;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; SMC_UTIL.INI
;
; This file contains several sections described below.  Please
; note that the SMC_UTIL engine ignores all whitespace in this file.
; Only one section is processed  at runtime based on the command line usage.
; The file is CASE SENSITIVE.
;
; The parsing engine for this file is not very robust, it can detect only
; basic errors.  Please follow the templates carefully.
;
; Comment lines must begin with a ';'.  Please do not place
; comments at the end of any line containing headers, data, etc.
;
; PATCH   - this section defines patches that search for a binary pattern and
;           replace the specifed bytes.  Useful for things like disabling code,
;           changing JTAG I/O, etc.
;
; CUSTOM  - this section allows you to define custom patches in INTEL HEX (I-HEX) format.
;           Custom patches do not use search engines, they are applied at the address
;           specifed in the I-HEX line.  Custom patches will only be applied if the
;           SMC version matches the specified version.
;
;           Custom patches are a convienient way to create a modified SMC built up from
;           the original file.  Future fixes or changes can simply be added as new
;           custom definitions.
;
; ANALYSIS - this section is similar to the 'PATCHES' section, except they are used for
;            reporting only.  This can be helpful to determine the state of the SMC.
;            Examples include checking for the PCIe write bug, checking which I/O are used
;            for JTAG, etc.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; PATCH
;
; When using the 'patch' mode, the program will execute the
; patches defined in this section.  The format is:
; 
; [NAME=<pattern_name>]
; [PAT=<code pattern>]
; [WILD=<wild card flags>]
; [<hex_offset>=<data>]
; ...
; [<hex_offset>=<data>]
; [\<pattern_name>]
;
; The pattern is a hexstring representing bytes.  The binary wildcard field
; has one bit for each pattern byte.  A '1' will mask the corresponding byte so it is
; not compared in the search.  A '0' means it is compared.  This is useful for
; parameters that might change, like SMC I/O used, etc.
;
; If the pattern match is found, the data will be modified using each <byte_offset>=<data>
; where <hex_offset> is measured from the begining of the pattern, and <data> is the new byte
; defined in hex.
; 
[PATCH]

[NAME=PCI_MASK_BUG]
; Search for the original hack's PCI write mask bug
; replace 0xD0 0xE0 0xF8 with 0xF8 0xD0 0xE0
;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
[PAT=2407D0E0F8]
;     0123456789            <= this line is just for byte labeling
[WILD=00000]
[2=F8]
[3=D0]
[4=E0]
[\PCI_MASK_BUG]

;;PNC_NO_CHARGE PATCH
;;This patch can modify an SMC that has been built with the AIO script.
;;Instead of charging in standby, it will shut the console down.  This will
;;allow you charge while using the console, but shutdown completely without having
;;to unplug the cable if you don't like leaving the console running.
;[NAME=PNC_NO_CHARGE]
;; Search for the 'startup_ran' function, turn on powerdown fsm
;; CLR ACC.1  MOV @R0,A  POP R0 RET
;; = 0xC2 0xE1 0xF6 0xD0 0x00 0x22
;;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
;[PAT=C2E1F6D00022]
;;     0123456789            <= this line is just for byte labeling
;[WILD=000000]
;; replace the CLR ACC.1 with enable power down fsm
;[0=D2]
;[1=04]
;[\PNC_NO_CHARGE]

;;UNCONDITIONAL_BOOT
;;This patch will unconditionally execute the JTAG during start events
;;restoring behavior to the original hack.  i.e.  Reboots on charging,
;[NAME=UNCONDITIONAL_BOOT]
;; Search for the JTAG boot gate
;; PUSH R7 MOV R0, <D/C>  MOV A,@R0  CJNE A, #0h, #025h
;; = 0xC0 0x07 0x78 0x?? 0xE6 0xB4 0x00 0x??
;;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
;[PAT=C0077800E6B40000]
;;     0123456789            <= this line is just for byte labeling
;[WILD=00010001]
;[2=00]
;[3=E5]
;[4=3D]
;[6=82]
;[\UNCONDITIONAL_BOOT]

