1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
"""Who touches SMN 0x215C0 / 0x2161C, and does anything READ them after boot?
Previous owner() lookups in this project were buggy (they returned the last function
whose start <= va, ignoring the end, or required the literal to be strictly inside the
function). Literal pools usually sit just past a function's code, so this version
reports the nearest PRECEDING function start plus the distance, and flags whether the
literal is inside the function's [start,end) range.
"""
import struct, json, sys
BASE = '/Users/user/dev/amd-psp-re/psp_out/handover/'
MODS = ('sos', 'sys_drv', 'asd', 'hdcp', 'dtm', 'ras')
TARGETS = [0x215C0, 0x2161C]
WINDOW = (0x21500, 0x21B78)
def load(mod):
raw = open(BASE + 'elf/%s2.elf' % mod, 'rb').read()
ph = struct.unpack('<I', raw[28:32])[0]
o, v, pa, f = struct.unpack('<IIII', raw[ph+4:ph+20])
d = json.load(open(BASE + 'symbols/%s.json' % mod))
funcs = sorted((int(k, 16), val) for k, val in d['functions'].items())
return raw[o:o+f], v, funcs
def owner(funcs, va):
lo, hi = 0, len(funcs)
while lo < hi:
mid = (lo + hi) // 2
if funcs[mid][0] <= va: lo = mid + 1
else: hi = mid
if lo == 0: return None, None, None
fa, fv = funcs[lo-1]
inside = va < fv.get('end', fa)
return fv['name'], va - fa, inside
print("=== exact-literal references ===")
for mod in MODS:
body, v, funcs = load(mod)
for i in range(0, len(body)-4, 4):
w = struct.unpack('<I', body[i:i+4])[0]
if w in TARGETS:
nm, off, inside = owner(funcs, v+i)
print(" %-8s %#010x at %#08x -> %s (+%#x, inside=%s)"
% (mod, w, v+i, nm, off or 0, inside))
print("\n=== ANY literal inside the Route C window, all modules ===")
for mod in MODS:
body, v, funcs = load(mod)
hits = []
for i in range(0, len(body)-4, 4):
w = struct.unpack('<I', body[i:i+4])[0]
if WINDOW[0] <= w <= WINDOW[1]:
nm, off, inside = owner(funcs, v+i)
hits.append((w, v+i, nm, inside))
print(" %-8s : %d" % (mod, len(hits)))
for w, at, nm, inside in hits:
print(" %#08x at %#08x -> %s (inside=%s)" % (w, at, nm, inside))
|
