Index: YC3121_OTP_tool/3121_OTP_Data_Gen.ini
===================================================================
--- /YC3121_ROM/YC3121_OTP_tool/3121_OTP_Data_Gen.ini	(revision 848)
+++ /YC3121_ROM/YC3121_OTP_tool/3121_OTP_Data_Gen.ini	(working copy)
@@ -6,7 +6,7 @@
 ESN=
 ETime=41
 EInfo=
-FlashPubFilePath=D:\MyProject\YC3121\YC3121_ROM\YC3121_OTP_tool\ccid_boot_key\yichip_public_key.pem
+FlashPubFilePath=D:\MyProject\Test_tool\YC31xxx loader\秘钥文件\公钥.txt
 Rc192CliAdjustParam=01 00
 ClkpoAdjustParam=7fff
 Ido_sec_vtrlm=04
@@ -44,5 +44,5 @@
 PatchValid=1
 PatchVersion=ffff
 PatchPriFilePath=D:\MyProject\YC3121\YC3121_ROM\YC3121_OTP_tool\yc3121_otp_rsa_private_key_2048.pem
-PatchFile=D:\MyProject\YC3121\YC3121_ROM\fw\output\boot_otp.bin
-FileType=0
+PatchFile=D:\MyProject\YC3121\YC3121_ROM\fw\output\otp.bin
+FileType=1
Index: YC3121_OTP_tool/3122OtpDataGenV1.3.exe
===================================================================
Cannot display: file marked as a binary type.
svn:mime-type = application/octet-stream

Property changes on: YC3121_OTP_tool/3122OtpDataGenV1.3.exe
___________________________________________________________________
Added: svn:mime-type
## -0,0 +1 ##
+application/octet-stream
\ No newline at end of property
Index: fw/c_otp_patch_sm.bat
===================================================================
--- /YC3121_ROM/fw/c_otp_patch_sm.bat	(nonexistent)
+++ /YC3121_ROM/fw/c_otp_patch_sm.bat	(working copy)
@@ -0,0 +1,8 @@
+cls
+make -f makefile_otp_patch_sm clean
+make -f makefile_otp_patch_sm
+
+python f_rom_to_bin.py 0 output\otp.rom
+rem f_rom_to_bin.py参数填写说明:
+rem 第一个参数为截取代码在文件中的行号
+rem 第二个参数为输入文件,输出文件为输入文件名+.bin后缀
\ No newline at end of file
Index: fw/f_rom_to_bin.py
===================================================================
--- /YC3121_ROM/fw/f_rom_to_bin.py	(nonexistent)
+++ /YC3121_ROM/fw/f_rom_to_bin.py	(working copy)
@@ -0,0 +1,34 @@
+import struct
+import sys
+print(sys.argv[0])
+print(sys.argv[1]) #鍙傛暟閮芥槸str
+print(len(sys.argv))
+
+if len(sys.argv) > 2:
+    input_file = sys.argv[2]
+else:
+    input_file = "flash.rom" 
+print("in  file name:",input_file)
+output_file = input_file.replace(".rom",".bin")
+print("out file name:",output_file)
+print(">>>>>>>>>>>>>>>>>>Flash_rom To Bin<<<<<<<<<<<<<<<<<<<<<<<<")
+
+
+#Read data
+print(">>Start Read Data")
+f= open(input_file,"r")
+list_lines=f.readlines()
+f.close()
+
+
+#write data
+a= int(sys.argv[1]) #str杞崲鎴恑nteger
+print(">>start write File From ",a)
+print(list_lines[a])
+fw = open(file=output_file,mode="wb")
+for i in list_lines[a:]:
+    fw.write(struct.pack('L',int(i,16)))
+fw.close()
+
+
+print("************************END***********************")
\ No newline at end of file
Index: fw/jlinkbat.txt
===================================================================
--- /YC3121_ROM/fw/jlinkbat.txt	(revision 848)
+++ /YC3121_ROM/fw/jlinkbat.txt	(working copy)
@@ -10,10 +10,11 @@
 g
 sleep 500
 h
-loadbin D:\MyProject\YC3121\YC3121_ROM\YC3121_OTP_tool\otp_patch_info.bin 0x2b134
+loadbin D:\MyProject\YC3121\YC3121_ROM\fw\output\otp_info.bin 0x2b134
 setbp 0x77a4
 g
 sleep 100
 h
-loadbin D:\MyProject\YC3121\YC3121_ROM\fw\output\boot_otp.bin 0x20000
+loadbin D:\MyProject\YC3121\YC3121_ROM\fw\output\otp.bin 0x20000
+setbp 0x20000
 g
\ No newline at end of file
Index: fw/makefile_otp_patch_sm
===================================================================
--- /YC3121_ROM/fw/makefile_otp_patch_sm	(nonexistent)
+++ /YC3121_ROM/fw/makefile_otp_patch_sm	(working copy)
@@ -0,0 +1,119 @@
+
+ifeq ($(OS),Windows_NT)
+DIR = C:/gcc-arm-none-eabi-7-2018-q2-update-win32
+else
+DIR = /usr/gcc-arm-none-eabi-7-2018-q2-update
+endif
+
+ARCH = $(DIR)/bin/arm-none-eabi
+GCC = $(ARCH)-gcc
+LD = $(ARCH)-ld
+AS = $(ARCH)-as
+OBJCOPY = $(ARCH)-objcopy
+OBJDUMP = "$(ARCH)-objdump"
+
+
+all : output/out.hex
+
+f : output/out.hex
+	e fp;e k
+
+
+
+#ROM_API = crypt sdk check update
+#ROM_PATH = sdk core $(addprefix core/rom_api/,$(ROM_API))
+#vpath %.c $(ROM_PATH)
+#vpath %.s core
+
+ROM_OBJS =  core/startup core/rom_main	\
+			core/rom_api/sdk/yc_dma		\
+			core/rom_api/crypt/yc_calc	\
+			core/rom_api/crypt/yc_des	\
+			core/rom_api/crypt/yc_rsa	\
+			core/rom_api/crypt/yc_sha	\
+			core/rom_api/crypt/yc_aes	\
