Guide how to start analysing 40D firmware - page 2 - DSLR Hack development - CHDK Forum
« previous next »
Pages: 1 [2]   Go Down

Guide how to start analysing 40D firmware

  • 15 Replies
  • 24961 Views
*

ASalina

Re: Guide how to start analysing 40D firmware
« Reply #10 on: 20 / May / 2008, 00:03:45 »
Advertisements
I'm also seeing a lot of strings that mention "card1" and "card2." An error message that states "Cannot record audio"... Things that sound like they are for a 1D series camera. I wonder what that could imply? Perhaps they just re-use the same block of strings for different model's firmware. I wonder if there is any actual code associated with that "AF microadjust" or 5 and 7 shot autobracketing selection string, or if they are just part of a standard block of menu strings.
Logged
*

Offline emklap

  • *
  • 45
Re: Guide how to start analysing 40D firmware
« Reply #11 on: 21 / May / 2008, 09:47:25 »
Hi

Simple question, does anyone if it is a 32, 16, or 8 bit application? In other words, does each of the operation start on every 4th byte, every second byte or can it start on each byte (even or odd). :'(

I am analysing the code but are unsure if I have to jump through the data is  steps of 4, 2 or 1 byte ??? I think it's every second byte.

I made some more IDC scripts that look for
1) CF.n and Menu strings,
2) Code
3) other strings.

Run  the IDC file called 40D.idc. It is the main file that calls the other script files.

It provides a lot of readable code, but there is still some work to be done by hand.
Any improvements and/or extensions are welcome

(Note that the attachments are only visable and downloadable when you have registered and are logged in >:()
« Last Edit: 22 / May / 2008, 05:24:23 by emklap »
Logged
*

Offline owerlord

  • ***
  • 115
Re: Guide how to start analysing 40D firmware
« Reply #12 on: 21 / May / 2008, 11:05:38 »
400D code is totaly 4byte. Is aligned for 4B and almost all data is aligned 4B (dword int's).
After analizing the 400D code I can say that it's the best way to start from begining, and go to functions calls until you get something like that:

LDR Rx, =sub_xxx1
LDR Ry, =aSomeString1
sub_eee
LDR Rx, =sub_xxx2
LDR Ry, =aSomeString2
sub_eee
LDR Rx, =sub_xxx3
LDR Ry, =aSomeString3
sub_eee

There you know you found the RegisterEvent or RegisterTask.

The main structure of the begining of the program is (function names from the vxWorks help:
romStart
{ here you have the adresses of the data segment to copy ,and the adres propably 1900 where to copy data. then it calls some wierd function which save's these adreses, then calls usrInit}

usrInit
{ it calls much functions to initialize hardwere and so. then calls usrKernelInit }

usrKernelInit
{ it calls more functions to initialize - this time mostly libreries then and the end calls:
 kernelInit( usrRoot <= function, ...) - like in the manual }

usrRoot
{ Initialize more hardware (drivers and so), at the end calls AppInit }

AppInit
{ It's the canon-only part. So you have here canon's initializations (I didn't recognized much of them), and at the end it calls:
RegisterTask ("Startup", , , task_Startup <=function, )
}

And here at last you have:
task_Startup
{ lot of function calls. most of these functions register event procedures. It's like "SomethingFunction" registers all events with "Something". }

I hope it'll help.
Logged
*

ASalina

Re: Guide how to start analysing 40D firmware
« Reply #13 on: 21 / May / 2008, 15:18:46 »
I'm finding and naming loads and loads of functions today.

The trick was to find TryPostEvent @ ROM:009638B8. This function is part of the Debug Manager ("../DbgMgr/DbgMgr.c") and takes as an argument (char *)R0 which points to a string with the calling function's name in it. Once TryPostEvent has been identified you can open up a XREF subview and find all of the funcs that call it. Their names are located in strings just above their entry points. Naming them then becomes easy -- almost mechanical (but not enough for an IDC script). Once I have exhausted this method of identifying functions in the Flasher there won't be much unidentified code left. This leftover code may well contain the decrypting function for the Firmware payload, so it'll be much easier to find.

I'd like to post these names and addresses once I've got them all, but I'm not sure how to export them from IDA. Anyone have any ideas?
Logged
*

ASalina

Re: Guide how to start analysing 40D firmware
« Reply #14 on: 21 / May / 2008, 15:38:32 »
Quote from: ASalina on 21 / May / 2008, 15:18:46
TryPostEvent @ ROM:009638B8. This function is part of the Debug Manager ("../DbgMgr/DbgMgr.c") and takes as an argument (char *)R0 which points to a string with the calling function's name in it.

That should be (char *)R2, not R0...   :-[
Logged
*

Offline emklap

  • *
  • 45
Re: Guide how to start analysing 40D firmware
« Reply #15 on: 22 / May / 2008, 05:31:34 »
Thanks, when I now look at the code it looks like the TryPostEvent code on location 009638B8 is a routine that prints debug strings when the fw updater is loaded en the updater than load the firmware itself.

See also the code at 00804FC8 where the updater is loaded and decypered.

I expect that the FW itself must be decrypted inside the FIR see the sub on locatoin 00804C1
Logged
Pages: 1 [2]   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal