Firmware Disassembly

I'd say the compiler was probably this Green Hills compiler.

Just for laughs, what happens if you run cygwin native objdump on the dismipper.exe and feed to create a bogus firmware.bin and feed that into dismipper? Works for me - I mean it complains about it not matching the hint file very well, but it processes it without the sorts of errors you've been seeing. The changes I had to make from the ogirinal (all in sections.c) where: - Replacing strcasestr with strstr and -*test*-('") to "Disassembly", also adding a -*test*-('") for "SYMBOLS" if the objdump output has a symbol table due to -t or because it just feels like giving you one - Implementing some version of strlcpy such as the one posted above. It can simply be put near the beginning of sections.c without a prototype... crude, but effective. comple with gcc -mno-cygwin -o dismipper <all the .c files with main.c last> Ok, did all that and got same results as you did from bogus firmware.bin and got "Unable to allocate 0xd8420200 bytes for section :" error when running real firmware through it.

my objdump starts out R2Firmware.img: file format elf32-littlemips Sections: Idx Name Size VMA LMA File off Algn 0 .spc0 00000210 bfc08000 bfc08000 00138fec 2**2 CONTENTS, ALLOC, LOAD, CODE 1 .spc1 00000000 bfc09000 bfc09000 001391fc 2**0 CONTENTS 2 .spc2 00000000 bfc09400 bfc09400 001391fc 2**0 CONTENTS 3 .spc3 00000000 bfc09800 bfc09800 001391fc 2**0 CONTENTS 4 .spd0 00000000 90008000 90008000 001391fc 2**0 CONTENTS 5 .spd1 00000000 90009000 90009000 001391fc 2**0 CONTENTS 6 .spd2 00000000 90009400 90009400 001391fc 2**0 CONTENTS 7 .spd3 00000400 90009800 90009800 00138bec 2**2 CONTENTS, ALLOC, LOAD, DATA 8 .exception 0000013c 80000180 80000180 000000d4 2**0 CONTENTS, ALLOC, LOAD, READONLY, CODE 9 .boot 00000040 80000600 80000600 00000220 2**2 CONTENTS, ALLOC, LOAD, READONLY, CODE 10 .text 0012dfc0 80000640 80000640 00000260 2**5 CONTENTS, ALLOC, LOAD, READONLY, CODE 11 __ex_table 00000010 8012e600 8012e600 0012e220 2**2 CONTENTS, ALLOC, LOAD, READONLY, DATA 12 .scratch 0000011c 8012e610 8012e610 0012e230 2**2 CONTENTS, ALLOC, LOAD, READONLY, CODE 13 .scratchpad3 00000070 8012e72c 8012e72c 0012e34c 2**0 CONTENTS, ALLOC, LOAD, READONLY, CODE 14 .data 0000a808 8012e7a0 8012e7a0 0012e3c0 2**3 CONTENTS, ALLOC, LOAD, DATA 15 .data1 00000018 80138fa8 80138fa8 00138bc8 2**2 CONTENTS, ALLOC, LOAD, DATA 16 .sbss 000005c4 80138fc0 80138fc0 00138be0 2**2 ALLOC 17 .bss 0000c5d0 80139590 80139590 00138bec 2**4 ALLOC Disassembly of section .spc0: bfc08000 <.spc0>: ... bfc08028: ac850000 sw a1,0(a0) ... bfc08050: 03e00008 jr ra bfc08054: 00000000 nop

I ran your posted excerpt through my build of dismipper, and it seemed to sort of work, except that it kept complaining like this on about every line, due to the obvious ommisions. Attempted to trace execution to address 8012e60e in section <somethingorother>, but not in input file. I'd be particularly interested to hear what you got for the line where I got Headers read: 12 sections, 15637 kB allocated. (firmware size 0x145c9c, 1303 kB) Did you still get that malloc failure?

actually, I was the one that got "Headers read: 12 sections, 15637 kB allocated. (firmware size 0x145c9c, 1303 kB)"...I got that when running my modified version of dismipper.exe when I used a Makefile and didn't use your strlcpy hack, but just added int strlcpy (char *dst, const char *src, int size); to sections.h Yes, when I modified dismipper per your instructions, I still get the malloc error. (if only I had at least 3gigs of memory free in this machine ;) )

BTW, IDA identifies the processor as "MIPS R5900 (Sony Playstation2) little endian"

BTW, IDA identifies the processor as "MIPS R5900 (Sony Playstation2) little endian" Which version of IDA are you using?