+			core/rom_api/crypt/yc_sm3	\
+			core/rom_api/crypt/yc_sm4	\
+			core/rom_api/sdk/yc_bt		\
+			core/rom_api/sdk/yc_misc	\
+			core/rom_api/sdk/yc_mpu		\
+			core/rom_api/sdk/yc_otp		\
+			core/rom_api/sdk/yc_qspiflash\
+			core/rom_api/sdk/yc_uart 	\
+			core/rom_api/sdk/yc_lpm 	\
+			core/rom_api/sdk/encflash 	\
+			core/rom_api/check/rom_selfcheck 	\
+			core/rom_api/update/rom_boot
+
+OBJS = $(ROM_OBJS) core/flash_start otp_boot_sm sdk/yc_it
+
+OTPS = otp
+
+
+CFLAG =  -mthumb -mcpu=cortex-m0 -c -g -Os $(DEF)   -fno-toplevel-reorder
+LDFLAG = -T output/ld.script -Map=output/memmap -lc -lm -lgcc -L "$(DIR)/lib/gcc/arm-none-eabi/7.3.1/thumb/v6-m"  -L "$(DIR)/arm-none-eabi/lib/thumb/v6-m"
+
+define ldscript =
+SECTIONS
+{
+        . = 0;
+        .rom : { *startup.o *rom_*.o(*.text* *.rodata*) *lib_a* *_udivsi3.o  *_dvmd_tls.o *_divsi3.o*}
+        . = 0x20000;
+        .otp : { *otp_boot_sm.o(.text* .rodata*) }
+		. = 0x1000000;
+        .text : { *flash_start.o *(.text*) *(.rodata*) }
+        _sidata = ALIGN(4);
+        . = 0x2b800;
+        .data : AT (_sidata) { _sdata = .; *(.data) _edata = .; }
+        .bss : { _sbss = .;     *(*.bss) *(*.scommon*) }
+        _ebss = .;
+        . = 0x30000;
+        _stack = .;
+        ASSERT(_ebss < _stack, "data size overflow")
+}
+endef
+
+
+output/out.hex : output/out
+	$(OBJCOPY) $^ -O ihex $@
+	perl hex2rom.pl 0 7fff < $@ > output/boot.rom
+	encrom output/boot.rom output/boot_enc.rom
+	perl hex2rom.pl 1000000 1ffffff < $@ > output/flash.rom
+	encrom output/flash.rom output/flash.dat key
+	perl hex2rom.pl 20000 22000 < $@ > output/otp.rom
+	perl rom2mif.pl 34 < output/boot_enc.rom > 	output/boot_enc.mif
+#	perl rom2mif.pl < output/flash_enc.rom > ../fpga/flash_enc.mif
+#	cp output/flash_enc.rom output/boot_enc.rom ../sim/
+
+
+output/out : $(addprefix output/, $(addsuffix .o, $(OBJS)))
+	$(file >output/ld.script, $(ldscript))
+	$(LD) $^ -o $@  $(LDFLAG)
+	$(OBJDUMP) -S $@ > output/disasm
+
+output/otp : $(addprefix output/, $(addsuffix .o, $(OTPS)))
+	$(file > output/ld.script, $(ldscript_otp))
+	$(LD) $^ -o $@  $(LDFLAG)
+	$(OBJDUMP) -S $@ > output/disasm_otp
+
+output/%.o : %.c
+	$(GCC) $< $(CFLAG) -o $@
+
+output/%.o : %.s
+	$(AS) $^ -mthumb -mcpu=cortex-m0 -o $@
+
+
+clean :
+ifeq ($(OS),Windows_NT)
+	del /Q output\*.*
+	del /Q output\out*
+	del /Q output\*.o
+	del /Q output\core\*.o
+	del /Q output\core\rom_api\crypt\*.o
+	del /Q output\core\rom_api\sdk\*.o
+	del /Q output\core\rom_api\update\*.o
+	del /Q output\core\rom_api\check\*.o
+	del /Q output\sdk\*.o
+else
+	rm -rf output/*
+endif
Index: fw/otp_boot_sm.c
===================================================================
--- /YC3121_ROM/fw/otp_boot_sm.c	(nonexistent)
+++ /YC3121_ROM/fw/otp_boot_sm.c	(working copy)
@@ -0,0 +1,850 @@
+#include "core/yc3121.h"
+
+//#define OTP__DEBUG
+
+//boot define
+#define BOOT_BUF_LEN						(int)1100
+#define BOOT_REPLY_STATUS_OK				(uint8_t)0
+#define BOOT_REPLY_STATUS_CRC_ERR			(uint8_t)1
+#define BOOT_REPLY_STATUS_LEN_ERR			(uint8_t)2
+#define BOOT_REPLY_STATUS_VERIFY_ERR		(uint8_t)3
+#define BOOT_REPLY_STATUS_ARQ				(uint8_t)4
+#define BOOT_REPLY_STATUS_OTP_ERR			(uint8_t)5
+#define BOOT_RECEIVE_HEAD_LEN     			(int)4
+
+//otp
+#define OTP_C_INFO_ADDR						(uint32_t)0x0000
+#define OTP_C_INFO_LEN						(int)14
+#define OTP_E_INFO_ADDR						(uint32_t)0x000e
+#define OTP_E_INFO_LEN						(int)34
+
+//flash
+#define FLASH_BASE_ADDR					(uint32_t)0x1000000
+#define FLASH_APP_INFO_ADDR				(uint32_t)0x1000000
+#define FLASH_APP_INFO_LEN					(int)12
+#define FLASH_CODE_ADDR					(uint32_t)0x1000200
+
+//ram
+#define SRAM_BOOT_STRUCT_ADDR        			(uint32_t)0x2b000
+
+
+
+typedef struct /*chip info*/
+{
+	uint16_t 	chip_stage;
+	uint8_t 	CSN[6];
+	uint16_t 	CTime;
+	uint16_t 	CInfo;
+	uint16_t 	crc;
+
+} C_InfoTypeDef;//size 14 byte
+
+
+
+typedef struct /*app sm3 info*/
+{
+	uint8_t 	app_sm3[32];
+	uint16_t 	crc;
+
+} E_InfoTypeDef;//size 34 byte
+
+
+
+
+
+typedef struct
+{
+	uint32_t 	start_addr;
+	uint32_t 	app_len;
+	uint16_t 	app_version;
+	uint16_t 	crc;
+
+} AppInfoTypeDef;//size 12 byte
+
+
+
+typedef struct
+{
+	uint8_t			boot_step;
+	uint8_t			upgrade;
+	uint16_t		reserved1;
+	uint16_t		wait_time;
+	C_InfoTypeDef	C_infoStruct;		//size 14 byte
+	E_InfoTypeDef	E_infoStruct;		//size 34 byte
+	uint16_t		reserved2;
+	AppInfoTypeDef	AppInfostruct;		//size 12 byte
+	uint8_t			reserved3[784];
+	uint8_t			boot_buf[BOOT_BUF_LEN];
+
+} RomBootDataTypeDef;//size 1948 byte(0x79c)
+
+
+#define RomBooDataStruct ((RomBootDataTypeDef*)SRAM_BOOT_STRUCT_ADDR)
+extern uint8_t self_test_config;
+extern uint16_t otp_user_start_addr;
+extern uint8_t uart_txd_IO;
+extern uint8_t uart_rxd_IO;
+extern uint8_t Jtag_sw_clk;
+extern uint8_t Jtag_sw_data;
+extern uint8_t ice_io;
+extern uint32_t main_flow_ctrl;
+extern uint8_t rom_switch;
+extern QSPI_ParamTypeDef qspi_param;
+extern uint8_t use_pr_flash;
+uint8_t fill_memmap_buf[8]={0};
+
+#ifndef BOOT_DEBUG
+#ifdef OTP__DEBUG
+void  _MyPrintf(char *format, ...);
+#endif
+#endif
+
+extern void _enable_debug_port();
+extern void _Hardware_Init();
+void boot_init();
+extern void _DeInit_download_port();
+void init_download_port();
+extern SCY_Boolean _detect_DownloadSignal();
+extern SCY_Boolean _boot_receive_data();
+extern uint8_t _boot_earse_app_flash_area(uint32_t len);
+extern void _boot_send_data(uint8_t* buf,int data_len);
+extern void _boot_reply_staus(uint8_t step,uint8_t status);
+extern void _boot_put_CRC16 (uint8_t* bufData, unsigned int DataLen);
+extern SCY_Boolean _boot_verify_CRC16 (uint8_t* bufData, unsigned int DataLen);
+extern void _otp_config();
+void  run_app();
+Boolean app_available();
+SCY_Boolean otp_boot_download();
+SCY_Boolean otp_verify_app();
+SCY_Boolean otp_boot_receive_app_data();
+
+
+
+void _otp_main()
+{
+	boot_init();
+	#if defined (OTP__DEBUG)
+	_MyPrintf("otp main\r\n");
+	_enable_debug_port();
+	#endif
+	if(read_chip_life()==DEBUG_STAGE)
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("DEBUG_STAGE\r\n");
+		#endif
+		init_download_port();
+		if(_detect_DownloadSignal()==SCY_TRUE)
+		{
+			if(otp_boot_download()!=SCY_TRUE)
+			{
+				#if defined (OTP__DEBUG)
+				_MyPrintf("download err\r\n");
+				#endif
+				soft_reset();
+			}
+		}
+		else
+		{
+			if(app_available()!=TRUE)
+			{
+				#if defined (OTP__DEBUG)
+				_MyPrintf("app disavailable\r\n");
+				#endif
+				soft_reset();
+			}
+		}
+		#ifndef OTP__DEBUG
+		_DeInit_download_port();
+		#endif
+		_enable_debug_port();
+	}
+	else
+	{
+		if(otp_verify_app()!=SCY_TRUE)
+		{
+			#if defined (OTP__DEBUG)
+			_MyPrintf("verify_app err\r\n");
+			#endif
+			soft_reset();
+		}
+		SYSCTRL_ROM_SWITCH &= ~(1<<ROMSWITCH_BTM_EN);
+		SYSCTRL_ROM_SWITCH|= (1 << ROMSWITCH_SW) | (1 << ROMSWITCH_ALARM_EN);
+	}
+	#ifdef OTP__DEBUG
+	_MyPrintf("_DeInit_download_port\r\n");
+	_DeInit_download_port();
+	#endif
+	_otp_config();
+	run_app();
+}
+
+
+#ifndef BOOT_DEBUG
+#ifdef OTP__DEBUG
+#include <stdarg.h>
+/**
+ * @brief Print format string to serial port 0.You need to initialize the serial port 0 before you use _MyPrintf.
+ * @param format : format string
+ * @param ...: format parameter
+ */
+static const int8_t* const g_pcHex1 = "0123456789abcdef";
+static const int8_t* const g_pcHex2 = "0123456789ABCDEF";
+
+void  printfsend(_UART_TypeDef UARTx, uint8_t* buf, int len)
+{
+    uint8_t printbuf[256];
+    volatile uint32_t packnum = (len+255)/256;
+    volatile uint32_t packlen = 0 ;
+    for(uint32_t j=0;j<packnum;j++)
+    {
+        packlen = len > 256? 256:len;
+        for(uint32_t i=0;i<packlen;i++)
+        {
+            printbuf[i] = buf[i+256*j];
+        }
+        _Uart_SendBuf(UARTx,printbuf, packlen);
+        len -= packlen;
+    }
+}
+void  _MyPrintf(char *format, ...)
+{
+
+        uint32_t ulIdx, ulValue, ulPos, ulCount, ulBase, ulNeg;
+        int8_t*pcStr, pcBuf[16], cFill;
+        char HexFormat;
+    	va_list vaArgP;
+
+    	va_start(vaArgP, format);
+
+    	while(*format)
+    	{
+      	    // Find the first non-% character, or the end of the string.
+            for(ulIdx = 0; (format[ulIdx] != '%') && (format[ulIdx] != '\0');ulIdx++)
+            {}
+
+        	// Write this portion of the string.
+            if(ulIdx>0)
+            {
+                printfsend(_UART0,format, ulIdx);
+            }
+
+            format += ulIdx;
+
+        if(*format == '%')
+        {
+            format++;
+
+            // Set the digit count to zero, and the fill character to space
+            // (i.e. to the defaults).