;[NAME=TMS_PATCH]
;; Search for the 'set_jtag_tms' and 'clr_jtag_tms' functions
;; SETB <TMS> MOV <TMS_DELAY> DJNZ ACC <addr> RET CLR <TMS> 
;; = 0xD2 0x?? 0x74 0x?? 0xD5 0xE0 0xFD 0x22 0xC2 0x??
;;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
;[PAT=D2007400D5E0FD22C200]
;;     0123456789            <= this line is just for byte labeling
;[WILD=0101000001]
;; AUD_CLAMP = CC, DB1F1 = C0, ARGON_DATA = 83, TRAY_OPEN = CF
;[1=CC]
;[9=CC]
;[\TMS_PATCH]

;;[NAME=TDI_PATCH_0_of_3]
;; clk_jtag_data_out subroutine
;; MOV <TDI>, C  ACALL <addr>  DJNZ R7, -8  RET
;; = 0x92 <TDI> ACALL <addr> DF F8 22
;;     0 1 2 3 4 5 6    <= this line is just for byte labeling
;[PAT=92000000DFF822]
;;     0123456	       <= this line is just for byte labeling
;[WILD=0111000]
;; AUD_CLAMP = CC, DB1F1 = C0, ARGON_DATA = 83, TRAY_OPEN = CF
;[1=C0]
;[\TDI_PATCH_0_of_3]


;[NAME=TDI_PATCH_1_of_3]
;; clk_data_into_IR_reg subroutine
;; CLR <TDI>  MOV A, #02h  ACALL <don't care>  ACALL <don't care>  MOV A, #02h
;; = 0xC2 <TDI> 0x74 0x02 0x00 0x00 0x00 0x00 0x74 0x02
;;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
;[PAT=C2007402000000007402]
;;     0123456789	       <= this line is just for byte labeling
;[WILD=0100111100]
;; AUD_CLAMP = CC, DB1F1 = C0, ARGON_DATA = 83, TRAY_OPEN = CF
;[1=C0]
;[\TDI_PATCH_1_of_3]

;[NAME=TDI_PATCH_2_of_3]
;; clk_data_into_DR_reg subroutine
;; MOV R7, #01h  ACALL <don't care>  CLR <TDI>  MOV A, #01h
;; = 0x7F 0x01 0x00 0x00 0xC2 <TDI> 0x74 0x01
;;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
;[PAT=7F010000C2007401]
;;     0123456789	       <= this line is just for byte labeling
;[WILD=00110100]
;; AUD_CLAMP = CC, DB1F1 = C0, ARGON_DATA = 83, TRAY_OPEN = CF
;[5=C0]
;[\TDI_PATCH_2_of_3]

;[NAME=TDI_PATCH_3_of_3]
;; main jtag hack subroutine
;; mov @R0, <don't care>  MOV R0, <don't care>  MOV @R0, <don't care>  SETB <TDI>
;; = 0x76 0x00 0x78 0x00 0x76 0x00 0xD2 0x00
;;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
;[PAT=760078007600D200]
;;     0123456789	       <= this line is just for byte labeling
;[WILD=01010101]
;; AUD_CLAMP = CC, DB1F1 = C0, ARGON_DATA = 83, TRAY_OPEN = CF
;[7=C0]
;[\TDI_PATCH_3_of_3]

[\PATCH]

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; CUSTOM
;
; The program will execute all custom Intel Hex patches that match the SMC version
; detected.  If the patch version is set to "*", then the patch will be applied
; regardless of the detected SMC version.  The patches are applied sequentially in order.
;
; Append any custom patches you want to this file using the following format
;
; [patch_name=smc_version]
; INTEL HEX patchline
; INTEL HEX patchline
; ...
; :00000001FF
; [\patch_name]
;
;
; The ":00000001FF" is optional, it is ignored by the patch engine.
; You can add as many patches as you wish.
;
; The default All-In-One patches for each SMC version are below.
;
[CUSTOM]

