Firmware Disassembly

Great summary post CVSfan :!: If anyone has tips on getting results with Reverse Engineering Compiler, I'm all ears. So far, I'm getting garbage out, but I suspect it's because of the ID-10-T user putting garbage in.

Reading prototype files...
warning: addtype: complex int redefined
Processing commands from firmware.cmd...
firmware.o is an ELF/MIPS executable file
Section       Offset   Address   Size
.spc0         138fec  bfc08000  00210
.spc1         1391fc  bfc09000  00000
.spc2         1391fc  bfc09400  00000
.spc3         1391fc  bfc09800  00000
.spd0         1391fc  90008000  00000
.spd1         1391fc  90009000  00000
.spd2         1391fc  90009400  00000
.spd3         138bec  90009800  00400
...
Reading symbol table...
Validating strings...
Finding references...
Finding procedures...
Done.
Decompiling bfc0820c - bfc0820f (1/3025)

Left 26512 assembly statements, 0 assembly nodes
Translation complete - 267127 translated statements in 0 sec.

I see many interesting strings, although.Failed to save USP. Resource formated

How do you mean you're getting garbage out? I've had the program bomb a couple of times, but it was able to generate a couple of result files. The dissassembly starts : /* This file was automatically created by * Reverse Engineering Compiler 2.0 (C) Giampiero Caprino (Aug 14 2005) * Input file: 'firmware.img' */ /* Region map */ /* Id Start End Size Offset Type */ /* 14 : 80139590 80139664 000000d4 00000000 bss */ /* 2 : 80000180 800002bc 0000013c 000000D4 text */ /* 16 : 80000180 800002bc 0000013c 000000D4 text */ /* 15 : 801397a0 801397b0 00000010 00000210 bss */ /* 3 : 80000600 80000640 00000040 00000220 text */ /* 18 : 80000600 80000640 00000040 00000220 text */ /* 17 : 801397f0 80145b60 0000c370 00000260 bss */ /* 19 : 80000640 8012e600 0012dfc0 00000260 text */ /* 20 : 8012e610 8012e72c 0000011c 0012E230 text */ /* 21 : 8012e72c 8012e79c 00000070 0012E34C text */ /* 22 : 8012e7a0 80138fa8 0000a808 0012E3C0 data */ /* 23 : 80138fa8 80138fc0 00000018 00138BC8 data */ /* 24 : bfc08000 bfc0802a 0000002a 00138FEC text */ /* 25 : bfc0802a bfc0802c 00000002 00139016 text */ /* 26 : bfc0802c bfc08050 00000024 00139018 text */ /* 27 : bfc08050 bfc08210 000001c0 0013903C text */ L80139590: .bss 0xd4 # id: 14, high: 0x80139664 .lcomm 212 L80000180: .text 0x13c # id: 2, high: 0x800002bc 0d 80 1a 3c lui r26,#0x800d0000 80 d5 5a 27 addiu r26,r26,#0xffffd580 There is also a pseudo-language output that starts /* This file was automatically created by * Reverse Engineering Compiler 2.0 (C) Giampiero Caprino (Aug 14 2005) * Input file: 'firmware.img' */ /* Procedure: 0x80000238 - 0x80000263 * Argument size: 0 * Local size: 0 * Save regs size: 0 */ L80000238() { r4 = r16; r29 = r29 + -4; *r29 = r31; L800CD2FC(); r31 = *r29; r29 = r29 + 4; goto ( *L800CD93C); } Anyone with thoughts??

I'd say the compiler was probably this Green Hills compiler. They'll send you a 30 day trial. (If you don't have it already) Would it help improve dismipper to compile some -*test*-('") programs with it?

I was running an older version of REC (1.6a) in batch mode and only looking at the decompiled C code. Anyhow, in intereactive mode, I now see it disassembling almost identically to objdump-mips. I originally thought it was garbage, because the below C routine didn't make sense to me.

