Bump version to v1.3.0

Add support for 8.1.0, new Sept, and master_key_08
Bump version to v1.2.0
2019-06-19 18:58:42 -04:00 · 2019-06-19 18:16:02 -04:00 · 2019-05-31 12:58:17 -04:00 · 2019-05-31 12:57:46 -04:00 · 2019-05-31 12:57:11 -04:00 · 2019-05-18 11:08:34 -04:00
29 changed files with 564 additions and 824 deletions
--- a/94
+++ b/94
@ -1,58 +1,30 @@
+rwildcard = $(foreach d, $(wildcard $1*), $(filter $(subst *, %, $2), $d) $(call rwildcard, $d/, $2))
+
 ifeq ($(strip $(DEVKITARM)),)
 $(error "Please set DEVKITARM in your environment. export DEVKITARM=<path to>devkitARM")
 endif

 include $(DEVKITARM)/base_rules

+################################################################################
+
 IPL_LOAD_ADDR := 0x40003000
+LPVERSION_MAJOR := 1
+LPVERSION_MINOR := 3
+LPVERSION_BUGFX := 0
+
+################################################################################

 TARGET := Lockpick_RCM
-LPVERSION_MAJOR := 1
-LPVERSION_MINOR := 1
-LPVERSION_BUGFX := 1
-
-BUILD := build
-OUTPUT := output
+BUILDDIR := build
+OUTPUTDIR := output
 SOURCEDIR = source
-VPATH = $(dir $(wildcard ./$(SOURCEDIR)/*/)) $(dir $(wildcard ./$(SOURCEDIR)/*/*/))

-OBJS = $(addprefix $(BUILD)/$(TARGET)/, \
-	start.o \
-	main.o \
-	keys.o \
-	heap.o \
-	btn.o \
-	clock.o \
-	cluster.o \
-	fuse.o \
-	gpio.o \
-	sept.o \
-	i2c.o \
-	max7762x.o \
-	max17050.o \
-	mc.o \
-	nx_emmc.o \
-	sdmmc.o \
-	sdmmc_driver.o \
-	sdram.o \
-	sdram_lp0.o \
-	util.o \
-	di.o \
-	gfx.o \
-	pinmux.o \
-	pkg1.o \
-	pkg2.o \
-	se.o \
-	tsec.o \
-	hw_init.o \
-	smmu.o \
-	max77620-rtc.o \
-)
+OBJS =	$(patsubst $(SOURCEDIR)/%.S, $(BUILDDIR)/$(TARGET)/%.o, \
+		$(patsubst $(SOURCEDIR)/%.c, $(BUILDDIR)/$(TARGET)/%.o, \
+		$(call rwildcard, $(SOURCEDIR), *.S *.c)))

-OBJS += $(addprefix $(BUILD)/$(TARGET)/, \
-	lz.o blz.o \
-	diskio.o ff.o ffunicode.o ffsystem.o \
-)
+################################################################################

 CUSTOMDEFINES := -DIPL_LOAD_ADDR=$(IPL_LOAD_ADDR)
 CUSTOMDEFINES += -DLP_VER_MJ=$(LPVERSION_MAJOR) -DLP_VER_MN=$(LPVERSION_MINOR) -DLP_VER_BF=$(LPVERSION_BUGFX)
@ -61,34 +33,30 @@ ARCH := -march=armv4t -mtune=arm7tdmi -mthumb-interwork
 CFLAGS = $(ARCH) -O2 -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -std=gnu11 -Wall $(CUSTOMDEFINES)
 LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections -Xlinker --defsym=IPL_LOAD_ADDR=$(IPL_LOAD_ADDR)

-MODULEDIRS := $(wildcard modules/*)
+################################################################################

-.PHONY: all clean $(MODULEDIRS)
+.PHONY: all clean

-all: $(TARGET).bin
-	@echo -n "Payload size is "
-	@wc -c < $(OUTPUT)/$(TARGET).bin
-	@echo "Max size is 126296 Bytes."
+all: $(OUTPUTDIR)/$(TARGET).bin

 clean:
-	@rm -rf $(OBJS)
-	@rm -rf $(BUILD)
-	@rm -rf $(OUTPUT)
+	@rm -rf $(BUILDDIR)
+	@rm -rf $(OUTPUTDIR)

-$(MODULEDIRS):
-	$(MAKE) -C $@ $(MAKECMDGOALS)
+$(OUTPUTDIR)/$(TARGET).bin: $(BUILDDIR)/$(TARGET)/$(TARGET).elf
+	@mkdir -p "$(@D)"
+	$(OBJCOPY) -S -O binary $< $@
+	@echo -n "Payload size is "
+	@wc -c < $@
+	@echo "Max size is 126296 Bytes."

-$(TARGET).bin: $(BUILD)/$(TARGET)/$(TARGET).elf $(MODULEDIRS)
-	$(OBJCOPY) -S -O binary $< $(OUTPUT)/$@
-
-$(BUILD)/$(TARGET)/$(TARGET).elf: $(OBJS)
+$(BUILDDIR)/$(TARGET)/$(TARGET).elf: $(OBJS)
 	$(CC) $(LDFLAGS) -T $(SOURCEDIR)/link.ld $^ -o $@

-$(BUILD)/$(TARGET)/%.o: %.c
+$(BUILDDIR)/$(TARGET)/%.o: $(SOURCEDIR)/%.c
+	@mkdir -p "$(@D)"
 	$(CC) $(CFLAGS) -c $< -o $@

-$(BUILD)/$(TARGET)/%.o: %.S
-	@mkdir -p "$(BUILD)"
-	@mkdir -p "$(BUILD)/$(TARGET)"
-	@mkdir -p "$(OUTPUT)"
+$(BUILDDIR)/$(TARGET)/%.o: $(SOURCEDIR)/%.S
+	@mkdir -p "$(@D)"
 	$(CC) $(CFLAGS) -c $< -o $@
--- a/source/gfx/gfx.c
+++ b/source/gfx/gfx.c
@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
 * Copyright (c) 2019 shchmue
 *
 * This program is free software; you can redistribute it and/or modify it
@ -306,7 +306,7 @@ static void _gfx_putn(u32 v, int base, char fill, int fcnt)
 	gfx_puts(p);
 }

-void gfx_put_small_sep(gfx_con_t *con)
+void gfx_put_small_sep()
 {
 	u8 prevFontSize = gfx_con.fntsz;
 	gfx_con.fntsz = 8;
@ -314,7 +314,7 @@ void gfx_put_small_sep(gfx_con_t *con)
 	gfx_con.fntsz = prevFontSize;
 }

-void gfx_put_big_sep(gfx_con_t *con)
+void gfx_put_big_sep()
 {
 	u8 prevFontSize = gfx_con.fntsz;
 	gfx_con.fntsz = 16;
--- a/source/gfx/gfx.h
+++ b/source/gfx/gfx.h
@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
 * Copyright (C) 2018 M4xw
 *
 * This program is free software; you can redistribute it and/or modify it
@ -41,8 +41,8 @@ void gfx_hexdump(u32 base, const u8 *buf, u32 len);

 void gfx_set_pixel(u32 x, u32 y, u32 color);
 void gfx_line(int x0, int y0, int x1, int y1, u32 color);
-void gfx_put_small_sep(gfx_con_t *con);
-void gfx_put_big_sep(gfx_con_t *con);
+void gfx_put_small_sep();
+void gfx_put_big_sep();
 void gfx_set_rect_grey(const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
 void gfx_set_rect_rgb(const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
 void gfx_set_rect_argb(const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
--- a/source/hos/pkg1.c
+++ b/source/hos/pkg1.c
@ -23,17 +23,18 @@
 #include "../sec/se.h"

 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008", 0, 0x1900, 0x3FE0, 0x4002B020 }, //1.0.0
-	{ "20170210155124", 0, 0x1900, 0x3FE0, 0x4002D000 }, //2.0.0 - 2.3.0
-	{ "20170519101410", 1, 0x1A00, 0x3FE0, 0x4002D000 }, //3.0.0
-	{ "20170710161758", 2, 0x1A00, 0x3FE0, 0x4002D000 }, //3.0.1 - 3.0.2
-	{ "20170921172629", 3, 0x1800, 0x3FE0, 0x4002B000 }, //4.0.0 - 4.1.0
-	{ "20180220163747", 4, 0x1900, 0x3FE0, 0x4002B000 }, //5.0.0 - 5.1.0
-	{ "20180802162753", 5, 0x1900, 0x3FE0, 0x4002B000 }, //6.0.0 - 6.1.0
-	{ "20181107105733", 6, 0x0E00, 0x6FE0, 0x4002B000 }, //6.2.0
-	{ "20181218175730", 7, 0x0F00, 0x6FE0, 0x40030000 }, //7.0.0
-	{ "20190208150037", 7, 0x0F00, 0x6FE0, 0x40030000 }, //7.0.1
-	{ "20190314172056", 7, 0x0E00, 0x6FE0, 0x40030000 }, //8.0.0
+	{ "20161121183008", 0 }, //1.0.0
+	{ "20170210155124", 0 }, //2.0.0 - 2.3.0
+	{ "20170519101410", 1 }, //3.0.0
+	{ "20170710161758", 2 }, //3.0.1 - 3.0.2
+	{ "20170921172629", 3 }, //4.0.0 - 4.1.0
+	{ "20180220163747", 4 }, //5.0.0 - 5.1.0
+	{ "20180802162753", 5 }, //6.0.0 - 6.1.0
+	{ "20181107105733", 6 }, //6.2.0
+	{ "20181218175730", 7 }, //7.0.0
+	{ "20190208150037", 7 }, //7.0.1
+	{ "20190314172056", 7 }, //8.0.0
+	{ "20190531152432", 8 }, //8.1.0
 	{ NULL } //End.
 };

--- a/source/hos/pkg1.h
+++ b/source/hos/pkg1.h
@ -23,9 +23,6 @@ typedef struct _pkg1_id_t
 {
 	const char *id;
 	u32 kb;
-	u32 tsec_off;
-	u32 pkg11_off;
-	u32 secmon_base;
 } pkg1_id_t;

 const pkg1_id_t *pkg1_identify(u8 *pkg1);
--- a/source/hos/pkg2.c
+++ b/source/hos/pkg2.c
@ -41,11 +41,15 @@ static u32 _pkg2_calc_kip1_size(pkg2_kip1_t *kip1)

 void pkg2_parse_kips(link_t *info, pkg2_hdr_t *pkg2)
 {
-	u8 *ptr = pkg2->data;
-	if (pkg2->sec_size[PKG2_SEC_INI1] == 0)
-		ptr += *(u32 *)(ptr + 0x168);
+	u8 *ptr;
+	// Check for new pkg2 type.
+	if (!pkg2->sec_size[PKG2_SEC_INI1])
+	{
+		u32 kernel_ini1_off = *(u32 *)(pkg2->data + PKG2_NEWKERN_INI1_START);
+		ptr = pkg2->data + kernel_ini1_off;
+	}
 	else
-		ptr += pkg2->sec_size[PKG2_SEC_KERNEL];
+		ptr = pkg2->data + pkg2->sec_size[PKG2_SEC_KERNEL];

 	pkg2_ini1_t *ini1 = (pkg2_ini1_t *)ptr;
 	ptr += sizeof(pkg2_ini1_t);
--- a/source/hos/pkg2.h
+++ b/source/hos/pkg2.h
@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@ -26,6 +26,8 @@
 #define PKG2_SEC_KERNEL 0
 #define PKG2_SEC_INI1 1

+#define PKG2_NEWKERN_INI1_START 0x168
+
 typedef struct _pkg2_hdr_t
 {
 	u8 ctr[0x10];
--- a/source/hos/sept.c
+++ b/source/hos/sept.c
@ -59,15 +59,15 @@ extern boot_cfg_t b_cfg;
 extern void sd_unmount();
 extern void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size);

-int reboot_to_sept(const u8 *tsec_fw)
+int reboot_to_sept(const u8 *tsec_fw, const u32 tsec_size, const u32 kb)
 {
 	FIL fp;

 	// Copy warmboot reboot code and TSEC fw.
 	memcpy((u8 *)(SEPT_PK1T_ADDR - WB_RST_SIZE), (u8 *)warmboot_reboot, sizeof(warmboot_reboot));
-	memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, 0x3000);
-	*(vu32 *)SEPT_TCSZ_ADDR = 0x3000;
-	
+	memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, tsec_size);
+	*(vu32 *)SEPT_TCSZ_ADDR = tsec_size;
+
 	// Copy sept-primary.
 	if (f_open(&fp, "sd:/sept/sept-primary.bin", FA_READ))
 		goto error;
@ -80,7 +80,9 @@ int reboot_to_sept(const u8 *tsec_fw)
 	f_close(&fp);

 	// Copy sept-secondary.
-	if (f_open(&fp, "sd:/sept/sept-secondary.enc", FA_READ))
+	if ((kb == 7) && f_open(&fp, "sd:/sept/sept-secondary.enc", FA_READ) && f_open(&fp, "sd:/sept/sept-secondary_00.enc", FA_READ))
+		goto error;
+	else if ((kb == 8) && f_open(&fp, "sd:/sept/sept-secondary_01.enc", FA_READ))
 		goto error;

 	if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL))
@ -90,7 +92,7 @@ int reboot_to_sept(const u8 *tsec_fw)
 	}
 	f_close(&fp);