BTW, IDA identifies the processor as "MIPS R5900 (Sony Playstation2) little endian" Well now we know what to buy as a development environment ;-) Zapped... wierd... have you tried pasting your post into firmware.hd and running that? Because it works on my cygwin... And I really don't think I'm mallocing 3GB...

BTW, IDA identifies the processor as "MIPS R5900 (Sony Playstation2) little endian" Well now we know what to buy as a development environment ;-) Zapped... wierd... have you tried pasting your post into firmware.hd and running that? Because it works on my cygwin... And I really don't think I'm mallocing 3GB... yep, and I probably get the same as you, a bunch of "Attempted to trace execution to address 80000640 in section .text, but not in input file." (with various addresses and sections)

So when do you get the malloc error then?

BTW, IDA identifies the processor as "MIPS R5900 (Sony Playstation2) little endian" Well now we know what to buy as a development environment ;-) So. you plan on compiling your own firmware natively on the camcorder? :lol: Or just setting up a toolchain for cross-compiling? ;) I'd say the compiler was probably this Green Hills compiler. The feature I will miss the most in "dismipper" is IDA Pro's fast library identification and recognition technology. It uses signatures to recognize standard library functions generated by supported compilers. Unfortunately, Green Hills C Compiler is not one of the compilers that is supported. However, if someone had access to that compiler, a program could be written that called most of the common C functions. That program could then be disassembled and annotated with the source. It's then possible to quickly recognize certain patterns in other disassembled binaries from the same compiler.

Anyone know where I can get objdump for mips?

Here's what the start of my output looks like:


Headers read: 12 sections, 15637 kB allocated. (firmware size 0x145c9c, 1303 kB)
Pass zero: Reading data...              done. (bytes read =  0x1363d0)
Pass one: tracing program execution
Warning - bad var address in firmware.comments:
var=0xb0010170,"UART write register?"
          exploring 874 entry points (0 instructions disassembled, 0% of code).
warning: failed to trace execution at computed goto @ bfc080a0 (thread .spc0)
successful jumptable trace - jump @ 80001734, table @ 80118008, 8 entries
successful jumptable trace - jump @ 80004750, table @ 80118500, 20 entries
successful jumptable trace - jump @ 80005488, table @ 80118568, 8 entries
successful jumptable trace - jump @ 80006ae0, table @ 80118610, 18 entries
successful jumptable trace - jump @ 800095e0, table @ 80118808, 5 entries
successful jumptable trace - jump @ 80027494, table @ 8011a300, 443 entries
successful jumptable trace - jump @ 8002a31c, table @ 8011b0a8, 5 entries
warning: failed to trace execution at computed goto @ 8002f44c (thread Browse Audio_2)
successful jumptable trace - jump @ 8002f568, table @ 8011b578, 32 entries

... plus lots more warnings before getting to the good stuff. Pure analog - objdump is part of the binutils - download version 2.16 here. I compiled it from the source, and used this configure line:./configure --target=mips powerpc-apple-darwin8.1.0... but if you're not on a mac, you'd probably need something else

I got it, had to get bison and flex first though.

i got my firmware and tried to run the program, but it crashes on this line of sections.c: (void) vsnprintf(add_note_str, note_buffer_len, fmt, ap); va_end(ap); add_note_str is not a null pointer note_buffer_len is 2048, but that's been true before without crashing it

View Full Version: Firmware Disassembly