Hello World for Patchouli's exploit

main.c

#include <pspdisplay.h>
#include <pspctrl.h>
#include <pspkernel.h>
#include <pspdebug.h>
#include <pspaudio.h>


#define HOOK_sceKernelDcacheWritebackAll_WITH_sceKernelDcacheWritebackInvalidateAll

#define HBL_ROOT "ms0:/PSP/SAVEDATA/"

#define SCREEN_HEIGHT	272
#define SCREEN_WIDTH	480
#define CMAX_X		60
#define CMAX_Y		38
#define LINESIZE	512	//in long
#define FRAMESIZE	0xAA000	//in byte

#define TEXTCOLOUR	0x00FFFFFFL

#define INDEX_BLACK      0
#define INDEX_WHITE      1
#define INDEX_PINK       2
#define INDEX_RED        3
#define INDEX_BLUE       4
#define INDEX_GREEN      5
#define INDEX_YELLOW     6
#define INDEX_CYAN       7
#define INDEX_GRAY       8
#define INDEX_DARKGREEN  9

unsigned long colours[10];

typedef struct {
	unsigned int left;
	unsigned int right;
	unsigned int top;
	unsigned int bottom;
} RECT;

// get vram address for character position
unsigned char *GetVramAddr(unsigned long x,unsigned long y);

// print a single character
void PutChar(unsigned long x,unsigned long y,unsigned long color,unsigned long bgcolor,unsigned char ch,char drawfg,char drawbg,char mag);

// print a string
void Print(unsigned long x,unsigned long y,unsigned long color,const char *str);

// clear video ram
void Fillvram(unsigned long color);

void FillRect(RECT *xirect, unsigned long xicolour);

void changeBuffer();

void initScreenAndCtrl();

void createScreenshot();

void memdump();

void (*_sceDisplayWaitVblankStart)();