-	// Save auto boot config to payload, if any.
+	// Save auto boot config to sept payload, if any.
 	boot_cfg_t *tmp_cfg = malloc(sizeof(boot_cfg_t));
 	memcpy(tmp_cfg, &b_cfg, sizeof(boot_cfg_t));

@ -125,10 +127,8 @@ int reboot_to_sept(const u8 *tsec_fw)

 	(*sept)();

-	return 1;
-
 error:
-	EPRINTF("Sept payloads not found in sd:/sept!\nPlace appropriate files and try again.");
+	EPRINTF("Sept files not found in sd:/sept!\nPlace appropriate files and try again.");
 	display_backlight_brightness(100, 1000);

 	btn_wait();
--- a/source/hos/sept.h
+++ b/source/hos/sept.h
@ -19,6 +19,6 @@

 #include "../utils/types.h"

-int reboot_to_sept(const u8 *tsec_fw);
+int reboot_to_sept(const u8 *tsec_fw, const u32 tsec_size, const u32 kb);

 #endif
--- a/source/keys/key_sources.inl
+++ b/source/keys/key_sources.inl
@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2019 shchmue
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+static const u8 zeros[0x10] = {0};
+
+static const u8 keyblob_key_source[][0x10] = {
+    {0xDF, 0x20, 0x6F, 0x59, 0x44, 0x54, 0xEF, 0xDC, 0x70, 0x74, 0x48, 0x3B, 0x0D, 0xED, 0x9F, 0xD3}, //1.0.0
+    {0x0C, 0x25, 0x61, 0x5D, 0x68, 0x4C, 0xEB, 0x42, 0x1C, 0x23, 0x79, 0xEA, 0x82, 0x25, 0x12, 0xAC}, //3.0.0
+    {0x33, 0x76, 0x85, 0xEE, 0x88, 0x4A, 0xAE, 0x0A, 0xC2, 0x8A, 0xFD, 0x7D, 0x63, 0xC0, 0x43, 0x3B}, //3.0.1
+    {0x2D, 0x1F, 0x48, 0x80, 0xED, 0xEC, 0xED, 0x3E, 0x3C, 0xF2, 0x48, 0xB5, 0x65, 0x7D, 0xF7, 0xBE}, //4.0.0
+    {0xBB, 0x5A, 0x01, 0xF9, 0x88, 0xAF, 0xF5, 0xFC, 0x6C, 0xFF, 0x07, 0x9E, 0x13, 0x3C, 0x39, 0x80}, //5.0.0
+    {0xD8, 0xCC, 0xE1, 0x26, 0x6A, 0x35, 0x3F, 0xCC, 0x20, 0xF3, 0x2D, 0x3B, 0x51, 0x7D, 0xE9, 0xC0}  //6.0.0
+};
+
+static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600][0x10] = {
+    {0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A}, //6.2.0
+    {0x9A, 0x3E, 0xA9, 0xAB, 0xFD, 0x56, 0x46, 0x1C, 0x9B, 0xF6, 0x48, 0x7F, 0x5C, 0xFA, 0x09, 0x5C}, //7.0.0
+    {0xDE, 0xDC, 0xE3, 0x39, 0x30, 0x88, 0x16, 0xF8, 0xAE, 0x97, 0xAD, 0xEC, 0x64, 0x2D, 0x41, 0x41}, //8.1.0
+};
+
+static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] =
+{
+    {0x0C, 0xF0, 0x59, 0xAC, 0x85, 0xF6, 0x26, 0x65, 0xE1, 0xE9, 0x19, 0x55, 0xE6, 0xF2, 0x67, 0x3D}, /* Zeroes encrypted with Master Key 00. */
+    {0x29, 0x4C, 0x04, 0xC8, 0xEB, 0x10, 0xED, 0x9D, 0x51, 0x64, 0x97, 0xFB, 0xF3, 0x4D, 0x50, 0xDD}, /* Master key 00 encrypted with Master key 01. */
+    {0xDE, 0xCF, 0xEB, 0xEB, 0x10, 0xAE, 0x74, 0xD8, 0xAD, 0x7C, 0xF4, 0x9E, 0x62, 0xE0, 0xE8, 0x72}, /* Master key 01 encrypted with Master key 02. */
+    {0x0A, 0x0D, 0xDF, 0x34, 0x22, 0x06, 0x6C, 0xA4, 0xE6, 0xB1, 0xEC, 0x71, 0x85, 0xCA, 0x4E, 0x07}, /* Master key 02 encrypted with Master key 03. */
+    {0x6E, 0x7D, 0x2D, 0xC3, 0x0F, 0x59, 0xC8, 0xFA, 0x87, 0xA8, 0x2E, 0xD5, 0x89, 0x5E, 0xF3, 0xE9}, /* Master key 03 encrypted with Master key 04. */
+    {0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE}, /* Master key 04 encrypted with Master key 05. */
+    {0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */
+    {0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F}, /* Master key 06 encrypted with Master key 07. */
+    {0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29}, /* Master key 07 encrypted with Master key 08. */
+};
+
+//======================================Keys======================================//
+// from Package1 -> Secure_Monitor
+static const u8 aes_kek_generation_source[0x10] = {
+    0x4D, 0x87, 0x09, 0x86, 0xC4, 0x5D, 0x20, 0x72, 0x2F, 0xBA, 0x10, 0x53, 0xDA, 0x92, 0xE8, 0xA9};
+static const u8 aes_kek_seed_01[0x10] = {
+    0xA2, 0xAB, 0xBF, 0x9C, 0x92, 0x2F, 0xBB, 0xE3, 0x78, 0x79, 0x9B, 0xC0, 0xCC, 0xEA, 0xA5, 0x74};
+static const u8 aes_kek_seed_03[0x10] = {
+    0xE5, 0x4D, 0x9A, 0x02, 0xF0, 0x4F, 0x5F, 0xA8, 0xAD, 0x76, 0x0A, 0xF6, 0x32, 0x95, 0x59, 0xBB};
+static const u8 package2_key_source[0x10] = {
+    0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7};
+static const u8 titlekek_source[0x10] = {
+    0x1E, 0xDC, 0x7B, 0x3B, 0x60, 0xE6, 0xB4, 0xD8, 0x78, 0xB8, 0x17, 0x15, 0x98, 0x5E, 0x62, 0x9B};
+static const u8 retail_specific_aes_key_source[0x10] = {
+    0xE2, 0xD6, 0xB8, 0x7A, 0x11, 0x9C, 0xB8, 0x80, 0xE8, 0x22, 0x88, 0x8A, 0x46, 0xFB, 0xA1, 0x95};
+
+// from Package1ldr (or Secure_Monitor on 6.2.0)
+static const u8 keyblob_mac_key_source[0x10] = {
+    0x59, 0xC7, 0xFB, 0x6F, 0xBE, 0x9B, 0xBE, 0x87, 0x65, 0x6B, 0x15, 0xC0, 0x53, 0x73, 0x36, 0xA5};
+static const u8 master_key_source[0x10] = {
+    0xD8, 0xA2, 0x41, 0x0A, 0xC6, 0xC5, 0x90, 0x01, 0xC6, 0x1D, 0x6A, 0x26, 0x7C, 0x51, 0x3F, 0x3C};
+static const u8 per_console_key_source[0x10] = {
+    0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78};
+
+// from SPL
+static const u8 aes_key_generation_source[0x10] = {
+    0x89, 0x61, 0x5E, 0xE0, 0x5C, 0x31, 0xB6, 0x80, 0x5F, 0xE5, 0x8F, 0x3D, 0xA2, 0x4F, 0x7A, 0xA8};
+
+// from FS
+static const u8 bis_kek_source[0x10] = {
+    0x34, 0xC1, 0xA0, 0xC4, 0x82, 0x58, 0xF8, 0xB4, 0xFA, 0x9E, 0x5E, 0x6A, 0xDA, 0xFC, 0x7E, 0x4F};
+static const u8 bis_key_source[3][0x20] = {
+    {
+        0xF8, 0x3F, 0x38, 0x6E, 0x2C, 0xD2, 0xCA, 0x32, 0xA8, 0x9A, 0xB9, 0xAA, 0x29, 0xBF, 0xC7, 0x48,
+        0x7D, 0x92, 0xB0, 0x3A, 0xA8, 0xBF, 0xDE, 0xE1, 0xA7, 0x4C, 0x3B, 0x6E, 0x35, 0xCB, 0x71, 0x06},
+    {
+        0x41, 0x00, 0x30, 0x49, 0xDD, 0xCC, 0xC0, 0x65, 0x64, 0x7A, 0x7E, 0xB4, 0x1E, 0xED, 0x9C, 0x5F,
+        0x44, 0x42, 0x4E, 0xDA, 0xB4, 0x9D, 0xFC, 0xD9, 0x87, 0x77, 0x24, 0x9A, 0xDC, 0x9F, 0x7C, 0xA4},
+    {
+        0x52, 0xC2, 0xE9, 0xEB, 0x09, 0xE3, 0xEE, 0x29, 0x32, 0xA1, 0x0C, 0x1F, 0xB6, 0xA0, 0x92, 0x6C,
+        0x4D, 0x12, 0xE1, 0x4B, 0x2A, 0x47, 0x4C, 0x1C, 0x09, 0xCB, 0x03, 0x59, 0xF0, 0x15, 0xF4, 0xE4}
+};
+
+static const u8 fs_hashes_sha256[10][0x20] = {
+    { // header_kek_source
+        0x18, 0x88, 0xca, 0xed, 0x55, 0x51, 0xb3, 0xed, 0xe0, 0x14, 0x99, 0xe8, 0x7c, 0xe0, 0xd8, 0x68,
+        0x27, 0xf8, 0x08, 0x20, 0xef, 0xb2, 0x75, 0x92, 0x10, 0x55, 0xaa, 0x4e, 0x2a, 0xbd, 0xff, 0xc2},
+    { // header_key_source
+        0x8f, 0x78, 0x3e, 0x46, 0x85, 0x2d, 0xf6, 0xbe, 0x0b, 0xa4, 0xe1, 0x92, 0x73, 0xc4, 0xad, 0xba,
+        0xee, 0x16, 0x38, 0x00, 0x43, 0xe1, 0xb8, 0xc4, 0x18, 0xc4, 0x08, 0x9a, 0x8b, 0xd6, 0x4a, 0xa6},
+    { // key_area_key_application_source
+        0x04, 0xad, 0x66, 0x14, 0x3c, 0x72, 0x6b, 0x2a, 0x13, 0x9f, 0xb6, 0xb2, 0x11, 0x28, 0xb4, 0x6f,
+        0x56, 0xc5, 0x53, 0xb2, 0xb3, 0x88, 0x71, 0x10, 0x30, 0x42, 0x98, 0xd8, 0xd0, 0x09, 0x2d, 0x9e},
+    { // key_area_key_ocean_source
+        0xfd, 0x43, 0x40, 0x00, 0xc8, 0xff, 0x2b, 0x26, 0xf8, 0xe9, 0xa9, 0xd2, 0xd2, 0xc1, 0x2f, 0x6b,
+        0xe5, 0x77, 0x3c, 0xbb, 0x9d, 0xc8, 0x63, 0x00, 0xe1, 0xbd, 0x99, 0xf8, 0xea, 0x33, 0xa4, 0x17},
+    { // key_area_key_system_source
+        0x1f, 0x17, 0xb1, 0xfd, 0x51, 0xad, 0x1c, 0x23, 0x79, 0xb5, 0x8f, 0x15, 0x2c, 0xa4, 0x91, 0x2e,
+        0xc2, 0x10, 0x64, 0x41, 0xe5, 0x17, 0x22, 0xf3, 0x87, 0x00, 0xd5, 0x93, 0x7a, 0x11, 0x62, 0xf7},
+    { // save_mac_kek_source
+        0x3D, 0xCB, 0xA1, 0x00, 0xAD, 0x4D, 0xF1, 0x54, 0x7F, 0xE3, 0xC4, 0x79, 0x5C, 0x4B, 0x22, 0x8A,
+        0xA9, 0x80, 0x38, 0xF0, 0x7A, 0x36, 0xF1, 0xBC, 0x14, 0x8E, 0xEA, 0xF3, 0xDC, 0xD7, 0x50, 0xF4},
+    { // save_mac_key_source
+        0xB4, 0x7B, 0x60, 0x0B, 0x1A, 0xD3, 0x14, 0xF9, 0x41, 0x14, 0x7D, 0x8B, 0x39, 0x1D, 0x4B, 0x19,
+        0x87, 0xCC, 0x8C, 0x88, 0x4A, 0xC8, 0x9F, 0xFC, 0x91, 0xCA, 0xE2, 0x21, 0xC5, 0x24, 0x51, 0xF7},
+    { // sd_card_kek_source
+        0x6B, 0x2E, 0xD8, 0x77, 0xC2, 0xC5, 0x23, 0x34, 0xAC, 0x51, 0xE5, 0x9A, 0xBF, 0xA7, 0xEC, 0x45,
+        0x7F, 0x4A, 0x7D, 0x01, 0xE4, 0x62, 0x91, 0xE9, 0xF2, 0xEA, 0xA4, 0x5F, 0x01, 0x1D, 0x24, 0xB7},
+    { // sd_card_nca_key_source
+        0x2E, 0x75, 0x1C, 0xEC, 0xF7, 0xD9, 0x3A, 0x2B, 0x95, 0x7B, 0xD5, 0xFF, 0xCB, 0x08, 0x2F, 0xD0,
+        0x38, 0xCC, 0x28, 0x53, 0x21, 0x9D, 0xD3, 0x09, 0x2C, 0x6D, 0xAB, 0x98, 0x38, 0xF5, 0xA7, 0xCC},
+    { // sd_card_save_key_source
+        0xD4, 0x82, 0x74, 0x35, 0x63, 0xD3, 0xEA, 0x5D, 0xCD, 0xC3, 0xB7, 0x4E, 0x97, 0xC9, 0xAC, 0x8A,
+        0x34, 0x21, 0x64, 0xFA, 0x04, 0x1A, 0x1D, 0xC8, 0x0F, 0x17, 0xF6, 0xD3, 0x1E, 0x4B, 0xC0, 0x1C}
+};
+
+static const u8 es_hashes_sha256[3][0x20] = {
+    { // eticket_rsa_kek
+        0xB7, 0x1D, 0xB2, 0x71, 0xDC, 0x33, 0x8D, 0xF3, 0x80, 0xAA, 0x2C, 0x43, 0x35, 0xEF, 0x88, 0x73,
+        0xB1, 0xAF, 0xD4, 0x08, 0xE8, 0x0B, 0x35, 0x82, 0xD8, 0x71, 0x9F, 0xC8, 0x1C, 0x5E, 0x51, 0x1C},
+    { // eticket_rsa_kekek
+        0xE8, 0x96, 0x5A, 0x18, 0x7D, 0x30, 0xE5, 0x78, 0x69, 0xF5, 0x62, 0xD0, 0x43, 0x83, 0xC9, 0x96,
+        0xDE, 0x48, 0x7B, 0xBA, 0x57, 0x61, 0x36, 0x3D, 0x2D, 0x4D, 0x32, 0x39, 0x18, 0x66, 0xA8, 0x5C},
+    { // ssl_rsa_kek_source_x
+        0x69, 0xA0, 0x8E, 0x62, 0xE0, 0xAE, 0x50, 0x7B, 0xB5, 0xDA, 0x0E, 0x65, 0x17, 0x9A, 0xE3, 0xBE,
+        0x05, 0x1F, 0xED, 0x3C, 0x49, 0x94, 0x1D, 0xF4, 0xEF, 0x29, 0x56, 0xD3, 0x6D, 0x30, 0x11, 0x0C}
+};
+
+static const u8 ssl_hashes_sha256[2][0x20] = {
+    { // ssl_rsa_kek_source_x
+        0x69, 0xA0, 0x8E, 0x62, 0xE0, 0xAE, 0x50, 0x7B, 0xB5, 0xDA, 0x0E, 0x65, 0x17, 0x9A, 0xE3, 0xBE,
+        0x05, 0x1F, 0xED, 0x3C, 0x49, 0x94, 0x1D, 0xF4, 0xEF, 0x29, 0x56, 0xD3, 0x6D, 0x30, 0x11, 0x0C},
+    { // ssl_rsa_kek_source_y
+        0x1C, 0x86, 0xF3, 0x63, 0x26, 0x54, 0x17, 0xD4, 0x99, 0x22, 0x9E, 0xB1, 0xC4, 0xAD, 0xC7, 0x47,
+        0x9B, 0x2A, 0x15, 0xF9, 0x31, 0x26, 0x1F, 0x31, 0xEE, 0x67, 0x76, 0xAE, 0xB4, 0xC7, 0x65, 0x42}
+};
--- a/source/keys/keys.c
+++ b/source/keys/keys.c
@ -34,18 +34,16 @@
 #include "../storage/sdmmc.h"
 #include "../utils/btn.h"
 #include "../utils/list.h"
+#include "../utils/sprintf.h"
 #include "../utils/util.h"

