path: root/source/main.c

/*
 * Copyright (C) 2017 hatkirby
 * Copyright (C) 2017 slipstream/RoL
 * Copyright (C) 2016 FIX94
 *
 * This software may be modified and distributed under the terms
 * of the MIT license.  See the LICENSE file for details.
 */
#include <gccore.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <malloc.h>
#include "link.h"
#include "encoding.h"

//from my tests 50us seems to be the lowest
//safe si transfer delay in between calls
#define SI_TRANS_DELAY 50

extern u8 gba_mb_gba[];
extern u32 gba_mb_gba_size;

void printmain()
{
  printf("\x1b[2J");
  printf("\x1b[37m");
  printf("Pokemon Gen III Data Extractor by hatkirby\n");
	printf("Based on gba-gen3multiboot by slipstream/RoL\n");
  printf("Based on GBA Link Cable Dumper v1.6 by FIX94\n");
}

u8 *resbuf,*cmdbuf;

volatile u32 transval = 0;
void transcb(s32 chan, u32 ret)
{
  transval = 1;
}

volatile u32 resval = 0;
void acb(s32 res, u32 val)
{
  resval = val;
}

unsigned int docrc(u32 crc,u32 val)
{
	u32 result;

	result = val ^ crc;
	for (int i = 0; i < 0x20; i++)
	{
		if (result & 1)
		{
			result >>= 1;
			result ^= 0xA1C1;
		} else {
			result >>= 1;
		}
	}

	return result;
}

void doreset()
{
  cmdbuf[0] = 0xFF; //reset
  transval = 0;
  SI_Transfer(1, cmdbuf, 1, resbuf, 3, transcb, SI_TRANS_DELAY);

  while (transval == 0);
}

void getstatus()
{
  cmdbuf[0] = 0; //status
  transval = 0;
  SI_Transfer(1, cmdbuf, 1, resbuf, 3, transcb, SI_TRANS_DELAY);

  while (transval == 0);
}

void endproc()
{
	doreset();
  printf("Start pressed, exit\n");
  VIDEO_WaitVSync();
  VIDEO_WaitVSync();
  exit(0);
}

u32 recv()
{
  memset(resbuf,0,32);
  cmdbuf[0]=0x14; //read
  transval = 0;
  SI_Transfer(1, cmdbuf, 1, resbuf, 5, transcb, SI_TRANS_DELAY);

	while (transval == 0);
	printf("%08lx\n", *(vu32*)resbuf);
  return *(vu32*)resbuf;
}

void send(u32 msg)
{
  cmdbuf[0] = 0x15;
  cmdbuf[1] = (msg >> 0) & 0xFF;
  cmdbuf[2] = (msg >> 8) & 0xFF;
  cmdbuf[3] = (msg >> 16) & 0xFF;
  cmdbuf[4] = (msg >> 24) & 0xFF;

  transval = 0;
  resbuf[0] = 0;
  SI_Transfer(1, cmdbuf, 5, resbuf, 1, transcb, SI_TRANS_DELAY);

  while (transval == 0);
}

void warnError(char *msg)
{
  puts(msg);
  VIDEO_WaitVSync();
  VIDEO_WaitVSync();
  sleep(2);
}

void fatalError(char *msg)
{
  puts(msg);
  VIDEO_WaitVSync();
  VIDEO_WaitVSync();
  sleep(5);
  exit(0);
}

u32 genKeyA()
{
	u32 retries = 0;

	for (;;)
	{
		u32 key = 0;

		if (retries > 32)
		{
			key = 0xDD654321;
		} else {
			key = (rand() & 0x00ffffff) | 0xDD000000;
		}

		u32 unk = (key % 2 != 0);
		u32 v12 = key;
		for (u32 v13 = 1; v13 < 32; v13++)
		{
			v12 >>= 1;
			unk += (v12 % 2 != 0);
		}

		if ((unk >= 10 && unk <= 24))
		{
			if (retries > 4)
			{
				printf("KeyA retries = %ld", retries);
			}

			printf("KeyA = 0x%08lx\n", key);

			return key;
		}

		retries++;
	}
}

u32 checkKeyB(u32 KeyBRaw)
{
	if ((KeyBRaw & 0xFF) != 0xEE)
	{
		printf("Invalid KeyB - lowest 8 bits should be 0xEE, actually 0x%02x\n",
			((u8)(KeyBRaw)));

		return 0;
	}

	u32 KeyB = KeyBRaw & 0xffffff00;
	u32 val = KeyB;
	u32 unk = (val < 0);
	for (u32 i = 1; i < 24; i++)
	{
		val <<= 1;
		unk += (val < 0);
	}

	if (unk > 14)
	{
		printf("Invalid KeyB - high 24 bits bad: 0x%08lx\n", KeyB);

