fsebugoutzone.org:9999

       Post APnQUtxQBzhBiKJ4lc by Rairii@infosec.exchange
 (DIR) More posts by Rairii@infosec.exchange
 (DIR) Post #APnQUtxQBzhBiKJ4lc by Rairii@infosec.exchange
       2022-11-20T11:44:55Z
       
       1 likes, 0 repeats
       
       So here&#39;s some interesting #RaspberryPi related #ReverseEngineering research.Did you know that there&#39;s another undocumented microcontroller core in the BCM2708 SoC and its derivates?Around 2019 or so, I found this set of slides : https://www.rump.beer/2017/slides/etude_d_un_CPU_inconnu.pdfThe really fun stuff was redacted (I can only assume how they were convinced to remove the stuff related to keygenning the codec licensing :thinking: ), but that didn&#39;t matter. With some hardware experimentation, I figured out the majority of the remaining instruction set and coded a disassembler for the Broadcom Video Control Engine (VCE).I never did figure out the entire instruction set, but hopefully others can build upon my research.Yes, I coded a disassembler in PHP, it&#39;s something all Real Programmers should do, highly recommend.&lt;?php// thanks synacktiv :)// todo: figure out the full instruction set, eventually$opTbl = [    0b000000 =&gt; &#39;end&#39;,    0b000001 =&gt; &#39;xor&#39;,    0b000010 =&gt; &#39;sendc&#39;, // set end code?    0b000011 =&gt; &#39;dmarun&#39;, // start dma? dmarun blank,blank,1 used in prerun/postrun//  0b000100 =&gt; &#39;UNK&#39;, // rD not touched.//  0b000101 =&gt; &#39;UNK&#39;, // rD not touched.//  0b000110 =&gt; &#39;UNK&#39;, // rD not touched.//  0b000111 =&gt; &#39;UNK&#39;, // rD not touched.    // load: op[0] = *(TYPE*)(op[1])    0b001000 =&gt; &#39;ldb&#39;,    0b001001 =&gt; &#39;ldw&#39;,    0b001010 =&gt; &#39;ldd&#39;,    0b001011 =&gt; &#39;ver&#39;, // &lt;&lt; output reg gets 0x68323634 &#39;h264&#39;    // store: *(TYPE*)(op[0]) = op[2];    0b001100 =&gt; &#39;stb&#39;,    0b001101 =&gt; &#39;stw&#39;,    0b001110 =&gt; &#39;std&#39;,//  0b001111 =&gt; &#39;UNK&#39;, // &lt;&lt; unsure what this does. used by h264_code    0b010000 =&gt; &#39;dmafr&#39;, // set main memory addr to dma FROM? dmaf r1, &lt;reg&gt;, 0 used by prerun -- dest always at 0 of vce code/data?    0b010001 =&gt; &#39;dmato&#39;, // set main memory addr to dma TO? dmato r1, &lt;reg&gt;, 0 used by postrun; src always at 0?    0b010010 =&gt; &#39;dmatdl&#39;, // set length of copy to dma to DATA? mov r6, &lt;len&gt;;mov r7,0;dmadl r1, r7, 0 used by prerun    0b010011 =&gt; &#39;dmafdl&#39;, // set length of copy to dma from DATA?//  0b010100 =&gt; &#39;UNK&#39;, // op[0] = (op[1] &lt;&lt; op[2]) with maybe some additional bits set in low4//  0b010101 =&gt; &#39;UNK&#39;, // op[0] = op[1] unk op[2], something bitwise? shl-related?//  0b010110 =&gt; &#39;UNK&#39;, // rD not touched.//  0b010111 =&gt; &#39;UNK&#39;, // rD not touched.    0b011000 =&gt; &#39;zero&#39;, // op[0] = 0    0b011001 =&gt; &#39;zero&#39;, // op[0] = 0//  0b011010 =&gt; &#39;UNK&#39;, // rD not touched.    0b011011 =&gt; &#39;dmacl&#39;, // set length of copy to dma to CODE? mov r6, &lt;len&gt;;mov r7,0;dmacl r1, r7, 0 used by prerun    0b011100 =&gt; &#39;j&#39;,    0b011101 =&gt; &#39;ldiw&#39;, // &lt;&lt; op[0] = *(u16*)(op[2]), if not aligned does the same thing as mem-operand//  0b011110 =&gt; &#39;UNK&#39;, // &lt;&lt; rD not touched.//  0b011111 =&gt; &#39;UNK&#39;, // &lt;&lt; rD not touched.    0b100000 =&gt; &#39;shl&#39;, // op[0]=op[1]&lt;&lt;op[2]    0b100001 =&gt; &#39;rshl&#39;, // op[0]=op[2]&lt;&lt;op[1]    0b100010 =&gt; &#39;shr&#39;,    0b100011 =&gt; &#39;mov&#39;, // &lt;&lt; op[0]=op[1]    0b100100 =&gt; &#39;shr&#39;,    0b100101 =&gt; &#39;movi&#39;, // op[0] = op[2]    0b100110 =&gt; &#39;ror&#39;, // op[0] = op[1] ror op[2]    0b100111 =&gt; &#39;movi&#39;,    0b101000 =&gt; &#39;mulu&#39;, // op[0] = op[1] * op[2], all unsigned, 24-bit output?//  0b101001 =&gt; &#39;UNK&#39;, // op[0] = op[1] &lt;UNK&gt; op[2], something bitwise?    