/*	Procedure: 0x800035A0 - 0x800035DB
 *	Argument size: 0
 *	Local size: 0
 *	Save regs size: 0
 */

L800035A0()
{
	/* unknown */ void  Vfffffff0;
	/* unknown */ void  Vfffffff4;
	/* unknown */ void  Vfffffff8;

    r29 = r29 + -32;
    Vfffffff8 = r31;
    Vfffffff0 = 0x140;
    Vfffffff4 = 0xf0;
    r5 = 0x80118404;
    r4 = 0;
    r6 = 0;
    r7 = 0;
    r2 = L800261CC();
    r31 = Vfffffff8;
    r29 = r29 + 0x20;
}

If you're going to get the compiler, might as well get ThreadX and FileX, too. Could playing with latter help understand the partition issues? Express Logic's downloadable tx_api.h has the "tx_" function signatures and structures, which is somewhat helpful. P.S. Here's a MIPS R3000 Instruction Set Summary. Too bad this isn't 80x86 or MC680x0.

I know I can just comment out the #warning in sections.c and simmip.c, or ignore the warning when compiling, but I'm not really happy with that solution. I've tried searching google and a few other search engines, but havn't been able to get any answers there either. Is #warning proper syntax for a Mac, or does it also give a compile error?

#warning statements are just that ... a warning instructing "builders" of a potential problem. In this case the #warning were added by morcheeba as a reminder to look at this later on. You can safely ignore them. so the compiler sees them the same as it would #avvertimento, #advertencia,#takeALookAtThisLater, or #pardonMonFrançais?

Nope, #warning handled by the C-preprocessor. Others include #error, #pragma and the usual #ifdef, #if, #else, #endif, et.al.

Nope, #warning handled by the C-preprocessor. Others include #error, #pragma and the usual #ifdef, #if, #else, #endif, et.al. Thanks for the clarification. and many thanks for the following instructions from which I finally got dismipper compiled and running Got dismipper to run under cygwin, two files needed patching to work around some stack corruption and other memory issues (diff with original to see changes): pass_one.c and sections.c. Hopefully the output is accurate ... To compile under cygwin (as pure-analog discovered, needs no-cygwin): $ gcc -mno-cygwin -o dismipper *.c And for reference: - Get camcorder firmware by using Ops' Download Memory button: Start Location=200043008 and Length=1283583; save as firmware.o - Using objdump built to understand MIPS, generate firmware.hd: $ objdump-mips -w -f -h -D -M reg-names=r3000 firmware.o > firmware.hd VER 2.16.1). Extract and configure (./configure --target=mips), type make and then find the binary in binutils/objdump.exe ... rename to objdump-mips> - Generate the re-disassembly: $ dismipper > firmware.lst

