// File: /workspace/github_c_makefile_star2_O0/jogolden[P]ps4flashtool/southbridge.c
// Function: replace_eap_kbl
int replace_eap_kbl(unsigned char *flashdata, unsigned char *newkbl, int length) {
    struct bldr_hdr *blhdr = flash_locate_eap_kbl(flashdata);
    unsigned char *hdraeskey = keymgr_getkey("eapkblaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("eapkblhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EAP KBL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EAP KBL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // decrypt header
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &blhdr->crypteddata, 0x50);

    // encrypt body and replace it in flash
    if(verbose) {
        printf("* old EAP KBL body_len 0x%X\n", blhdr->body_len);
        printf("* new EAP KBL body_len 0x%X\n", length);
    }

    if(blhdr->body_len != length) {
        printf("warning: new EAP KBL has a different body length\n");
    }

    blhdr->body_len = length;
    aes128_cbc_iv_zero_encrypt(blhdr->crypteddata.iplbodyaeskey, newkbl, &blhdr->bodystart, blhdr->body_len);

    // replace body signature
    hmac_sha1(blhdr->crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);

    if(verbose) {
        printf("* old EAP KBL body hmac-sha1: ");
        hexdump(blhdr->crypteddata.iplbodyhmac, 0x14, 0);

        printf("* new EAP KBL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);
    }

    memcpy(blhdr->crypteddata.iplbodyhmac, bodyhmac, sizeof(bodyhmac));

    // filler null
    memset(blhdr->crypteddata.filler, 0, 8);

    // replace header signature
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)blhdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* old EAP KBL header hmac-sha1: ");
        hexdump(blhdr->crypteddata.headerhmac, 0x14, 0);

        printf("* new EAP KBL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    memcpy(blhdr->crypteddata.headerhmac, hdrhmac, sizeof(hdrhmac));

    // encrypt header
    aes128_cbc_iv_zero_encrypt(hdraeskey, &blhdr->crypteddata, &blhdr->crypteddata, 0x50);

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x70, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movl %edx, -0x14(%rbp)
movq -0x8(%rbp), %rdi
callq 0x9cc0
movq %rax, -0x20(%rbp)
leaq 0x2c46(%rip), %rdi      # 0xd47d
movl $0xa1, %esi
callq 0x7200
movq %rax, -0x28(%rbp)
leaq 0x2c3b(%rip), %rdi      # 0xd487
movl $0xb1, %esi
callq 0x7200
movq %rax, -0x30(%rbp)
leaq 0x5ae3(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa8a2
leaq 0x2c25(%rip), %rdi      # 0xd492
movb $0x0, %al
callq 0x2080
movq -0x28(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2c22(%rip), %rdi      # 0xd4ad
movb $0x0, %al
callq 0x2080
movq -0x30(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
movq -0x28(%rbp), %rdi
movq -0x20(%rbp), %rsi
addq $0x30, %rsi
movq -0x20(%rbp), %rdx
addq $0x30, %rdx
movl $0x50, %ecx
callq 0x3b60
leaq 0x5a7d(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa8f2
movq -0x20(%rbp), %rax
movl 0xc(%rax), %esi
leaq 0x2c86(%rip), %rdi      # 0xd560
movb $0x0, %al
callq 0x2080
movl -0x14(%rbp), %esi
leaq 0x2c92(%rip), %rdi      # 0xd57d
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rax
movl 0xc(%rax), %eax
cmpl -0x14(%rbp), %eax
je 0xa90c
leaq 0x2c95(%rip), %rdi      # 0xd59a
movb $0x0, %al
callq 0x2080
movl -0x14(%rbp), %ecx
movq -0x20(%rbp), %rax
movl %ecx, 0xc(%rax)
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
movq -0x10(%rbp), %rsi
movq -0x20(%rbp), %rdx
addq $0x80, %rdx
movq -0x20(%rbp), %rax
movl 0xc(%rax), %ecx
callq 0x3b10
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x10, %rdi
movq -0x20(%rbp), %rdx
addq $0x80, %rdx
movq -0x20(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, %ecx
leaq -0x50(%rbp), %r8
movl $0x10, %esi
callq 0x6df0
leaq 0x59d6(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa9b7
leaq 0x2c52(%rip), %rdi      # 0xd5cc
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x20, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2c4b(%rip), %rdi      # 0xd5eb
movb $0x0, %al
callq 0x2080
leaq -0x50(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
movq -0x20(%rbp), %rax
movq -0x50(%rbp), %rcx
movq %rcx, 0x50(%rax)
movq -0x48(%rbp), %rcx
movq %rcx, 0x58(%rax)
movl -0x40(%rbp), %ecx
movl %ecx, 0x60(%rax)
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x34, %rdi
xorl %esi, %esi
movl $0x8, %edx
callq 0x20a0
movq -0x30(%rbp), %rdi
movq -0x20(%rbp), %rdx
leaq -0x70(%rbp), %r8
movl $0x10, %esi
movl $0x6c, %ecx
callq 0x6df0
leaq 0x5939(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xaa54
leaq 0x2bf3(%rip), %rdi      # 0xd60a
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rdi
addq $0x30, %rdi
addq $0x3c, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2bee(%rip), %rdi      # 0xd62b
movb $0x0, %al
callq 0x2080
leaq -0x70(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
movq -0x20(%rbp), %rax
movq -0x70(%rbp), %rcx
movq %rcx, 0x6c(%rax)
movq -0x68(%rbp), %rcx
movq %rcx, 0x74(%rax)
movl -0x60(%rbp), %ecx
movl %ecx, 0x7c(%rax)
movq -0x28(%rbp), %rdi
movq -0x20(%rbp), %rsi
addq $0x30, %rsi
movq -0x20(%rbp), %rdx
addq $0x30, %rdx
movl $0x50, %ecx
callq 0x3b10
xorl %eax, %eax
addq $0x70, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)