0b101010 =&gt; &#39;muls&#39;, // op[0] = op[1] * op[2], all signed, 24-bit output?//  0b101011 =&gt; &#39;UNK&#39;, // op[0] = op[1] &lt;UNK&gt; op[2], something bitwise?    0b101100 =&gt; &#39;add&#39;,    0b101101 =&gt; &#39;sub&#39;,    0b101110 =&gt; &#39;ldid&#39;, // op[0] = *(u32*)(op[2] &amp; ~3)    0b101111 =&gt; &#39;rsub&#39;, // &lt;&lt; op[0]=op[2]-op[1]    0b110000 =&gt; &#39;sub1&#39;, // op[0] = op[1] - 1 - op[2]    0b110001 =&gt; &#39;and&#39;,    0b110010 =&gt; &#39;bic&#39;, // op[0] = op[1] &amp; ~op[2]    0b110011 =&gt; &#39;xorlim&#39;, // op[0] = (op[1] ^ op[2]) &amp; mask(bnh(op[2]))    0b110100 =&gt; &#39;or&#39;, // op[0] = op[1] | op[2]    0b110101 =&gt; &#39;xor&#39;,//  0b110110 =&gt; &#39;UNK&#39;, // op[0] = op[1] &lt;UNK&gt; op[2], some bitwise operation...//  0b110111 =&gt; &#39;UNK&#39;, // op[0] = op[2] &lt;&lt; unk(op[1])    0b111000 =&gt; &#39;signext&#39;, // op[0] = sign_extend(op[1] &amp; mask(op[2]))    0b111001 =&gt; &#39;movi&#39;, // op[0] = op[2]    0b111010 =&gt; &#39;mov&#39;,    0b111011 =&gt; &#39;bnh&#39;, // op[0] = number of highest bit set in op[1], so bnh(0xffffffff)=31, bnh(0x7fffffff)=30 etc.    0b111100 =&gt; &#39;cmp&#39;,//  0b111101 =&gt; &#39;UNK&#39;, // cmp variant? seen used before conditional instrs//  0b111110 =&gt; &#39;UNK&#39;,//  0b111111 =&gt; &#39;UNK&#39;];$condTbl = [    0b00 =&gt; &#39;&#39;,//  0b01 =&gt;    0b10 =&gt; &#39;eq&#39;,    0b11 =&gt; &#39;ne&#39;,];function registerParse($reg) {    if ($reg == 0) return &#39;last&#39;;    if ($reg == 63) return &#39;blank&#39;;    return sprintf(&#39;r%d&#39;, $reg);}function operandParse($imm) {    if (($imm &gt;&gt; 7) == 0b01101) {        // reg?        $reg = ($imm &gt;&gt; 3) &amp; 0b1111;        return registerParse($reg);    }    if (($imm &amp; 0x800) == 0x800) {        // (u32) data        return sprintf(&#39;(0x%x)&#39;, $imm &amp; 0x7ff);    }    if ($imm &gt; 32) return sprintf(&#39;0x%x&#39;, $imm);    return sprintf(&#39;%d&#39;, $imm);}function opCodeAsText($opcode) {    global $opTbl, $condTbl;    $ret = &#39;&#39;;    if (in_array($opcode &gt;&gt; 2, array_keys($opTbl))) $ret = $opTbl[$opcode &gt;&gt; 2];    else {        $opBin = decbin($opcode &gt;&gt; 2);        if (strlen($opBin) &lt; 6) $opBin = str_repeat(&#39;0&#39;,6 - strlen($opBin)) . $opBin;        $ret = &#39;unk_0b&#39; . $opBin;    }    $cond = $opcode &amp; 0b11;    if (in_array($cond, array_keys($condTbl))) $condTxt = $condTbl[$cond];    else {        $condBin = decbin($cond);        if (strlen($condBin) &lt; 2) $condBin = str_repeat(&#39;0&#39;, 2 - strlen($condBin)) . $condBin;        $condTxt = &#39;unk_0b&#39; . $condBin;    }    if ($condTxt != &quot;&quot;) $ret .= &#39;.&#39; . $condTxt;    return $ret;}function unpackOp($op) {    // bits:    // 0-11: immediate    // 12-17: register operand 2    // 18-23: register operand 1    // 24-31: opcode    return (object) [         &#39;opcode&#39; =&gt; ( ($op &gt;&gt; 24) &amp; 0b11111111 ),         &#39;reg1&#39;   =&gt; ( ($op &gt;&gt; 18) &amp; 0b111111 ),         &#39;reg2&#39;   =&gt; ( ($op &gt;&gt; 12) &amp; 0b111111 ),         &#39;imm&#39;    =&gt; (  $op        &amp; 0b111111111111 ),         &#39;imm_ex&#39; =&gt; (  $op        &amp; 0b111111111111111111 )           ];}function dis($bytes) {    $arr = unpack(&#39;V*&#39;, $bytes);    $off = 0;    foreach ($arr as $u32) {        $op = unpackOp($u32);        $reg1 = registerParse($op-&gt;reg1);        if ($reg1 != &quot;&quot;) $reg1 .= &#39;, &#39;;        $reg2 = registerParse($op-&gt;reg2);        if ($reg2 != &quot;&quot;) $reg2 .= &#39;, &#39;;        $operands = trim(sprintf(&quot;%s%s%s&quot;, $reg1, $reg2, operandParse($op-&gt;imm)), &quot;,&quot;);        printf(&quot;%08x : %08x : %s %s\n&quot;,$off,$u32,opCodeAsText($op-&gt;opcode),$operands);         $off+=4;    }}if ($argc == 0) die();dis( file_get_contents( $argv[1] ) );