+#include "key_sources.inl"
+
 #include <string.h>
-#include <stdarg.h>

 extern bool sd_mount();
 extern void sd_unmount();
-extern void *sd_file_read(char *path);
 extern int  sd_save_to_file(void *buf, u32 size, const char *filename);
-extern void power_off();
-extern void reboot_normal();
-extern void reboot_rcm();

 u32 _key_count = 0;
 sdmmc_storage_t storage;
@ -57,132 +55,8 @@ emmc_part_t *system_part;
 #define TPRINTFARGS(text, args...) \
    end_time = get_tmr_ms(); \
    gfx_printf(text" done @ %d.%03ds\n", args, (end_time - start_time) / 1000, (end_time - start_time) % 1000)
-#define SAVE_KEY(name, src, len) _save_key(name, src, len, text_buffer, &buf_index)
-#define SAVE_KEY_FAMILY(name, src, count, len) _save_key_family(name, src, count, len, text_buffer, &buf_index)
-
-static const u8 zeros[0x10] = {0};
-
-static const u8 keyblob_key_source[][0x10] = {
-    {0xDF, 0x20, 0x6F, 0x59, 0x44, 0x54, 0xEF, 0xDC, 0x70, 0x74, 0x48, 0x3B, 0x0D, 0xED, 0x9F, 0xD3}, //1.0.0
-    {0x0C, 0x25, 0x61, 0x5D, 0x68, 0x4C, 0xEB, 0x42, 0x1C, 0x23, 0x79, 0xEA, 0x82, 0x25, 0x12, 0xAC}, //3.0.0
-    {0x33, 0x76, 0x85, 0xEE, 0x88, 0x4A, 0xAE, 0x0A, 0xC2, 0x8A, 0xFD, 0x7D, 0x63, 0xC0, 0x43, 0x3B}, //3.0.1
-    {0x2D, 0x1F, 0x48, 0x80, 0xED, 0xEC, 0xED, 0x3E, 0x3C, 0xF2, 0x48, 0xB5, 0x65, 0x7D, 0xF7, 0xBE}, //4.0.0
-    {0xBB, 0x5A, 0x01, 0xF9, 0x88, 0xAF, 0xF5, 0xFC, 0x6C, 0xFF, 0x07, 0x9E, 0x13, 0x3C, 0x39, 0x80}, //5.0.0
-    {0xD8, 0xCC, 0xE1, 0x26, 0x6A, 0x35, 0x3F, 0xCC, 0x20, 0xF3, 0x2D, 0x3B, 0x51, 0x7D, 0xE9, 0xC0}  //6.0.0
-};
-
-static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600][0x10] = {
-    {0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A},
-    {0x9A, 0x3E, 0xA9, 0xAB, 0xFD, 0x56, 0x46, 0x1C, 0x9B, 0xF6, 0x48, 0x7F, 0x5C, 0xFA, 0x09, 0x5C}
-};
-
-static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] =
-{
-    {0x0C, 0xF0, 0x59, 0xAC, 0x85, 0xF6, 0x26, 0x65, 0xE1, 0xE9, 0x19, 0x55, 0xE6, 0xF2, 0x67, 0x3D}, /* Zeroes encrypted with Master Key 00. */
-    {0x29, 0x4C, 0x04, 0xC8, 0xEB, 0x10, 0xED, 0x9D, 0x51, 0x64, 0x97, 0xFB, 0xF3, 0x4D, 0x50, 0xDD}, /* Master key 00 encrypted with Master key 01. */
-    {0xDE, 0xCF, 0xEB, 0xEB, 0x10, 0xAE, 0x74, 0xD8, 0xAD, 0x7C, 0xF4, 0x9E, 0x62, 0xE0, 0xE8, 0x72}, /* Master key 01 encrypted with Master key 02. */
-    {0x0A, 0x0D, 0xDF, 0x34, 0x22, 0x06, 0x6C, 0xA4, 0xE6, 0xB1, 0xEC, 0x71, 0x85, 0xCA, 0x4E, 0x07}, /* Master key 02 encrypted with Master key 03. */
-    {0x6E, 0x7D, 0x2D, 0xC3, 0x0F, 0x59, 0xC8, 0xFA, 0x87, 0xA8, 0x2E, 0xD5, 0x89, 0x5E, 0xF3, 0xE9}, /* Master key 03 encrypted with Master key 04. */
-    {0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE}, /* Master key 04 encrypted with Master key 05. */
-    {0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */
-    {0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F}, /* Master key 06 encrypted with Master key 07. */
-};
-
-//======================================Keys======================================//
-// from Package1 -> Secure_Monitor
-static const u8 aes_kek_generation_source[0x10] = {
-    0x4D, 0x87, 0x09, 0x86, 0xC4, 0x5D, 0x20, 0x72, 0x2F, 0xBA, 0x10, 0x53, 0xDA, 0x92, 0xE8, 0xA9};
-static const u8 aes_kek_seed_01[0x10] = {
-    0xA2, 0xAB, 0xBF, 0x9C, 0x92, 0x2F, 0xBB, 0xE3, 0x78, 0x79, 0x9B, 0xC0, 0xCC, 0xEA, 0xA5, 0x74};
-static const u8 aes_kek_seed_03[0x10] = {
-    0xE5, 0x4D, 0x9A, 0x02, 0xF0, 0x4F, 0x5F, 0xA8, 0xAD, 0x76, 0x0A, 0xF6, 0x32, 0x95, 0x59, 0xBB};
-static const u8 package2_key_source[0x10] = {
-    0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7};
-static const u8 titlekek_source[0x10] = {
-    0x1E, 0xDC, 0x7B, 0x3B, 0x60, 0xE6, 0xB4, 0xD8, 0x78, 0xB8, 0x17, 0x15, 0x98, 0x5E, 0x62, 0x9B};
-static const u8 retail_specific_aes_key_source[0x10] = {
-    0xE2, 0xD6, 0xB8, 0x7A, 0x11, 0x9C, 0xB8, 0x80, 0xE8, 0x22, 0x88, 0x8A, 0x46, 0xFB, 0xA1, 0x95};
-
-// from Package1ldr (or Secure_Monitor on 6.2.0)
-static const u8 keyblob_mac_key_source[0x10] = {
-    0x59, 0xC7, 0xFB, 0x6F, 0xBE, 0x9B, 0xBE, 0x87, 0x65, 0x6B, 0x15, 0xC0, 0x53, 0x73, 0x36, 0xA5};
-static const u8 master_key_source[0x10] = {
-    0xD8, 0xA2, 0x41, 0x0A, 0xC6, 0xC5, 0x90, 0x01, 0xC6, 0x1D, 0x6A, 0x26, 0x7C, 0x51, 0x3F, 0x3C};
-static const u8 per_console_key_source[0x10] = {
-    0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78};
-
-// from SPL
-static const u8 aes_key_generation_source[0x10] = {
-    0x89, 0x61, 0x5E, 0xE0, 0x5C, 0x31, 0xB6, 0x80, 0x5F, 0xE5, 0x8F, 0x3D, 0xA2, 0x4F, 0x7A, 0xA8};
-
-// from FS
-static const u8 bis_kek_source[0x10] = {
-    0x34, 0xC1, 0xA0, 0xC4, 0x82, 0x58, 0xF8, 0xB4, 0xFA, 0x9E, 0x5E, 0x6A, 0xDA, 0xFC, 0x7E, 0x4F};
-static const u8 bis_key_source[3][0x20] = {
-    {
-        0xF8, 0x3F, 0x38, 0x6E, 0x2C, 0xD2, 0xCA, 0x32, 0xA8, 0x9A, 0xB9, 0xAA, 0x29, 0xBF, 0xC7, 0x48,
-        0x7D, 0x92, 0xB0, 0x3A, 0xA8, 0xBF, 0xDE, 0xE1, 0xA7, 0x4C, 0x3B, 0x6E, 0x35, 0xCB, 0x71, 0x06},
-    {
-        0x41, 0x00, 0x30, 0x49, 0xDD, 0xCC, 0xC0, 0x65, 0x64, 0x7A, 0x7E, 0xB4, 0x1E, 0xED, 0x9C, 0x5F,
-        0x44, 0x42, 0x4E, 0xDA, 0xB4, 0x9D, 0xFC, 0xD9, 0x87, 0x77, 0x24, 0x9A, 0xDC, 0x9F, 0x7C, 0xA4},
-    {
-        0x52, 0xC2, 0xE9, 0xEB, 0x09, 0xE3, 0xEE, 0x29, 0x32, 0xA1, 0x0C, 0x1F, 0xB6, 0xA0, 0x92, 0x6C,
-        0x4D, 0x12, 0xE1, 0x4B, 0x2A, 0x47, 0x4C, 0x1C, 0x09, 0xCB, 0x03, 0x59, 0xF0, 0x15, 0xF4, 0xE4}
-};
-
-static const u8 fs_hashes_sha256[10][0x20] = {
-    { // header_kek_source
-        0x18, 0x88, 0xca, 0xed, 0x55, 0x51, 0xb3, 0xed, 0xe0, 0x14, 0x99, 0xe8, 0x7c, 0xe0, 0xd8, 0x68,
-        0x27, 0xf8, 0x08, 0x20, 0xef, 0xb2, 0x75, 0x92, 0x10, 0x55, 0xaa, 0x4e, 0x2a, 0xbd, 0xff, 0xc2},
-    { // header_key_source
-        0x8f, 0x78, 0x3e, 0x46, 0x85, 0x2d, 0xf6, 0xbe, 0x0b, 0xa4, 0xe1, 0x92, 0x73, 0xc4, 0xad, 0xba,
-        0xee, 0x16, 0x38, 0x00, 0x43, 0xe1, 0xb8, 0xc4, 0x18, 0xc4, 0x08, 0x9a, 0x8b, 0xd6, 0x4a, 0xa6},
-    { // key_area_key_application_source
-        0x04, 0xad, 0x66, 0x14, 0x3c, 0x72, 0x6b, 0x2a, 0x13, 0x9f, 0xb6, 0xb2, 0x11, 0x28, 0xb4, 0x6f,
-        0x56, 0xc5, 0x53, 0xb2, 0xb3, 0x88, 0x71, 0x10, 0x30, 0x42, 0x98, 0xd8, 0xd0, 0x09, 0x2d, 0x9e},
-    { // key_area_key_ocean_source
-        0xfd, 0x43, 0x40, 0x00, 0xc8, 0xff, 0x2b, 0x26, 0xf8, 0xe9, 0xa9, 0xd2, 0xd2, 0xc1, 0x2f, 0x6b,
-        0xe5, 0x77, 0x3c, 0xbb, 0x9d, 0xc8, 0x63, 0x00, 0xe1, 0xbd, 0x99, 0xf8, 0xea, 0x33, 0xa4, 0x17},
-    { // key_area_key_system_source
-        0x1f, 0x17, 0xb1, 0xfd, 0x51, 0xad, 0x1c, 0x23, 0x79, 0xb5, 0x8f, 0x15, 0x2c, 0xa4, 0x91, 0x2e,
-        0xc2, 0x10, 0x64, 0x41, 0xe5, 0x17, 0x22, 0xf3, 0x87, 0x00, 0xd5, 0x93, 0x7a, 0x11, 0x62, 0xf7},
-    { // save_mac_kek_source
-        0x3D, 0xCB, 0xA1, 0x00, 0xAD, 0x4D, 0xF1, 0x54, 0x7F, 0xE3, 0xC4, 0x79, 0x5C, 0x4B, 0x22, 0x8A,
-        0xA9, 0x80, 0x38, 0xF0, 0x7A, 0x36, 0xF1, 0xBC, 0x14, 0x8E, 0xEA, 0xF3, 0xDC, 0xD7, 0x50, 0xF4},
-    { // save_mac_key_source
-        0xB4, 0x7B, 0x60, 0x0B, 0x1A, 0xD3, 0x14, 0xF9, 0x41, 0x14, 0x7D, 0x8B, 0x39, 0x1D, 0x4B, 0x19,
-        0x87, 0xCC, 0x8C, 0x88, 0x4A, 0xC8, 0x9F, 0xFC, 0x91, 0xCA, 0xE2, 0x21, 0xC5, 0x24, 0x51, 0xF7},
-    { // sd_card_kek_source
-        0x6B, 0x2E, 0xD8, 0x77, 0xC2, 0xC5, 0x23, 0x34, 0xAC, 0x51, 0xE5, 0x9A, 0xBF, 0xA7, 0xEC, 0x45,
-        0x7F, 0x4A, 0x7D, 0x01, 0xE4, 0x62, 0x91, 0xE9, 0xF2, 0xEA, 0xA4, 0x5F, 0x01, 0x1D, 0x24, 0xB7},
-    { // sd_card_nca_key_source
-        0x2E, 0x75, 0x1C, 0xEC, 0xF7, 0xD9, 0x3A, 0x2B, 0x95, 0x7B, 0xD5, 0xFF, 0xCB, 0x08, 0x2F, 0xD0,
-        0x38, 0xCC, 0x28, 0x53, 0x21, 0x9D, 0xD3, 0x09, 0x2C, 0x6D, 0xAB, 0x98, 0x38, 0xF5, 0xA7, 0xCC},
-    { // sd_card_save_key_source
-        0xD4, 0x82, 0x74, 0x35, 0x63, 0xD3, 0xEA, 0x5D, 0xCD, 0xC3, 0xB7, 0x4E, 0x97, 0xC9, 0xAC, 0x8A,
-        0x34, 0x21, 0x64, 0xFA, 0x04, 0x1A, 0x1D, 0xC8, 0x0F, 0x17, 0xF6, 0xD3, 0x1E, 0x4B, 0xC0, 0x1C}
-};
-
-static const u8 es_hashes_sha256[3][0x20] = {
-    { // eticket_rsa_kek
-        0xB7, 0x1D, 0xB2, 0x71, 0xDC, 0x33, 0x8D, 0xF3, 0x80, 0xAA, 0x2C, 0x43, 0x35, 0xEF, 0x88, 0x73,
-        0xB1, 0xAF, 0xD4, 0x08, 0xE8, 0x0B, 0x35, 0x82, 0xD8, 0x71, 0x9F, 0xC8, 0x1C, 0x5E, 0x51, 0x1C},
-    { // eticket_rsa_kekek
-        0xE8, 0x96, 0x5A, 0x18, 0x7D, 0x30, 0xE5, 0x78, 0x69, 0xF5, 0x62, 0xD0, 0x43, 0x83, 0xC9, 0x96,
-        0xDE, 0x48, 0x7B, 0xBA, 0x57, 0x61, 0x36, 0x3D, 0x2D, 0x4D, 0x32, 0x39, 0x18, 0x66, 0xA8, 0x5C},
-    { // ssl_rsa_kek_source_x
-        0x69, 0xA0, 0x8E, 0x62, 0xE0, 0xAE, 0x50, 0x7B, 0xB5, 0xDA, 0x0E, 0x65, 0x17, 0x9A, 0xE3, 0xBE,
-        0x05, 0x1F, 0xED, 0x3C, 0x49, 0x94, 0x1D, 0xF4, 0xEF, 0x29, 0x56, 0xD3, 0x6D, 0x30, 0x11, 0x0C}
-};
-
-static const u8 ssl_hashes_sha256[2][0x20] = {
-    { // ssl_rsa_kek_source_x
-        0x69, 0xA0, 0x8E, 0x62, 0xE0, 0xAE, 0x50, 0x7B, 0xB5, 0xDA, 0x0E, 0x65, 0x17, 0x9A, 0xE3, 0xBE,
-        0x05, 0x1F, 0xED, 0x3C, 0x49, 0x94, 0x1D, 0xF4, 0xEF, 0x29, 0x56, 0xD3, 0x6D, 0x30, 0x11, 0x0C},
-    { // ssl_rsa_kek_source_y
-        0x1C, 0x86, 0xF3, 0x63, 0x26, 0x54, 0x17, 0xD4, 0x99, 0x22, 0x9E, 0xB1, 0xC4, 0xAD, 0xC7, 0x47,
-        0x9B, 0x2A, 0x15, 0xF9, 0x31, 0x26, 0x1F, 0x31, 0xEE, 0x67, 0x76, 0xAE, 0xB4, 0xC7, 0x65, 0x42}
-};
+#define SAVE_KEY(name, src, len) _save_key(name, src, len, text_buffer)
+#define SAVE_KEY_FAMILY(name, src, count, len) _save_key_family(name, src, count, len, text_buffer)

 static u8 temp_key[0x10],
          bis_key[4][0x20] = {0},
@ -213,22 +87,17 @@ static const u32 colors[6] = {COLOR_RED, COLOR_ORANGE, COLOR_YELLOW, COLOR_GREEN

 // key functions
 static bool   _key_exists(const void *data) { return memcmp(data, zeros, 0x10); };
-static void   _save_key(const char *name, const void *data, const u32 len, char *outbuf, u32 *buf_index);
-static void   _save_key_family(const char *name, const void *data, const u32 num_keys, const u32 len, char *outbuf, u32 *buf_index);
+static void   _save_key(const char *name, const void *data, const u32 len, char *outbuf);
+static void   _save_key_family(const char *name, const void *data, const u32 num_keys, const u32 len, char *outbuf);
 static void   _generate_kek(u32 ks, const void *key_source, void *master_key, const void *kek_seed, const void *key_seed);
 // nca functions
 static void  *_nca_process(u32 hk_ks1, u32 hk_ks2, FIL *fp, u32 key_offset, u32 len);
 static u32    _nca_fread_ctr(u32 ks, FIL *fp, void *buffer, u32 offset, u32 len, u8 *ctr);
 static void   _update_ctr(u8 *ctr, u32 ofs);
-// output functions
-static void _putc(char *buffer, const char c);
-static u32  _puts(char *buffer, const char *s);
-static u32  _putn(char *buffer, u32 v, int base, char fill, int fcnt);
-static u32  _sprintf(char *buffer, const char *fmt, ...);

 void dump_keys() {
    display_backlight_brightness(100, 1000);
-    gfx_clear_partial_grey(0x1B, 0, 1280);
+    gfx_clear_grey(0x1B);
    gfx_con_setpos(0, 0);

    gfx_printf("[%kLo%kck%kpi%kck%k-R%kCM%k v%d.%d.%d%k]\n\n",
@ -253,6 +122,23 @@ void dump_keys() {
        goto out_wait;
    }

+    bool found_tsec_fw = false;
+    for (const u32 *pos = (const u32 *)pkg1; (u8 *)pos < pkg1 + 0x40000; pos += 0x100 / sizeof(u32)) {
+        if (*pos == 0xCF42004D) {
+            tsec_ctxt.fw = (u8 *)pos;
+            found_tsec_fw = true;
+            break;
+        }
+    }
+    if (!found_tsec_fw) {
+        EPRINTF("Failed to locate TSEC firmware.");
+        goto out_wait;
+    }
+
+    tsec_key_data_t *key_data = (tsec_key_data_t *)(tsec_ctxt.fw + TSEC_KEY_DATA_ADDR);
+    tsec_ctxt.pkg1 = pkg1;
+    tsec_ctxt.size = 0x100 + key_data->blob0_size + key_data->blob1_size + key_data->blob2_size + key_data->blob3_size + key_data->blob4_size;
+
    u32 MAX_KEY = 6;
    if (pkg1_id->kb >= KB_FIRMWARE_VERSION_620)
        MAX_KEY = pkg1_id->kb + 1;
@ -267,8 +153,8 @@ void dump_keys() {
            // bundle lp0 fw for sept instead of loading it from SD as hekate does
            sdram_lp0_save_params(sdram_get_params_patched());
            FIL fp;
-            if (f_stat("sd:/sept/sept-primary.bin", NULL) || f_stat("sd:/sept/sept-secondary.enc", NULL)) {
-                EPRINTF("On firmware 7.x or higher but no sept payload present\nSkipping new key derivation...");
+            if (f_stat("sd:/sept", NULL)) {
+                EPRINTF("On firmware 7.x+ but Sept missing.\nSkipping new key derivation...");
                goto get_tsec;
            }
            // backup post-reboot payload
@ -282,7 +168,7 @@ void dump_keys() {
            gfx_printf("%kFirmware 7.x or higher detected.\n%kRenamed /sept/payload.bin", colors[0], colors[1]);
            gfx_printf("\n%k     to /sept/payload.bak\n%kCopied self to /sept/payload.bin",colors[2], colors[3]);
            sdmmc_storage_end(&storage);
-            if (!reboot_to_sept((u8 *)pkg1 + pkg1_id->tsec_off))
+            if (!reboot_to_sept((u8 *)tsec_ctxt.fw, tsec_ctxt.size, pkg1_id->kb))
                goto out_wait;
        } else {
            se_aes_key_read(12, master_key[pkg1_id->kb], 0x10);
@ -292,21 +178,6 @@ void dump_keys() {
 get_tsec: ;
    u8 tsec_keys[0x10 * 2] = {0};

-    tsec_ctxt.fw = (u8 *)pkg1 + pkg1_id->tsec_off;
-    tsec_ctxt.pkg1 = pkg1;
-    tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
-    tsec_ctxt.secmon_base = pkg1_id->secmon_base;
-
-    if (pkg1_id->kb <= KB_FIRMWARE_VERSION_600)
-        tsec_ctxt.size = 0xF00;
-    else if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
-        tsec_ctxt.size = 0x2900;
-    else {
-        tsec_ctxt.size = 0x3000;
-        // Exit after TSEC key generation.
-        *((vu16 *)((u32)tsec_ctxt.fw + 0x2DB5)) = 0x02F8;
-    }
-
    if (pkg1_id->kb == KB_FIRMWARE_VERSION_620) {
        u8 *tsec_paged = (u8 *)page_alloc(3);
        memcpy(tsec_paged, (void *)tsec_ctxt.fw, tsec_ctxt.size);
@ -410,10 +281,6 @@ get_tsec: ;
    // Dump package2.
    u8 *pkg2 = NULL;
    pkg2_kip1_info_t *ki = NULL;
-    if (!_key_exists(master_key[pkg1_id->kb])) {
-        EPRINTF("Current master key not found.\nUnable to decrypt Package2.");
-        goto pkg2_done;
-    }

    sdmmc_storage_set_mmc_partition(&storage, 0);
    // Parse eMMC GPT.
@ -443,14 +310,24 @@ get_tsec: ;
    pkg2 = malloc(pkg2_size_aligned);
    nx_emmc_part_read(&storage, pkg2_part, 0x4000 / NX_EMMC_BLOCKSIZE, pkg2_size_aligned / NX_EMMC_BLOCKSIZE, pkg2);

-    // Decrypt package2 and parse KIP1 blobs in INI1 section.
-    se_aes_key_set(8, master_key[pkg1_id->kb], 0x10);
-    se_aes_unwrap_key(8, 8, package2_key_source);
-    pkg2_hdr_t *pkg2_hdr = pkg2_decrypt(pkg2);
-    if (!pkg2_hdr) {
+    // Decrypt package2 and parse KIP1 blobs in INI1 section. Try all available key generations in case of pkg1/pkg2 mismatch.
+    pkg2_hdr_t *pkg2_hdr;
+    pkg2_hdr_t hdr;
+    u32 pkg2_kb;
+    for (pkg2_kb = 0; pkg2_kb < MAX_KEY; pkg2_kb++) {
+        se_aes_key_set(8, master_key[pkg2_kb], 0x10);
+        se_aes_unwrap_key(8, 8, package2_key_source);
+        memcpy(&hdr, pkg2 + 0x100, sizeof(pkg2_hdr_t));
+        se_aes_crypt_ctr(8, &hdr, sizeof(pkg2_hdr_t), &hdr, sizeof(pkg2_hdr_t), &hdr);
+        if (hdr.magic == PKG2_MAGIC)
+            break;
+    }
+    if (pkg2_kb == MAX_KEY) {
        EPRINTF("Failed to decrypt Package2.");
        goto pkg2_done;
-    }
+    } else if (pkg2_kb != pkg1_id->kb)
+        EPRINTF("Warning: Package1-Package2 mismatch.");
+    pkg2_hdr = pkg2_decrypt(pkg2);

    TPRINTFARGS("%kDecrypt pkg2... ", colors[2]);

@ -523,6 +400,7 @@ get_tsec: ;
            alignment = 8;
            break;
        case KB_FIRMWARE_VERSION_700:
+        case KB_FIRMWARE_VERSION_810:
            start_offset = 0x29c50;
            hks_offset_from_end -= 0x6a73;
            alignment = 8;
@ -605,7 +483,7 @@ pkg2_done:
        EPRINTF("Failed to locate System partition.");
        goto key_output;
    }
-    FATFS emmc_fs;
+    __attribute__ ((aligned (16))) FATFS emmc_fs;
    if (f_mount(&emmc_fs, "emmc:", 1)) {
        EPRINTF("Mount failed.");
        goto key_output;
@ -672,6 +550,7 @@ pkg2_done:
                start_offset = 0x5674;
                break;
            case KB_FIRMWARE_VERSION_700:
+            case KB_FIRMWARE_VERSION_810:
                start_offset = 0x5563;
                break;
            }
@ -722,6 +601,7 @@ pkg2_done:
                start_offset = 0x1d5be;
                break;
            case KB_FIRMWARE_VERSION_700:
+            case KB_FIRMWARE_VERSION_810:
                start_offset = 0x1d437;
                break;
            }
@ -753,25 +633,25 @@ pkg2_done:
    free(dec_header);

    if (f_open(&fp, "sd:/Nintendo/Contents/private", FA_READ | FA_OPEN_EXISTING)) {
-        EPRINTF("Failed to open SD seed verification file from SD.");
+        EPRINTF("Unable to locate SD seed. Skipping.");
        goto dismount;
    }
    // get sd seed verification vector
    if (f_read(&fp, temp_key, 0x10, &read_bytes) || read_bytes != 0x10) {
-        EPRINTF("Failed to read SD seed verification vector from SD.");
+        EPRINTF("Unable to locate SD seed. Skipping.");
        f_close(&fp);
        goto dismount;
    }
    f_close(&fp);

-    if (f_open(&fp, "emmc:/save/8000000000000043", FA_READ | FA_OPEN_EXISTING) || f_stat("emmc:/save/8000000000000043", &fno)) {
-        EPRINTF("Failed to open ns_appman save.");
+    if (f_open(&fp, "emmc:/save/8000000000000043", FA_READ | FA_OPEN_EXISTING)) {
+        EPRINTF("Failed to open ns_appman save.\nSkipping SD seed.");
        goto dismount;
    }

    // locate sd seed
    u8 read_buf[0x20] = {0};
-    for (u32 i = 0; i < fno.fsize; i += 0x4000) {
+    for (u32 i = 0; i < f_size(&fp); i += 0x4000) {
        if (f_lseek(&fp, i) || f_read(&fp, read_buf, 0x20, &read_bytes) || read_bytes != 0x20)
            break;
        if (!memcmp(temp_key, read_buf, 0x10)) {
@ -807,8 +687,7 @@ dismount:
    }

 key_output: ;
-    char *text_buffer = (char *)calloc(0x4000, 1);
-    u32 buf_index = 0;
+    __attribute__ ((aligned (16))) char text_buffer[0x3000] = {0};

    SAVE_KEY("aes_kek_generation_source", aes_kek_generation_source, 0x10);
    SAVE_KEY("aes_key_generation_source", aes_key_generation_source, 0x10);
@ -836,6 +715,7 @@ key_output: ;
    SAVE_KEY_FAMILY("master_kek", master_kek, MAX_KEY, 0x10);
    SAVE_KEY("master_kek_source_06", master_kek_sources[0], 0x10);
    SAVE_KEY("master_kek_source_07", master_kek_sources[1], 0x10);
+    SAVE_KEY("master_kek_source_08", master_kek_sources[2], 0x10);
    SAVE_KEY_FAMILY("master_key", master_key, MAX_KEY, 0x10);
    SAVE_KEY("master_key_source", master_key_source, 0x10);
    SAVE_KEY_FAMILY("package1_key", package1_key, 6, 0x10);
@ -871,16 +751,20 @@ key_output: ;
    TPRINTFARGS("\n%kFound %d keys.\n%kLockpick totally", colors[0], _key_count, colors[1]);

    f_mkdir("switch");
-    if (!sd_save_to_file(text_buffer, buf_index, "sd:/switch/prod.keys"))
-        gfx_printf("%kWrote %d bytes to /switch/prod.keys\n", colors[2], buf_index);
+    char keyfile_path[30] = "sd:/switch/";
+    if (!(fuse_read_odm(4) & 3))
+        sprintf(&keyfile_path[11], "prod.keys");
    else
+        sprintf(&keyfile_path[11], "dev.keys");
+    if (!sd_save_to_file(text_buffer, strlen(text_buffer), keyfile_path) && !f_stat(keyfile_path, &fno)) {
+        gfx_printf("%kWrote %d bytes to %s\n", colors[2], (u32)fno.fsize, keyfile_path);
+    } else
        EPRINTF("Failed to save keys to SD.");
    sd_unmount();
-    free(text_buffer);

+out_wait:
    gfx_printf("\n%kVOL + -> Reboot to RCM\n%kVOL - -> Reboot normally\n%kPower -> Power off", colors[3], colors[4], colors[5]);

-out_wait: ;
    u32 btn = btn_wait();
    if (btn & BTN_VOL_UP)
        reboot_rcm();
@ -890,21 +774,22 @@ out_wait: ;
        power_off();
 }

-static void _save_key(const char *name, const void *data, const u32 len, char *outbuf, u32 *buf_index) {
+static void _save_key(const char *name, const void *data, const u32 len, char *outbuf) {
    if (!_key_exists(data))
        return;
-    *buf_index += _sprintf(outbuf + *buf_index, "%s = ", name);
+    u32 pos = strlen(outbuf);
+    pos += sprintf(&outbuf[pos], "%s = ", name);
    for (u32 i = 0; i < len; i++)
-        *buf_index += _sprintf(outbuf + *buf_index, "%02x", *(u8*)(data + i));
-    *buf_index += _sprintf(outbuf + *buf_index, "\n");
+        pos += sprintf(&outbuf[pos], "%02x", *(u8*)(data + i));
+    sprintf(&outbuf[pos], "\n");
    _key_count++;
 }

-static void _save_key_family(const char *name, const void *data, const u32 num_keys, const u32 len, char *outbuf, u32 *buf_index) {
+static void _save_key_family(const char *name, const void *data, const u32 num_keys, const u32 len, char *outbuf) {
    char temp_name[0x40] = {0};
    for (u32 i = 0; i < num_keys; i++) {
-        _sprintf(temp_name, "%s_%02x", name, i);
-        _save_key(temp_name, data + i * len, len, outbuf, buf_index);
+        sprintf(temp_name, "%s_%02x", name, i);
+        _save_key(temp_name, data + i * len, len, outbuf);
    }
 }

@ -984,105 +869,3 @@ static void _update_ctr(u8 *ctr, u32 ofs) {
    for (u32 i = 0; i < 4; i++, ofs >>= 8)
        ctr[0x10-i-1] = (u8)(ofs & 0xff);
 }
-
-static void _putc(char *buffer, const char c) {
-    *buffer = c;
-}
-
-static u32 _puts(char *buffer, const char *s) {
-    u32 count = 0;
-    for (; *s; s++, count++)
-        _putc(buffer + count, *s);
-    return count;
-}
-
-static u32 _putn(char *buffer, u32 v, int base, char fill, int fcnt) {
-    char buf[0x121];
-    static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
-    char *p;
-    int c = fcnt;
-
-    if (base > 36)
-        return 0;
-
-    p = buf + 0x120;
-    *p = 0;
-    do {
-        c--;
-        *--p = digits[v % base];
-        v /= base;
-    } while (v);
-
-    if (fill != 0) {
-        while (c > 0) {
-            *--p = fill;
-            c--;
-        }
-    }
-
-    return _puts(buffer, p);
-}
-
-static u32 _sprintf(char *buffer, const char *fmt, ...) {
-    va_list ap;
-    int fill, fcnt;
-    u32 count = 0;
-
-    va_start(ap, fmt);
-    while(*fmt) {
-        if (*fmt == '%') {
-            fmt++;
-            fill = 0;
-            fcnt = 0;
-            if ((*fmt >= '0' && *fmt <= '9') || *fmt == ' ') {
-                fcnt = *fmt;
-                fmt++;
-                if (*fmt >= '0' && *fmt <= '9') {
-                    fill = fcnt;
-                    fcnt = *fmt - '0';
-                    fmt++;
-                } else {
-                    fill = ' ';
-                    fcnt -= '0';
-                }
-            }
-            switch (*fmt) {
-            case 'c':
-                _putc(buffer + count, va_arg(ap, u32));
-                count++;
-                break;
-            case 's':
-                count += _puts(buffer + count, va_arg(ap, char *));
-                break;
-            case 'd':
-                count += _putn(buffer + count, va_arg(ap, u32), 10, fill, fcnt);
-                break;
-            case 'p':
-            case 'P':
-            case 'x':
-            case 'X':
-                count += _putn(buffer + count, va_arg(ap, u32), 16, fill, fcnt);
-                break;
-            case '%':
-                _putc(buffer + count, '%');
-                count++;
-                break;
-            case '\0':
-                goto out;
-            default:
-                _putc(buffer + count, '%');
-                _putc(buffer + count, *fmt);
-                count += 2;
-                break;
-            }
-        } else {
-            _putc(buffer + count, *fmt);
-            count++;
-        }
-        fmt++;
-    }
-
-    out:
-    va_end(ap);
-    return count;
-}
--- a/source/keys/keys.h
+++ b/source/keys/keys.h
@ -1,3 +1,19 @@
+/*
+ * Copyright (c) 2019 shchmue
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
 #ifndef _KEYS_H_
 #define _KEYS_H_

--- a/source/libs/fatfs/diskio.c
+++ b/source/libs/fatfs/diskio.c
@ -25,7 +25,6 @@

 #include <string.h>
 #include "diskio.h"		/* FatFs lower layer API */
-#include "../../gfx/gfx.h"
 #include "../../mem/heap.h"
 #include "../../sec/se.h"
 #include "../../storage/nx_emmc.h"
@ -38,10 +37,6 @@ extern sdmmc_storage_t sd_storage;
 extern sdmmc_storage_t storage;
 extern emmc_part_t *system_part;

-typedef struct {
-	u64 b, a;
-} le128;
-
 typedef struct {
    u32 sector;
    u32 visit_count;
@ -54,14 +49,14 @@ static sector_cache_t *sector_cache = (sector_cache_t*)0x40020000;
 static u32 secindex = 0;

 DSTATUS disk_status (
-    BYTE pdrv /* Physical drive nmuber to identify the drive */
+    BYTE pdrv /* Physical drive number to identify the drive */
 )
 {
    return 0;
 }

 DSTATUS disk_initialize (
-    BYTE pdrv /* Physical drive nmuber to identify the drive */
+    BYTE pdrv /* Physical drive number to identify the drive */
 )
 {
    return 0;
@ -81,7 +76,6 @@ static inline void _gf256_mul_x_le(void *block) {
        pdata[0x0] ^= 0x87;
 }

-//8378ms before doing the block op all at once, 2179ms after!
 static inline int _emmc_xts(u32 ks1, u32 ks2, u32 enc, u8 *tweak, bool regen_tweak, u32 tweak_exp, u64 sec, void *dst, void *src, u32 secsize) {
    int res = 0;
    u8 *pdst = (u8 *)dst;
@ -131,7 +125,7 @@ out:;
 }

