Powerstates, asm, disassembly, how to, and the whole ordeal about watchdogs - page 2 - General Discussion and Assistance - CHDK Forum

Powerstates, asm, disassembly, how to, and the whole ordeal about watchdogs

  • 18 Replies
  • 8880 Views
*

Offline RaduP

  • *****
  • 926
Advertisements
Oh, got it, thanks!
I was looking in the developers wiki, expecting to find them there.

*

Offline RaduP

  • *****
  • 926
Ok, I followed the steps, but had some problems here:

"To semi-automate initial stage you need to download and install FLIRT-signatures and IDC-scripts. You can get them here. Copy file "sig/CanonFW_A-Series.sig" from the archive to "<PATH_of_IDA_insalled>/sig/arm/". Unpack the idc folder to whatever you want."

First, there was no /arm directory there, so I created it.
Also, there was no file called "CanonFW_A-Series.sig", there was "CanonFW_VxWorks_A-Series.sig", and I copied it there.

Then I went in IDA and followed the instructions, but at the CPU selection I only have X86 CPUs, nothing else..
My IDA version is IDA Pro 4.9 Freeware Version

Any idea why I can't select an ARM CPU?

*

Offline RaduP

  • *****
  • 926
Well, after reading the IDA site and the helps and stuff, it seems that only the IDA Pro version supports arm and loading of raw files. Since that cost over 500 bucks, and I have no other use for it, I guess that's a dead end for me. Are there any similar, free tools out there?

*

Offline PhyrePhoX

  • *****
  • 2254
  • make RAW not WAR
    • PhyreWorX
take a look here: GPL Tools - CHDK Wiki chr compiled a nice tutorial on how to achieve things without IDA


*

Offline RaduP

  • *****
  • 926
Great, thanks. I am downloading the windows version, from here: ARM projects
Hope it works..

*

Offline RaduP

  • *****
  • 926
Ok, I was able to get an elf file with that which I attempted to run it through IDA, but for some reason it didn't work very well (didn't see any assembly displayed there).
I was also able to disassambly the firmware into a text file, but I am not even sure that's actual code and not some garbage. I get a lot of undefined instructions and code that looks like gibberish to me (I have no ARM assembly experience, but I do know ASM on two other CPU families).

For example, the first lines look like:
Quote
ff810000:   e3a00002    mov   r0, #2   ; 0x2
ff810004:   ea000012    b   ff810054 <_binary_primary_bin_start+0x54>
ff810008:   79706f43    ldmvcdb   r0!, {r0, r1, r6, r8, r9, sl, fp, sp, lr}^
ff81000c:   68676972    stmvsda   r7!, {r1, r4, r5, r6, r8, fp, sp, lr}^
ff810010:   39312074    ldmccdb   r1!, {r2, r4, r5, r6, sp}
ff810014:   322d3939    eorcc   r3, sp, #933888   ; 0xe4000
ff810018:   20313030    eorcss   r3, r1, r0, lsr r0
ff81001c:   204d5241    subcs   r5, sp, r1, asr #4
ff810020:   696d694c    stmvsdb   sp!, {r2, r3, r6, r8, fp, sp, lr}^
ff810024:   0a646574    beq   11295fc <_binary_primary_bin_size+0xdf02ec>

*

Offline fudgey

  • *****
  • 1705
  • a570is
When in doubt, find a thread that has someone's paste of an IDA disassembly, find the same firmware dump they used and disassemble it and compare.

Note that the disassembler interprets each word as an instruction, even if the software never executes that word but instead just uses it as a constant for math or addressing or other data. So there are a lot of instructions that aren't even supposed to make sense.

*

Offline RaduP

  • *****
  • 926
Yes, I am aware of that, of course.
I was expecting, however, that the FAQ would at least explain how to get a disassembly of the actual code segment, not the data part.


*

Offline DataGhost

  • ****
  • 314
  • EOS 40D, S5IS
    • DataGhost.com
StopWDT will prevent the camera from shutting down while executing big functions without sleeps, though I don't know what side-effects it has. Just letting you know :)

 

Related Topics