// File: /workspace/github_c_makefile_star2_O0/jogolden[P]ps4flashtool/southbridge.c
// Function: verify_emc_ipl
int verify_emc_ipl(unsigned char *flashdata) {
    struct bldr_hdr *blhdr = flash_locate_emc_ipl(flashdata, 0);
    unsigned char *hdraeskey = keymgr_getkey("emciplaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("emciplhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EMC IPL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EMC IPL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    struct bldr_hdr dechdr;
    unsigned char *decbody = (unsigned char *)malloc(blhdr->body_len);
    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // copy the header on to the stack, we dont want to modify anything
    memcpy(&dechdr, blhdr, blhdr->hdr_len);
    
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &dechdr.crypteddata, 0x50);

    hmac_sha1(dechdr.crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)&dechdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* flash EMC IPL body hmac-sha1: ");
        hexdump(dechdr.crypteddata.iplbodyhmac, 0x14, 0);

        printf("* calculated EMC IPL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);

        printf("* flash EMC IPL header hmac-sha1: ");
        hexdump(dechdr.crypteddata.headerhmac, 0x14, 0);

        printf("* calculated EMC IPL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    // some checks that the rom will do
    unsigned char *h = (unsigned char *)&dechdr;
    int flag;

    // TODO: clean this all up and make it nice :P
    flag = *(unsigned short *)&h[6] >> 14 == 1;
    if(!flag) {
        flag = *(unsigned short *)&h[6] >> 14 == 2;
    }

    if(!flag) {
        printf("error: header flag part 1 invalid!\n");
        return 1;
    }

    flag = (*(unsigned short *)&h[6] >> 12) & 3;
    if(flag == 0) {
        flag = *(unsigned short *)&h[8] == 0x80;
    }

    if(!flag || h[12] & 0x0F) {
        printf("error: header flag part 2 invalid!\n");
        return 1;
    }

    if(dechdr.load_addr_1 < 0x100C00) {
        printf("error: invalid load address!\n");
        return 1;
    }

    // TODO: add size checks also and other stuff

    free(decbody);