 DRESULT disk_read (
-    BYTE pdrv,		/* Physical drive nmuber to identify the drive */
+    BYTE pdrv,		/* Physical drive number to identify the drive */
    BYTE *buff,		/* Data buffer to store read data */
    DWORD sector,	/* Start sector in LBA */
    UINT count		/* Number of sectors to read */
@ -140,20 +134,12 @@ DRESULT disk_read (
    switch (pdrv)
    {
    case 0:
-        if ((u32)buff >= DRAM_START)
-            return sdmmc_storage_read(&sd_storage, sector, count, buff) ? RES_OK : RES_ERROR;
-        u8 *buf = (u8 *)SDMMC_UPPER_BUFFER;
-        if (sdmmc_storage_read(&sd_storage, sector, count, buf))
-        {
-            memcpy(buff, buf, 512 * count);
-            return RES_OK;
-        }
-        return RES_ERROR;
+        return sdmmc_storage_read(&sd_storage, sector, count, buff) ? RES_OK : RES_ERROR;

    case 1:;
-        static u8 tweak[0x10];
-        static u64 prev_cluster = -1;
-        static u32 prev_sector = 0;
+        __attribute__ ((aligned (16))) static u8 tweak[0x10];
+        __attribute__ ((aligned (16))) static u64 prev_cluster = -1;
+        __attribute__ ((aligned (16))) static u32 prev_sector = 0;
        u32 tweak_exp = 0;
        bool regen_tweak = true, cache_sector = false;

@ -166,7 +152,6 @@ DRESULT disk_read (
                    memcpy(tweak, sector_cache[s].tweak, 0x10);
                    prev_sector = sector;
                    prev_cluster = sector / 0x20;
-                    //gfx_printf("addr %x sec %x count %x cached\n", sector * 0x200, sector, count);
                    return RES_OK;
                }
            }
@ -180,7 +165,6 @@ DRESULT disk_read (
        }

        if (nx_emmc_part_read(&storage, system_part, sector, count, buff)) {
-            //gfx_hexdump(0, buff, 0x100);
            if (prev_cluster != sector / 0x20) { // sector in different cluster than last read
                prev_cluster = sector / 0x20;
                tweak_exp = sector % 0x20;
@ -192,13 +176,11 @@ DRESULT disk_read (
            }

            // fatfs will never pull more than a cluster
-            //gfx_printf("sec %6x count %2x tweak %2x\n", sector, count, tweak_exp);
            _emmc_xts(9, 8, 0, tweak, regen_tweak, tweak_exp, prev_cluster, buff, buff, count * 0x200);
            if (cache_sector) {
                memcpy(sector_cache[s].cached_sector, buff, 0x200);
                memcpy(sector_cache[s].tweak, tweak, 0x10);
            }
-            //gfx_hexdump(0, buff, 0x10);
            prev_sector = sector + count - 1;
            return RES_OK;
        }
@ -208,7 +190,7 @@ DRESULT disk_read (
 }

 DRESULT disk_write (
-    BYTE pdrv,			/* Physical drive nmuber to identify the drive */
+    BYTE pdrv,			/* Physical drive number to identify the drive */
    const BYTE *buff,	/* Data to be written */
    DWORD sector,		/* Start sector in LBA */
    UINT count			/* Number of sectors to write */
@ -216,17 +198,11 @@ DRESULT disk_write (
 {
    if (pdrv == 1)
        return RES_WRPRT;
-    if ((u32)buff >= DRAM_START)
-        return sdmmc_storage_write(&sd_storage, sector, count, (void *)buff) ? RES_OK : RES_ERROR;
-    u8 *buf = (u8 *)SDMMC_UPPER_BUFFER; //TODO: define this somewhere.
-    memcpy(buf, buff, 512 * count);
-    if (sdmmc_storage_write(&sd_storage, sector, count, buf))
-        return RES_OK;
-    return RES_ERROR;
+    return sdmmc_storage_write(&sd_storage, sector, count, (void *)buff) ? RES_OK : RES_ERROR;
 }

 DRESULT disk_ioctl (
-    BYTE pdrv,		/* Physical drive nmuber (0..) */
+    BYTE pdrv,		/* Physical drive number (0..) */
    BYTE cmd,		/* Control code */
    void *buff		/* Buffer to send/receive control data */
 )
--- a/source/libs/fatfs/ff.h
+++ b/source/libs/fatfs/ff.h
@ -137,6 +137,7 @@ typedef struct {
 	DWORD	bitbase;		/* Allocation bitmap base sector */
 #endif
 	DWORD	winsect;		/* Current sector appearing in the win[] */
+	DWORD	padding;		/* Ensure window is 16-aligned */
 	BYTE	win[FF_MAX_SS];	/* Disk access window for Directory, FAT (and file data at tiny cfg) */
 } FATFS;

--- a/source/main.c
+++ b/source/main.c
@ -1,7 +1,7 @@
 /*
 * Copyright (c) 2018 naehrwert
 *
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@ -32,7 +32,7 @@

 sdmmc_t sd_sdmmc;
 sdmmc_storage_t sd_storage;
-FATFS sd_fs;
+__attribute__ ((aligned (16))) FATFS sd_fs;
 static bool sd_mounted;

 boot_cfg_t __attribute__((section ("._boot_cfg"))) b_cfg;
@ -49,7 +49,7 @@ bool sd_mount()
    else
    {
        int res = 0;
-        res = f_mount(&sd_fs, "", 1);
+        res = f_mount(&sd_fs, "sd:", 1);
        if (res == FR_OK)
        {
            sd_mounted = 1;
@ -68,38 +68,35 @@ void sd_unmount()
 {
    if (sd_mounted)
    {
-        f_mount(NULL, "", 1);
+        f_mount(NULL, "sd:", 1);
        sdmmc_storage_end(&sd_storage);
        sd_mounted = false;
    }
 }

-void *sd_file_read(char *path)
+void *sd_file_read(const char *path, u32 *fsize)
 {
-    FIL fp;
-    if (f_open(&fp, path, FA_READ) != FR_OK)
-        return NULL;
+	FIL fp;
+	if (f_open(&fp, path, FA_READ) != FR_OK)
+		return NULL;

-    u32 size = f_size(&fp);
-    void *buf = malloc(size);
+	u32 size = f_size(&fp);
+	if (fsize)
+		*fsize = size;

-    u8 *ptr = buf;
-    while (size > 0)
-    {
-        u32 rsize = MIN(size, 512 * 512);
-        if (f_read(&fp, ptr, rsize, NULL) != FR_OK)
-        {
-            free(buf);
-            return NULL;
-        }
+	void *buf = malloc(size);

-        ptr += rsize;
-        size -= rsize;
-    }
+	if (f_read(&fp, buf, size, NULL) != FR_OK)
+	{
+		free(buf);
+		f_close(&fp);

-    f_close(&fp);
+		return NULL;
+	}

-    return buf;
+	f_close(&fp);
+
+	return buf;
 }

 int sd_save_to_file(void *buf, u32 size, const char *filename)
@ -150,8 +147,8 @@ void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size)

 extern void pivot_stack(u32 stack_top);

-void ipl_main() {
-
+void ipl_main()
+{
    config_hw();
    pivot_stack(IPL_STACK_TOP);
    heap_init(IPL_HEAP_START);
--- a/source/power/bq24193.c
+++ b/source/power/bq24193.c
@ -1,162 +0,0 @@
-/*
- * Battery charger driver for Nintendo Switch's TI BQ24193
- *
- * Copyright (C) 2018 CTCaer
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "bq24193.h"
-#include "../soc/i2c.h"
-#include "../utils/util.h"
-
-int bq24193_get_property(enum BQ24193_reg_prop prop, int *value)
-{
-	u8 data;
-
-	switch (prop) {
-		case BQ24193_InputVoltageLimit: // Input voltage limit (mV).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_InputSource);
-			data = (data & BQ24193_INCONFIG_VINDPM_MASK) >> 3;
-			*value += ((data >> 0) & 1) ? 80 : 0;
-			*value += ((data >> 1) & 1) ? 160 : 0;
-			*value += ((data >> 2) & 1) ? 320 : 0;
-			*value += ((data >> 3) & 1) ? 640 : 0;
-			*value += 3880;
-			break;
-		case BQ24193_InputCurrentLimit: // Input current limit (mA).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_InputSource);
-			data &= BQ24193_INCONFIG_INLIMIT_MASK;
-			switch (data)
-			{
-			case 0:
-				*value = 100;
-				break;
-			case 1:
-				*value = 150;
-				break;
-			case 2:
-				*value = 500;
-				break;
-			case 3:
-				*value = 900;
-				break;
-			case 4:
-				*value = 1200;
-				break;
-			case 5:
-				*value = 1500;
-				break;
-			case 6:
-				*value = 2000;
-				break;
-			case 7:
-				*value = 3000;
-				break;
-			}
-			break;
-		case BQ24193_SystemMinimumVoltage: // Minimum system voltage limit (mV).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_PORConfig);
-			*value = (data & BQ24193_PORCONFIG_SYSMIN_MASK) >> 1;
-			*value *= 100;
-			*value += 3000;
-			break;
-		case BQ24193_FastChargeCurrentLimit: // Fast charge current limit (mA).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgCurr);
-			data = (data & BQ24193_CHRGCURR_ICHG_MASK) >> 2;
-			*value += ((data >> 0) & 1) ? 64 : 0;
-			*value += ((data >> 1) & 1) ? 128 : 0;
-			*value += ((data >> 2) & 1) ? 256 : 0;
-			*value += ((data >> 3) & 1) ? 512 : 0;
-			*value += ((data >> 4) & 1) ? 1024 : 0;
-			*value += ((data >> 5) & 1) ? 2048 : 0;
-			*value += 512;
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgCurr);
-			data &= BQ24193_CHRGCURR_20PCT_MASK;
-			if (data)
-				*value = *value * 20 / 100; // Fast charge current limit is 20%.
-			break;
-		case BQ24193_ChargeVoltageLimit: // Charge voltage limit (mV).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgVolt);
-			data = (data & BQ24193_CHRGVOLT_VREG) >> 2; 
-			*value += ((data >> 0) & 1) ? 16 : 0;
-			*value += ((data >> 1) & 1) ? 32 : 0;
-			*value += ((data >> 2) & 1) ? 64 : 0;
-			*value += ((data >> 3) & 1) ? 128 : 0;
-			*value += ((data >> 4) & 1) ? 256 : 0;
-			*value += ((data >> 5) & 1) ? 512 : 0;
-			*value += 3504;
-			break;
-		case BQ24193_RechargeThreshold: // Recharge voltage threshold less than voltage limit (mV).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgVolt);
-			data &= BQ24193_IRTHERMAL_THERM_MASK;
-			if (data)
-				*value = 300;
-			else
-				*value = 100;
-			break;
-		case BQ24193_ThermalRegulation: // Thermal regulation threshold (oC).
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_IRCompThermal);
-			data &= BQ24193_IRTHERMAL_THERM_MASK;
-			switch (data)
-			{
-			case 0:
-				*value = 60;
-				break;
-			case 1:
-				*value = 80;
-				break;
-			case 2:
-				*value = 100;
-				break;
-			case 3:
-				*value = 120;
-				break;
-			}
-			break;
-		case BQ24193_ChargeStatus: // 0: Not charging, 1: Pre-charge, 2: Fast charging, 3: Charge termination done
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_Status);
-			*value = (data & BQ24193_STATUS_CHRG_MASK) >> 4;
-			break;
-		case BQ24193_TempStatus: // 0: Normal, 2: Warm, 3: Cool, 5: Cold, 6: Hot.
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_FaultReg);
-			*value = data & BQ24193_FAULT_THERM_MASK;
-			break;
-		case BQ24193_DevID: // Dev ID.
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_VendorPart);
-			*value = data & BQ24193_VENDORPART_DEV_MASK;
-			break;
-		case BQ24193_ProductNumber: // Product number.
-			data = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_VendorPart);
-			*value = (data & BQ24193_VENDORPART_PN_MASK) >> 3;
-			break;
-		default:
-			return -1;
-	}
-	return 0;
-}
-
-void bq24193_fake_battery_removal()
-{
-	u8 value;
-
-	// Disable watchdog to keep BATFET disabled.
-	value = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgTermTimer);
-	value &= ~BQ24193_CHRGTERM_WATCHDOG_MASK;
-	i2c_send_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgTermTimer, value);
-
-	// Force BATFET to disabled state. This disconnects the battery from the system.
-	value = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_Misc);
-	value |= BQ24193_MISC_BATFET_DI_MASK;
-	i2c_send_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_Misc, value);
-}
--- a/source/power/bq24193.h
+++ b/source/power/bq24193.h
@ -1,119 +0,0 @@
-/*
- * Battery charger driver for Nintendo Switch's TI BQ24193
- *
- * Copyright (C) 2018 CTCaer
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef __BQ24193_H_
-#define __BQ24193_H_
-
-#define BQ24193_I2C_ADDR 0x6B
-
-// REG 0 masks.
-#define BQ24193_INCONFIG_INLIMIT_MASK (7<<0)
-#define BQ24193_INCONFIG_VINDPM_MASK   0x78
-#define BQ24193_INCONFIG_HIZ_EN_MASK  (1<<7)
-
-// REG 1 masks.
-#define BQ24193_PORCONFIG_BOOST_MASK       (1<<0)
-#define BQ24193_PORCONFIG_SYSMIN_MASK      (7<<1)
-#define BQ24193_PORCONFIG_CHGCONFIG_MASK   (3<<4)
-#define BQ24193_PORCONFIG_I2CWATCHDOG_MASK (1<<6)
-#define BQ24193_PORCONFIG_RESET_MASK       (1<<7)
-
-// REG 2 masks.
-#define BQ24193_CHRGCURR_20PCT_MASK (1<<0)
-#define BQ24193_CHRGCURR_ICHG_MASK   0xFC
-
-// REG 3 masks.
-#define BQ24193_PRECHRG_ITERM   0x0F
-#define BQ24193_PRECHRG_IPRECHG 0xF0
-
-// REG 4 masks.
-#define BQ24193_CHRGVOLT_VTHRES  (1<<0)
-#define BQ24193_CHRGVOLT_BATTLOW (1<<1)
-#define BQ24193_CHRGVOLT_VREG     0xFC
-
-// REG 5 masks.
-#define BQ24193_CHRGTERM_ISET_MASK     (1<<0)
-#define BQ24193_CHRGTERM_CHGTIMER_MASK (3<<1)
-#define BQ24193_CHRGTERM_ENTIMER_MASK  (1<<3)
-#define BQ24193_CHRGTERM_WATCHDOG_MASK (3<<4)
-#define BQ24193_CHRGTERM_TERM_ST_MASK  (1<<6)
-#define BQ24193_CHRGTERM_TERM_EN_MASK  (1<<7)
-
-// REG 6 masks.
-#define BQ24193_IRTHERMAL_THERM_MASK    (3<<0)
-#define BQ24193_IRTHERMAL_VCLAMP_MASK   (7<<2)
-#define BQ24193_IRTHERMAL_BATTCOMP_MASK (7<<5)
-
-// REG 7 masks.
-#define BQ24193_MISC_INT_MASK       (3<<0)
-#define BQ24193_MISC_VSET_MASK      (1<<4)
-#define BQ24193_MISC_BATFET_DI_MASK (1<<5)
-#define BQ24193_MISC_TMR2X_EN_MASK  (1<<6)
-#define BQ24193_MISC_DPDM_EN_MASK   (1<<7)
-
-// REG 8 masks.
-#define BQ24193_STATUS_VSYS_MASK  (1<<0)
-#define BQ24193_STATUS_THERM_MASK (1<<1)
-#define BQ24193_STATUS_PG_MASK    (1<<2)
-#define BQ24193_STATUS_DPM_MASK   (1<<3)
-#define BQ24193_STATUS_CHRG_MASK  (3<<4)
-#define BQ24193_STATUS_VBUS_MASK  (3<<6)
-
-// REG 9 masks.
-#define BQ24193_FAULT_THERM_MASK    (7<<0)
-#define BQ24193_FAULT_BATT_OVP_MASK (1<<3)
-#define BQ24193_FAULT_CHARGE_MASK   (3<<4)
-#define BQ24193_FAULT_BOOST_MASK    (1<<6)
-#define BQ24193_FAULT_WATCHDOG_MASK (1<<7)
-
-// REG A masks.
-#define BQ24193_VENDORPART_DEV_MASK (3<<0)
-#define BQ24193_VENDORPART_PN_MASK  (7<<3)
-
-enum BQ24193_reg {
-	BQ24193_InputSource     = 0x00,
-	BQ24193_PORConfig       = 0x01,
-	BQ24193_ChrgCurr        = 0x02,
-	BQ24193_PreChrgTerm     = 0x03,
-	BQ24193_ChrgVolt        = 0x04,
-	BQ24193_ChrgTermTimer   = 0x05,
-	BQ24193_IRCompThermal   = 0x06,
-	BQ24193_Misc            = 0x07,
-	BQ24193_Status          = 0x08,
-	BQ24193_FaultReg        = 0x09,
-	BQ24193_VendorPart      = 0x0A,
-};
-
-enum BQ24193_reg_prop {
-	BQ24193_InputVoltageLimit,      // REG 0.
-	BQ24193_InputCurrentLimit,      // REG 0.
-	BQ24193_SystemMinimumVoltage,   // REG 1.
-	BQ24193_FastChargeCurrentLimit, // REG 2.
-	BQ24193_ChargeVoltageLimit,     // REG 4.
-	BQ24193_RechargeThreshold,      // REG 4.
-	BQ24193_ThermalRegulation,      // REG 6.
-	BQ24193_ChargeStatus,           // REG 8.
-	BQ24193_TempStatus,             // REG 9.
-	BQ24193_DevID,                  // REG A.
-	BQ24193_ProductNumber,          // REG A.
-};
-
-int bq24193_get_property(enum BQ24193_reg_prop prop, int *value);
-void bq24193_fake_battery_removal();
-
-#endif /* __BQ24193_H_ */
--- a/source/sec/tsec.c
+++ b/source/sec/tsec.c
@ -28,7 +28,7 @@
 #include "../mem/mc.h"
 #include "../utils/util.h"