// font data
const unsigned char font[256*8]={
	// much better charset, by eddie!
	// this is actually the 8x8 neuromancer
	// vga/ega mode font :)
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,   // 0x20
	0x30,0x78,0x78,0x30,0x30,0x00,0x30,0x00,   // 0x21
	0x6C,0x6C,0x6C,0x00,0x00,0x00,0x00,0x00,   // 0x22
	0x6C,0x6C,0xFE,0x6C,0xFE,0x6C,0x6C,0x00,   // 0x23
	0x30,0x7C,0xC0,0x78,0x0C,0xF8,0x30,0x00,   // 0x24
	0x00,0xC6,0xCC,0x18,0x30,0x66,0xC6,0x00,   // 0x25
	0x38,0x6C,0x38,0x76,0xDC,0xCC,0x76,0x00,   // 0x26
	0x60,0x60,0xC0,0x00,0x00,0x00,0x00,0x00,   // 0x27
	0x18,0x30,0x60,0x60,0x60,0x30,0x18,0x00,   // 0x28
	0x60,0x30,0x18,0x18,0x18,0x30,0x60,0x00,   // 0x29
	0x00,0x66,0x3C,0xFF,0x3C,0x66,0x00,0x00,   // 0x2A
	0x00,0x30,0x30,0xFC,0x30,0x30,0x00,0x00,   // 0x2B
	0x00,0x00,0x00,0x00,0x00,0x30,0x30,0x60,   // 0x2C
	0x00,0x00,0x00,0xFC,0x00,0x00,0x00,0x00,   // 0x2D
	0x00,0x00,0x00,0x00,0x00,0x30,0x30,0x00,   // 0x2E
	0x06,0x0C,0x18,0x30,0x60,0xC0,0x80,0x00,   // 0x2F
	0x7C,0xC6,0xCE,0xDE,0xF6,0xE6,0x7C,0x00,   // 0x30
	0x30,0x70,0x30,0x30,0x30,0x30,0xFC,0x00,   // 0x31
	0x78,0xCC,0x0C,0x38,0x60,0xCC,0xFC,0x00,   // 0x32
	0x78,0xCC,0x0C,0x38,0x0C,0xCC,0x78,0x00,   // 0x33
	0x1C,0x3C,0x6C,0xCC,0xFE,0x0C,0x1E,0x00,   // 0x34
	0xFC,0xC0,0xF8,0x0C,0x0C,0xCC,0x78,0x00,   // 0x35
	0x38,0x60,0xC0,0xF8,0xCC,0xCC,0x78,0x00,   // 0x36
	0xFC,0xCC,0x0C,0x18,0x30,0x30,0x30,0x00,   // 0x37
	0x78,0xCC,0xCC,0x78,0xCC,0xCC,0x78,0x00,   // 0x38
	0x78,0xCC,0xCC,0x7C,0x0C,0x18,0x70,0x00,   // 0x39
	0x00,0x30,0x30,0x00,0x00,0x30,0x30,0x00,   // 0x3A
	0x00,0x30,0x30,0x00,0x00,0x30,0x30,0x60,   // 0x3B
	0x18,0x30,0x60,0xC0,0x60,0x30,0x18,0x00,   // 0x3C
	0x00,0x00,0xFC,0x00,0x00,0xFC,0x00,0x00,   // 0x3D
	0x60,0x30,0x18,0x0C,0x18,0x30,0x60,0x00,   // 0x3E
	0x78,0xCC,0x0C,0x18,0x30,0x00,0x30,0x00,   // 0x3F
	0x7C,0xC6,0xDE,0xDE,0xDE,0xC0,0x78,0x00,   // 0x40
	0x30,0x78,0xCC,0xCC,0xFC,0xCC,0xCC,0x00,   // 0x41
	0xFC,0x66,0x66,0x7C,0x66,0x66,0xFC,0x00,   // 0x42
	0x3C,0x66,0xC0,0xC0,0xC0,0x66,0x3C,0x00,   // 0x43
	0xF8,0x6C,0x66,0x66,0x66,0x6C,0xF8,0x00,   // 0x44
	0xFE,0x62,0x68,0x78,0x68,0x62,0xFE,0x00,   // 0x45
	0xFE,0x62,0x68,0x78,0x68,0x60,0xF0,0x00,   // 0x46
	0x3C,0x66,0xC0,0xC0,0xCE,0x66,0x3E,0x00,   // 0x47
	0xCC,0xCC,0xCC,0xFC,0xCC,0xCC,0xCC,0x00,   // 0x48
	0x78,0x30,0x30,0x30,0x30,0x30,0x78,0x00,   // 0x49
	0x1E,0x0C,0x0C,0x0C,0xCC,0xCC,0x78,0x00,   // 0x4A
	0xE6,0x66,0x6C,0x78,0x6C,0x66,0xE6,0x00,   // 0x4B
	0xF0,0x60,0x60,0x60,0x62,0x66,0xFE,0x00,   // 0x4C
	0xC6,0xEE,0xFE,0xFE,0xD6,0xC6,0xC6,0x00,   // 0x4D