    return memcmp(bodyhmac, dechdr.crypteddata.iplbodyhmac, sizeof(bodyhmac)) + 
        memcmp(hdrhmac, &dechdr.crypteddata.headerhmac, sizeof(bodyhmac));
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x100, %rsp            # imm = 0x100
movq %rdi, -0x10(%rbp)
movq -0x10(%rbp), %rdi
xorl %esi, %esi
callq 0x9b10
movq %rax, -0x18(%rbp)
leaq 0x3473(%rip), %rdi      # 0xd248
movl $0xa1, %esi
callq 0x7200
movq %rax, -0x20(%rbp)
leaq 0x3468(%rip), %rdi      # 0xd252
movl $0xb1, %esi
callq 0x7200
movq %rax, -0x28(%rbp)
leaq 0x6545(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0x9e40
leaq 0x3452(%rip), %rdi      # 0xd25d
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x344f(%rip), %rdi      # 0xd278
movb $0x0, %al
callq 0x2080
movq -0x28(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
movq -0x18(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, %edi
callq 0x2100
movq %rax, -0xb8(%rbp)
movq -0x18(%rbp), %rsi
movq -0x18(%rbp), %rax
movl 0x8(%rax), %eax
movl %eax, %edx
leaq -0xa9(%rbp), %rdi
callq 0x20f0
movq -0x20(%rbp), %rdi
movq -0x18(%rbp), %rsi
addq $0x30, %rsi
leaq -0xa9(%rbp), %rdx
addq $0x30, %rdx
movl $0x50, %ecx
callq 0x3b60
leaq -0xa9(%rbp), %rdi
addq $0x30, %rdi
addq $0x10, %rdi
movq -0x18(%rbp), %rdx
addq $0x80, %rdx
movq -0x18(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, %ecx
leaq -0xd0(%rbp), %r8
movl $0x10, %esi
callq 0x6df0
movq -0x28(%rbp), %rdi
leaq -0xf0(%rbp), %r8
movl $0x10, %esi
leaq -0xa9(%rbp), %rdx
movl $0x6c, %ecx
callq 0x6df0
leaq 0x6459(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0x9f88
leaq 0x339e(%rip), %rdi      # 0xd299
movb $0x0, %al
callq 0x2080
leaq -0xa9(%rbp), %rdi
addq $0x30, %rdi
addq $0x20, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x3396(%rip), %rdi      # 0xd2ba
movb $0x0, %al
callq 0x2080
leaq -0xd0(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x339b(%rip), %rdi      # 0xd2e0
movb $0x0, %al
callq 0x2080
leaq -0xa9(%rbp), %rdi
addq $0x30, %rdi
addq $0x3c, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x3395(%rip), %rdi      # 0xd303
movb $0x0, %al
callq 0x2080
leaq -0xf0(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq -0xa9(%rbp), %rax
movq %rax, -0xf8(%rbp)
movq -0xf8(%rbp), %rax
movzwl 0x6(%rax), %eax
sarl $0xe, %eax
cmpl $0x1, %eax
sete %al
andb $0x1, %al
movzbl %al, %eax
movl %eax, -0xfc(%rbp)
cmpl $0x0, -0xfc(%rbp)
jne 0x9fdd
movq -0xf8(%rbp), %rax
movzwl 0x6(%rax), %eax
sarl $0xe, %eax
cmpl $0x2, %eax
sete %al
andb $0x1, %al
movzbl %al, %eax
movl %eax, -0xfc(%rbp)
cmpl $0x0, -0xfc(%rbp)
jne 0xa000
leaq 0x333e(%rip), %rdi      # 0xd32b
movb $0x0, %al
callq 0x2080
movl $0x1, -0x4(%rbp)
jmp 0xa0f6
movq -0xf8(%rbp), %rax
movzwl 0x6(%rax), %eax
sarl $0xc, %eax
andl $0x3, %eax
movl %eax, -0xfc(%rbp)
cmpl $0x0, -0xfc(%rbp)
jne 0xa03e
movq -0xf8(%rbp), %rax
movzwl 0x8(%rax), %eax
cmpl $0x80, %eax
sete %al
andb $0x1, %al
movzbl %al, %eax
movl %eax, -0xfc(%rbp)
cmpl $0x0, -0xfc(%rbp)
je 0xa05a
movq -0xf8(%rbp), %rax
movzbl 0xc(%rax), %eax
andl $0xf, %eax
cmpl $0x0, %eax
je 0xa074
leaq 0x32ee(%rip), %rdi      # 0xd34f
movb $0x0, %al
callq 0x2080
movl $0x1, -0x4(%rbp)
jmp 0xa0f6
cmpl $0x100c00, -0x95(%rbp)  # imm = 0x100C00
jae 0xa097
leaq 0x32ec(%rip), %rdi      # 0xd373
movb $0x0, %al
callq 0x2080
movl $0x1, -0x4(%rbp)
jmp 0xa0f6
movq -0xb8(%rbp), %rdi
callq 0x2030
leaq -0xd0(%rbp), %rdi
leaq -0xa9(%rbp), %rsi
addq $0x30, %rsi
addq $0x20, %rsi
movl $0x14, %edx
callq 0x20b0
movl %eax, -0x100(%rbp)
leaq -0xf0(%rbp), %rdi
leaq -0xa9(%rbp), %rsi
addq $0x30, %rsi
addq $0x3c, %rsi
movl $0x14, %edx
callq 0x20b0
movl %eax, %ecx
movl -0x100(%rbp), %eax
addl %ecx, %eax
movl %eax, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x100, %rsp            # imm = 0x100
popq %rbp
retq
nopw %cs:(%rax,%rax)