-/* #include "../gfx/gfx.h" */
+// #include "../gfx/gfx.h"

 static int _tsec_dma_wait_idle()
 {
@ -118,7 +118,7 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 	{
 		// Init SMMU translation for TSEC.
 		pdir = smmu_init_for_tsec();
-		smmu_init(tsec_ctxt->secmon_base);
+		smmu_init(0x4002B000);
 		// Enable SMMU
 		if (!smmu_is_used())
 			smmu_enable();
@ -161,7 +161,7 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 		iram = page_alloc(0x30);
 		memcpy(iram, tsec_ctxt->pkg1, 0x30000);
 		// PKG1.1 magic offset.
-		pkg11_magic_off = (u32 *)(iram + ((tsec_ctxt->pkg11_off + 0x20) / 4));
+		pkg11_magic_off = (u32 *)(iram + (0x7000 / 4));
 		smmu_map(pdir, 0x40010000, (u32)iram, 0x30, _READABLE | _WRITABLE | _NONSECURE);

 		// Exception vectors
@ -187,7 +187,8 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 		{
 			smmu_flush_all();

-			if (k != se[SE_KEYTABLE_DATA0_REG_OFFSET / 4]) {
+			if (k != se[SE_KEYTABLE_DATA0_REG_OFFSET / 4])
+			{
 				k = se[SE_KEYTABLE_DATA0_REG_OFFSET / 4];
 				key[kidx++] = k;
 			}
--- a/source/sec/tsec.h
+++ b/source/sec/tsec.h
@ -20,15 +20,31 @@

 #include "../utils/types.h"

+#define TSEC_KEY_DATA_ADDR 0x300
+
 typedef struct _tsec_ctxt_t
 {
 	void *fw;
 	u32 size;
 	void *pkg1;
-	u32 pkg11_off;
-	u32 secmon_base;
 } tsec_ctxt_t;

+typedef struct _tsec_key_data_t
+{
+	u8 debug_key[0x10];
+	u8 blob0_auth_hash[0x10];
+	u8 blob1_auth_hash[0x10];
+	u8 blob2_auth_hash[0x10];
+	u8 blob2_aes_iv[0x10];
+	u8 hovi_eks_seed[0x10];
+	u8 hovi_common_seed[0x10];
+	u32 blob0_size;
+	u32 blob1_size;
+	u32 blob2_size;
+	u32 blob3_size;
+	u32 blob4_size;
+} tsec_key_data_t;
+
 int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt);

 #endif
--- a/source/soc/clock.c
+++ b/source/soc/clock.c
@ -364,10 +364,12 @@ static void _clock_sdmmc_clear_enable(u32 id)

 static u32 _clock_sdmmc_table[8] = { 0 };

+#define PLLP_OUT0      0x0
+
 static int _clock_sdmmc_config_clock_source_inner(u32 *pout, u32 id, u32 val)
 {
 	u32 divisor = 0;
-	u32 source = 0;
+	u32 source = PLLP_OUT0;

 	switch (val)
 	{
@ -414,16 +416,16 @@ static int _clock_sdmmc_config_clock_source_inner(u32 *pout, u32 id, u32 val)
 	switch (id)
 	{
 	case SDMMC_1:
-		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC1) = source | divisor;
+		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC1) = (source << 29) | divisor;
 		break;
 	case SDMMC_2:
-		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC2) = source | divisor;
+		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC2) = (source << 29) | divisor;
 		break;
 	case SDMMC_3:
-		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC3) = source | divisor;
+		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC3) = (source << 29) | divisor;
 		break;
 	case SDMMC_4:
-		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC4) = source | divisor;
+		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC4) = (source << 29) | divisor;
 		break;
 	}

--- a/source/soc/hw_init.c
+++ b/source/soc/hw_init.c
@ -18,6 +18,13 @@
 #include <string.h>

 #include "hw_init.h"
+#include "clock.h"
+#include "fuse.h"
+#include "gpio.h"
+#include "i2c.h"
+#include "pinmux.h"
+#include "pmc.h"
+#include "t210.h"
 #include "../gfx/di.h"
 #include "../mem/mc.h"
 #include "../mem/sdram.h"
@ -25,13 +32,6 @@
 #include "../power/max7762x.h"
 #include "../sec/se.h"
 #include "../sec/se_t210.h"
-#include "../soc/clock.h"
-#include "../soc/fuse.h"
-#include "../soc/gpio.h"
-#include "../soc/i2c.h"
-#include "../soc/pinmux.h"
-#include "../soc/pmc.h"
-#include "../soc/t210.h"
 #include "../storage/sdmmc.h"
 #include "../utils/util.h"

--- a/source/storage/sdmmc.c
+++ b/source/storage/sdmmc.c
@ -19,13 +19,15 @@
 #include "sdmmc.h"
 #include "mmc.h"
 #include "sd.h"
-#include "../utils/util.h"
+#include "../gfx/gfx.h"
 #include "../mem/heap.h"
+#include "../utils/util.h"

-/*#include "gfx.h"
-#define DPRINTF(...) gfx_printf(__VA_ARGS__)*/
+//#define DPRINTF(...) gfx_printf(__VA_ARGS__)
 #define DPRINTF(...)

+extern boot_cfg_t b_cfg;
+
 static inline u32 unstuff_bits(u32 *resp, u32 start, u32 size)
 {
 	const u32 mask = (size < 32 ? 1 << size : 0) - 1;
@ -425,7 +427,7 @@ static int _mmc_storage_enable_HS400(sdmmc_storage_t *storage)
 static int _mmc_storage_enable_highspeed(sdmmc_storage_t *storage, u32 card_type, u32 type)
 {
 	//TODO: this should be a config item.
-	//---v
+	// --v
 	if (!1 || sdmmc_get_voltage(storage->sdmmc) != SDMMC_POWER_1_8)
 		goto out;

@ -530,7 +532,9 @@ int sdmmc_storage_init_mmc(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 		DPRINTF("[MMC] BKOPS enabled\n");
 	}
 	else
+	{
 		DPRINTF("[MMC] BKOPS disabled\n");
+	}

 	if (!_mmc_storage_enable_highspeed(storage, storage->ext_csd.card_type, type))
 		return 0;
@ -704,7 +708,7 @@ int _sd_storage_get_scr(sdmmc_storage_t *storage, u8 *buf)

 	u32 tmp = 0;
 	sdmmc_get_rsp(storage->sdmmc, &tmp, 4, SDMMC_RSP_TYPE_1);
-    //Prepare buffer for unstuff_bits
+	//Prepare buffer for unstuff_bits
 	for (int i = 0; i < 8; i+=4)
 	{
 		storage->raw_scr[i + 3] = buf[i];
@ -831,6 +835,7 @@ int _sd_storage_enable_highspeed_low_volt(sdmmc_storage_t *storage, u32 type, u8
 	switch (type)
 	{
 	case 11:
+		// Fall through if not supported.
 		if (buf[13] & SD_MODE_UHS_SDR104)
 		{
 			type = 11;
@ -839,7 +844,6 @@ int _sd_storage_enable_highspeed_low_volt(sdmmc_storage_t *storage, u32 type, u8
 			storage->csd.busspeed = 104;
 			break;
 		}
-		//Fall through.
 	case 10:
 		if (buf[13] & SD_MODE_UHS_SDR50)
 		{
@ -876,7 +880,7 @@ int _sd_storage_enable_highspeed_high_volt(sdmmc_storage_t *storage, u8 *buf)
 	if (!_sd_storage_switch_get(storage, buf))
 		return 0;
 	//gfx_hexdump(0, (u8 *)buf, 64);
-	if (!(buf[13] & 2))
+	if (!(buf[13] & SD_MODE_HIGH_SPEED))
 		return 1;

 	if (!_sd_storage_enable_highspeed(storage, 1, buf))
@ -1011,6 +1015,11 @@ int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 {
 	int is_version_1 = 0;

+	// Some cards (Sandisk U1), do not like a fast power cycle. Wait min 100ms.
+	u32 sd_poweroff_time = (u32)get_tmr_ms() - b_cfg.sd_timeoff;
+	if (id == SDMMC_1 && (sd_poweroff_time < 100))
+		msleep(100 - sd_poweroff_time);
+
 	memset(storage, 0, sizeof(sdmmc_storage_t));
 	storage->sdmmc = sdmmc;

@ -1103,7 +1112,9 @@ int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 		DPRINTF("[SD] switched to wide bus width\n");
 	}
 	else
+	{
 		DPRINTF("[SD] SD does not support wide bus width\n");
+	}

 	if (storage->is_low_voltage)
 	{
@ -1129,7 +1140,9 @@ int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32

 	// Parse additional card info from sd status.
 	if (_sd_storage_get_ssr(storage, buf))
+	{
 		DPRINTF("[SD] got sd status\n");
+	}

 	free(buf);
 	return 1;
--- a/source/storage/sdmmc_driver.c
+++ b/source/storage/sdmmc_driver.c
@ -17,20 +17,22 @@

 #include <string.h>

-#include "sdmmc.h"
-#include "../utils/util.h"
-#include "../soc/clock.h"
 #include "mmc.h"
+#include "sdmmc.h"
+#include "../gfx/gfx.h"
 #include "../power/max7762x.h"
-#include "../soc/t210.h"
-#include "../soc/pmc.h"
-#include "../soc/pinmux.h"
+#include "../soc/clock.h"
 #include "../soc/gpio.h"
+#include "../soc/pinmux.h"
+#include "../soc/pmc.h"
+#include "../soc/t210.h"
+#include "../utils/util.h"

-/*#include "gfx.h"
-#define DPRINTF(...) gfx_printf(__VA_ARGS__)*/
+//#define DPRINTF(...) gfx_printf(__VA_ARGS__)
 #define DPRINTF(...)