+            ulCount = 0;
+            cFill = ' ';
+
+again:
+           switch(*format++)
+            {
+                case '0':
+                case '1':
+                case '2':
+                case '3':
+                case '4':
+                case '5':
+                case '6':
+                case '7':
+                case '8':
+                case '9':
+                {
+                    if((format[-1] == '0') && (ulCount == 0))
+                    {
+                        cFill = '0';
+                    }
+
+                    ulCount *= 10;
+                    ulCount += format[-1] - '0';
+
+                    goto again;
+                }
+
+                case 'c':
+                {
+                    ulValue = va_arg(vaArgP, unsigned long);
+                    printfsend(_UART0,(char *)&ulValue, 1);
+                    break;
+                }
+
+                case 'd':
+                {
+                    ulValue = va_arg(vaArgP, unsigned long);
+                    ulPos = 0;
+
+                    if((long)ulValue < 0)
+                    {
+                        ulValue = -(long)ulValue;
+                        ulNeg = 1;
+                    }
+                    else
+                    {
+                        ulNeg = 0;
+                    }
+
+                    ulBase = 10;
+                    goto convert;
+                }
+
+                case 's':
+                {
+                    pcStr = va_arg(vaArgP, char *);
+
+                    for(ulIdx = 0; pcStr[ulIdx] != '\0'; ulIdx++)
+                    {}
+
+                    printfsend(_UART0,pcStr, ulIdx);
+
+                    if(ulCount > ulIdx)
+                    {
+                        ulCount -= ulIdx;
+                        while(ulCount--)
+                        {
+                            printfsend(_UART0," ", 1);
+                        }
+                    }
+                    break;
+                }
+
+                case 'u':
+                {
+                    ulValue = va_arg(vaArgP, unsigned long);
+                    ulPos = 0;
+                    ulBase = 10;
+                    ulNeg = 0;
+                    goto convert;
+                }
+
+
+                case 'X':
+                {
+                    ulValue = va_arg(vaArgP, unsigned long);
+                    ulPos = 0;
+                    ulBase = 16;
+                    ulNeg = 0;
+                    HexFormat='X';
+                    goto convert;
+                }
+
+                case 'x':
+                case 'p':
+                {
+                    ulValue = va_arg(vaArgP, unsigned long);
+                    ulPos = 0;
+                    ulBase = 16;
+                    ulNeg = 0;
+                     HexFormat='x';
+
+convert:
+                    for(ulIdx = 1;
+                        (((ulIdx * ulBase) <= ulValue) &&
+                         (((ulIdx * ulBase) / ulBase) == ulIdx));
+                        ulIdx *= ulBase, ulCount--)
+                    {
+                    }
+
+                    if(ulNeg)
+                    {
+                        ulCount--;
+                    }
+
+                    if(ulNeg && (cFill == '0'))
+                    {
+                        pcBuf[ulPos++] = '-';
+                        ulNeg = 0;
+                    }
+
+                    if((ulCount > 1) && (ulCount < 16))
+                    {
+                        for(ulCount--; ulCount; ulCount--)
+                        {
+                            pcBuf[ulPos++] = cFill;
+                        }
+                    }
+
+                    if(ulNeg)
+                    {
+                        pcBuf[ulPos++] = '-';
+                    }
+
+                    for(; ulIdx; ulIdx /= ulBase)
+                    {
+                        if(HexFormat=='x')	pcBuf[ulPos++] = g_pcHex1[(ulValue / ulIdx) % ulBase];//x
+                        else	pcBuf[ulPos++] = g_pcHex2[(ulValue / ulIdx) % ulBase];//X
+                    }
+
+                    printfsend(_UART0,pcBuf, ulPos);
+                    break;
+                }
+
+                case '%':
+                {
+                    printfsend(_UART0,format - 1, 1);
+                    break;
+                }
+
+                default:
+                {
+                    printfsend(_UART0,"ERROR", 5);
+                    break;
+                }
+            }//switch
