00000000) to store the semaphore value which is right after all functions in the HV and just before all data. I am not sure if this is the right place. It it seems to work fine.

Releasing the semaphore (again split because of not enough room):

Code:

000003C0                 mflr    %r12
000003C4                 std     %r12, var_30(%sp)
000003C8                 std     %r4, var_18(%sp)
000003CC                 std     %r6, var_28(%sp)
000003D0                 stdu    %sp, var_90(%sp)
000003D4                 lis     %r6, 0x8000 # 0x80000102
000003D8                 ori     %r6, %r6, 0x102 # 0x80000102
000003DC                 rldicr  %r6, %r6, 32,31
000003E0                 oris    %r6, %r6, 1
000003E4                 ori     %r6, %r6, 0xBC74
000003E8                 li      %r4, 7
000003EC                 stw     %r4, 0(%r6)               // store 0x7 at 0x800001020001BC74
000003F0                 addi    %sp, %sp, 0x90
000003F4                 ld      %r4, -0x90+arg_78(%sp)
000003F8                 ld      %r6, -0x90+arg_68(%sp)
000003FC                 b       loc_468

Code:

00000468                 ld      %r12, -0x90+arg_60(%sp)
0000046C                 mtlr    %r12
00000470                 blr

The serial output is done at 0x1530 (this is split too but only by one instruction at 0x1600).

Code:

00001530                 mflr    %r12
00001534                 std     %r12, var_30(%sp)
00001538                 std     %r11, var_8(%sp)
0000153C                 std     %r3, var_10(%sp)
00001540                 std     %r4, var_18(%sp)
00001544                 std     %r5, var_20(%sp)
00001548                 std     %r6, var_28(%sp)
0000154C                 stdu    %sp, var_90(%sp)
00001550                 mr      %r6, %r3
00001554                 nop
00001558                 nop
0000155C                 nop
00001560                 nop
00001564                 mfspr   %r3, pir
00001568                 bl      sub_1790
0000156C                 li      %r3, 0x3A # ':'
00001570                 bl      sub_16C0
00001574                 mr      %r3, %r6
00001578                 bl      sub_16C0
0000157C                 li      %r3, 0x20 # ' '
00001580                 bl      sub_16C0
00001584                 andi.   %r3, %r11, 0xF0
00001588                 srwi    %r3, %r3, 4
0000158C                 bl      sub_1790
00001590                 andi.   %r3, %r11, 0xF
00001594                 bl      sub_1790
00001598                 li      %r3, 0xD 
0000159C                 bl      sub_16C0
000015A0                 li      %r3, 0xA
000015A4                 bl      sub_16C0
000015A8                 nop
000015AC                 nop
000015B0                 nop
000015B4                 nop
000015B8                 nop
000015BC                 nop
000015C0                 nop
000015C4                 nop
000015C8                 nop
000015CC                 nop
000015D0                 nop
000015D4                 nop
000015D8                 nop
000015DC                 nop
000015E0                 nop
000015E4                 nop
000015E8                 nop
000015EC                 nop
000015F0                 nop
000015F4                 nop
000015F8                 nop
000015FC                 b       loc_1604
00001600 # ---------------------------------------------------------------------------
00001600                 b       sub_204
00001604 # ---------------------------------------------------------------------------
00001604                 nop
00001608                 nop
0000160C                 nop
00001610                 nop
00001614                 nop
00001618                 nop
0000161C                 nop
00001620                 nop
00001624                 nop
00001628                 nop
0000162C                 nop
00001630                 nop
00001634                 nop
00001638                 nop
0000163C                 nop
00001640                 nop
00001644                 addi    %sp, %sp, 0x90
00001648                 ld      %r11, -0x90+arg_88(%sp)
0000164C                 ld      %r3, -0x90+arg_80(%sp)
00001650                 ld      %r4, -0x90+arg_78(%sp)
00001654                 ld      %r5, -0x90+arg_70(%sp)
00001658                 ld      %r6, -0x90+arg_68(%sp)
0000165C                 ld      %r12, -0x90+arg_60(%sp)
00001660                 mtlr    %r12
00001664                 blr

Sorry about the nops . I'm planning to extend this...

The code at 0x1790 makes sure output of lowest byte of %r3 is done hexadecimally:

Code:

00001790                 mflr    %r12
00001794                 addi    %r3, %r3, 0x30        // 0x30 = '0'
00001798                 cmpwi   %r3, 0x3A
0000179C                 blt     loc_17A4
000017A0                 addi    %r3, %r3, 7            // 0x37 + 0xA = 'A'
000017A4                 bl      sub_16C0
000017A8                 mtlr    %r12
000017AC                 blr

And of course the serial output itself:

Code:

000016C0                 lis     %r4, 0x8000
000016C4                 ori     %r4, %r4, 0x200
000016C8                 rldicr  %r4, %r4, 32,31
000016CC                 oris    %r4, %r4, 0xEA00
000016D0                 mr      %r5, %r3
000016D4                 lwz     %r3, 0x1018(%r4)
000016D8                 rlwinm. %r3, %r3, 0,6,6
000016DC                 beq     loc_16D4
000016E0                 mr      %r3, %r5
000016E4                 slwi    %r3, %r3, 24
000016E8                 stw     %r3, 0x1014(%r4)
000016EC                 blr

All the above is just to dump stuff and get an idea of the dynamics of the booting the kernel/hv. And for me its just a tool to figure out what it doesn't do compared to normal boot or where certain cpus are stuck etc.

I will keep sharing my results.

Regards,

arnezami

PS. The reason why programming in the hv/kernel is a pain is because all the above has been done by a hex editor. While some of it I can first compile and then copy-paste other stuff (like the branches) have to be done manually. And there is also the room-issue and potential checksum(?) problems. So far I have been able to avoid or cope with these issues.