+extern boot_cfg_t b_cfg;
+
 /*! SCMMC controller base addresses. */
 static const u32 _sdmmc_bases[4] = {
 	0x700B0000,
@ -116,7 +118,7 @@ static int _sdmmc_config_ven_ceata_clk(sdmmc_t *sdmmc, u32 id)

 	if (id == 4)
 		sdmmc->regs->venceatactl = (sdmmc->regs->venceatactl & 0xFFFFC0FF) | 0x2800;
-	sdmmc->regs->field_1C0 &= 0xFFFDFFFF;
+	sdmmc->regs->ventunctl0 &= 0xFFFDFFFF;
 	if (id == 4)
 	{
 		if (!sdmmc->venclkctl_set)
@ -168,11 +170,11 @@ static int _sdmmc_wait_type4(sdmmc_t *sdmmc)
 		sdmmc->regs->clkcon |= TEGRA_MMC_CLKCON_SD_CLOCK_ENABLE;
 	}

-	sdmmc->regs->field_1B0 |= 0x80000000;
+	sdmmc->regs->vendllcal |= 0x80000000;
 	_sdmmc_get_clkcon(sdmmc);

 	u32 timeout = get_tmr_ms() + 5;
-	while (sdmmc->regs->field_1B0 & 0x80000000)
+	while (sdmmc->regs->vendllcal & 0x80000000)
 	{
 		if (get_tmr_ms() > timeout)
 		{
@ -182,7 +184,7 @@ static int _sdmmc_wait_type4(sdmmc_t *sdmmc)
 	}

 	timeout = get_tmr_ms() + 10;
-	while (sdmmc->regs->field_1BC & 0x80000000)
+	while (sdmmc->regs->dllcfgstatus & 0x80000000)
 	{
 		if (get_tmr_ms() > timeout)
 		{
@ -561,9 +563,9 @@ int sdmmc_config_tuning(sdmmc_t *sdmmc, u32 type, u32 cmd)
 		return 0;
 	}

-	sdmmc->regs->field_1C0 = (sdmmc->regs->field_1C0 & 0xFFFF1FFF) | flag;
-	sdmmc->regs->field_1C0 = (sdmmc->regs->field_1C0 & 0xFFFFE03F) | 0x40;
-	sdmmc->regs->field_1C0 |= 0x20000;
+	sdmmc->regs->ventunctl0 = (sdmmc->regs->ventunctl0 & 0xFFFF1FFF) | flag;
+	sdmmc->regs->ventunctl0 = (sdmmc->regs->ventunctl0 & 0xFFFFE03F) | 0x40;
+	sdmmc->regs->ventunctl0 |= 0x20000;
 	sdmmc->regs->hostctl2  |= SDHCI_CTRL_EXEC_TUNING;

 	for (u32 i = 0; i < max; i++)
@ -1000,8 +1002,8 @@ int sdmmc_init(sdmmc_t *sdmmc, u32 id, u32 power, u32 bus_width, u32 type, int n
 	sdmmc->clock_stopped = 0;

 	//TODO: make this skip-able.
-	sdmmc->regs->field_1F0 |= 0x80000;
-	sdmmc->regs->field_1AC &= 0xFFFFFFFB;
+	sdmmc->regs->iospare |= 0x80000;
+	sdmmc->regs->veniotrimctl &= 0xFFFFFFFB;
 	static const u32 trim_values[] = { 2, 8, 3, 8 };
 	sdmmc->regs->venclkctl = (sdmmc->regs->venclkctl & 0xE0FFFFFF) | (trim_values[sdmmc->id] << 24);
 	sdmmc->regs->sdmemcmppadctl = (sdmmc->regs->sdmemcmppadctl & 0xF) | 7;
@ -1036,7 +1038,9 @@ void sdmmc_end(sdmmc_t *sdmmc)
 		if (sdmmc->id == SDMMC_1)
 		{
 			gpio_output_enable(GPIO_PORT_E, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
-			msleep(1); // To power cycle min 1ms without power is needed.
+			max77620_regulator_enable(REGULATOR_LDO2, 0);
+			b_cfg.sd_timeoff = get_tmr_ms(); // Some sandisc U1 cards need 100ms for a power cycle.
+			msleep(1); // To power cycle, min 1ms without power is needed.
 		}

 		_sdmmc_get_clkcon(sdmmc);
--- a/source/storage/sdmmc_t210.h
+++ b/source/storage/sdmmc_t210.h
@ -115,18 +115,18 @@ typedef struct _t210_sdmmc_t
 	vu32 vendebouncecnt;
 	vu32 venmiscctl;
 	vu32 res6[34];
-	vu32 field_1AC;
-	vu32 field_1B0;
+	vu32 veniotrimctl;
+	vu32 vendllcal;
 	vu8 res7[8];
-	vu32 field_1BC;
-	vu32 field_1C0;
+	vu32 dllcfgstatus;
+	vu32 ventunctl0;
 	vu32 field_1C4;
 	vu8 field_1C8[24];
 	vu32 sdmemcmppadctl;
 	vu32 autocalcfg;
 	vu32 autocalintval;
 	vu32 autocalsts;
-	vu32 field_1F0;
+	vu32 iospare;
 } t210_sdmmc_t;

 #endif
--- a/source/utils/sprintf.c
+++ b/source/utils/sprintf.c
@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2019 shchmue
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "types.h"
+
+#include <stdarg.h>
+
+static void _putc(char *buffer, const char c) {
+    *buffer = c;
+}
+
+static u32 _puts(char *buffer, const char *s) {
+    u32 count = 0;
+    for (; *s; s++, count++)
+        _putc(buffer + count, *s);
+    return count;
+}
+
+static u32 _putn(char *buffer, u32 v, int base, char fill, int fcnt) {
+    char buf[0x121];
+    static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+    char *p;
+    int c = fcnt;
+
+    if (base > 36)
+        return 0;
+
+    p = buf + 0x120;
+    *p = 0;
+    do {
+        c--;
+        *--p = digits[v % base];
+        v /= base;
+    } while (v);
+
+    if (fill != 0) {
+        while (c > 0) {
+            *--p = fill;
+            c--;
+        }
+    }
+
+    return _puts(buffer, p);
+}
+
+u32 sprintf(char *buffer, const char *fmt, ...) {
+    va_list ap;
+    int fill, fcnt;
+    u32 count = 0;
+
+    va_start(ap, fmt);
+    while(*fmt) {
+        if (*fmt == '%') {
+            fmt++;
+            fill = 0;
+            fcnt = 0;
+            if ((*fmt >= '0' && *fmt <= '9') || *fmt == ' ') {
+                fcnt = *fmt;
+                fmt++;
+                if (*fmt >= '0' && *fmt <= '9') {
+                    fill = fcnt;
+                    fcnt = *fmt - '0';
+                    fmt++;
+                } else {
+                    fill = ' ';
+                    fcnt -= '0';
+                }
+            }
+            switch (*fmt) {
+            case 'c':
+                _putc(buffer + count, va_arg(ap, u32));
+                count++;
+                break;
+            case 's':
+                count += _puts(buffer + count, va_arg(ap, char *));
+                break;
+            case 'd':
+                count += _putn(buffer + count, va_arg(ap, u32), 10, fill, fcnt);
+                break;
+            case 'p':
+            case 'P':
+            case 'x':
+            case 'X':
+                count += _putn(buffer + count, va_arg(ap, u32), 16, fill, fcnt);
+                break;
+            case '%':
+                _putc(buffer + count, '%');
+                count++;
+                break;
+            case '\0':
+                goto out;
+            default:
+                _putc(buffer + count, '%');
+                _putc(buffer + count, *fmt);
+                count += 2;
+                break;
+            }
+        } else {
+            _putc(buffer + count, *fmt);
+            count++;
+        }
+        fmt++;
+    }
+
+    out:
+    buffer[count] = 0;
+    va_end(ap);
+    return count;
+}
--- a/source/utils/sprintf.h
+++ b/source/utils/sprintf.h
@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2019 shchmue
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _SPRINTF_H_
+#define _SPRINTF_H_
+
+u32 sprintf(char *buffer, const char *fmt, ...);
+
+#endif
--- a/source/utils/types.h
+++ b/source/utils/types.h
@ -34,7 +34,8 @@
 #define KB_FIRMWARE_VERSION_600 5
 #define KB_FIRMWARE_VERSION_620 6
 #define KB_FIRMWARE_VERSION_700 7
-#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_700
+#define KB_FIRMWARE_VERSION_810 8
+#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_810

 #define HOS_PKG11_MAGIC 0x31314B50

@ -80,7 +81,8 @@ typedef struct __attribute__((__packed__)) _boot_cfg_t
 	u8  autoboot;
 	u8  autoboot_list;
 	u8  extra_cfg;
-	u8  rsvd[128];
+	u32 sd_timeoff;
+	u8  rsvd[124];
 } boot_cfg_t;

 typedef struct __attribute__((__packed__)) _reloc_meta_t
--- a/source/utils/util.c
+++ b/source/utils/util.c
@ -106,45 +106,3 @@ void power_off()
 	//TODO: we should probably make sure all regulators are powered off properly.
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1, MAX77620_ONOFFCNFG1_PWR_OFF);
 }
-
-#define CRC32C_POLY 0x82F63B78
-u32 crc32c(const void *buf, u32 len)
-{
-	const u8 *cbuf = (const u8 *)buf;
-	u32 crc = 0xFFFFFFFF;
-	while (len--)
-	{
-		crc ^= *cbuf++;
-		for (int i = 0; i < 8; i++)
-			crc = crc & 1 ? (crc >> 1) ^ CRC32C_POLY : crc >> 1;
-	}
-	return ~crc;
-}
-
-u32 memcmp32sparse(const u32 *buf1, const u32 *buf2, u32 len)
-{
-	u32 len32 = len / 4;
-
-	if (!(len32 % 32))
-	{
-		while (len32)
-		{
-			len32 -= 32;
-			if(buf1[len32] != buf2[len32])
-				return 1;
-		}
-	}
-	else
-	{
-		while (len32)
-		{
-			len32 -= 32;
-			if(buf1[len32] != buf2[len32])
-				return 1;
-			if (len32 < 32)
-				return 0;
-		}
-	}
-
-	return 0;
-}
--- a/source/utils/util.h
+++ b/source/utils/util.h
@ -39,10 +39,5 @@ void reboot_normal();
 void reboot_rcm();
 void power_off();
 void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops);
-u32 crc32c(const void *buf, u32 len);
-
-/* This is a faster implementation of memcmp that checks two u32 values */
-/* every 128 Bytes block. Intented only for Backup and Restore          */
-u32 memcmp32sparse(const u32 *buf1, const u32 *buf2, u32 len);

 #endif
Author	SHA1	Message	Date
shchmue	a376837886	Bump version to v1.3.0	2019-06-19 18:58:42 -04:00
shchmue	54d14196e0	Add support for 8.1.0, new Sept, and master_key_08	2019-06-19 18:16:02 -04:00
shchmue	0b2442fb8e	Bump version to v1.2.0	2019-05-31 12:58:17 -04:00
shchmue	7a50772703	Fit SD seed messaging on single lines	2019-05-31 12:57:46 -04:00
shchmue	abc2c85864	Respect IRAM stack in diskio.c	2019-05-31 12:57:11 -04:00
shchmue	dae4c72910	Support pkg1+pkg2 mismatch and "dev.keys" filename	2019-05-18 11:08:34 -04:00
shchmue	b464042f3a	Remove explicit object list from Makefile	2019-05-17 10:09:59 -04:00
shchmue	220fb4ba3c	Clean up diskio.c, enforce buffer alignment	2019-05-17 09:17:14 -04:00
shchmue	83b75af726	Improve sprintf semantics and usage	2019-05-12 14:05:58 -04:00
shchmue	f73bb0b7b7	Tidy keys.c, align FATFS struct and its members	2019-05-12 13:15:23 -04:00
shchmue	f612ee2a8c	Find tsecfw size and offset firmware-agnostically	2019-05-11 21:03:24 -04:00
shchmue	1bc5c2a667	Merge newer hekate commits	2019-05-11 17:51:44 -04:00