// File: /workspace/github_c_makefile_star2_O2/jogolden[P]ps4flashtool/southbridge.c
// Function: verify_emc_ipl
int verify_emc_ipl(unsigned char *flashdata) {
    struct bldr_hdr *blhdr = flash_locate_emc_ipl(flashdata, 0);
    unsigned char *hdraeskey = keymgr_getkey("emciplaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("emciplhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EMC IPL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EMC IPL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    struct bldr_hdr dechdr;
    unsigned char *decbody = (unsigned char *)malloc(blhdr->body_len);
    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // copy the header on to the stack, we dont want to modify anything
    memcpy(&dechdr, blhdr, blhdr->hdr_len);
    
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &dechdr.crypteddata, 0x50);

    hmac_sha1(dechdr.crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)&dechdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* flash EMC IPL body hmac-sha1: ");
        hexdump(dechdr.crypteddata.iplbodyhmac, 0x14, 0);

        printf("* calculated EMC IPL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);

        printf("* flash EMC IPL header hmac-sha1: ");
        hexdump(dechdr.crypteddata.headerhmac, 0x14, 0);

        printf("* calculated EMC IPL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    // some checks that the rom will do
    unsigned char *h = (unsigned char *)&dechdr;
    int flag;

    // TODO: clean this all up and make it nice :P
    flag = *(unsigned short *)&h[6] >> 14 == 1;
    if(!flag) {
        flag = *(unsigned short *)&h[6] >> 14 == 2;
    }

    if(!flag) {
        printf("error: header flag part 1 invalid!\n");
        return 1;
    }

    flag = (*(unsigned short *)&h[6] >> 12) & 3;
    if(flag == 0) {
        flag = *(unsigned short *)&h[8] == 0x80;
    }

    if(!flag || h[12] & 0x0F) {
        printf("error: header flag part 2 invalid!\n");
        return 1;
    }

    if(dechdr.load_addr_1 < 0x100C00) {
        printf("error: invalid load address!\n");
        return 1;
    }

    // TODO: add size checks also and other stuff

    free(decbody);

    return memcmp(bodyhmac, dechdr.crypteddata.iplbodyhmac, sizeof(bodyhmac)) + 
        memcmp(hdrhmac, &dechdr.crypteddata.headerhmac, sizeof(bodyhmac));
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xb8, %rsp
xorl %esi, %esi
callq 0x5f48
movq %rax, %rbx
leaq 0x20f5(%rip), %rdi      # 0x81df
movl $0xa1, %esi
callq 0x4954
movq %rax, %r15
leaq 0x20eb(%rip), %rdi      # 0x81e9
movl $0xb1, %esi
callq 0x4954
movq %rax, %r14
leaq 0x5212(%rip), %r13      # 0xb324
cmpl $0x0, (%r13)
je 0x6150
leaq 0x20d4(%rip), %rdi      # 0x81f4
xorl %eax, %eax
callq 0x20b0
pushq $0x10
popq %rbp
movq %r15, %rdi
movl %ebp, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x20d2(%rip), %rdi      # 0x820f
xorl %eax, %eax
callq 0x20b0
movq %r14, %rdi
movl %ebp, %esi
xorl %edx, %edx
callq 0x3559
movl 0x8(%rbx), %edx
leaq 0x37(%rsp), %r12
movq %r12, %rdi
movq %rbx, %rsi
callq 0x2140
leaq 0x30(%rbx), %rsi
leaq 0x67(%rsp), %rdx
pushq $0x50
popq %rcx
movq %r15, %rdi
callq 0x2994
leaq 0x77(%rsp), %rdi
movq %rbx, %rdx
subq $-0x80, %rdx
movl 0xc(%rbx), %ecx
pushq $0x10
popq %rbx
leaq 0x20(%rsp), %r8
movq %rbx, %rsi
callq 0x466c
pushq $0x6c
popq %rcx
movq %rsp, %r8
movq %r14, %rdi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x466c
cmpl $0x0, (%r13)
je 0x6228
leaq 0x2078(%rip), %rdi      # 0x8230
xorl %eax, %eax
callq 0x20b0
leaq 0x87(%rsp), %rdi
pushq $0x14
popq %rbx
movl %ebx, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x2077(%rip), %rdi      # 0x8251
xorl %eax, %eax
callq 0x20b0
leaq 0x20(%rsp), %rdi
movl %ebx, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x2081(%rip), %rdi      # 0x8277
xorl %eax, %eax
callq 0x20b0
leaq 0xa3(%rsp), %rdi
movl %ebx, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x2085(%rip), %rdi      # 0x829a
xorl %eax, %eax
callq 0x20b0
movq %rsp, %rdi
movl %ebx, %esi
xorl %edx, %edx
callq 0x3559
movzwl 0x3d(%rsp), %eax
movl %eax, %ecx
shrl $0xe, %ecx
decl %ecx
cmpw $0x2, %cx
jae 0x6262
shrl $0xc, %eax
andl $0x3, %eax
jne 0x624e
xorl %eax, %eax
cmpw $0x80, 0x3f(%rsp)
sete %al
testl %eax, %eax
je 0x6259
testb $0xf, 0x43(%rsp)
je 0x6283
leaq 0x23ad(%rip), %rdi      # 0x860d
jmp 0x6269
leaq 0x2364(%rip), %rdi      # 0x85cd
callq 0x2060
pushq $0x1
popq %rax
addq $0xb8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
cmpl $0x100bff, 0x4b(%rsp)   # imm = 0x100BFF
ja 0x6296
leaq 0x235c(%rip), %rdi      # 0x85f0
jmp 0x6269
leaq 0x87(%rsp), %rsi
leaq 0x20(%rsp), %rdi
pushq $0x14
popq %rbx
movq %rbx, %rdx
callq 0x20f0
movl %eax, %ebp
leaq 0xa3(%rsp), %rsi
movq %rsp, %rdi
movq %rbx, %rdx
callq 0x20f0
addl %ebp, %eax
jmp 0x6271