|
|
All twelve TA types this card loads and invokes are now opened in idalib via
idatui, annotated and saved, with their command surfaces recovered.
Three tools carry the pass. ta_symbols.py statically recovers the info header
and the five TEE entry points from the ARM-mode trampoline, with a selftest
against HDCP 23.0.4.49 that must reproduce the dispatcher address and the
hand-read command set. It deliberately does not name command handlers any more:
its jump-table walk guessed the first bl after each arm, which is wrong when the
arm sets up arguments, and those wrong names persisted in the database and
shadowed the correct map, so every TA was re-analysed from a deleted database
once that was found.
annotate_ta.py takes the map from the decompiler's own output and applies it by
address, handling switch/case including the 1u suffix form and nested two-tier
switches, if/else-if chains, wrapper entries that tail-call the real dispatcher,
and callees that are already named. A third step promotes loc_ labels to
functions, because handlers are often reached as loc_XXXX)(args) where IDA never
made a function and the decompiler shows a cast-through-label that cannot be
renamed; that step alone took OPM from three recovered commands to nine.
Renaming is by address rather than token, since drive mv resolves names against
the current view and silently failed for six of fourteen GCP handlers.
Surfaces: GCP 21 commands, XGMI 12, OPM 9, POWERPLAY and FP and RAP 7, AUC and
MERIT 6, CSU 3, OC 2, WSPE 2, and TMZ none since it is a stub.
GCP is the most interesting of the twelve and is now fully named from its own 69
log strings: it is a DRM content-protection TA with a low family for session
lifecycle and content keys and a high 0xFE0x family for authenticated crypto
sessions, key exchange and key refresh. WSPE is fully resolved too, and shows
that the cmp constants the static pass saw were error codes rather than command
ids.
|
