src/patch.c
__attribute__((at(0x214600, "", CHIP_VER_BCM4375B1_BT, FW_VER_S20)))
__attribute__((optimize("O0")))
void bthci_cmd_start_tx(uint8_t *hci_cmd_buffer) {
	
	tx_enabled = 0x01;
	tx_frequency = (hci_cmd_buffer[12] == 0x01 ? channelToFrequency(hci_cmd_buffer[13]) : hci_cmd_buffer[13]-2);


	buffer_decoded_size = hci_cmd_buffer[14];
	if (hci_cmd_buffer[12] == 0x01) {

		for (int i=0;i<4;i++) {
			buffer_decoded[i] = 0;
		}
		// Save decoded packet in RAM
		memcpybt(&buffer_decoded[4],&hci_cmd_buffer[15],buffer_decoded_size);
		
		// Generate GMSK representation of Zigbee packet
		for (int i=0;i<255;i++) raw_buffer[i] = 0;
		for (int i=0;i<buffer_decoded_size+4;i++) {
			uint8_t msb = buffer_decoded[i] >> 4;
			uint8_t lsb = buffer_decoded[i] & 0x0F;

			raw_buffer[i*8+0] = (SYMBOL_TO_CHIP_MAPPING[lsb][0]);
			raw_buffer[i*8+1] = (SYMBOL_TO_CHIP_MAPPING[lsb][1]);
			raw_buffer[i*8+2] = (SYMBOL_TO_CHIP_MAPPING[lsb][2]);
			raw_buffer[i*8+3] = (SYMBOL_TO_CHIP_MAPPING[lsb][3]);

			raw_buffer[i*8+4] = (SYMBOL_TO_CHIP_MAPPING[msb][0]);
			raw_buffer[i*8+5] = (SYMBOL_TO_CHIP_MAPPING[msb][1]);
			raw_buffer[i*8+6] = (SYMBOL_TO_CHIP_MAPPING[msb][2]);
			raw_buffer[i*8+7] = (SYMBOL_TO_CHIP_MAPPING[msb][3]);
		}
	}
	else if (hci_cmd_buffer[12] == 0x02 || hci_cmd_buffer[12] == 0x03 || hci_cmd_buffer[12] == 0x04 ) {
		memcpybt(buffer_decoded,&hci_cmd_buffer[15],buffer_decoded_size);
		encode_mosart(raw_buffer,buffer_decoded,buffer_decoded_size);
	}
	else if (hci_cmd_buffer[12] == 0x05 || hci_cmd_buffer[12] == 0x06 ) {
		memcpybt(buffer_decoded,&hci_cmd_buffer[15],buffer_decoded_size);
		for (int i=0;i<buffer_decoded_size;i++) raw_buffer[i] = swap_bits(buffer_decoded[i]);
	}	
	*((int*)(0x232138)) = 0x000005d0;
	*((int*)(0x232140)) = 0x00000005;
	*((int*)(0x232144)) = 0x00000010;

	// Copy packet as adv data
	if (hci_cmd_buffer[12] == 0x01) {
		memcpybt((void*)(0x232ec0),raw_buffer,(buffer_decoded_size+4)*8);
		*((int*)(0x2332c0)) = (buffer_decoded_size+4)*8;
	}
	else if (hci_cmd_buffer[12] < 0x05) {
		memcpybt((void*)(0x232ec0),raw_buffer,buffer_decoded_size*2);
		*((int*)(0x2332c0)) = buffer_decoded_size*2;	
	}
	else {
		memcpybt((void*)(0x232ec0),raw_buffer,buffer_decoded_size);
		*((int*)(0x2332c0)) = buffer_decoded_size;	
	
	}
	for (int i=0;i<40;i++) fake_hci_buffer[i] = 0;
		
	// Configure fake HCI buffer to enable LE adv
	fake_hci_buffer[8] =  0x01;
	fake_hci_buffer[9] =  0x39;
	fake_hci_buffer[10] =  0x20;
	fake_hci_buffer[11] =  0x06;
	fake_hci_buffer[12] =  0x01;
	fake_hci_buffer[13] =  0x01;
	fake_hci_buffer[14] =  0x00;
	fake_hci_buffer[15] =  0x00;
	fake_hci_buffer[16] =  0x00;
	fake_hci_buffer[17] =  0x00;	
	bthci_cmd_ble_HandleSet_Extended_Advertising_Enable(fake_hci_buffer);

