// File: /workspace/github_c_makefile_star2_O0/jogolden[P]ps4flashtool/southbridge.c
// Function: flash_locate_emc_ipl
struct bldr_hdr *flash_locate_emc_ipl(unsigned char *flashdata, int forcehdr) {
    // reversed from EMC bootrom
    // I want to start calling the first header the meta header and then the second header the main header.
    // I cannot tell if the two slots for booting are for updates or for testkit/devkit vs retail?
    struct flashheader0 *hdr0 = NULL;
    struct flashheader1 *hdr1 = NULL;
    struct bldr_hdr *blhdr = NULL;
    unsigned char flag;
    int blocknum;

    hdr0 = (struct flashheader0 *)flashdata;

    if(verbose) {
        printf("* flash branding '%s'\n", hdr0->branding);
    }

    blocknum = hdr0->secondHeaderBlockNum2;
    flag = *(unsigned int *)(flashdata + (hdr0->headerInfoBlockNum * 0x200));
    if(!((flag >> 7) & 1)) {
        if(verbose && !forcehdr) {
            printf("* using header block num 1\n");
        }

        blocknum = hdr0->secondHeaderBlockNum1;
    } else if(verbose && !forcehdr) {
        printf("* using header block num 2\n");
    }

    hdr1 = (struct flashheader1 *)(flashdata + (blocknum * 0x200));
    blhdr = (struct bldr_hdr *)(flashdata + ((blocknum + hdr1->dataBlockNumber) * 0x200));
    
    if(blhdr->magic != BLDR_MAGIC) {
        printf("error: invalid EMC IPL bootloader header magic!\n");
        return NULL;
    }

    if(blhdr->type != BLDR_TYPE_EMC) {
        printf("error: invalid EMC IPL bootloader header type!\n");
        return NULL;
    }

    if(forcehdr == 1) {
        return (struct bldr_hdr *)(flashdata + ((hdr0->secondHeaderBlockNum1 + hdr1->dataBlockNumber) * 0x200));
    } else if(forcehdr == 2) {
        return (struct bldr_hdr *)(flashdata + ((hdr0->secondHeaderBlockNum2 + hdr1->dataBlockNumber) * 0x200));
    }

    return blhdr;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x40, %rsp
movq %rdi, -0x10(%rbp)
movl %esi, -0x14(%rbp)
movq $0x0, -0x20(%rbp)
movq $0x0, -0x28(%rbp)
movq $0x0, -0x30(%rbp)
movq -0x10(%rbp), %rax
movq %rax, -0x20(%rbp)
leaq 0x67fe(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0x9b5d
movq -0x20(%rbp), %rsi
leaq 0x361a(%rip), %rdi      # 0xd170
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rax
movl 0x28(%rax), %eax
movl %eax, -0x38(%rbp)
movq -0x10(%rbp), %rax
movq -0x20(%rbp), %rcx
movl 0x34(%rcx), %ecx
shll $0x9, %ecx
movl %ecx, %ecx
movl (%rax,%rcx), %eax
movb %al, -0x31(%rbp)
movzbl -0x31(%rbp), %eax
sarl $0x7, %eax
andl $0x1, %eax
cmpl $0x0, %eax
jne 0x9bb8
leaq 0x67b1(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0x9bac
cmpl $0x0, -0x14(%rbp)
jne 0x9bac
leaq 0x35e2(%rip), %rdi      # 0xd187
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rax
movl 0x24(%rax), %eax
movl %eax, -0x38(%rbp)
jmp 0x9bda
leaq 0x6785(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0x9bd8
cmpl $0x0, -0x14(%rbp)
jne 0x9bd8
leaq 0x35d2(%rip), %rdi      # 0xd1a3
movb $0x0, %al
callq 0x2080
jmp 0x9bda
movq -0x10(%rbp), %rax
movl -0x38(%rbp), %ecx
shll $0x9, %ecx
movslq %ecx, %rcx
addq %rcx, %rax
movq %rax, -0x28(%rbp)
movq -0x10(%rbp), %rax
movl -0x38(%rbp), %ecx
movq -0x28(%rbp), %rdx
addl 0x30(%rdx), %ecx
shll $0x9, %ecx
movl %ecx, %ecx
addq %rcx, %rax
movq %rax, -0x30(%rbp)
movq -0x30(%rbp), %rax
cmpl $0xd48ff9aa, (%rax)     # imm = 0xD48FF9AA
je 0x9c2c
leaq 0x35a4(%rip), %rdi      # 0xd1bf
movb $0x0, %al
callq 0x2080
movq $0x0, -0x8(%rbp)
jmp 0x9ca7
movq -0x30(%rbp), %rax
movzbl 0x7(%rax), %eax
cmpl $0x48, %eax
je 0x9c51
leaq 0x35b0(%rip), %rdi      # 0xd1f0
movb $0x0, %al
callq 0x2080
movq $0x0, -0x8(%rbp)
jmp 0x9ca7
cmpl $0x1, -0x14(%rbp)
jne 0x9c77
movq -0x10(%rbp), %rax
movq -0x20(%rbp), %rcx
movl 0x24(%rcx), %ecx
movq -0x28(%rbp), %rdx
addl 0x30(%rdx), %ecx
shll $0x9, %ecx
movl %ecx, %ecx
addq %rcx, %rax
movq %rax, -0x8(%rbp)
jmp 0x9ca7
cmpl $0x2, -0x14(%rbp)
jne 0x9c9d
movq -0x10(%rbp), %rax
movq -0x20(%rbp), %rcx
movl 0x28(%rcx), %ecx
movq -0x28(%rbp), %rdx
addl 0x30(%rdx), %ecx
shll $0x9, %ecx
movl %ecx, %ecx
addq %rcx, %rax
movq %rax, -0x8(%rbp)
jmp 0x9ca7
jmp 0x9c9f
movq -0x30(%rbp), %rax
movq %rax, -0x8(%rbp)
movq -0x8(%rbp), %rax
addq $0x40, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)