[AIO151=1.51]
:0307560075817E2C
:0307750075817E0D
:03085100022F571C
:030FEF00122F01BD
:031D9400022F1DFE
:031E9700022F28EF
:031EB100022F39C4
:03119700022F4ADA
:03115300022F6FF9
:0307B60000000040
:102DC000D000001B00020100D000001B0002010027
:102DD000D0140013EA00C000D01400070000000661
:102DE000D0150013EA001000D015000700000006FF
:102DF000EA00C00F00000200EA00C01F00130360D9
:102E0000EA00C02300002080D2C17428D5E0FD2252
:102E1000C2C180F6D1087405D153D1107401C153D9
:102E2000EC2403F8740FF6EC2404F87F04E493F622
:102E3000A308DFF922E4A8047A08F608DAFC227A6B
:102E400003DAFE22C2C3D13FD2C3D13FC2C3D13FB6
:102E5000A2C222D144D5E0FB22A8047A08E613F6E8
:102E600008DAFA22D15992C0D144DFF822C0E0EC4E
:102E70002407F8D0E0F6D1087402D153D1107402BF
:102E8000D1537F07D164D1087F01D164C2C07402DD
:102E9000D153D1107402D15322D5E002C1A1FFD188
:102EA00064D1087F01D164C2C07401D153D11074C0
:102EB00001D1532274E0D16DD1207424D1992274B0
:102EC000E4D16DD1357401D1DF7401D1992274E15F
:102ED000D16DD127C1DA74E3D16D7420D19922C0AC
:102EE000E0EC2407F8D0E0F622D1B4D1BFD1D6224D
:102EF000D1B4D1CED1BF227E09902DC0D1F0DEFC5D
:102F00002212009AC000787EE6C2E0F6D00022C00D
:102F100000787EE620E003C2E1F6D00022C000780F
:102F20007E7600D000021E2D753D0DC000787EB665
:102F300004027600D000021E9A756402C000787EFA
:102F4000B604027600D000021EB4D20FC000787E14
:102F50007600D000021121B40403022F600208564B
:102F6000787DB6AA0575F507C2C27600020854C07E
:102F700000C002C003C004C006C007787EE6B400EB
:102F800029D2C2AC810C7B08C0E0DBFC0000D10878
:102F9000D114D1F7D11400007B08D0E0DBFC787DA0
:102FA00076AA787E7607D2C0D108D000D002D003AE
:102FB000D004D006D007122F0F201303021156C2DF
:022FC0000E22DF
:00000001FF
[\AIO151]

[AIO16=1.6]
:030756007581BBEF
:030775007581BBD0
:03085900022E9AD2
:03111900122E444F
:031E8400022E60CB
:031F8700022E6BBC
:031FA100022E7C91
:0312BA00022E8D74
:03127900022EB092
:102D0300D000001B00020100D000001B00020100E4
:102D1300D0140013EA00C000D0140007000000061E
:102D2300D0150013EA001000D015000700000006BC
:102D3300EA00C00F00000200EA00C01F0013036096
:102D4300EA00C02300002080D2CC7428D5E0FD2205
:102D5300C2CC80F6B14B7405B196B1537401A19600
:102D6300EC2403F8740FF6EC2404F87F04E493F6E0
:102D7300A308DFF922E4A8047A08F608DAFC227A29
:102D830003DAFE22C2C3B182D2C3B182C2C3B1820B
:102D9300A2C222B187D5E0FB22A8047A08E613F683
:102DA30008DAFA22B19C92C0B187DFF822C0E0ECC6
:102DB3002407F8D0E0F6B14B7402B196B153740214
:102DC300B1967F07B1A7B14B7F01B1A7C2C074020F
:102DD300B196B1537402B19622D5E002A1E4FFB1DA
:102DE300A7B14B7F01B1A7C2C07401B196B15374AF
:102DF30001B1962274E0B1B0B1637424B1DC2274E2
:102E0300E4B1B0B1787401D1227401B1DC2274E170
:102E1300B1B0B16AC11D74E3B1B07420B1DC22C09A
:102E2300E0EC2407F8D0E0F622B1F7D102D1192261
:102E3300B1F7D111D102227E09902D03D133DEFCEB
:102E4300221200C3C00078BBE6C2E0F6D00022C065
:102E53000078BBE620E003C2E1F6D00022C0007890
:102E6300BB7600D000021F1D753D0DC00078BBB6B8
:102E730004027600D000021F8A756502C00078BB89
:102E8300B604027600D000021FA4D20FC00078BBA4
:102E93007600D000021252B40403022EA302085E8D
:102EA30078BAB6AA0375F507760002085CC000C0BD
:102EB30002C003C004C006C00778BBE6B40027AC59
:102EC300810C7B08C0E0DBFC0000B14BB157D13A69
:102ED300B15700007B08D0E0DBFC78BA76AA78BB58
:102EE3007607D2C0B14BD000D002D003D004D006B5
:0E2EF300D007122E5220130302127CC20E22B0
:00000001FF
[\AIO16]