	0xC6,0xE6,0xF6,0xDE,0xCE,0xC6,0xC6,0x00,   // 0x4E
	0x38,0x6C,0xC6,0xC6,0xC6,0x6C,0x38,0x00,   // 0x4F
	0xFC,0x66,0x66,0x7C,0x60,0x60,0xF0,0x00,   // 0x50
	0x78,0xCC,0xCC,0xCC,0xDC,0x78,0x1C,0x00,   // 0x51
	0xFC,0x66,0x66,0x7C,0x6C,0x66,0xE6,0x00,   // 0x52
	0x78,0xCC,0xE0,0x70,0x1C,0xCC,0x78,0x00,   // 0x53
	0xFC,0xB4,0x30,0x30,0x30,0x30,0x78,0x00,   // 0x54
	0xCC,0xCC,0xCC,0xCC,0xCC,0xCC,0xFC,0x00,   // 0x55
	0xCC,0xCC,0xCC,0xCC,0xCC,0x78,0x30,0x00,   // 0x56
	0xC6,0xC6,0xC6,0xD6,0xFE,0xEE,0xC6,0x00,   // 0x57
	0xC6,0xC6,0x6C,0x38,0x38,0x6C,0xC6,0x00,   // 0x58
	0xCC,0xCC,0xCC,0x78,0x30,0x30,0x78,0x00,   // 0x59
	0xFE,0xC6,0x8C,0x18,0x32,0x66,0xFE,0x00,   // 0x5A
	0x78,0x60,0x60,0x60,0x60,0x60,0x78,0x00,   // 0x5B
	0xC0,0x60,0x30,0x18,0x0C,0x06,0x02,0x00,   // 0x5C
	0x78,0x18,0x18,0x18,0x18,0x18,0x78,0x00,   // 0x5D
	0x10,0x38,0x6C,0xC6,0x00,0x00,0x00,0x00,   // 0x5E
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xFF,   // 0x5F
	0x30,0x30,0x18,0x00,0x00,0x00,0x00,0x00,   // 0x60
	0x00,0x00,0x78,0x0C,0x7C,0xCC,0x76,0x00,   // 0x61
	0xE0,0x60,0x60,0x7C,0x66,0x66,0xDC,0x00,   // 0x62
	0x00,0x00,0x78,0xCC,0xC0,0xCC,0x78,0x00,   // 0x63
	0x1C,0x0C,0x0C,0x7C,0xCC,0xCC,0x76,0x00,   // 0x64
	0x00,0x00,0x78,0xCC,0xFC,0xC0,0x78,0x00,   // 0x65
	0x38,0x6C,0x60,0xF0,0x60,0x60,0xF0,0x00,   // 0x66
	0x00,0x00,0x76,0xCC,0xCC,0x7C,0x0C,0xF8,   // 0x67
	0xE0,0x60,0x6C,0x76,0x66,0x66,0xE6,0x00,   // 0x68
	0x30,0x00,0x70,0x30,0x30,0x30,0x78,0x00,   // 0x69
	0x0C,0x00,0x0C,0x0C,0x0C,0xCC,0xCC,0x78,   // 0x6A
	0xE0,0x60,0x66,0x6C,0x78,0x6C,0xE6,0x00,   // 0x6B
	0x70,0x30,0x30,0x30,0x30,0x30,0x78,0x00,   // 0x6C
	0x00,0x00,0xCC,0xFE,0xFE,0xD6,0xC6,0x00,   // 0x6D
	0x00,0x00,0xF8,0xCC,0xCC,0xCC,0xCC,0x00,   // 0x6E
	0x00,0x00,0x78,0xCC,0xCC,0xCC,0x78,0x00,   // 0x6F
	0x00,0x00,0xDC,0x66,0x66,0x7C,0x60,0xF0,   // 0x70
	0x00,0x00,0x76,0xCC,0xCC,0x7C,0x0C,0x1E,   // 0x71
	0x00,0x00,0xDC,0x76,0x66,0x60,0xF0,0x00,   // 0x72
	0x00,0x00,0x7C,0xC0,0x78,0x0C,0xF8,0x00,   // 0x73
	0x10,0x30,0x7C,0x30,0x30,0x34,0x18,0x00,   // 0x74
	0x00,0x00,0xCC,0xCC,0xCC,0xCC,0x76,0x00,   // 0x75
	0x00,0x00,0xCC,0xCC,0xCC,0x78,0x30,0x00,   // 0x76
	0x00,0x00,0xC6,0xD6,0xFE,0xFE,0x6C,0x00,   // 0x77
	0x00,0x00,0xC6,0x6C,0x38,0x6C,0xC6,0x00,   // 0x78
	0x00,0x00,0xCC,0xCC,0xCC,0x7C,0x0C,0xF8,   // 0x79
	0x00,0x00,0xFC,0x98,0x30,0x64,0xFC,0x00,   // 0x7A
	0x1C,0x30,0x30,0xE0,0x30,0x30,0x1C,0x00,   // 0x7B
	0x18,0x18,0x18,0x00,0x18,0x18,0x18,0x00,   // 0x7C
	0xE0,0x30,0x30,0x1C,0x30,0x30,0xE0,0x00,   // 0x7D
	0x76,0xDC,0x00,0x00,0x00,0x00,0x00,0x00,   // 0x7E
};

