FreeCalypso > hg > freecalypso-sw
comparison target-utils/tf-breakin/payload.S @ 356:4e0aa166baa5
target-utils/tf-breakin: payload written for the TF C139 break-in attempt
| author | Michael Spacefalcon <msokolov@ivan.Harhan.ORG> |
|---|---|
| date | Thu, 15 May 2014 09:18:23 +0000 |
| parents | |
| children | 7166c8311b0d |
comparison
equal
deleted
inserted
replaced
| 355:4a92b7261e23 | 356:4e0aa166baa5 |
|---|---|
| 1 .text | |
| 2 .org 0 | |
| 3 .code 32 | |
| 4 | |
| 5 @ set CPSR like mot931c payload does | |
| 6 msr CPSR_c, #0xd3 | |
| 7 @ disable the watchdog | |
| 8 ldr r1, =0xfffff802 | |
| 9 mov r0, #0xf5 | |
| 10 strh r0, [r1, #2] | |
| 11 mov r0, #0xa0 | |
| 12 strh r0, [r1, #2] | |
| 13 @ MODEM UART | |
| 14 ldr r6, =0xffff5800 | |
| 15 @ wait for any previous output to flush out | |
| 16 1: ldrb r0, [r6, #5] | |
| 17 tst r0, #0x20 | |
| 18 beq 1b | |
| 19 @ send our indication | |
| 20 adr r1, outstr | |
| 21 mov r2, #6 | |
| 22 1: ldrb r0, [r1], #1 | |
| 23 strb r0, [r6] | |
| 24 subs r2, r2, #1 | |
| 25 bne 1b | |
| 26 @ wait for this output to go out to the TxD pin | |
| 27 1: ldrb r0, [r6, #5] | |
| 28 tst r0, #0x40 | |
| 29 beq 1b | |
| 30 @ enable the Calypso boot ROM | |
| 31 ldr r1, =0xFFFFFB10 | |
| 32 mov r2, #0x0100 | |
| 33 strh r2, [r1] | |
| 34 @ jump to it! | |
| 35 mov pc, #0 | |
| 36 | |
| 37 outstr: .byte 2,2,2,'O','K',2 |