4,558
edits
Changes
Jump to navigation
Jump to search
Line 45:
Line 45: + + + + + + + + Line 132:
Line 140: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
→Commands
|-
|-
| [[#0x04013104]] || 0x8 || 0x8
| [[#0x04013104]] || 0x8 || 0x8
|-
| [[#0x04011104]] || 0x8 || 0x4
|-
| [[#0x04011204]] || 0x8 || 0x4
|-
| [[#0x04011304]] || 0x8 || 0x4
|-
| [[#0x10011A04]] || 0x14 || 0x4
|}
|}
Unlike the other cmds, this checks for output_size==0x4, instead of {output buffer size} (it's unknown whether this is intended).
Unlike the other cmds, this checks for output_size==0x4, instead of {output buffer size} (it's unknown whether this is intended).
== 0x04011104 ==
Cmd+0x4 is the 4-byte input. The output_size is not checked.
See [[#0x10011A04]].
== 0x04011204 ==
Cmd+0x4 is the 4-byte input. The output_size is not checked.
See [[#0x10011A04]].
== 0x04011304 ==
Cmd+0x4 is the 4-byte input. The output_size is not checked.
See [[#0x10011A04]].
== 0x10011A04 ==
The app uses cmd [[#0x00020000]] first. When u8 reply_x5 from that cmd is >=0x20, it proceeds to use cmd 0x10011A04 then returns. Otherwise, the following cmds are used, with the same 4-byte input listed in the below table: [[#0x04011104]] (below cmd+0x4), [[#0x04011204]] (below cmd+0x8), [[#0x04011304]] (below cmd+0xC).
The app doesn't use reply data here besides the status, and the output_size is not checked.
Cmd:
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x4 || 0x2 || Func input param & 0xFFFF
|-
| 0x6 || 0x1 || [[#CRC]] over the previous 2-bytes.
|-
| 0x7 || 0x1 || Padding.
|-
| 0x8 || 0x2 || (Func input param >> 16) & 0xFFFF
|-
| 0xA || 0x1 || [[#CRC]] over the previous 2-bytes.
|-
| 0xB || 0x1 || Padding.
|-
| 0xC || 0x2 || (Func input param >> 32) & 0xFFFF
|-
| 0xE || 0x1 || [[#CRC]] over the previous 2-bytes.
|-
| 0xF || 0x1 || Padding.
|-
| 0x10 || 0x4 || Zeros
|}