本帖最后由 jiangzhengwenjz 于 2015-11-27 21:01 编辑  
 
预览图: 
 
 
当然这个还是不太完善需要优化的,不过暂时没有时间,因此这个贴只是提供信息性质的。严重的bug也是没有发现 
1)用DNS加入实时时钟系统(rtc),并在模拟器中打钩 
2)写入这些源码,并作注释中对应字节更改- /*0x6F09C - 00 48 00 47 XX+1 XX XX 08
 
 - 源码中所有0x8750000改为代码写入地址
 
 - 源码中所有0x8750001改为代码写入地址+1*/
 
 - .thumb
 
 - bl box_func
 
 - ldr r1, =0x20370FF
 
 - ldrb r0, [r1]
 
 - add r0, #1
 
 - strb r0, [r1]
 
 - mov r0, #0
 
 - add sp, sp, #0xC
 
 - pop {r4, pc}
 
 - .ltorg
 
  
- box_func:
 
 - push {r4, lr}
 
 - ldr r4, =0x2037101
 
 - ldr r0, =(0x8750000 + rbox_config)
 
 - ldr r3, =0x8003ce5
 
 - bl call_r3
 
 - strb r0, [r4]
 
 - ldr r3, =0x8003fa1
 
 - bl call_r3
 
 - ldrb r0, [r4]
 
 - mov r1, #0
 
 - ldr r3, =0x80F6F1D
 
 - bl call_r3
 
 - bl print_string
 
 - ldr r0, =(0x8750001 + print_string)
 
 - mov r1, #2
 
 - ldr r3, =0x807741D
 
 - bl call_r3
 
 - ldr r1, =0x20370C0
 
 - strh r0, [r1]
 
 - pop {r4, pc}
 
 - .ltorg
 
  
- print_string:
 
 - push {r4-r7, lr}
 
 - sub sp, sp, #0xC
 
 - ldr r0, =0x2021cd0
 
 - add r7, r0, #0
 
 - ldr r1, =0x300553c
 
 - ldrb r5, [r1, #7] @minute
 
 - ldrb r6, [r1, #8] @second
 
 - ldrb r1, [r1, #6] @hour
 
 - mov r2, #1
 
 - mov r3, #2
 
 - ldr r4, =0x8008E79
 
 - bl call_r4
 
 - bl go_padding
 
 - ldr r0, =0x2021CF0
 
 - add r7, r0, #0
 
 - add r1, r5, #0
 
 - mov r2, #1
 
 - mov r3, #2
 
 - ldr r4, =0x8008e79
 
 - bl call_r4
 
 - bl go_padding
 
 - ldr r0, =0x2021d04
 
 - add r7, r0, #0
 
 - add r1, r6, #0
 
 - mov r2, #1
 
 - mov r3, #2
 
 - ldr r4, =0x8008e79
 
 - bl call_r4
 
 - bl go_padding
 
 - ldr r5, =0x2021D18
 
 - ldr r1, =(0x8750000 + string)
 
 - add r0, r5, #0
 
 - ldr r3, =0x8008FCD
 
 - bl call_r3
 
 - ldr r0, =0x2037101
 
 - ldrb r0, [r0]
 
 - mov r1, #3
 
 - str r1, [sp]
 
 - mov r1, #0xff
 
 - str r1, [sp, #4]
 
 - mov r1, #0
 
 - str r1, [sp, #8]
 
 - mov r1, #2
 
 - add r2, r5, #0
 
 - mov r3, #4
 
 - ldr r4, =0x8002C49
 
 - bl call_r4
 
 - ldr r0, =0x2037101
 
 - ldrb r0, [r0]
 
 - mov r1, #2
 
 - ldr r3, =0x8003F21
 
 - bl call_r3
 
 - add sp, sp, #0xC
 
 - pop {r4-r7, pc}
 
 - .ltorg
 
  
- go_padding:
 
 - push {lr}
 
 - ldrb r0, [r7]
 
 - cmp r0, #0
 
 - bne back
 
 - mov r0, #0xa1
 
 - strb r0, [r7]
 
 - back:
 
 - pop {pc}
 
  
- call_r3:
 
 - bx r3
 
  
- call_r4:
 
 - bx r4
 
  
- .align 2
 
 - rbox_config:
 
 - .byte 0x0 @bg_id
 
 - .byte 0x1 @x
 
 - .byte 0x1 @y
 
 - .byte 0xa @width
 
 - .byte 0x2 @height
 
 - .byte 0xf
 
 - .hword 0x8 @tileset_ofs
 
 - .word 0x8419f76 @pixels
 
  
- .align 2
 
 - string: 
 
 - .byte 0xce, 0xdd, 0xe1, 0xd9, 0xf0, 0xfd, 0x2, 0xf0, 0xfd, 0x3, 0xf0, 0xfd, 0x4, 0xff
 
  复制代码- /*0x6EF1E - 00 00 00 49 08 47 YY+1 YY YY 08*/
 
 - .thumb
 
 - cmp r0, #1
 
 - beq safari
 
 - ldr r0, =0x20370C0
 
 - ldrh r0, [r0]
 
 - ldr r3, =0x8077509
 
 - bl call_r3
 
  
- safari:
 
 - ldr r4, =0x02037101
 
 - ldrb r0, [r4]
 
 - mov r1, #0
 
 - ldr r3, =0x806ef29
 
  
- call_r3:
 
 - bx r3
 
  复制代码- /*0x6f4e8 - 00 48 00 47 ZZ+1 ZZ ZZ 08*/
 
 - .thumb
 
 - push {lr}
 
 - ldr r0, =0x20370c0
 
 - ldrh r0, [r0]
 
 - ldr r3, =0x8077509
 
 - bl call_r3
 
 - ldr r1, =0x20370F0
 
 - ldr r0, =0x806f5a5
 
 - str r0, [r1]
 
 - mov r0, #0
 
 - pop {pc}
 
 - call_r3:
 
 - bx r3
 
  复制代码 |