I need some help in understanding the AudioSwitch. Especially this part:
Code: Select all
void *asw_movieplay_injection()
{
...
asm volatile(
"MOV R10,%0\n"
"STR R10,[R5,#0xDB0]\n"
:
: "r" (asw_streamid[asw_currentstream]) );
...
}
It stores "asw_streamid[asw_currentstream]" into [R5, ,#0xDB0]. The values in "asw_streamid[]" are assigned in "asw_process_mediatype()":
Code: Select all
...
asw_streamcodec[asw_streams] = u8;
asw_streamid[asw_streams] = u9;
asw_streamptr[asw_streams] = u7;
asw_streams++;
...
with "u9" coming from the injector code "asw_mediatype_injection()"
Code: Select all
...
"ADD R9, R6, #0x1\n"
);
asm volatile(
"MOV r5,%0\n"
"STR r7,[r5]\n"
"MOV r5,%1\n"
"STR r8,[r5]\n"
"MOV r5,%2\n"
"STR r9,[r5]\n"
:
: "r" (&u7), "r" (&u8), "r" (&u9) );
asw_process_mediatype();
...
So, asw_streamid[] contains the stream index + 1. That's OK so far. But when I look at the original code in Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void), which populates [R5,#0xDB0], it shows this:
Code: Select all
...
text:00FCE8A4 loc_FCE8A4 ; CODE XREF: Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void)+14j
.text:00FCE8A4 ; DATA XREF: Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void)+1Co
.text:00FCE8A4 00 20 A0 E3 MOV R2, #0 ; jumptable 00FCE860 case 11
.text:00FCE8A8 01 10 A0 E3 MOV R1, #1
.text:00FCE8AC C0 30 A0 E3 MOV R3, #0xC0
.text:00FCE8B0 AC 2D 80 E5 STR R2, [R0,#0xDAC]
.text:00FCE8B4 B0 3D 80 E5 STR R3, [R0,#0xDB0]
.text:00FCE8B8 A0 2D 80 E5 STR R2, [R0,#0xDA0]
.text:00FCE8BC 9C 2D 80 E5 STR R2, [R0,#0xD9C]
.text:00FCE8C0 01 00 A0 E1 MOV R0, R1
.text:00FCE8C4 00 A8 9D E8 LDMFD SP, {R11,SP,PC}
.text:00FCE8C8 ; ---------------------------------------------------------------------------
.text:00FCE8C8
.text:00FCE8C8 loc_FCE8C8 ; CODE XREF: Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void)+14j
.text:00FCE8C8 ; DATA XREF: Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void)+1Co
.text:00FCE8C8 98 3D 90 E5 LDR R3, [R0,#0xD98] ; jumptable 00FCE860 cases 4,8
.text:00FCE8CC 05 00 53 E3 CMP R3, #5
.text:00FCE8D0 01 00 00 0A BEQ loc_FCE8DC
.text:00FCE8D4 04 00 53 E3 CMP R3, #4
.text:00FCE8D8 EE FF FF 1A BNE loc_FCE898 ; default
.text:00FCE8D8 ; jumptable 00FCE860 cases 1-3,5-7,9,10
.text:00FCE8DC
.text:00FCE8DC loc_FCE8DC ; CODE XREF: Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void)+84j
.text:00FCE8DC A8 3D 90 E5 LDR R3, [R0,#0xDA8] ; CMovie->SamsungAudioCodecID
.text:00FCE8E0 03 00 53 E3 CMP R3, #3
.text:00FCE8E4 BD 30 83 02 ADDEQ R3, R3, #0xBD
.text:00FCE8E8 B0 3D 80 05 STREQ R3, [R0,#0xDB0]
.text:00FCE8EC 02 00 00 0A BEQ loc_FCE8FC
.text:00FCE8F0 09 00 53 E3 CMP R3, #9
.text:00FCE8F4 97 30 83 02 ADDEQ R3, R3, #0x97
.text:00FCE8F8 B0 3D 80 05 STREQ R3, [R0,#0xDB0]
.text:00FCE8FC
.text:00FCE8FC loc_FCE8FC ; CODE XREF: Multimedia::MediaPlayer::Movie::CMovie::SetStreamId(void)+A0j
.text:00FCE8FC E0 30 A0 E3 MOV R3, #0xE0
.text:00FCE900 01 10 A0 E3 MOV R1, #1
.text:00FCE904 AC 3D 80 E5 STR R3, [R0,#0xDAC]
.text:00FCE908 A0 3D 80 E5 STR R3, [R0,#0xDA0]
.text:00FCE90C 9C 3D 80 E5 STR R3, [R0,#0xD9C]
.text:00FCE910 01 00 A0 E1 MOV R0, R1
.text:00FCE914 00 A8 9D E8 LDMFD SP, {R11,SP,PC}
...
So, #0xDB0 is not just "stream index + 1".
Do I miss something?