finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

reyalp

14128

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #70 on: 02 / December / 2018, 21:46:22 »

Advertisements

Quote from: srsa_4c on 25 / March / 2018, 07:04:09

I have a suggestion for a capdis feature:
When disassembling a function partially, it would be nice if capdis could (optionally) add an LDR PC instruction at the end that would point to the next instruction at the routine's original location.

I added an option -jfw which does this in r5134 (yeah, I'm a slacker

)

Logged

Don't forget what the H stands for.

srsa_4c

4451

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #71 on: 08 / December / 2018, 18:17:21 »

Quote from: reyalp on 02 / December / 2018, 21:46:22

I added an option -jfw which does this in r5134

Thanks.

While working on a completely unsupported dump, I've noticed that an unrecognized function listed in find_generic_funcs() prevents the rest of the functions from being used. Did not go as far as finding the piece of code that does this (the code is rather convoluted), but making add_generic_sig_match() return immediately when the first get_saved_sig_val() fails does seem to help.

edit:
patch below does what I wrote above plus fixes two possible memory leaks

Code: [Select]

Index: tools/finsig_thumb2.c
===================================================================
--- tools/finsig_thumb2.c	(revision 5136)
+++ tools/finsig_thumb2.c	(working copy)
@@ -663,10 +663,12 @@
     int k;
 
     char *s = n;
+    int mallocd = 0;
     if (suffix != 0)
     {
         s = malloc(strlen(n) + strlen(suffix) + 1);
         sprintf(s, "%s%s", n, suffix);
+        mallocd = 1;
     }
 
     for (k=0; sig_names[k].name != 0; k++)
@@ -677,10 +679,14 @@
             {
                 sig_names[k].val = eadr;
                 sig_names[k].flags |= EV_MATCH;
+                if (mallocd)
+                    free(s);
                 return;
             }
             else if (sig_names[k].val == eadr)     // same name, same address
             {
+                if (mallocd)
+                    free(s);
                 return;
             }
             else // same name, different address
@@ -2687,6 +2693,7 @@
 
     for(i=1; i<=64; i++) {
         if (!disasm_iter(fw,is)) {
+            free(blobs);
             return 0;
         }
         if (is->insn->id == ARM_INS_LDR && is->insn->detail->arm.operands[1].type == ARM_OP_MEM) {
@@ -4228,6 +4235,7 @@
     uint32_t adr=get_saved_sig_val(name);
     if(!adr) {
         printf("add_generic_sig_match: missing %s\n",name);
+        return;
     }
     add_generic_func_match(match_fns,match_fn_count,MAX_GENERIC_FUNCS,fn,adr);
     char veneer[128];

« Last Edit: 09 / December / 2018, 14:31:15 by srsa_4c »

Logged

reyalp

14128

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #72 on: 19 / May / 2019, 00:24:13 »

Quote from: srsa_4c on 08 / December / 2018, 18:17:21

While working on a completely unsupported dump, I've noticed that an unrecognized function listed in find_generic_funcs() prevents the rest of the functions from being used. Did not go as far as finding the piece of code that does this (the code is rather convoluted), but making add_generic_sig_match() return immediately when the first get_saved_sig_val() fails does seem to help.

edit:
patch below does what I wrote above plus fixes two possible memory leaks

Oops, I downloaded this when it was posted but neglected to apply it

Feel free to prod me if it seems like I'm ignoring something, it usually just means I forgot.

Having add_generic_sig_match bail if the reference function doesn't exist makes sense.

Unrelated to that, I added a generic match to find PTP handlers in r5207. They aren't useful directly as stubs, but can be for analysis and finding other functions.

A couple notes:
* Canon sometimes registers the same handler for different opcodes, which creates duplicate addresses in the funcs_by... CSV files. There are already duplicates for _FW, so this doesn't seem like a big deal. It would be kind of nice to prefer the standard name where they are registered for both a standard opcode and Canon extension.
* The names for the Canon extensions come from libgphoto2. I don't know how reliable they are.

I plan to port this to the other sig finders.

Logged

Don't forget what the H stands for.

srsa_4c

4451

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #73 on: 19 / May / 2019, 16:05:45 »

Quote from: reyalp on 19 / May / 2019, 00:24:13

Oops, I downloaded this when it was posted but neglected to apply it Feel free to prod me if it seems like I'm ignoring something, it usually just means I forgot.

No problem, these were minor issues that did not really affect the output.

Logged

srsa_4c

4451

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #74 on: 18 / November / 2020, 13:07:05 »

I have a case where capdis and objdump disagree on their disassembly. I'm trying to get a disassembly of ARM cache manipulation functions, in this example, ixus150 100c.
capdis -c=126 -s=0xFF8201BC PRIMARY.BIN 0xff810000
First 3 instructions from capdis:

Code: [Select]

    mrs     r3, apsr
    orr     r0, r3, #0xc0
    msr     cpsr_fsxc, r0

From objdump:

Code: [Select]

   mrs       r3, CPSR
   orr       r0, r3, #0xC0
   msr       CPSR_fsxc, r0

I think objdump is right, APSR would not make sense in that code. Capstone lib is probably version 4, built in May 2019. Am I having a local issue, or is this a bug?

Logged

philmoz

3450

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #75 on: 18 / November / 2020, 16:26:36 »

https://developer.arm.com/documentation/dui0489/c/arm-and-thumb-instructions/miscellaneous-instructions/mrs?lang=en
CPSR deprecated synonym for APSR and for use in Debug state

GCC generates identical code for 'mrs r0, cpsr' and 'mrs r0, apsr'

Phil.

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)

srsa_4c

4451

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #76 on: 18 / November / 2020, 17:13:22 »

Quote from: philmoz on 18 / November / 2020, 16:26:36

CPSR deprecated synonym for APSR and for use in Debug state

That's quite confusing to me. How could (the term) CPSR be deprecated if APSR only holds always accessible status flags. Deprecation is also not mentioned here. I guess I'm probably misunderstanding something.

Quote

GCC generates identical code for 'mrs r0, cpsr' and 'mrs r0, apsr'

If that's so, then there's probably not much that could be done (how would the disassembler know the processor mode). Of course we know that the Powershot firmware uses supervisor mode by default, but hardcoding that to a disassembler is probably not a good idea.

Logged

philmoz

3450

Re: finsig and other tools for thumb2 (was Re: chdk in the DIGIC6 world)

« Reply #77 on: 18 / November / 2020, 17:29:58 »

I think it's only deprecated for the 'mrs' instruction.

The generated code is the same, the actual operation depends on processor mode at runtime.

Phil.

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)

Subject / Started by	Replies	Last post
The World's Best Photos of CHDK Started by NewbieToobie General Chat	1 Replies 5754 Views	by acseven
gensig and finsig for DSLR and Magic Lantern Started by arm.indiana DryOS Development	0 Replies 3241 Views	by arm.indiana
STICK and ASSIST - new tools to install CHDK and SDM Started by zeno « 1 2 3 » General Help and Assistance on using CHDK stable releases	25 Replies 19539 Views	by Aquila
chdk in the DIGIC6 world Started by c10ud « 1 2 ... 20 21 » General Discussion and Assistance	201 Replies 172706 Views	by Caefix
Toolchain for G16 (digic6) Started by alvm DryOS Development	3 Replies 7153 Views	by nafraf