Add support for all remaining version, cleanup & fix code

README.md

@@ -11,25 +11,19 @@ of the firmware for which the sound app is available.
 
 | Version | N3DS/N2DS | O3DS/2DS |
 | --- | --- | --- |
-| US 2.1-11.3 | ✓ | ✓ |
-| JPN 2.1-11.3 | ✓ | ✓ |
-| EUR 2.1-11.3 | ✓ | ✓ |
+| US 1.0-11.3 | ✓ | ✓ |
+| JPN 1.0-11.3 | ✓ | ✓ |
+| EUR 1.0-11.3 | ✓ | ✓ |
 | KOR 4.0-11.3 | ✓ | ✓ |
-| CHN 4.0-11.3 | ✗ | ✗ |
-| TWN 4.1-11.3 | ✗ | ✗ |
+| CHN 4.0-11.3 | N/A | ✓ |
+| TWN 4.1-11.3 | N/A | ✓ |
+
+**All existing versions of Nintendo 3DS Sound prior to Nintendo fixing the vulnerability are now supported**.
 
 If your box is checked, then put [otherapp.bin](https://smealum.github.io/3ds/#otherapp) on the root of your SD card along with soundhax.m4a and launch the song from the sound player.
 
 It can be used along [pre9otherapp](https://github.com/hax0kartik/pre9otherapp) to launch an arm9 payload from the SD card on pre 9.0 firms (2.1 - 9.2).
 
-## Status for KOR/CHN/TWN
-
-| Status | KOR | CHN | TWN |
-| --- | --- | --- | --- |
-| bug confirmed | ✓ | ✗ | ✗ |
-| sound constants | ✓ | ✗ | ✗ |
-| stage2 payload constants | ✓ | ✗ | ✗ |
-
 ## Installation
 1. Download the relevant soundhax-region-console-firmware.m4a file for your device.
 2. Save the soundhax song file and copy to the root of your SD.
@@ -43,7 +37,7 @@ Fixing the annoying bird: Click through all of the bird tips then close the app
 ## Build
 Install [Python 2.7](https://python.org) and [devkitARM](https://devkitpro.org/wiki/Getting_Started).
 
-Then run `python exp.py <usa/eur/jpn/kor> <new/old> <v21and22/v3xand4x/post5>` to generate `soundhax-*.m4a`.
+Then run `python exp.py <usa/eur/jpn/kor/chn/twl> <new/old> <pre21/v21and22/v3xand4x/post5>` to generate `soundhax-*.m4a`.
 
 ## Writeup
 
@@ -60,19 +54,25 @@ I overflow my data onto the next heap chunk, which lets me fully control the
 malloc header of that chunk, which happens to be allocated at the time of the overflow.
 When that chunk is freed, a heap unlink is performed, which allows me to do
 an arbitrary write. This means I can write a dword to the stack and control
-PC. Unfortunately, there aren't any usable gadgets (trust me, I looked), so I
+PC.
+
+Unfortunately, there aren't any usable gadgets (trust me, I looked), so I
 had to use a more advanced technique to exploit the bug. I used the
 arbitrary write to overwrite the free list header with a stack address,
 while setting the start and end fields of the chunk being freed to cause the
 block to appear undersized, thus causing it to not be added to the free list
-and so the stack address I just wrote is used on the next malloc. Because malloc
-jumps through the free list looking for a suitable block, I had to find a stack
+and so the stack address I just wrote is used on the next malloc.
+
+Because malloc jumps through the free list looking for a suitable block, I had to find a stack
 address at which there appears to be a valid heap chunk header with a large enough
 size for the requested allocation and null pointers for the next and prev entries
-in the list, so that my stack chunk is chosen as the 'best' one. Once all of
-these conditions are met, the next malloc returns the stack address as the
+in the list, so that my stack chunk is chosen as the 'best' one.
+
+Once all of these conditions are met, the next malloc returns the stack address as the
 'heap' location to write my next tag data, which lets me turn the arbitrary
-write primitive into ROP. From there I use the gspwn GPU exploit to write
+write primitive into ROP.
+
+From there I use the gspwn GPU exploit to write
 my stage2 shellcode over the text section of the sound process, before finally
 jumping to it.