+        }//if
+    }//while
+
+    va_end(vaArgP);
+}
+#endif
+#endif
+
+void boot_init()
+{
+	_Hardware_Init();
+	#if defined (OTP__DEBUG)
+	_MyPrintf("_Hardware_Init end\r\n");
+	#endif
+	//load C_Info
+	_read_otp(OTP_C_INFO_ADDR,(uint8_t *)&(RomBooDataStruct->C_infoStruct),OTP_C_INFO_LEN);
+	RomBooDataStruct->wait_time=RomBooDataStruct->C_infoStruct.CTime;
+	//read sm3 from otp
+	_read_otp(OTP_E_INFO_ADDR,(uint8_t *)&RomBooDataStruct->E_infoStruct,OTP_E_INFO_LEN);
+}
+
+void init_download_port()
+{
+
+}
+
+Boolean app_available()
+{
+	if(_flash_blank_check(0,512)==TRUE)
+	{
+		return FALSE;
+	}
+	else
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("flash not blank\r\n");
+		#endif
+		_dmacopy((uint8_t *)(&(RomBooDataStruct->AppInfostruct)),(uint8_t *)FLASH_APP_INFO_ADDR,FLASH_APP_INFO_LEN);
+		if(_boot_verify_CRC16((uint8_t *)(&(RomBooDataStruct->AppInfostruct)),FLASH_APP_INFO_LEN)==SCY_TRUE)
+		{
+			return TRUE;
+		}
+		else
+		{
+			return FALSE;
+		}
+
+	}
+}
+
+/*
+ * @brief:sm3 hash check
+ * @param:output: output data buffer
+ * @param:input	: input data
+ * @param:istep: number of data
+ * @param:isend : is last data
+ * @return: none
+ */
+void SM3_BYTE(uint8_t *output, uint8_t input,uint32_t istep,uint8_t isend)
+{
+	int i, j, maxlen,bytes;
+
+	enable_clock(2);
+
+	i = istep % 64;
+	j = ((i/4)*8 + i%4);
+
+	SHA_BDATA(j) = input;
+	if((istep & 3) == 3)
+	{
+		SHA_BDATA(j + 1) = 0;
+		SHA_BDATA(j + 2) = 0;
+		SHA_BDATA(j + 3) = 0;
+		SHA_BDATA(j + 4) = 0;
+		j+=4;
+	}
+
+	if(istep%64==63)
+	{
+		SHA_CTRL = 0x05 | 0x20 | (istep > 63  ? 0x10 : 0);
+		while(SHA_CTRL & 0x80);
+	}
+
+	bytes = istep + 1;
+
+	if(isend)
+	{
+		j = (j == 127) ? 0 : j+1;
+
+		SHA_BDATA(j) = 0x80;
+		if((bytes%64) < 56)
+		{
+			for(j++;j<120;j++)
+				SHA_BDATA(j) = 0;
+			for(i = 0;i <4;i++)
+				SHA_BDATA(120+i) = (bytes*8) >> (3 -i)*8;
+			SHA_CTRL = 0x05 | 0x20 | (istep >= 63 ? 0x10 : 0);
+			while(SHA_CTRL & 0x80);
+		}
+		else
+		{
+			for(j++;j<128;j++)
+				SHA_BDATA(j) = 0;
+			SHA_CTRL = 0x05 | 0x20 | (istep >= 63 ? 0x10 : 0);
+			while(SHA_CTRL & 0x80);
+
+			for(j=0;j<32;j++)
+			SHA_DATA(j) = 0;
+
+			for(i = 0;i <4;i++)
+				SHA_BDATA(120+i) = (bytes*8) >> (3 -i)*8;
+
+			SHA_CTRL = 0x05 | 0x20 | (0x10);
+			while(SHA_CTRL & 0x80);
+		}
+
+		for(i = 14, j = 0;i >= 0;i -= 2, j+=4)
+		{
+			output[j  ] = SHA_RESULT(i)>>24;
+			output[j+1] = SHA_RESULT(i)>>16;
+			output[j+2] = SHA_RESULT(i)>>8;
+			output[j+3] = SHA_RESULT(i);
+		}
+	}
+}
+
+SCY_Boolean otp_verify_app()
+{
+	uint8_t sm3_resault[32];
+	uint8_t app_data[32];
+	uint32_t caculated_len=0;
+	uint32_t packet_len;
+	uint32_t start_addr=0x1000200;
+	uint8_t IsEnd=0;
+	if(app_available()!=TRUE)
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("app_available error\r\n");
+		#endif
+		return SCY_FALSE;
+	}
+
+	if(_boot_verify_CRC16((uint8_t *)(&(RomBooDataStruct->E_infoStruct)),OTP_E_INFO_LEN)!=SCY_TRUE)
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("E_infoStruct crc error\r\n");
+		#endif
+		return SCY_FALSE;
+	}
+
+	//caculate fw sm3
+	#if defined (OTP__DEBUG)
+	_MyPrintf("start_addr=%x\r\n",start_addr);
+	_MyPrintf("app_len=%x\r\n",RomBooDataStruct->AppInfostruct.app_len);
+	#endif
+	while (caculated_len<RomBooDataStruct->AppInfostruct.app_len)
+	{
+		packet_len = RomBooDataStruct->AppInfostruct.app_len-caculated_len>=32 ? 32 : RomBooDataStruct->AppInfostruct.app_len-caculated_len;
+		// refresh cache
+		prefetch_len(((uint8_t *)start_addr),packet_len);
+		_dmacopy(app_data ,((uint8_t *)start_addr),packet_len);
+		for(int i=0;i<packet_len;i++)
+		{
+			if((caculated_len+1)>=RomBooDataStruct->AppInfostruct.app_len)
+			{
+				IsEnd=1;
+			}
+			SM3_BYTE(sm3_resault,app_data[i],caculated_len,IsEnd);
+			caculated_len++;
+		}
+		start_addr += packet_len;
+	}
+	//compare sm3
+	for(int i=0;i<sizeof(sm3_resault);i++)
+	{
+		if(sm3_resault[i]!=RomBooDataStruct->E_infoStruct.app_sm3[i])
+		{
+			#if defined (OTP__DEBUG)
+			_MyPrintf("sm3 error\r\n");
+			_MyPrintf("sm3_resault:\r\n");
+			for(int j=0;j<sizeof(sm3_resault);j++)	_MyPrintf("%02x ",sm3_resault[j]);
+			_MyPrintf("\r\napp_sm3:\r\n");
+			for(int j=0;j<sizeof(sm3_resault);j++)	_MyPrintf("%02x ",RomBooDataStruct->E_infoStruct.app_sm3[j]);
+			_MyPrintf("\r\n");
+			#endif
+			return SCY_FALSE;
+		}
+	}
+	return SCY_TRUE;
+}
+
+SCY_Boolean otp_boot_receive_app_data()
+{
+	int i;
+	int received_len;
+	int packet_len;
+	uint8_t ISend;
+	uint32_t write_flash_addr;
+
+	write_flash_addr=FLASH_BASE_ADDR;