}
/*
Function allowing to enable and configure TX mode.
*/
Function allowing to enable and configure TX mode.
Function allowing to enable and configure TX mode .
__attribute__((at(0x214600, "", CHIP_VER_BCM4375B1_BT, FW_VER_S20)))
__attribute__((optimize("O0")))
void bthci_cmd_start_tx(uint8_t *hci_cmd_buffer) {
	tx_enabled = 0x01;
	tx_frequency = (hci_cmd_buffer[12] == 0x01 ? channelToFrequency(hci_cmd_buffer[13]) : hci_cmd_buffer[13]-2);
	buffer_decoded_size = hci_cmd_buffer[14];
	if (hci_cmd_buffer[12] == 0x01) {
		for (int i=0;i<4;i++) {
			buffer_decoded[i] = 0;
		}
		memcpybt(&buffer_decoded[4],&hci_cmd_buffer[15],buffer_decoded_size);
		for (int i=0;i<255;i++) raw_buffer[i] = 0;
		for (int i=0;i<buffer_decoded_size+4;i++) {
			uint8_t msb = buffer_decoded[i] >> 4;
			uint8_t lsb = buffer_decoded[i] & 0x0F;
			raw_buffer[i*8+0] = (SYMBOL_TO_CHIP_MAPPING[lsb][0]);
			raw_buffer[i*8+1] = (SYMBOL_TO_CHIP_MAPPING[lsb][1]);
			raw_buffer[i*8+2] = (SYMBOL_TO_CHIP_MAPPING[lsb][2]);
			raw_buffer[i*8+3] = (SYMBOL_TO_CHIP_MAPPING[lsb][3]);
			raw_buffer[i*8+4] = (SYMBOL_TO_CHIP_MAPPING[msb][0]);
			raw_buffer[i*8+5] = (SYMBOL_TO_CHIP_MAPPING[msb][1]);
			raw_buffer[i*8+6] = (SYMBOL_TO_CHIP_MAPPING[msb][2]);
			raw_buffer[i*8+7] = (SYMBOL_TO_CHIP_MAPPING[msb][3]);
		}
	}
	else if (hci_cmd_buffer[12] == 0x02 || hci_cmd_buffer[12] == 0x03 || hci_cmd_buffer[12] == 0x04 ) {
		memcpybt(buffer_decoded,&hci_cmd_buffer[15],buffer_decoded_size);
		encode_mosart(raw_buffer,buffer_decoded,buffer_decoded_size);
	}
	else if (hci_cmd_buffer[12] == 0x05 || hci_cmd_buffer[12] == 0x06 ) {
		memcpybt(buffer_decoded,&hci_cmd_buffer[15],buffer_decoded_size);
		for (int i=0;i<buffer_decoded_size;i++) raw_buffer[i] = swap_bits(buffer_decoded[i]);
	}	
	*((int*)(0x232138)) = 0x000005d0;
	*((int*)(0x232140)) = 0x00000005;
	*((int*)(0x232144)) = 0x00000010;
	if (hci_cmd_buffer[12] == 0x01) {
		memcpybt((void*)(0x232ec0),raw_buffer,(buffer_decoded_size+4)*8);
		*((int*)(0x2332c0)) = (buffer_decoded_size+4)*8;
	}
	else if (hci_cmd_buffer[12] < 0x05) {
		memcpybt((void*)(0x232ec0),raw_buffer,buffer_decoded_size*2);
		*((int*)(0x2332c0)) = buffer_decoded_size*2;	
	}
	else {
		memcpybt((void*)(0x232ec0),raw_buffer,buffer_decoded_size);
		*((int*)(0x2332c0)) = buffer_decoded_size;	
	}
	for (int i=0;i<40;i++) fake_hci_buffer[i] = 0;
	fake_hci_buffer[8] =  0x01;
	fake_hci_buffer[9] =  0x39;
	fake_hci_buffer[10] =  0x20;
	fake_hci_buffer[11] =  0x06;
	fake_hci_buffer[12] =  0x01;
	fake_hci_buffer[13] =  0x01;
	fake_hci_buffer[14] =  0x00;
	fake_hci_buffer[15] =  0x00;
	fake_hci_buffer[16] =  0x00;
	fake_hci_buffer[17] =  0x00;	
	bthci_cmd_ble_HandleSet_Extended_Advertising_Enable(fake_hci_buffer);
}