unsigned char *vramtop=(unsigned char *)0x04000000;
unsigned long drawframe;

// get vram address for character position
unsigned char *GetVramAddr(unsigned long x,unsigned long y)
{
	return vramtop + (drawframe ? FRAMESIZE : 0) + x * 4 + y * LINESIZE * 4 + 0x40000000;
}

// print a single character
void PutChar(
	unsigned long x,
	unsigned long y,
	unsigned long color,
	unsigned long bgcolor,
	unsigned char ch,
	char drawfg,
	char drawbg,
	char mag)
{
	unsigned char *vptr0;		//pointer to vram
	unsigned char *vptr;		//pointer to vram
	const unsigned char *cfont;	//pointer to font
	unsigned long cx, cy;
	unsigned long b;
	char mx, my;

	cfont = font + ch * 8;

	vptr0 = GetVramAddr(x, y);

	for (cy = 0; cy < 8; cy++)
	{
		for (my = 0; my < mag; my++)
		{
			vptr = vptr0;
			b = 0x80;
			for (cx = 0; cx < 8; cx++)
			{
				for (mx = 0; mx < mag; mx++)
				{
					if (drawfg)
						*(unsigned long *)vptr =
							(*cfont & b) != 0 ? color : bgcolor;
					vptr += 4;
				}
				b = b >> 1;
			}
			vptr0 += LINESIZE * 4; // 2
		}
		cfont++;
	}
}

// print a string
void Print(unsigned long x, unsigned long y, unsigned long color, const char *str)
{
	while (*str != 0 && x < CMAX_X && y < CMAX_Y) {
		PutChar( x * 8 , y * 8, color, 0, *str, 1, 1, 1);
		str++;
		x++;
		if (x >= CMAX_X) {
			x = 0;
			y++;
		}
	}
}

// clear video ram
void Fillvram(unsigned long color)
{
	unsigned char *vptr0;		//pointer to vram
	unsigned long i;

	vptr0 = GetVramAddr(0, 0);

	for (i = 0; i < FRAMESIZE / 4; i++)
	{
		*(unsigned long *)vptr0 = color;
		vptr0 += 4;
	}
}

void FillRect(RECT *xirect, unsigned long xicolour)
{
	unsigned long	*vptrl;
	unsigned char	*vptrc;
	int		y;

	for (y = xirect->top; y < xirect->bottom; y++)
	{
		int x = xirect->left;
		vptrc = GetVramAddr(x,y);
		vptrl = (unsigned long*)vptrc;

		while (x < xirect->right)
		{
			*vptrl++ = xicolour;
			x++;
		}
	}
}

void changeBuffer()
{
	_sceDisplayWaitVblankStart();

	sceDisplaySetFrameBuf(
		(void *)GetVramAddr(0, 0),
		512,
		PSP_DISPLAY_PIXEL_FORMAT_8888,
		0);

	drawframe = !drawframe;
}

void initScreenAndCtrl()
{
	drawframe = 0;
	sceDisplaySetMode(0, SCREEN_WIDTH, SCREEN_HEIGHT);

	sceDisplaySetFrameBuf(
		(void *)vramtop,
		512,
		PSP_DISPLAY_PIXEL_FORMAT_8888,
		1);
	Fillvram(0x00000000);
	drawframe = 1;
	Fillvram(0x00000000);
	sceCtrlSetSamplingMode(1);
}

/*****************************************************************************/
/* Screenshot code borrowed from PSPSokoban: Niklas Nordebo                  */
/*****************************************************************************/
#define PIXELSIZE 4
void createScreenshot() {
	char bmpHeader24[] = {
		0x42, 0x4d, 0x38, 0xfa, 0x05, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x28, 0x00,
		0x00, 0x00, 0xe0, 0x01, 0x00, 0x00, 0x10, 0x01,
		0x00, 0x00, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x0b,
		0x00, 0x00, 0x12, 0x0b, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
	char buffer[SCREEN_WIDTH*3];
	char r, g, b;
	int bufferIndex = 0;
	long p;
	int file;
	void *vptr;
	void *vptr0;
	int i = 0;
	int e = 0;
	char savePath[] = "ms0:/PSP/SCREENSHOT/screen.bmp";

	file = sceIoOpen(savePath, PSP_O_CREAT | PSP_O_TRUNC | PSP_O_RDWR, 0777);

	// write bmp header
	sceIoWrite(file, (void *)bmpHeader24, 54);