		return 0;
	}

	printf("Valid KeyB: 0x%08lx\n", KeyB);

	return KeyB;
}

u32 deriveKeyC(u32 keyCderive, u32 kcrc)
{
	u32 keyc = 0;
	u32 keyCi = 0;

	do
	{
		u32 v5 = 0x1000000 * keyCi - 1;
		u32 keyCattempt = docrc(kcrc,v5);

		if (keyCderive == keyCattempt)
		{
			keyc = v5;

			printf("Found keyC: %08lx\n",keyc);

			return keyc;
		}

		keyCi++;
	} while (keyCi < 256);

	return keyc;
}

u32 getMsg()
{
  u32 val = 0;
	while (val == 0)
	{
		val = __builtin_bswap32(recv());
		sleep(1);
	}

  send(0);
	while (recv()!=0) {sleep(1);};
	send(0);

	return val;
}

int main(int argc, char *argv[])
{
  void *xfb = NULL;
  GXRModeObj *rmode = NULL;
  VIDEO_Init();
  rmode = VIDEO_GetPreferredMode(NULL);
  xfb = MEM_K0_TO_K1(SYS_AllocateFramebuffer(rmode));
  VIDEO_Configure(rmode);
  VIDEO_SetNextFramebuffer(xfb);
  VIDEO_SetBlack(FALSE);
  VIDEO_Flush();
  VIDEO_WaitVSync();
  if(rmode->viTVMode&VI_NON_INTERLACE) VIDEO_WaitVSync();
  int x = 24, y = 32, w, h;
  w = rmode->fbWidth - (32);
  h = rmode->xfbHeight - (48);
  CON_InitEx(rmode, x, y, w, h);
  VIDEO_ClearFrameBuffer(rmode, xfb, COLOR_BLACK);
  PAD_Init();
  cmdbuf = memalign(32,32);
  resbuf = memalign(32,32);

  for (;;)
  {
    printmain();

		printf("Press A to begin, press Start to quit.\n");
		if (waitForButtons(PAD_BUTTON_A | PAD_BUTTON_START) & PAD_BUTTON_START)
		{
			endproc();
		}

    printf("Waiting for a GBA in port 2...\n");
    resval = 0;

    SI_GetTypeAsync(1,acb);
    while(1)
    {
      if (resval)
      {
        if (resval == 0x80 || resval & 8)
        {
          resval = 0;
          SI_GetTypeAsync(1,acb);
        } else if (resval)
        {
          break;
        }
      }

      PAD_ScanPads();
      VIDEO_WaitVSync();
      if (PAD_ButtonsHeld(0) & PAD_BUTTON_START)
      {
				getstatus();
        endproc();
      }
    }

    if (resval & SI_GBA)
    {
      printf("GBA Found! Waiting on BIOS\n");

			resbuf[2]=0;

			// wait for the BIOS to hand over to the game
			do
			{
				doreset();
			} while (!(resbuf[1] > 4));

			printf("BIOS handed over to game, waiting on game\n");

			do
			{
				doreset();
			} while ((resbuf[0] != 0) || !(resbuf[2] & 0x10));

			// receive the game-code from GBA side.
			u32 gamecode = recv();

			printf("Ready, sending multiboot ROM\n");

			unsigned int sendsize = ((gba_mb_gba_size+7)&~7);

			// generate KeyA
			unsigned int ourkey = genKeyA();

			//printf("Our Key: %08x\n", ourkey);
			printf("Sending game code that we got: 0x%08lx\n",
				__builtin_bswap32(gamecode));

			// send the game code back, then KeyA.
			send(__builtin_bswap32(gamecode));
			send(ourkey);

			// get KeyB from GBA, check it to make sure its valid, then xor with KeyA
			// to derive the initial CRC value and the sessionkey.
			u32 sessionkeyraw = 0;
			do
			{
				sessionkeyraw = recv();
			} while (sessionkeyraw == gamecode);

			sessionkeyraw = checkKeyB(__builtin_bswap32(sessionkeyraw));
			if (sessionkeyraw == 0)
			{
				warnError("Cannot continue.\n");

				continue;
			}

			u32 sessionkey = sessionkeyraw ^ ourkey;
			u32 kcrc = sessionkey;
			printf("start kCRC=%08lx\n",kcrc);

			sessionkey = (sessionkey*0x6177614b)+1;

			// send hacked up send-size in uint32s
			u32 hackedupsize = (sendsize >> 3) - 1;

			printf("Sending hacked up size 0x%08lx\n",hackedupsize);
			send(hackedupsize);

