Firmware keywords for processor IDing ? - General Discussion and Assistance - CHDK Forum supplierdeeply

Firmware keywords for processor IDing ?

  • 15 Replies
  • 6931 Views
*

linuxGuy

Firmware keywords for processor IDing ?
« on: 08 / December / 2007, 12:32:47 »
Advertisements
Has someone searched the firmware for characters, keywords or phrases that might be embedded such as:

"DaVinci"
"ARM"
"DryOS"
"VxWorks"
"copyright"
the copyright symbol (c with a circle around it like '@')
"version"
"MontaVista"
"Sun"
"Java"
"gcc"
"linux"
"kernel"
"Canon"
etc.

Ideally said searches would be case insensitive.

Has it been done ?  What has been found ?
« Last Edit: 08 / December / 2007, 13:09:12 by linuxGuy »

*

linuxGuy

Re: Firmware keywords for processor IDing ?
« Reply #1 on: 08 / December / 2007, 12:54:07 »
It would be interesting to know what compiler Canon used to develop the firmware.  Gcc is a very popular compiler.  Is there a way to identify if Gcc was used to create the firmware ?

Thanks

*

linuxGuy

Re: Firmware keywords for processor IDing ?
« Reply #2 on: 08 / December / 2007, 15:18:28 »
Search results of A720IS-100C.bin using khexeditor on Linux.  (Allows case insensitive searches of binary files.)

Word/ Result

Davinci: not found
ARM: ARM Library runtime error, armlib,
DRYOS: DRYOS version 2.3 release #0023
VxWorks: not found
copyright: Copyright (C) 1997-2007 by CANON Inc.
Wind: no matches outside of windows.
River: no matches outside of driver.
Monta: not found
Sun: no matches outside of Sunday
Java: no matches
gcc: no matches
linux: not found
kernel: found twice, nothing interesting
link: dwLinkList.c: this is very interesting !
compile: no found
Texas: not found
TI: too many matches to search
Device: lots of matches
Jdata: lots of matches
OS: lots of matches, non interesting.
Motorola: no matches

.c: lots of matches.  Very interesting 

Thermometer.c !  Do these cameras have a thermometer in them ?  Does the image noise reduction algorithm change or maybe the CMOS sensor gain voltage ?  Very interesting. 

I am surprised to see so many .c function names embedded in the firmware.   Is it possible that Canon ships debug stuff in their production code ?  The A720 is a DryOS/ Digic III camera... are the VxWorks/DigicII cameras similar ?  (I guess I could search them myself...) 

Watchdog.c.:  The processor has a watchdog !

AFDataManager.c: When I see things like this in the firmware I get the feeling that we are not starting at ground zero deciphering things.  There look to me to be debug hooks written into the firmware.  Much better than starting with a totally unknown function.

SingleAF.c: What do you think that does ?  :smile AFParam.c ? AFCalc.c ?

DirectTransfer20.c.  Huffman.c: probably a compression algorithm.

MakeBootDisk: ?
Script.c ?
DesignInfo.c ?  I'd love to see what happens when you call that.  Spit out the processor data ?
FirmwareVersionDialog.c:  Guess what that does !  Wow, I am impressed to see all these hooks in the code.
EXPLock.c ?

Its clear to me that this code is written in C.  I see things like %s = NULL %s = %s%2d.%03d, etc.  Those look like printf format strings (or fprintf, etc.)

CDSGain.c: hmmm...

There are tons and tons of .c words in the firmware.

Write: write in memory, UIFS_WriteFirmInfoToFile: dump the firmware to a file ?
ExecuteFactoryResetWithROMWrite !
Write to ROM.
ROMWRITE.BIN
UPGRADER.BIN

FIle: lots of matches.  I wonder if they could be used for a firmware dumping routine ?

Assert: this code has 5 assert statements in it.  Clearly some debugging hooks have been left in.

Javelle: nothing found

h3a: nothing found

VPFE: nothing found

Other keywords found:
setLClk36MHz, setHCLK18MHz, setLClk72MHz.  The significance of these words is yet to be determined.  It appears that the TI chips use a setable clock for marching the data off the sensor.  This might be a clue, but maybe other systems use the same clock.

This is a very interesting exercise.  I'll leave it there for now.


*

linuxGuy

Re: Firmware keywords for processor IDing ?
« Reply #3 on: 08 / December / 2007, 15:22:38 »
« Last Edit: 08 / December / 2007, 15:29:38 by linuxGuy »


*

linuxGuy

Re: Firmware keywords for processor IDing ?
« Reply #4 on: 08 / December / 2007, 15:34:40 »
« Last Edit: 08 / December / 2007, 15:45:10 by linuxGuy »

*

Offline GrAnd

  • ****
  • 916
  • [A610, S3IS]
    • CHDK
Re: Firmware keywords for processor IDing ?
« Reply #5 on: 08 / December / 2007, 15:47:01 »
<br />
<b>Fatal error</b>:  Allowed memory size of 33554432 bytes exhausted (tried to allocate 7280641 bytes) in <b>/home/acseven/public_html/chdk/Sources/Load.php(1726) : eval()'d code</b> on line <b>974</b><br />
CHDK Developer.

*

Offline GrAnd

  • ****
  • 916
  • [A610, S3IS]
    • CHDK
Re: Firmware keywords for processor IDing ?
« Reply #6 on: 08 / December / 2007, 15:52:48 »
Oops... That post was too long...

Here is the list of strings from A610 (VxWorks). See attachment.
CHDK Developer.

*

Offline GrAnd

  • ****
  • 916
  • [A610, S3IS]
    • CHDK
Re: Firmware keywords for processor IDing ?
« Reply #7 on: 08 / December / 2007, 15:58:20 »
List of functions with signatures for IDA...
CHDK Developer.


*

linuxGuy

Re: Firmware keywords for processor IDing ?
« Reply #8 on: 08 / December / 2007, 16:02:13 »
Thanks GrAnd.  I was just about to do a search on a VxWorks firmware.

Good news: at first glance there are far, far more hooks in the DryOS firmware.  Like 10x, if your search method is what I think it is.  I think every function has a C function name in the header for some reason.  Why did they end up in the firmware ?  Debugging ?

Some of the code is C++.   Does C++ embed that sort of info ?

Has anyone done byecode matching ?  Take malloc.c, compile it with gcc, link it, optimize it, take the bytecode pattern and see if it matches ?  I'll bet they are using gcc.   It would be hard to find a match unless it was optimized the same.   But one should be able to discern something from the way the function pre and post amble works too.

*

linuxGuy

Re: Firmware keywords for processor IDing ?
« Reply #9 on: 08 / December / 2007, 16:05:07 »
List of functions with signatures for IDA...

Thanks.

Which version of IDA are you using ?

 

Related Topics