It turns out that in-place UCL decompression isn't as easy as we thought, so we copy the OF to an unused part of RAM before decompressing it. This works - I have successfully patched m300a-1.1.17A.bin and installed on my Clip with this code. Thanks to Rafael Carre (funman) for the actual patch.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@18679 a1c6a512-1295-4272-9138-f99709370657

utils/AMS/hacking/test.S

@@ -27,10 +27,30 @@ start:
 loop:   subs  r1, r1, #1
         bne   loop
 
-        /* Call the ucl decompress function, which will branch to 0x0
+        /* First copy the compressed firmware to unused RAM */
-           on completion */
+
         ldr   r0, ucl_start   /* Source */
         ldr   r1, ucl_size    /* Source length */
+
+        mov   r2, #0x40000    /* Destination end */
+        sub   r2, r2, r1
+
+memcpy:
+        ldrb  r3, [r0]
+        strb  r3, [r2]
+        adds  r0, r0, #1
+        adds  r2, r2, #1
+        cmp   r2, #0x40000    /* Stop when we reached dest_end */
+        bne   memcpy
+
+        sub   r0, r2, r1      /* Point to the compressed firmware */
+
+        /* Call the ucl decompress function, which will branch to 0x0 */
+        /* on completion */
+
         mov   r2, #0          /* Destination */
+
         ldr   r3, ucl_unpack
         bx    r3
+
+        /* never reached */