// File: /workspace/github_c_makefile_star2_O2/jogolden[P]ps4flashtool/southbridge.c
// Function: replace_eap_kbl
int replace_eap_kbl(unsigned char *flashdata, unsigned char *newkbl, int length) {
    struct bldr_hdr *blhdr = flash_locate_eap_kbl(flashdata);
    unsigned char *hdraeskey = keymgr_getkey("eapkblaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("eapkblhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EAP KBL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EAP KBL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // decrypt header
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &blhdr->crypteddata, 0x50);

    // encrypt body and replace it in flash
    if(verbose) {
        printf("* old EAP KBL body_len 0x%X\n", blhdr->body_len);
        printf("* new EAP KBL body_len 0x%X\n", length);
    }

    if(blhdr->body_len != length) {
        printf("warning: new EAP KBL has a different body length\n");
    }

    blhdr->body_len = length;
    aes128_cbc_iv_zero_encrypt(blhdr->crypteddata.iplbodyaeskey, newkbl, &blhdr->bodystart, blhdr->body_len);

    // replace body signature
    hmac_sha1(blhdr->crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);

    if(verbose) {
        printf("* old EAP KBL body hmac-sha1: ");
        hexdump(blhdr->crypteddata.iplbodyhmac, 0x14, 0);

        printf("* new EAP KBL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);
    }

    memcpy(blhdr->crypteddata.iplbodyhmac, bodyhmac, sizeof(bodyhmac));

    // filler null
    memset(blhdr->crypteddata.filler, 0, 8);

    // replace header signature
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)blhdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* old EAP KBL header hmac-sha1: ");
        hexdump(blhdr->crypteddata.headerhmac, 0x14, 0);

        printf("* new EAP KBL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    memcpy(blhdr->crypteddata.headerhmac, hdrhmac, sizeof(hdrhmac));

    // encrypt header
    aes128_cbc_iv_zero_encrypt(hdraeskey, &blhdr->crypteddata, &blhdr->crypteddata, 0x50);

    return 0;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x48, %rsp
movl %edx, %ebp
movq %rsi, (%rsp)
callq 0x6011
movq %rax, %rbx
leaq 0x1b61(%rip), %rdi      # 0x837c
movl $0xa1, %esi
callq 0x4954
movq %rax, %r14
leaq 0x1b57(%rip), %rdi      # 0x8386
movl $0xb1, %esi
callq 0x4954
movq %rax, %r13
leaq 0x4ae1(%rip), %r12      # 0xb324
cmpl $0x0, (%r12)
je 0x6884
leaq 0x1b40(%rip), %rdi      # 0x8391
xorl %eax, %eax
callq 0x20b0
pushq $0x10
popq %r15
movq %r14, %rdi
movl %r15d, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x1b3c(%rip), %rdi      # 0x83ac
xorl %eax, %eax
callq 0x20b0
movq %r13, %rdi
movl %r15d, %esi
xorl %edx, %edx
callq 0x3559
movq %r13, 0x8(%rsp)
leaq 0x30(%rbx), %r15
pushq $0x50
popq %rcx
movq %r14, %rdi
movq %r15, %rsi
movq %r15, %rdx
callq 0x2994
cmpl $0x0, (%r12)
je 0x68c6
movl 0xc(%rbx), %esi
leaq 0x1bb0(%rip), %rdi      # 0x845f
xorl %eax, %eax
callq 0x20b0
leaq 0x1bbf(%rip), %rdi      # 0x847c
movl %ebp, %esi
xorl %eax, %eax
callq 0x20b0
movq %r12, %r13
cmpl %ebp, 0xc(%rbx)
je 0x68da
leaq 0x1d8c(%rip), %rdi      # 0x8661
callq 0x2060
movl %ebp, 0xc(%rbx)
leaq 0x80(%rbx), %r12
movq %r15, %rdi
movq (%rsp), %rsi
movq %r12, %rdx
movl %ebp, %ecx
callq 0x297c
leaq 0x40(%rbx), %rdi
movl 0xc(%rbx), %ecx
pushq $0x10
popq %rsi
leaq 0x30(%rsp), %r8
movq %r12, %rdx
callq 0x466c
cmpl $0x0, (%r13)
je 0x694d
leaq 0x1b7f(%rip), %rdi      # 0x8499
xorl %eax, %eax
callq 0x20b0
leaq 0x50(%rbx), %rdi
pushq $0x14
popq %rbp
movl %ebp, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x1b80(%rip), %rdi      # 0x84b8
xorl %eax, %eax
callq 0x20b0
leaq 0x30(%rsp), %rdi
movl %ebp, %esi
xorl %edx, %edx
callq 0x3559
movl 0x40(%rsp), %eax
movl %eax, 0x60(%rbx)
movaps 0x30(%rsp), %xmm0
movups %xmm0, 0x50(%rbx)
andq $0x0, 0x64(%rbx)
pushq $0x10
popq %rsi
pushq $0x6c
popq %rcx
leaq 0x10(%rsp), %r8
movq 0x8(%rsp), %rdi
movq %rbx, %rdx
callq 0x466c
cmpl $0x0, (%r13)
je 0x69be
leaq 0x1b4f(%rip), %rdi      # 0x84d7
xorl %eax, %eax
callq 0x20b0
movq %rbx, %rdi
addq $0x6c, %rdi
pushq $0x14
popq %rbp
movl %ebp, %esi
xorl %edx, %edx
callq 0x3559
leaq 0x1b4f(%rip), %rdi      # 0x84f8
xorl %eax, %eax
callq 0x20b0
leaq 0x10(%rsp), %rdi
movl %ebp, %esi
xorl %edx, %edx
callq 0x3559
movl 0x20(%rsp), %eax
movl %eax, 0x7c(%rbx)
movaps 0x10(%rsp), %xmm0
movups %xmm0, 0x6c(%rbx)
pushq $0x50
popq %rcx
movq %r14, %rdi
movq %r15, %rsi
movq %r15, %rdx
callq 0x297c
xorl %eax, %eax
addq $0x48, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq