some good news
i have a working ST.DB for cold boot > uber4020 dash > st.db > habibi
(using a NDURE C:\ along side it)
that is based on the "doublestdb" by rmenhal
the one that uses "BUFF" instead of "RIFF" as HEAD0 (the one that cleans up the music dir)
so now we just need to find the offset of 5960 dash from <<EggsBox>>
i will
try to do a xbe (settings_adoc.xip) that just writes this offset to a file
here it is incase some wants to work on this.
CODE
;;;
;;; Compile: nasm -o ST.DB stdb.asm
;;;
BITS 32
stdbmemofs equ 1498BCh ; < fixed by 4920 dash
D5960_offset equ 00000000h ; what is it ? <<<<<<
mem_offset equ 0D004B694h + D5960_offset ; adrress when launched from 4920 only
bin_start:
.HEAD0 dd 'BUFF'
.HEAD1 dd (mem_offset-1498C8h)/4
.HEAD2 dd .start-.HEAD0+stdbmemofs
;;;
;;; Summary:
;;; 1) Remove the subdirectory 1498c8 (HEAD2) that Dashboard created.
;;; 2) Rewrite ST.DB to disk (because Dashboard gobbles it.)
;;; 3) Change the MS public key in kernel to habibi-key.
;;; 4) Load and run a habibi-signed XBE.
;;;
.start:
call .base
.base: pop ebp
jmp short .continuecode
;----------------
.xbestring db 'default.xbe',0
.trnumstr db 'T:\music\1498c8',0
.trnum dw $-.trnumstr-1, $-.trnumstr-1
.ptrnumstr dd .trnumstr-.HEAD0+stdbmemofs
.tmusicstdb dw 14, 14
dd 17E10h; "T:\MUSIC\ST.DB"
.dispose db 1
;----------------
.continuecode:
; jmp short $ ; make it hang <<<<<<<<<<<<<<<<
dec dword [ebp+.HEAD1-.base]
dec dword [ebp+.HEAD2-.base]
push dword [ebp+.HEAD0-.base-4]
call dword [12034h]; NtClose
push byte 26
pop ecx
xor eax,eax
mov edi,stdbmemofs+416
rep stosd
inc eax
stosd
mov dword [edi-12],21371h
push eax
mov ebx,esp ; File handle
push eax
push eax
mov esi,esp ; IO status
lea eax,[ebp+.trnum-.base]
push byte 40h
push eax
push byte -3
mov edi,esp ; Object attributes
push byte 1
push byte 4
push esi
push edi
push dword 10000h
push ebx
call dword [12040h]; NtOpenFile
push byte 13 ; 13 = FileDispositionInformation
push byte 1
lea eax,[ebp+.dispose-.base]
push eax
push esi
push dword [ebx]
call dword [120A0h]; NtSetInformationFile
push dword [ebx]
call dword [12034h]; NtClose
lea eax,[ebp+.tmusicstdb-.base]
mov [edi+4],eax
push byte 22h
push byte 3
push esi
push edi
push dword 40100000h
push ebx
call dword [12040h]; NtOpenFile
mov eax,512+12
lea edx,[ebp+.HEAD0-.base]
call .write
push byte 101
pop ecx
mov eax,512-12
.wl: push ecx
mov edx,10D70h; zeroes at 0x10D70
call .write
mov eax,512
pop ecx
loop .wl
push dword [ebx]
mov esi,dword [12034h]; NtClose
call esi
; add esp,byte 12+8+4
.patchpublickey:
mov ebx,dword [121A8h]; XePublicKeyData
test ebx,ebx
jz short .badexport
cmp dword [ebx],31415352h
jne short .badexport
cmp dword [ebx+10h],10001h
je short .keyfound
.badexport:
and si,0F000h
.findkernel:
mov ax,[esi]
cmp ax,'ZM'
je short .check
cmp ax,'MZ'
je short .check
.retry: sub esi,1000h
jmp short .findkernel
.check:
mov eax,[esi+3Ch]
cmp eax,0FFFh
ja short .retry
cmp dword [esi+eax],'PE'
jne short .retry
mov ebx,esi
.searchkey:
inc ebx
cmp dword [ebx],31415352h
jne short .searchkey
cmp dword [ebx+10h],10001h
jne short .searchkey
.keyfound:
.searchkeyend:
inc ebx
cmp dword [ebx],0A44B1BBDh
jne short .searchkeyend
cli
mov ecx,cr0
push ecx
and ecx,0FFFEFFFFh
mov cr0,ecx
xor dword [ebx],2DD78BD6h
pop ecx
mov cr0,ecx
sti
.loadrunxbe:
push byte 0
push esp
push byte 0
push byte 2
push 127C8h ; "\Device\Harddisk0\partition1"
lea eax,[ebp+.xbestring-.base]
push eax
mov esi,555A9h
call esi
.inf: jmp short .inf
;------------------------
.write:
xor ecx,ecx
push ecx
push eax
push edx
push esi
push ecx
push ecx
push ecx
push dword [ebx]
call dword [120D8h]; NtWriteFile
ret
;
%if $-.HEAD0 > 416
%error 416 bytes maximum!
%endif
times 512-$+.HEAD0 db 0
dd 21371h, 0, 1 ; An empty no-name track (for HD to HD copy)
times 52224-$+bin_start.HEAD0 db 0
