AES obfuscation on the Wii U bootrom

via http://www.eurasia.nu/modules.php?na...ticle&sid=3290

I've read the whole bootrom code and i have to admit, that big N has done a good job on hiding where and how it calls the AES code. Finding the AES implementation is easy, it's just before the ancast header check function and after the most useless function. Finding how the AES implementation is called, is a little bit hard, for two reasons: There are no cross references in the text segment; This means you will not see something like: 'bl AES_Decrypt'. There are no addresses saved in the data segment: 'AES_offset: .long AES_Decrypt'. So how to find it? You have to read the code, because the value is hardcoded and saved into a memory on an unknown address (like 0xE0000000); then a function will load that addresses to the count (CTR) register and jumps there.