+	received_len=0;
+	RomBooDataStruct->boot_step=3;
+	packet_len=0;
+	ISend=0;
+
+	#if defined (OTP__DEBUG)
+	_MyPrintf("receive app data\r\n");
+	#endif
+
+	//earse app flash area
+	_boot_earse_app_flash_area(RomBooDataStruct->AppInfostruct.app_len);
+	_setflashiv();
+	_qspi_init(&qspi_param);
+
+	//put app info into boot_buf
+	memcpy(RomBooDataStruct->boot_buf,(void *)&RomBooDataStruct->AppInfostruct,FLASH_APP_INFO_LEN);
+	packet_len=FLASH_APP_INFO_LEN;
+	//fill data between app info and app code
+	for(i=(FLASH_APP_INFO_ADDR+FLASH_APP_INFO_LEN);i<FLASH_CODE_ADDR;i++)
+	{
+		RomBooDataStruct->boot_buf[packet_len++]=0xff;
+	}
+	_enc_flash(write_flash_addr,RomBooDataStruct->boot_buf,packet_len,ISend);
+	write_flash_addr+=packet_len;
+
+	#if defined (OTP__DEBUG)
+	_MyPrintf("start receive app data len=%d\r\n",RomBooDataStruct->AppInfostruct.app_len);
+	#endif
+
+	while(received_len<RomBooDataStruct->AppInfostruct.app_len)
+	{
+		if(_boot_receive_data()!=SCY_TRUE)
+		{
+			#if defined (BOOT_APP_DEBUG)
+			_MyPrintf("receive app data err\r\n");
+			#endif
+			return SCY_FALSE;
+		}
+		packet_len=RomBooDataStruct->boot_buf[2]+RomBooDataStruct->boot_buf[3]*256-2;
+		received_len+=packet_len;
+
+		#if defined (BOOT_APP_DEBUG)
+		_MyPrintf("packet_len=%d\r\n",packet_len);
+		_MyPrintf("received_len=%d\r\n",received_len);
+		_MyPrintf("app_len=%d\r\n",RomBooDataStruct->AppInfostruct.app_len);
+		#endif
+		//reply success
+		_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_OK);
+
+		ISend= (received_len>=RomBooDataStruct->AppInfostruct.app_len) ? 1 : 0;
+
+		#if defined (OTP__DEBUG)
+		_MyPrintf("enc_flash addr=%08x buf_addr=%08x len=%d end=%d\r\n",write_flash_addr,RomBooDataStruct->boot_buf+4,packet_len,ISend);
+		#endif
+
+		_enc_flash(write_flash_addr,RomBooDataStruct->boot_buf+4,packet_len,ISend);
+		write_flash_addr+=packet_len;
+
+		#if defined (OTP__DEBUG)
+		_MyPrintf("enc_flash finish\r\n");
+		#endif
+
+	}
+
+	return SCY_TRUE;
+}
+
+
+void boot_send_boot_info()
+{
+	int i;
+	uint8_t ReplyData[50]={0};
+	#if defined (OTP__DEBUG)
+	_MyPrintf("send boot info\r\n");
+	#endif
+	i=0;
+	RomBooDataStruct->boot_step=1;
+	ReplyData[i++]=0xAA;
+	ReplyData[i++]=RomBooDataStruct->boot_step;
+	ReplyData[i++]=12;//length low
+	ReplyData[i++]=0;//length high
+	memcpy(ReplyData+i,(uint8_t *)&RomBooDataStruct->C_infoStruct.CSN,8);
+	i+=8;
+	ReplyData[i++]=RomBooDataStruct->AppInfostruct.app_version%256;
+	ReplyData[i++]=RomBooDataStruct->AppInfostruct.app_version/256;
+
+	_boot_send_data(ReplyData,i);
+}
+
+
+SCY_Boolean boot_receive_app_info()
+{
+	int i;
+	#if defined (OTP__DEBUG)
+	_MyPrintf("receive app info\r\n");
+	#endif
+	RomBooDataStruct->boot_step=2;
+	if(_boot_receive_data()!=SCY_TRUE)
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("receive app info data err\r\n");
+		#endif
+		return SCY_FALSE;
+	}
+	//save app info
+	memcpy((uint8_t *)&RomBooDataStruct->AppInfostruct,(uint8_t *)(RomBooDataStruct->boot_buf+BOOT_RECEIVE_HEAD_LEN),FLASH_APP_INFO_LEN);
+	RomBooDataStruct->AppInfostruct.start_addr=FLASH_CODE_ADDR;//not use pc send addr
+	_boot_put_CRC16((uint8_t *)&RomBooDataStruct->AppInfostruct,FLASH_APP_INFO_LEN-2);
+	//reply success
+	_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_OK);
+
+	return SCY_TRUE;
+}
+
+
+Boolean boot_write_otp(uint32_t addr, uint8_t *data, uint32_t len)
+{
+	_write_otp(addr,data,len);
+	_init_otp();
+	_delay_ms(1);
+	_read_otp(addr,RomBooDataStruct->boot_buf,len);
+	for(int i=0;i<len;i++)
+	{
+		if(data[i]!=RomBooDataStruct->boot_buf[i])
+		{
+			return FALSE;
+		}
+	}
+	return TRUE;
+}
+
+
+SCY_Boolean otp_boot_receive_sm3_data()
+{
+	int i;
+	#if defined (OTP__DEBUG)
+	_MyPrintf("otp_boot_receive_sm3_data\r\n");
+	#endif
+	RomBooDataStruct->boot_step=4;
+	if(_boot_receive_data()!=SCY_TRUE)
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("otp_boot_receive_sm3_data err\r\n");
+		#endif
+		return SCY_FALSE;
+	}
+	RomBooDataStruct->upgrade=RomBooDataStruct->boot_buf[BOOT_RECEIVE_HEAD_LEN];
+	//save sm3 info
+	memcpy((uint8_t *)&RomBooDataStruct->E_infoStruct,(uint8_t *)(RomBooDataStruct->boot_buf+BOOT_RECEIVE_HEAD_LEN+1),OTP_E_INFO_LEN);
+	_boot_put_CRC16((uint8_t *)&RomBooDataStruct->E_infoStruct,OTP_E_INFO_LEN-2);
+	if(otp_verify_app()==SCY_TRUE)
+	{
+		#if defined (OTP__DEBUG)
+		_MyPrintf("verify_app verify ok\r\n");
+		#endif
+		if(RomBooDataStruct->upgrade==0x55)
+		{
+			RomBooDataStruct->C_infoStruct.chip_stage=PRODUCT_STAGE;
+			//verify E info