	// write bmp data
	vptr0 = GetVramAddr(0, 271);

	for(i = 0; i < SCREEN_HEIGHT; i++)
	{
		vptr = vptr0;
		for(e = 0; e < SCREEN_WIDTH; e++)
		{
			p = *(long *)vptr;
			r = (char)(p & 0x000000FFL);
			g = (char)((p & 0x0000FF00L) >> 8);
			b = (char)((p & 0x00FF0000L) >> 16);

			buffer[bufferIndex] = b;
			bufferIndex++;
			buffer[bufferIndex] = g;
			bufferIndex++;
			buffer[bufferIndex] = r;
			bufferIndex++;

			vptr += PIXELSIZE;
		}
		// write chunk
		sceIoWrite(file, (void *)buffer, SCREEN_WIDTH * 3);
		bufferIndex = 0;
		vptr0 -= LINESIZE * 4;
	}

	// bmp end
	drawframe = !drawframe;

	Print(0, 12, colours[INDEX_GRAY],"Finished screenshot. Writing BMP End...");
	unsigned char end[] = { 0x00, 0x00 };
	sceIoWrite(file, end, 2);

	Print(0, 13, colours[INDEX_GRAY], "Closing File...");
	sceIoClose(file);

	drawframe = !drawframe;
}

void memdump()
{
	int file;

	drawframe = !drawframe;

	Print(0, 12, colours[INDEX_GRAY], "Opening File...");
	file = sceIoOpen(HBL_ROOT "memdump_2.bin", PSP_O_CREAT | PSP_O_TRUNC | PSP_O_RDWR, 0777);

	Print(0, 13, colours[INDEX_GRAY], "Dumping Memory 2 (0x08800000~0x0A000000)...");
	sceIoWrite(file, (void *)0x08800000, 0x01800000);

	Print(0, 14, colours[INDEX_GRAY], "Closing File...");
	sceIoClose(file);

	Print(0, 15, colours[INDEX_GRAY], "Opening File...");
	file = sceIoOpen(HBL_ROOT "memdump_5.bin", PSP_O_CREAT | PSP_O_TRUNC | PSP_O_RDWR, 0777);

#ifndef HOOK_sceKernelVolatileMemUnlock_WITH_dummy
	sceKernelVolatileMemUnlock(0);
#endif

	Print(0, 17, colours[INDEX_GRAY], "Dumping Memory 5 (0x08400000~0x08800000)...");
	sceIoWrite(file, (void *)0x08400000, 0x00400000);

	Print(0, 18, colours[INDEX_GRAY], "Closing File...");
	sceIoClose(file);

	drawframe = !drawframe;
}

extern unsigned long failedNID;

SceCtrlData gpaddata;

int Paused;

int color, i;


#define N 624
#define M 397
#define MATRIX_A 0x9908b0dfUL   /* constant vector a */
#define UMASK 0x80000000UL /* most significant w-r bits */
#define LMASK 0x7fffffffUL /* least significant r bits */
#define MIXBITS(u,v) ( ((u) & UMASK) | ((v) & LMASK) )
#define TWIST(u,v) ((MIXBITS(u,v) >> 1) ^ ((v)&1UL ? MATRIX_A : 0UL))

static unsigned long state[N]; /* the array for the state vector  */
static int left = 1;
static int initf = 0;
static unsigned long *next;

/* initializes state[N] with a seed */
static void init_genrand(unsigned long s)
{
	int j;
	state[0]= s & 0xFFFFFFFFUL;
	for (j = 1; j < N; j++) {
		state[j] = (1812433253UL * (state[j - 1] ^ (state[j - 1] >> 30)) + j); 
		/* See Knuth TAOCP Vol2. 3rd Ed. P.106 for multiplier.	*/
		/* In the previous versions, MSBs of the seed affect	*/
		/* only MSBs of the array state[].			*/
		/* 2002/01/09 modified by Makoto Matsumoto		*/
		state[j] &= 0xFFFFFFFFUL;  /* for >32 bit machines */
	}
	left = 1;
	initf = 1;
}

/* initialize by an array with array-length */
/* init_key is the array for initializing keys */
/* key_length is its length */
/* slight change for C++, 2004/2/26 */
static void init_by_array(unsigned long init_key[], int key_length)
{
	int i = 1, j = 0, k;
	init_genrand(19650218UL);
	for (k = N > key_length ? N : key_length; k; k--)
	{
		state[i] = (state[i] ^ ((state[i - 1] ^ (state[i - 1] >> 30)) * 1664525UL))
			+ init_key[j] + j; /* non linear */
		state[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */
		i++;
		j++;
		if (i >= N)
		{
			state[0] = state[N - 1];
			i=1;
		}
		if (j >= key_length) j = 0;
	}
	for (k = N - 1; k; k--) {
		state[i] = (state[i] ^ ((state[i-1] ^ (state[i-1] >> 30)) * 1566083941UL))
			- i; /* non linear */
		state[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */
		i++;
		if (i >= N)
		{
			state[0] = state[N-1];
			i = 1;
		}
	}

	state[0] = 0x80000000UL; /* MSB is 1; assuring non-zero initial array */ 
	left = 1;
	initf = 1;
}

static void next_state()
{
	unsigned long *p=state;
	int j;

	/* if init_genrand() has not been called,	*/
	/* a default initial seed is used		*/
	if (initf == 0) init_genrand(5489UL);

	left = N;
	next = state;
    
	for (j = N - M + 1; --j; p++) 
		*p = p[M] ^ TWIST(p[0], p[1]);

	for (j = M; --j; p++) 
		*p = p[M-N] ^ TWIST(p[0], p[1]);

	*p = p[M-N] ^ TWIST(p[0], state[0]);
}

/* generates a random number on [0,0xffffffff]-interval */
static unsigned long genrand_int32(void)
{
	unsigned long y;

	if (--left == 0) next_state();
	y = *next++;

	/* Tempering */
	y ^= y >> 11;
	y ^= (y << 7) & 0x9d2c5680UL;
	y ^= (y << 15) & 0xefc60000UL;
	y ^= y >> 18;

	return y;
}

/* generates a random number on [0,1) with 53-bit resolution*/
static double genrand_real(void) 
{ 
	unsigned long a = genrand_int32() >> 5, b = genrand_int32() >> 6; 
	return (a * 67108864.0 + b) * (1.0 / 9007199254740992.0); 
} 

static unsigned long rand(void) __attribute__((alias("genrand_int32")));

void InitGlobals()
{
	colours[INDEX_BLACK] = 0x00000000L;
	colours[INDEX_WHITE] = 0x00FFFFFFL;
	colours[INDEX_PINK] = 0x00FF00FFL;
	colours[INDEX_RED] = 0x00FF0000L;
	colours[INDEX_BLUE] = 0x000000FFL;
	colours[INDEX_GREEN] = 0x0000FF00L;
	colours[INDEX_YELLOW] = 0x00FFFF00L;
	colours[INDEX_CYAN] = 0x0000FFFFL;
	colours[INDEX_GRAY] = 0x00888888L;
	colours[INDEX_DARKGREEN] = 0x00008800L;

	i = 0;
	color = INDEX_GRAY;
}

int Sleep(unsigned int xicount)
{
	int ldummy = 2;
	unsigned int i;
	unsigned int j;

	for (i = 0; i < xicount; i++)
		for (j=0; j < 65000; j++)
			ldummy = ldummy * ldummy;

	return ldummy;
}

void fadeIn()
{
	int i;

	for (i = 0; i < 16; i+=3)
	{
		Fillvram(0x00111111 * i);
		_sceDisplayWaitVblankStart();
		changeBuffer();
	}
}

void fadeOut()
{
	int i;

	for (i = 15; i >= 0; i--)
	{
		Fillvram(0x00111111 * i);
		_sceDisplayWaitVblankStart();
		changeBuffer();
	}

	Fillvram(0);
	changeBuffer();
	Fillvram(0);
}

RECT pixel;
void drawPixel(int x, int y, int sizex, int sizey, unsigned long color) {
	pixel.top = y;
	pixel.left = x;
	pixel.bottom = y+sizey;
	pixel.right = x+sizex;
     