[AIO23=2.3]
:030756007581BBEF
:030775007581BBD0
:03085900022F0A61
:03111E00122EB4DA
:031E9F00022ED040
:031FA200022EDB31
:031FBC00022EEC06
:0312D100022EFDED
:03128700022F2013
:102D7300D000001B00020100D000001B0002010074
:102D8300D0140013EA00C000D014000700000006AE
:102D9300D0150013EA001000D0150007000000064C
:102DA300EA00C00F00000200EA00C01F0013036026
:102DB300EA00C02300002080D2CC7428D5E0FD2295
:102DC300C2CC80F6B1BB7405D106B1C37401C10690
:102DD300EC2403F8740FF6EC2404F87F04E493F670
:102DE300A308DFF922E4A8047A08F608DAFC227AB9
:102DF30003DAFE22C2C3B1F2D2C3B1F2C2C3B1F24B
:102E0300A2C222B1F7D5E0FB22A8047A08E613F6A2
:102E130008DAFA22D10C92C0B1F7DFF822C0E0EC55
:102E23002407F8D0E0F6B1BB7402D106B1C3740233
:102E3300D1067F07D117B1BB7F01D117C2C074027E
:102E4300D106B1C37402D10622D5E002C154FFD129
:102E530017B1BB7F01D117C2C07401D106B1C374CE
:102E630001D1062274E0D120B1D37424D14C227451
:102E7300E4D120B1E87401D1927401D14C2274E100
:102E8300D120B1DAC18D74E3D1207420D14C22C09A
:102E9300E0EC2407F8D0E0F622D167D172D1892281
:102EA300D167D181D172227E09902D73D1A3DEFC2B
:102EB300221200E0C00078BBE6C2E0F6D00022C0D8
:102EC3000078BBE620E003C2E1F6D00022C0007820
:102ED300BB7600D000021F38753D0DC00078BBB62D
:102EE30004027600D000021FA5756602C00078BBFD
:102EF300B604027600D000021FBFD20FC00078BB19
:102F03007600D000021257B40403022F1302085EA6
:102F130078BAB6AA0375F507760002085CC000C04C
:102F230002C003C004C006C00778BBE6B40027ACE8
:102F3300810C7B08C0E0DBFC0000B1BBB1C7D1AAA8
:102F4300B1C700007B08D0E0DBFC78BA76AA78BB77
:102F53007607D2C0B1BBD000D002D003D004D006D4
:0E2F6300D007122EC220130302128AC20E22C1
:00000001FF
[\AIO23]

[\CUSTOM]

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; SMC Analysis
;
; The SMC Analysis section defines binary patterns with wildcard
; capability.  These are used to search the SMC to report which
; hacks and patches have been applied.
;
; These are for reporting purposes only, they do not have any impact
; on the SMC file itself.
;
; The user can also write their own analysis scripts!
; 
; FORMAT:
; [NAME=<pattern name>]
; [PAT=<code pattern>]
; [WILD=<wild card flags>]
; [\<pattern_name>]
;
; The pattern is a hexstring representing bytes.  The wildcard field
; has one bit for each pattern byte.  A '1' will mask the corresponding byte so it is
; not compared in the search.  A '0' means it is compared.  This is useful
; for parameters that might change, like SMC I/O used, etc.
[ANALYSIS]

[NAME=DMA_READ_HACK]
; Search for the DMA Read hack
; CJNE A, #04h, #03h = 0xB4 0x04 0x03
; LJMP <don't care> = 0x02 0x?? 0x??
; LJMP <don't care> = 0x02 0x?? 0x??
;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
[PAT=B4040302000002]
;     0123456789            <= this line is just for byte labeling
[WILD=0000110]
[\DMA_READ_HACK]

[NAME=GPU_JTAG]
; Search for the GPU JTAG hack
; POP ACC = 0xD0 0xE0
; DJNZ R3, 0FEh = 0xDB 0xFC
; MOV R0, ?? = 0x78 0x??
; MOV @R0, ?? = 0x76 0x??
;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
[PAT=D0E0DBFC78007600]
;     0123456789            <= this line is just for byte labeling
[WILD=00000101]
[\GPU_JTAG]