+			if(_boot_verify_CRC16((uint8_t *)&RomBooDataStruct->E_infoStruct,OTP_E_INFO_LEN)!=SCY_TRUE)
+			{
+				//reply verify error
+				_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_OTP_ERR);
+				#if defined (OTP__DEBUG)
+				_MyPrintf("EInfo verify error\r\n");
+				#endif
+				return SCY_FALSE;
+			}
+			//write E info
+			if(TRUE!=boot_write_otp(OTP_E_INFO_ADDR,(uint8_t *)&RomBooDataStruct->E_infoStruct,OTP_E_INFO_LEN))
+			{
+				#if defined (OTP__DEBUG)
+				_MyPrintf("write EInfo error\r\n");
+				#endif
+				//reply verify error
+				_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_OTP_ERR);
+				return SCY_FALSE;
+			}
+			//write C info
+			if(TRUE!=boot_write_otp(OTP_C_INFO_ADDR,(uint8_t *)&RomBooDataStruct->C_infoStruct,2))
+			{
+				#if defined (OTP__DEBUG)
+				_MyPrintf("write CInfo error\r\n");
+				#endif
+				//reply verify error
+				_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_OTP_ERR);
+				return SCY_FALSE;
+			}
+			else
+			{
+				#if defined (OTP__DEBUG)
+				_MyPrintf("chip upgrade ok\r\n");
+				#endif
+			}
+
+		}
+		//reply success
+		_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_OK);
+		return SCY_TRUE;
+	}
+	else
+	{
+		//reply verify error
+		_boot_reply_staus(RomBooDataStruct->boot_step,BOOT_REPLY_STATUS_VERIFY_ERR);
+		#if defined (OTP__DEBUG)
+		_MyPrintf("verify_app verify error\r\n");
+		#endif
+		return SCY_FALSE;
+	}
+}
+
+SCY_Boolean otp_boot_download()
+{
+	#if defined (OTP__DEBUG)
+	_MyPrintf("_boot_download\r\n");
+	#endif
+
+	//send boot info
+	boot_send_boot_info();
+
+	//receive app info
+	if(boot_receive_app_info()!=SCY_TRUE)
+	{
+		return SCY_FALSE;
+	}
+
+	//receive app data
+	if(otp_boot_receive_app_data()!=SCY_TRUE)
+	{
+		return SCY_FALSE;
+	}
+	#if defined (OTP__DEBUG)
+	_MyPrintf("flash data receive finish\r\n");
+	#endif
+
+	//receive app sm3
+	if(otp_boot_receive_sm3_data()!=SCY_TRUE)
+	{
+		return SCY_FALSE;
+	}
+	return SCY_TRUE;
+}
+
+void  run_app()
+{
+	 ((void(*)(void))(0x1000200+1))();
+
+}
+
+void main()
+{
+	while(1);
+}
+
+
Index: fw/otp_patch_sm.txt
===================================================================
--- /YC3121_ROM/fw/otp_patch_sm.txt	(nonexistent)
+++ /YC3121_ROM/fw/otp_patch_sm.txt	(working copy)
@@ -0,0 +1,1698 @@
+40
+08
+55
+55
+9a
+02
+94
+05
+ff
+ff
+67
+d0
+bd
+6e
+a1
+c9
+17
+18
+fd
+88
+4f
+f5
+72
+d6
+04
+c3
+8c
+97
+d7
+bc
+69
+7e
+29
+d1
+ec
+0d
+6f
+f4
+b5
+3d
+dd
+97
+fc
+e8
+67
+9e
+cc
+c9
+b0
+77
+02
+4e
+2a
+ff
+52
+8a
+ad
+4e
+48
+21
+c3
+3d
+39
+99
+3d
+51
+6a
+b8
+5d
+f9
+62
+13
+c6
+5b
+8a
+ae
+c6
+a1
+cc
+a1
+7f
+43
+99
+fa
+31
+d5
+df
+99
+3a
+99
+f5
+95
+e5
+e1
+3b
+81
+b2
+aa
+45
+d7
+51
+5c
+7a
+a5
+aa
+02
+d3
+b5
+d2
+61
+f9
+2d
+7f
+80
+a8
+ad
+e0
+53
+3e
+e1
+a0
+ed
+db
+ed
+d0
+f3
+da
+4c
+57
+05
+d8
+24
+09
+8d
+e0
+f4
+21
+d7
+52
+33
+79
+73
+41
+c4
+84
+8d
+ad
+2b
+86
+16
+35
+bc
+6b
+4c
+79
+94
+7a
+e5
+80
+b1
+03
+a9
+6b
+63
+26
+e0
+e3
+ac
+71
+a7
+96
+8b
+c1
+84
+8e
+0a
+47
+00
+02
+ef
+c0
+9e
+47
+4d
+b2
+d6
+93
+8a
+b2
+37
+06
+89
+6d
+06
+ec
+3d
+8a
+f5
+10
+91
+47
+06
+b8
+49
+e3
+77
+69
+41
+d8
+ed
+40
+a5
+96
+8d
+09
+ec
+e0
+cd
+89
+a7
+fb
+5f
+a4
+ae
+68
+dd
+31
+80
+bd
+e7
+3a
+0a
+4d
+ba
+63
+75
+3f
+60
+e3
+5e
+24
+0f
+1d
+fd
+a7
+1b
+04
+24
+cc
+93
+1a
+c1
+82
+2f
+e8
+9c
+96
+da
+50
+df
+14
+c8
+bf
+a7
+fc
+46
+0e
+06
+5e
+16
+70
+b5
+00
+f0
+35
+f8
+e4
+f7
+ee
+fa
+16
+4b
+16
+4c
+98
+42
+18
+d1
+e6
+f7
+55
+ff
+05
+00
+a0
+42
+0e
+d1
+00
+f0
+98
+fa
+a8
+42
+01
+d0
+e4
+f7
+e0
+f9
+e6
+f7
+34
+ff
+e7
+f7
+5a
+fb
+e7
+f7
+c8
+fb
+00
+f0
+a6
+fa
+70
+bd
+00
+f0
+30
+f8
+01
+28
+f0
+d1
+f1
+e7
+00
+f0
+0a
+f9
+a0
+42
+01
+d0
+e4
+f7
+cc
+f9
+08
+21
+06
+4b
+1a
+78
+8a
+43
+1a
+70
+1a
+78
+79
+31
+0a
+43
+1a
+70
+e5
+e7
+11
+11
+00
+00
+aa
+55
+aa
+55
+3c
+85
+0f
+00
+10
+b5
+e6
+f7
+33
+fd
+0e
+22
+06
+49
+00
+20
+e4
+f7
+0e
+fa
+ac
+23
+9b
+02
+da
+89
+04
+49
+9a
+80
+0e
+20
+22
+22
+e4
+f7
+05
+fa
+10
+bd
+06
+b0
+02
+00
+14
+b0
+02
+00
+70
+47
+80
+21
+10
+b5
+89
+00
+00
+20
+e5
+f7
+49
+f8
+03
+00
+00
+20
+01
+2b
+0e
+d0
+80
+21
+0c
+22
+49
+04
+06
+48
+e0
+f7
+8d
+f8
+0c
+21
+04
+48
+e6
+f7
+b1
+fc
+04
+4b
+c0
+18
+43
+42
+58
+41
+c0
+b2
+10
+bd
+c0
+46
+38
+b0
+02
+00
+56
+aa
+55
+aa
+f0
+b5
+04
+26
+4f
+4d
+50
+4f
+2c
+68
+b4
+43
+2c
+60
+03
+25
+94
+06
+24
+0f
+e4
+00
+15
+40
+66
+19
+f7
+19
+39
+70
+03
+2d
+0d
+d1
+4a
+49
+e6
+1d
+65
+18
+00
+21
+29
+70
+48
+4d
+65
+19
+29
+70
+48
+4d
+65
+19
+29
+70
+47
+4d
+65
+19
+29
+70
+d1
+43
+89
+06
+09
+d1
+25
+24
+3f
+2a
+00
+d0
+10
+34
+43
+49
+0c
+60
