I think there might be an issue with the keyboard routine.
On the SD300 firmware (contrary to what the sd500 SwitchCheckTask routine) there are TWO arguments in
the funtion call.
From IDA dissassembly:
ROM:FF830738 SwitchCheckTask
ROM:FF830738
ROM:FF830738 var_20 = -0x20
ROM:FF830738 var_1C = -0x1C
ROM:FF830738
ROM:FF830738 STMFD SP!, {R4-R8,LR}
ROM:FF83073C LDR R3, =0x20F8
ROM:FF830740 SUB SP, SP, #8
ROM:FF830744 LDR R2, [R3]
ROM:FF830748 CMP R2, #2
ROM:FF83074C BNE loc_FF830870
ROM:FF830750 LDR R6, =0x11AC8
ROM:FF830754 MOV R8, SP
ROM:FF830758 ADD R7, SP, #0x20+var_1C
ROM:FF83075C
ROM:FF83075C loc_FF83075C
ROM:FF83075C MOV R0, R8
ROM:FF830760 BL GetSystemTime
ROM:FF830764 LDR R1, =wrap_kbd_p1_f
ROM:FF830768 LDR R0, [SP,#0x20+var_20]
ROM:FF83076C MOV R3, R7
So, given that this routine is replaced by our own "mykbd_task_proceed", and called inside "mykbd_task" AFTER
stack manipulation, I think that either the pointer goes to hell or we are completely loosing those two arguments...
I still have not a clear idea of the ARM call procedure, but what I found puzzling is that (supposedly) the STACK pointer DECREASES with each value pushed into the stack, that is, if I push 0x41 and then I push 0x42 on the stack I get something like:
BFFF001C 0x41
BFFF0008 0x42 <----- And now SP points here...
Am I right?
If so, I think I don't get IDA convention. I imagine that when I enter the routine, after the first STDMF I have a stack like this:
XXXXXX20 var_20
XXXXXX1C var_1C
XXXXXX18 LR
XXXXXX14 R8
XXXXXX10 R7
XXXXXX0C R6
XXXXXX08 R5
XXXXXX04 R4 <---- And SP points here...
So after I do "SUB SP, #0x08", If I want to point to var_1c shouldn't I do [SP+#0x20+0x04] so I get SP=XXXXXX1C???
Why does IDA say [SP+#0x20-1C]?