			//unsigned int fcrc = 0x00bb;
			// send over multiboot binary header, in the clear until the end of the
			// nintendo logo. GBA checks this, if nintendo logo does not match the
			// one in currently inserted cart's ROM, it will not accept any more data.
			for (int i = 0; i < 0xA0; i+=4)
			{
				vu32 rom_dword = *(vu32*)(gba_mb_gba+i);
				send(__builtin_bswap32(rom_dword));
			}

			printf("\n");
			printf("Header done! Sending ROM...\n");

			// Add each uint32 of the multiboot image to the checksum, encrypt the
			// uint32 with the session key, increment the session key, send the
			// encrypted uint32.
			for (int i = 0xA0; i < sendsize; i+=4)
			{
				u32 dec = (
					(((gba_mb_gba[i+3]) << 24) & 0xff000000) |
					(((gba_mb_gba[i+2]) << 16) & 0x00ff0000) |
					(((gba_mb_gba[i+1]) << 8)  & 0x0000ff00) |
					(((gba_mb_gba[i])   << 0)  & 0x000000ff)
				);

				u32 enc = (dec - kcrc) ^ sessionkey;
				kcrc = docrc(kcrc,dec);
				sessionkey = (sessionkey * 0x6177614B) + 1;
				//enc^=((~(i+(0x20<<20)))+1);
				//enc^=0x6f646573;//0x20796220;

				send(enc);
			}

			//fcrc |= (sendsize<<16);
			printf("ROM done! CRC: %08lx\n", kcrc);
			//get crc back (unused)

			// Get KeyC derivation material from GBA (eventually)
			u32 keyCderive = 0;
			do
			{
				keyCderive = recv();
			} while (keyCderive <= 0xfeffffff);

			keyCderive = __builtin_bswap32(keyCderive);
			keyCderive >>= 8;

			printf("KeyC derivation material: %08lx\n",keyCderive);

			// (try to) find the KeyC, using the checksum of the multiboot image, and
			// the derivation material that GBA sent to us
			u32 keyc = deriveKeyC(keyCderive,kcrc);
			if (keyc == 0)
			{
				printf("Could not find keyC - kcrc=0x%08lx\n",kcrc);
        warnError("Cannot continue.\n");

				continue;
			}

			// derive the boot key from the found KeyC, and send to GBA. if this is
      // not correct, GBA will not jump to the multiboot image it was sent.
			u32 bootkey = docrc(0xBB,keyc) | 0xbb000000;
			printf("BootKey = 0x%08lx\n",bootkey);

			send(bootkey);
			sleep(2);

			printf("Waiting for GBA...\n");
			while (recv() != 0) {sleep(1);};
			send(0);

      VIDEO_WaitVSync();

      // Get game
      // -1 - unsupported game
      //  1 - Ruby
      //  2 - Sapphire
      //  3 - FireRed
      //  4 - LeafGreen
      //  5 - Emerald
      u32 gameId = getMsg();
      if (gameId == -1)
      {
        warnError("ERROR: Unsupported GBA game inserted!\n");

        continue;
      }

      printf("\nPokemon ");
      switch (gameId)
      {
        case 1: printf("Ruby"); break;
        case 2: printf("Sapphire"); break;
        case 3: printf("FireRed"); break;
        case 4: printf("LeafGreen"); break;
        case 5: printf("Emerald"); break;
      }

      printf("\n");
			VIDEO_WaitVSync();

			u32 isValid = getMsg();
      if (isValid == -1)
      {
        warnError("ERROR: Unsupported game version inserted!\n");

        continue;
      }

      // Get trainer name
      u8 trainerName[8];

      u32 tnd = getMsg();
      trainerName[0] = (tnd & 0xFF000000) >> 24;
      trainerName[1] = (tnd & 0x00FF0000) >> 16;
      trainerName[2] = (tnd & 0x0000FF00) >> 8;
      trainerName[3] = (tnd & 0x000000FF);

      tnd = getMsg();
      trainerName[4] = (tnd & 0xFF000000) >> 24;
      trainerName[5] = (tnd & 0x00FF0000) >> 16;
      trainerName[6] = (tnd & 0x0000FF00) >> 8;
      trainerName[7] = (tnd & 0x000000FF);

      // Get trainer ID
      u32 trainerId = getMsg();

      printf("Trainer: ");

			for (int i = 0; i < 8; i++)
			{
				if (trainerName[i] == 0xFF)
				{
					break;
				} else {
					printf("%c", debugGen3Decode(trainerName[i]));
				}
			}

      printf(" (%ld)\n", trainerId);

      // Wait for confirmation.
      printf("Press A to import the data from this game.\n");
      printf("Press B to cancel.\n");
			VIDEO_WaitVSync();

      if (waitForButtons(PAD_BUTTON_A | PAD_BUTTON_B) & PAD_BUTTON_B)
      {
        continue;
      }
    }
  }

  return 0;
}