	FillRect(&pixel, color);
}

void ProcessKeys(unsigned long xikeys)
{
	if (xikeys & (PSP_CTRL_UP | PSP_CTRL_RIGHT)) {
		if (color >= 9) color = 0;
		else color++;
	}
	if (xikeys & (PSP_CTRL_DOWN | PSP_CTRL_LEFT)) {
		if(color < 0) color = 9;
		else color--;
	}
	if (xikeys & PSP_CTRL_SELECT && xikeys & PSP_CTRL_START)
	{
		for(i = 0; i < 278; i++) {
			Fillvram(0x00FFFFFFL);
			changeBuffer();	// flip screen to display what i just wrote
			Sleep(10);	// delay for 1.5 seconds
		}
		changeBuffer();		// flip the buffer back to drawing mode for fade* functions
		fadeIn();		// fadeIn  -----|  Nice Cute
		fadeOut();		// fadeOut -----|    Effect
		sceKernelExitGame();	// exit
	}

	if (xikeys & PSP_CTRL_CROSS) memdump();

	if (xikeys & PSP_CTRL_TRIANGLE) createScreenshot();
}

typedef struct snoflake {
	int x, y, flake;
} snoflake;
snoflake snowflake[100];

void _start(unsigned long, unsigned long *) __attribute__ ((section (".text.start")));
void _start(unsigned long arglen, unsigned long *argp)
{
#ifdef HOOK_sceKernelDcacheWritebackAll_WITH_sceKernelDcacheWritebackInvalidateAll
	sceKernelDcacheWritebackInvalidateAll();
#else
	sceKernelDcacheWritebackAll();
#endif
	int a = 0, sway = 0;
	static int __sceDisplayWaitVblankStart[2];

	__sceDisplayWaitVblankStart[0] = ((int *)sceDisplayWaitVblankStart)[0];
	__sceDisplayWaitVblankStart[1] = ((int *)sceDisplayWaitVblankStart)[1];
	_sceDisplayWaitVblankStart = (void *)__sceDisplayWaitVblankStart;

	((int *)sceDisplayWaitVblankStart)[1] = ((int *)sceKernelSleepThread)[1];

#ifdef HOOK_sceKernelDcacheWritebackAll_WITH_sceKernelDcacheWritebackInvalidateAll
	sceKernelDcacheWritebackInvalidateAll();
#else
	sceKernelDcacheWritebackAll();
#endif

	InitGlobals();

	initScreenAndCtrl();

	fadeIn();
	fadeOut();

	Print(22, 15, colours[INDEX_GREEN], " - Hello World! -");
	changeBuffer();
	Sleep(1000);
	changeBuffer();

	fadeIn();
	fadeOut();

	for (i = 0; i < 100; i++) {
		snowflake[i].x = rand() % SCREEN_WIDTH;
		snowflake[i].y = rand() % SCREEN_HEIGHT;
		snowflake[i].flake = rand() % 3;
	}


	for(;;)
	{
		gpaddata.Buttons = 0;

		sceCtrlReadBufferPositive(&gpaddata, 1);

		ProcessKeys(gpaddata.Buttons);
    
		Fillvram(colours[INDEX_BLACK]);    

		for (a = 0;a<100;a++) {
			sway = rand() % 4;
			switch (sway) {
				case 1:
				case 2:
					snowflake[a].x--;
					break;
				case 3:
				case 4:
					snowflake[a].x++;
					break;
			}
			snowflake[a].y += rand() % 4;
			if (snowflake[a].y > SCREEN_HEIGHT) {
				snowflake[a].y = 0;
				snowflake[a].x = rand() % SCREEN_WIDTH;
			}
			if(snowflake[a].flake)
				drawPixel(snowflake[a].x,
					snowflake[a].y,
					snowflake[a].flake,
					snowflake[a].flake,
					colours[color]);
		}

		drawPixel(0, 247, SCREEN_WIDTH, SCREEN_HEIGHT, colours[INDEX_GRAY]); // ground
		Print (0, 0, colours[INDEX_GRAY], "Hello world");
		Print (0, 1, colours[INDEX_GRAY], "POC for 6.60, PS Vita 3.00");
		Print (0, 3, colours[INDEX_GRAY], "Exploit/SDK:");
		Print (0, 4, colours[INDEX_WHITE], "    Patchouli, 173210, malloxis, m0skit0, n00b81, wololo");
		Print (0, 6, colours[INDEX_GRAY], "Hello world adapted from Sparta SDK by Matiaz & Freeplay");
		Print (0, 7, colours[INDEX_GRAY], "Special thanks to TyRaNiD for PSPLink and PRXTool");
		Print (0, 11, colours[INDEX_GRAY], "   and to everyone involved in the PSPSDK");

		changeBuffer();
	}

}