+80
+24
+0d
+68
+25
+42
+fc
+d1
+00
+2b
+40
+d0
+00
+25
+7f
+2e
+00
+d0
+75
+1c
+80
+21
+38
+4c
+53
+1c
+2c
+19
+21
+70
+3c
+49
+6c
+1c
+19
+40
+04
+d5
+40
+26
+01
+39
+76
+42
+31
+43
+01
+31
+37
+29
+2d
+dc
+00
+21
+77
+2c
+54
+dd
+db
+00
+35
+49
+1c
+0e
+0c
+70
+19
+14
+34
+4c
+c9
+b2
+21
+70
+19
+12
+33
+4c
+c9
+b2
+21
+70
+33
+49
+db
+b2
+0b
+70
+25
+21
+3e
+2a
+00
+d9
+10
+31
+80
+22
+2a
+4b
+19
+60
+19
+68
+11
+42
+fc
+d1
+2d
+4a
+29
+49
+13
+68
+08
+3a
+1b
+16
+03
+70
+93
+68
+1b
+14
+43
+70
+93
+68
+1b
+12
+83
+70
+93
+68
+c3
+70
+04
+30
+8a
+42
+f0
+d1
+f0
+bd
+25
+49
+26
+4c
+69
+18
+00
+25
+a1
+42
+28
+d1
+25
+21
+3e
+2a
+00
+d9
+10
+31
+80
+25
+19
+4a
+11
+60
+11
+68
+29
+40
+fc
+d1
+11
+4d
+02
+c5
+a5
+42
+fc
+d1
+db
+00
+16
+49
+1c
+0e
+0c
+70
+19
+14
+15
+4c
+c9
+b2
+21
+70
+19
+12
+14
+4c
+c9
+b2
+21
+70
+13
+49
+db
+b2
+0b
+70
+35
+23
+13
+60
+4b
+33
+11
+68
+19
+42
+fc
+d1
+c3
+e7
+04
+4d
+65
+19
+29
+70
+01
+34
+a3
+e7
+0d
+70
+01
+31
+d1
+e7
+6c
+85
+0f
+00
+00
+86
+0f
+00
+04
+86
+0f
+00
+05
+86
+0f
+00
+06
+86
+0f
+00
+07
+86
+0f
+00
+c0
+86
+0f
+00
+3f
+00
+00
+80
+78
+86
+0f
+00
+79
+86
+0f
+00
+7a
+86
+0f
+00
+7b
+86
+0f
+00
+b8
+86
+0f
+00
+01
+86
+0f
+00
+80
+86
+0f
+00
+f0
+b5
+95
+b0
+ff
+f7
+1d
+ff
+01
+28
+01
+d0
+26
+4e
+1d
+e0
+22
+21
+26
+48
+e6
+f7
+da
+fb
+25
+4b
+06
+00
+98
+42
+f5
+d1
+00
+23
+ac
+27
+00
+25
+01
+93
+22
+4b
+bf
+02
+00
+93
+fc
+6b
+ac
+42
+0e
+d8
+00
+23
+04
+aa
+99
+5c
+ac
+22
+92
+02
+9a
+18
+12
+7d
+91
+42
+e2
+d1
+01
+33
+20
+2b
+f4
+d1
+30
+00
+15
+b0
+f0
+bd
+64
+1b
+20
+2c
+00
+d9
+20
+24
+21
+00
+00
+98
+e4
+f7
+ac
+f8
+22
+00
+00
+99
+0c
+a8
+df
+f7
+88
+ff
+2a
+00
+2b
+19
+03
+93
+03
+99
+fb
+6b
+8a
+42
+04
+d1
+00
+9b
+15
+00
+1b
+19
+00
+93
+d4
+e7
+51
+1c
+02
+91
+99
+42
+01
+d3
+01
+23
+01
+93
+53
+1c
+14
+a9
+5b
+1b
+cb
+18
+21
+3b
+19
+78
+04
+a8
+01
+9b
+ff
+f7
+ee
+fe
+02
+9a
+e4
+e7
+55
+aa
+55
+aa
+14
+b0
+02
+00
+aa
+55
+aa
+55
+00
+02
+00
+01
+f8
+b5
+ac
+23
+03
+22
+9b
+02
+1a
+70
+d8
+6b
+e7
+f7
+d2
+f8
+e4
+f7
+02
+fe
+1f
+48
+e4
+f7
+23
+fb
+1f
+4a
+1f
+4b
+13
+cb
+13
+c2
+80
+23
+0c
+22
+ff
+20
+9b
+00
+1b
+49
+51
+18
+01
+32
+08
+70
+9a
+42
+f9
+d1
+80
+20
+00
+23
+17
+49
+40
+04
+ac
+25
+e5
+f7
+10
+f8
+00
+26
+16
+4f
+ad
+02
+eb
+6b
+15
+4c
+b3
+42
+01
+d8
+20
+00
+f8
+bd
+e6
+f7
+02
+fe
+a0
+42
+17
+d1
+12
+4b
+28
+78
+ec
+5c
+11
+4b
+00
+21
+eb
+5c
+24
+02
+e4
+18
+e6
+f7
+e0
+fd
+00
+23
+02
+3c
+ea
+6b
+36
+19
+96
+42
+5b
+41
+38
+00
+db
+b2
+22
+00
+0a
+49
+e4
+f7
+ed
+ff
+3f
+19
+dd
+e7
+09
+48
+e0
+e7
+c0
+46
+7c
+bc
+02
+00
+54
+b3
+02
+00
+38
+b0
+02
+00
+00
+02
+00
+01
+aa
+55
+aa
+55
+57
+03
+00
+00
+56
+03
+00
+00
+58
+b3
+02
+00
+55
+aa
+55
+aa
+30
+b5
+8f
+b0
+6b
+46
+30
+22
+00
+21
+98
+1d
+e7
+f7
+a6
+fb
+ac
+23
+01
+22
+9b
+02
+1a
+70
+aa
+32
+01
+ac
+ff
+32
+22
+80
+9f
+3a
+ff
+3a
+a2
+70
+07
+4a
+02
+a9
+21
+ca
+21
+c1
+02
+33
+db
+8f
+0e
+21
+23
+73
+20
+00
+1b
+0a
+63
+73
+e6
+f7
+92
+fd
+0f
+b0
+30
+bd
+08
+b0
+02
+00
+70
+b5
+ac
+25
+02
+23
+ad
+02
+2b
+70
+e6
+f7
+a8
+fd
+0b
+4b
+04
+00
+98
+42
+10
+d1
+0c
+22
+09
+49
+0a
+48
+e7
+f7
+08
+fb
+09
+4b
+0a
+21
+07
+48
+ab
+63
+e6
+f7
+ea
+fa
+28
+78
+00
+21
+e6
+f7
+7f
+fd
+20
+00
+70
+bd
+04
+4c
+fb
+e7
+aa
+55
+aa
+55
+58
+b3
+02
+00
+38
+b0
+02
+00
+00
+02
+00
+01
+55
+aa
+55
+aa
+70
+b5
+14
+00
+06
+00
+0d
+00
+e4
+f7
+92
+f8
+e3
+f7
+dc
+ff
+01
+20
+e3
+f7
+f1
+fe
+22
+00
+09
+49
+30
+00
+e4
+f7
+0c
+f8
+00
+23
+a3
+42
+01
+d1
+01
+20
+70
+bd
+05
+4a
+e9
+5c
+9a
+18
+12
+78
+91
+42
+01
+d1
+01
+33
+f3
+e7
+00
+20
+f4
+e7
+c0
+46
+54
+b3
+02
+00
+70
+b5
+ac
+24
+04
+23
+a4
+02
+23
+70
+e6
+f7
+5e
+fd
+20
+4b
+06
+00
+98
+42
+20
+d1
+d6
+23
+9b
+00
+e3
+5c
+22
+22
+63
+70
+1c
+49
+1d
+48
+e7
+f7
+ba
+fa
+20
+21
+1b
+48
+e6
+f7
+9e
+fa
+ff
+f7
+c0
+fe
+05
+00
+b0
+42
+26
+d1
+63
+78
+55
+2b
+1b
+d1
+16
+4b
+22
+21
+e3
+80
+14
+48
+e6
+f7
+9a
+fa
+a8
+42
+05
+d0
+05
+21
+20
+78
+e6
+f7
+23
+fd
+11
+4d
+13
+e0
+22
+22
+0e
+49
+0e
+20
+ff
+f7
+ab
+ff
+01
+28
+f2
+d1
+02
+22
+0d
+49
+00
+20
+ff
+f7
+a4
+ff
+01
+28
+eb
+d1
+ac
+23
+9b
+02
+18
+78
+00
+21
+e6
+f7
+0d
+fd
+28
+00
+70
+bd
+20
+78
+03
+21
+e2
+e7
+c0
+46
+aa
+55
+aa
+55
+59
+b3
+02
+00
+14
+b0
+02
+00
+77
+77
+00
+00
+55
+aa
+55
+aa
+06
+b0
+02
+00
+70
+b5
+ff
+f7
+3b
+ff
+ff
+f7
+5d
+ff
+08
+4b
+05
+00
+98
+42
+01
+d0
+07
+48
+70
+bd
+ff
+f7
+d5
+fe
+04
+00
+a8
+42
+f8
+d1
+ff
+f7
+9a
+ff
+a0
+42
+f4
+d1
+f4
+e7
+c0
+46
+aa
+55
+aa
+55
+55
+aa
+55
+aa
+10
+b5
+01
+4b
+98
+47
+10
+bd
+01
+02
+00
+01
+fe
+e7
+00
+00