__attribute__ ( ( at ( 0x214600 , " " , CHIP_VER_BCM4375B1_BT , FW_VER_S20 ) ) ) __attribute__ ( ( optimize ( " " ) ) ) void bthci_cmd_start_tx ( uint8_t * hci_cmd_buffer ) { tx_enabled = 0x01 ; tx_frequency = ( hci_cmd_buffer [ 12 ] == 0x01 ? channelToFrequency ( hci_cmd_buffer [ 13 ] ) : hci_cmd_buffer [ 13 ] - 2 ) ; buffer_decoded_size = hci_cmd_buffer [ 14 ] ; if ( hci_cmd_buffer [ 12 ] == 0x01 ) { for ( int i = 0 ; i < 4 ; i ++ ) { buffer_decoded [ i ] = 0 ; } memcpybt ( & buffer_decoded [ 4 ] , & hci_cmd_buffer [ 15 ] , buffer_decoded_size ) ; for ( int i = 0 ; i < 255 ; i ++ ) raw_buffer [ i ] = 0 ; for ( int i = 0 ; i < buffer_decoded_size + 4 ; i ++ ) { uint8_t msb = buffer_decoded [ i ] >> 4 ; uint8_t lsb = buffer_decoded [ i ] & 0x0F ; raw_buffer [ i * 8 + 0 ] = ( SYMBOL_TO_CHIP_MAPPING [ lsb ] [ 0 ] ) ; raw_buffer [ i * 8 + 1 ] = ( SYMBOL_TO_CHIP_MAPPING [ lsb ] [ 1 ] ) ; raw_buffer [ i * 8 + 2 ] = ( SYMBOL_TO_CHIP_MAPPING [ lsb ] [ 2 ] ) ; raw_buffer [ i * 8 + 3 ] = ( SYMBOL_TO_CHIP_MAPPING [ lsb ] [ 3 ] ) ; raw_buffer [ i * 8 + 4 ] = ( SYMBOL_TO_CHIP_MAPPING [ msb ] [ 0 ] ) ; raw_buffer [ i * 8 + 5 ] = ( SYMBOL_TO_CHIP_MAPPING [ msb ] [ 1 ] ) ; raw_buffer [ i * 8 + 6 ] = ( SYMBOL_TO_CHIP_MAPPING [ msb ] [ 2 ] ) ; raw_buffer [ i * 8 + 7 ] = ( SYMBOL_TO_CHIP_MAPPING [ msb ] [ 3 ] ) ; } } else if ( hci_cmd_buffer [ 12 ] == 0x02 || hci_cmd_buffer [ 12 ] == 0x03 || hci_cmd_buffer [ 12 ] == 0x04 ) { memcpybt ( buffer_decoded , & hci_cmd_buffer [ 15 ] , buffer_decoded_size ) ; encode_mosart ( raw_buffer , buffer_decoded , buffer_decoded_size ) ; } else if ( hci_cmd_buffer [ 12 ] == 0x05 || hci_cmd_buffer [ 12 ] == 0x06 ) { memcpybt ( buffer_decoded , & hci_cmd_buffer [ 15 ] , buffer_decoded_size ) ; for ( int i = 0 ; i < buffer_decoded_size ; i ++ ) raw_buffer [ i ] = swap_bits ( buffer_decoded [ i ] ) ; } * ( ( int * ) ( 0x232138 ) ) = 0x000005d0 ; * ( ( int * ) ( 0x232140 ) ) = 0x00000005 ; * ( ( int * ) ( 0x232144 ) ) = 0x00000010 ; if ( hci_cmd_buffer [ 12 ] == 0x01 ) { memcpybt ( ( void * ) ( 0x232ec0 ) , raw_buffer , ( buffer_decoded_size + 4 ) * 8 ) ; * ( ( int * ) ( 0x2332c0 ) ) = ( buffer_decoded_size + 4 ) * 8 ; } else if ( hci_cmd_buffer [ 12 ] < 0x05 ) { memcpybt ( ( void * ) ( 0x232ec0 ) , raw_buffer , buffer_decoded_size * 2 ) ; * ( ( int * ) ( 0x2332c0 ) ) = buffer_decoded_size * 2 ; } else { memcpybt ( ( void * ) ( 0x232ec0 ) , raw_buffer , buffer_decoded_size ) ; * ( ( int * ) ( 0x2332c0 ) ) = buffer_decoded_size ; } for ( int i = 0 ; i < 40 ; i ++ ) fake_hci_buffer [ i ] = 0 ; fake_hci_buffer [ 8 ] = 0x01 ; fake_hci_buffer [ 9 ] = 0x39 ; fake_hci_buffer [ 10 ] = 0x20 ; fake_hci_buffer [ 11 ] = 0x06 ; fake_hci_buffer [ 12 ] = 0x01 ; fake_hci_buffer [ 13 ] = 0x01 ; fake_hci_buffer [ 14 ] = 0x00 ; fake_hci_buffer [ 15 ] = 0x00 ; fake_hci_buffer [ 16 ] = 0x00 ; fake_hci_buffer [ 17 ] = 0x00 ; bthci_cmd_ble_HandleSet_Extended_Advertising_Enable ( fake_hci_buffer ) ; }
Function allowing to enable and configure TX mode.
Function allowing to enable and configure TX mode .
// Save decoded packet in RAM // Generate GMSK representation of Zigbee packet // Copy packet as adv data // Configure fake HCI buffer to enable LE adv