// File: /workspace/github_c_makefile_star2_O0/jogolden[P]ps4flashtool/southbridge.c
// Function: replace_emc_ipl
int replace_emc_ipl(unsigned char *flashdata, unsigned char *newipl, int length) {
    struct bldr_hdr *blhdr = flash_locate_emc_ipl(flashdata, 0);
    unsigned char *hdraeskey = keymgr_getkey("emciplaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("emciplhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EMC IPL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EMC IPL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // decrypt header
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &blhdr->crypteddata, 0x50);

    // encrypt body and replace it in flash
    if(verbose) {
        printf("* old EMC IPL body_len 0x%X\n", blhdr->body_len);
        printf("* new EMC IPL body_len 0x%X\n", length);
    }

    if(blhdr->body_len != length) {
        printf("warning: new EMC IPL has a different body length\n");
    }

    blhdr->body_len = length;
    aes128_cbc_iv_zero_encrypt(blhdr->crypteddata.iplbodyaeskey, newipl, &blhdr->bodystart, blhdr->body_len);

    // replace body signature
    hmac_sha1(blhdr->crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);

    if(verbose) {
        printf("* old EMC IPL body hmac-sha1: ");
        hexdump(blhdr->crypteddata.iplbodyhmac, 0x14, 0);

        printf("* new EMC IPL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);
    }

    memcpy(blhdr->crypteddata.iplbodyhmac, bodyhmac, sizeof(bodyhmac));

    // filler null
    memset(blhdr->crypteddata.filler, 0, 8);

    // replace header signature
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)blhdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* old EMC IPL header hmac-sha1: ");
        hexdump(blhdr->crypteddata.headerhmac, 0x14, 0);

        printf("* new EMC IPL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    memcpy(blhdr->crypteddata.headerhmac, hdrhmac, sizeof(hdrhmac));

    // encrypt header
    aes128_cbc_iv_zero_encrypt(hdraeskey, &blhdr->crypteddata, &blhdr->crypteddata, 0x50);

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x70, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movl %edx, -0x14(%rbp)
movq -0x8(%rbp), %rdi
xorl %esi, %esi
callq 0x9b10
movq %rax, -0x20(%rbp)
leaq 0x2fef(%rip), %rdi      # 0xd248
movl $0xa1, %esi
callq 0x7200
movq %rax, -0x28(%rbp)
leaq 0x2fe4(%rip), %rdi      # 0xd252
movl $0xb1, %esi
callq 0x7200
movq %rax, -0x30(%rbp)
leaq 0x60c1(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa2c4
leaq 0x2fce(%rip), %rdi      # 0xd25d
movb $0x0, %al
callq 0x2080
movq -0x28(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2fcb(%rip), %rdi      # 0xd278
movb $0x0, %al
callq 0x2080
movq -0x30(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
movq -0x28(%rbp), %rdi
movq -0x20(%rbp), %rsi
addq $0x30, %rsi
movq -0x20(%rbp), %rdx
addq $0x30, %rdx
movl $0x50, %ecx
callq 0x3b60
leaq 0x605b(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa314
movq -0x20(%rbp), %rax
movl 0xc(%rax), %esi
leaq 0x3095(%rip), %rdi      # 0xd391
movb $0x0, %al
callq 0x2080
movl -0x14(%rbp), %esi
leaq 0x30a1(%rip), %rdi      # 0xd3ae
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rax
movl 0xc(%rax), %eax
cmpl -0x14(%rbp), %eax
je 0xa32e
leaq 0x30a4(%rip), %rdi      # 0xd3cb
movb $0x0, %al
callq 0x2080
movl -0x14(%rbp), %ecx
movq -0x20(%rbp), %rax
movl %ecx, 0xc(%rax)
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
movq -0x10(%rbp), %rsi
movq -0x20(%rbp), %rdx
addq $0x80, %rdx
movq -0x20(%rbp), %rax
movl 0xc(%rax), %ecx
callq 0x3b10
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x10, %rdi
movq -0x20(%rbp), %rdx
addq $0x80, %rdx
movq -0x20(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, %ecx
leaq -0x50(%rbp), %r8
movl $0x10, %esi
callq 0x6df0
leaq 0x5fb4(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa3d9
leaq 0x3061(%rip), %rdi      # 0xd3fd
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x20, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x305a(%rip), %rdi      # 0xd41c
movb $0x0, %al
callq 0x2080
leaq -0x50(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
movq -0x20(%rbp), %rax
movq -0x50(%rbp), %rcx
movq %rcx, 0x50(%rax)
movq -0x48(%rbp), %rcx
movq %rcx, 0x58(%rax)
movl -0x40(%rbp), %ecx
movl %ecx, 0x60(%rax)
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x34, %rdi
xorl %esi, %esi
movl $0x8, %edx
callq 0x20a0
movq -0x30(%rbp), %rdi
movq -0x20(%rbp), %rdx
leaq -0x70(%rbp), %r8
movl $0x10, %esi
movl $0x6c, %ecx
callq 0x6df0
leaq 0x5f17(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa476
leaq 0x3002(%rip), %rdi      # 0xd43b
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x3c, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2ffd(%rip), %rdi      # 0xd45c
movb $0x0, %al
callq 0x2080
leaq -0x70(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
movq -0x20(%rbp), %rax
movq -0x70(%rbp), %rcx
movq %rcx, 0x6c(%rax)
movq -0x68(%rbp), %rcx
movq %rcx, 0x74(%rax)
movl -0x60(%rbp), %ecx
movl %ecx, 0x7c(%rax)
movq -0x28(%rbp), %rdi
movq -0x20(%rbp), %rsi
addq $0x30, %rsi
movq -0x20(%rbp), %rdx
addq $0x30, %rdx
movl $0x50, %ecx
callq 0x3b10
xorl %eax, %eax
addq $0x70, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)