|
|
These TAs share one PSP TEE runtime, so the same helper appears byte-identical in
several of them. fw/ta_libmatch.py dumps IDA's function list per TA, hashes each
function's bytes, and clusters across TAs: 628 functions, 457 distinct bodies, 55
clusters shared by two or more TAs covering 225 instances. Naming a cluster once
and propagating by exact content match is much better leverage than renaming
anonymous functions individually.
The clustering reproduces known answers before being trusted for unknown ones: the
148-byte cluster shared by eight TAs is exactly the entry trampoline already named
from the header parse, and the 2- and 4-byte clusters are the return stubs already
named as the close-session and destroy entry points.
Naming discipline kept deliberately tight. Only six clusters got semantic names,
the ones whose disassembly proves them: a word-block zero fill present in ten TAs,
a bytewise zero fill with alignment fixup in six, the two return stubs, the
trampoline and a tail-jump thunk. The other 49 are tagged lib_<hash>_<size>, which
records that they are shared runtime rather than TA-specific logic without
inventing semantics; several look like a stream or vtable family but probably is
not a name.
Coverage rises from 38 to 61 percent. The remainder is TA-specific internal logic
and is stated as unnamed.
|