[NAME=PCI_MASK_BUG]
; Search for the original hack's PCI write mask bug
[PAT=2407D0E0F8]
[WILD=00000]
[\PCI_MASK_BUG]

[NAME=TMS_PATCH]
; Search for the 'set_jtag_tms' and 'clr_jtag_tms' functions
; SETB <TMS> MOV A <TMS_DELAY> DJNZ ACC -3 RET CLR <TMS> 
; = 0xD2 0x?? 0x74 0x?? 0xD5 0xE0 0xFD 0x22 0xC2 0x??
;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
[PAT=D2007400D5E0FD22C200]
;     0123456789	    <= this line is just for byte labeling
[WILD=0101000001]
[REP:TMS_value_is=1]
[\TMS_PATCH]

[NAME=TDI_PATCH_0_of_3]
; clk_jtag_data_out subroutine
; MOV <TDI>, C  ACALL <addr>  DJNZ R7, -8  RET
; = 0x92 <TDI> ACALL <addr> DF F8 22
;     0 1 2 3 4 5 6    <= this line is just for byte labeling
[PAT=92000000DFF822]
;     0123456	       <= this line is just for byte labeling
[WILD=0111000]
[REP:TDI_value_is=1]
[\TDI_PATCH_0_of_3]

[NAME=TDI_PATCH_1_of_3]
; clk_data_into_IR_reg subroutine
; CLR <TDI>  MOV A, #02h  ACALL <don't care>  ACALL <don't care>  MOV A, #02h
; = 0xC2 <TDI> 0x74 0x02 0x00 0x00 0x00 0x00 0x74 0x02
;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
[PAT=C2007402000000007402]
;     0123456789	       <= this line is just for byte labeling
[WILD=0100111100]
[REP:TDI_value_is=1]
[\TDI_PATCH_1_of_3]

[NAME=TDI_PATCH_2_of_3]
; clk_data_into_DR_reg subroutine
; MOV R7, #01h  ACALL <don't care>  CLR <TDI>  MOV A, #01h
; = 0x7F 0x01 0x00 0x00 0xC2 <TDI> 0x74 0x01
;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
[PAT=7F010000C2007401]
;     0123456789	       <= this line is just for byte labeling
[WILD=00110100]
[REP:TDI_value_is=5]
[\TDI_PATCH_2_of_3]

[NAME=TDI_PATCH_3_of_3]
; main jtag hack subroutine
; mov @R0, <don't care>  MOV R0, <don't care>  MOV @R0, <don't care>  SETB <TDI>
; = 0x76 0x00 0x78 0x00 0x76 0x00 0xD2 0x00
;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
[PAT=760078007600D200]
;     0123456789	       <= this line is just for byte labeling
[WILD=01010101]
[REP:TDI_value_is=7]
[\TDI_PATCH_3_of_3]

[NAME=PNC_CHARGE]
; startup_ran subroutine
; jb ACC.0, #03h  clr ACC.1  mov @R0, A
; 0x20 0xE0 0x03 0xC2 0xE1 0xF6
;     0 1 2 3 4 5 6 7 8 9      <= this line is just for byte labeling
[PAT=20E003C2E1F6]
;     0123456789	       <= this line is just for byte labeling
[WILD=000000]
[\PNC_CHARGE]

[NAME=PNC_NO_CHARGE]
; Search for the 'startup_ran' function, turn on powerdown fsm
; CLR ACC.1  MOV @R0,A  POP R0 RET
; = 0xD2 0x04 0xF6 0xD0 0x00 0x22
;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
[PAT=D204F6D00022]
;     0123456789            <= this line is just for byte labeling
[WILD=000000]
[\PNC_NO_CHARGE]

[NAME=UNCONDITIONAL_BOOT]
; Search for the JTAG boot gate
; PUSH R7  NOP  MOV A, RAM_3D  CJNE A, #082h, <d/c>
; = 0xC0 0x07 0x78 0x?? 0xE6 0x00 0x00 0x00
;     0 1 2 3 4 5 6 7 8 9   <= this line is just for byte labeling
[PAT=C00700E53DB48200]
;     0123456789            <= this line is just for byte labeling
[WILD=00000001]
[\UNCONDITIONAL_BOOT]

[\ANALYSIS]