Looking at the output from dismipper (compiled on Fedora), I see this at the start : dismipper -- a MIPS re-disassembler Copyright (C)2005 John Maushammer - http://www.maushammer.com/ Headers read: 12 sections, 15637 kB allocated. (firmware size 0x145c9c, 1303 kB) Pass zero: Reading data... done. (bytes read = 0x12e20c) Pass one: tracing program execution Attempted to trace execution to address 7fffffff - not a multiple of 4 Warning - bad entry point in firmware.comments: entry=0x80000180,".exception" // .exception Attempted to trace execution to address 7fffffff - not a multiple of 4 Warning - bad entry point in firmware.comments: entry=0x80000600,".boot" // .boot <... lots more where that come from, finally getting to :> Warning - bad function address in firmware.comments: function=0x800311d0, "set lsb of status-word-1 to register a0" Warning - bad function address in firmware.comments: function=0x800311f0, "OR msb of status-word-1 with register a0" Warning - bad function address in firmware.comments: function=0x80031214, "if (a1 != 1) {status-word-2 |= ~a0} else {status-word-2 &= a0}"Pass two: dumping output " "firmware.o: file format elf32-littlemips " "Sections: "Idx Name Size VMA LMA File off Algn " 0 .spc0 00000210 bfc08000 bfc08000 00138fec 2**2 " CONTENTS, ALLOC, LOAD, CODE " 1 .spc1 00000000 bfc09000 bfc09000 001391fc 2**0 " CONTENTS " 2 .spc2 00000000 bfc09400 bfc09400 001391fc 2**0 " CONTENTS " 3 .spc3 00000000 bfc09800 bfc09800 001391fc 2**0 " CONTENTS " 4 .spd0 00000000 90008000 90008000 001391fc 2**0 " CONTENTS " 5 .spd1 00000000 90009000 90009000 001391fc 2**0 " CONTENTS " 6 .spd2 00000000 90009400 90009400 001391fc 2**0 " CONTENTS " 7 .spd3 00000400 90009800 90009800 00138bec 2**2 " CONTENTS, ALLOC, LOAD, DATA " 8 .exception 0000013c 80000180 80000180 000000d4 2**0 " CONTENTS, ALLOC, LOAD, READONLY, CODE " 9 .boot 00000040 80000600 80000600 00000220 2**2 " CONTENTS, ALLOC, LOAD, READONLY, CODE " 10 .text 0012dfc0 80000640 80000640 00000260 2**5 " CONTENTS, ALLOC, LOAD, READONLY, CODE " 11 __ex_table 00000010 8012e600 8012e600 0012e220 2**2 " CONTENTS, ALLOC, LOAD, READONLY, DATA " 12 .scratch 0000011c 8012e610 8012e610 0012e230 2**2 " CONTENTS, ALLOC, LOAD, READONLY, CODE " 13 .scratchpad3 00000070 8012e72c 8012e72c 0012e34c 2**0 " CONTENTS, ALLOC, LOAD, READONLY, CODE " 14 .data 0000a808 8012e7a0 8012e7a0 0012e3c0 2**3 " CONTENTS, ALLOC, LOAD, DATA " 15 .data1 00000018 80138fa8 80138fa8 00138bc8 2**2 " CONTENTS, ALLOC, LOAD, DATA " 16 .sbss 000005c4 80138fc0 80138fc0 00138be0 2**2 " ALLOC " 17 .bss 0000c5d0 80139590 80139590 00138bec 2**4 " ALLOC "Disassembly of section .spc0: " "bfc08000 <.spc0>: " ... bfc08028 ac850000 sw a1,0(a0) "...." " ... bfc08050 03e00008 jr ra "...." bfc08054 00000000 nop "...." bfc08058 27bdffd8 addiu sp,sp,-40 "...'" My question is : from looking at this, can anyone with "good" dissassemblies tell me if I've got things goofed up somewhere (e.g. a compiler directive) or that this actually makes sense? (I suspect the former ...) TIA Editted : this firmware image came via the OPS download memory command, run on a Windows version and then pulled over a network as firmware.o

Hmm, would appear that the sscanf function is busted or it's having trouble with the %i in Fedora. Here's the first part of mine:

dismipper -- a MIPS re-disassembler
Copyright (C)2005 John Maushammer - http://www.maushammer.com/

Headers read: 12 sections, 15637 kB allocated. (firmware size 0x145c9c, 1303 kB)
Pass zero: Reading data...              done. (bytes read =  0x1363d0)
Pass one: tracing program execution
Warning - bad var address in firmware.comments:
var=0xb0010170,"UART write register?"
          exploring 874 entry points (0 instructions disassembled, 0% of code).

Did you make changes to the sscanf or %i lines and if so, can you pm/post what you did? Or any other advice!

Nope. Look at a couple of posts above; the one from zapped quoted what I did and the two files I had to change to work under cygwin.

That's what I thought, so those were the steps and files I used, albeit under Fedora (so no -mno-cygwin).

FWIW, I got dismipper to compile on Windows using the free Borland compiler. After adding the following defines #define strtoll(a,b,c) strtoul(a,b,c) #define strncasecmp(a,b,c) strnicmp(a,b,c) in the relevant places, the following has seemed to work bcc32 -WC -edismipper *.c (The firmware.hd file had been processed on a Linux box and transferred over ) Now to get the same output on Fedora ...

View Full Version: Firmware Disassembly