2 #include "reader-dre-st20.h"
10 #define FLASHS 0x7FE00000
11 #define FLASHE 0x7FFFFFFF
12 #define RAMS 0x40000000
13 #define RAME 0x401FFFFF
14 #define IRAMS 0x80000000
15 #define IRAME 0x800017FF
22 // ----------------------------------------------------------------
25 #define STACKMASK (STACKMAX-1)
31 uint32_t flashSize
, ramSize
;
32 int sptr
, stack
[STACKMAX
];
38 static bool st20_set_flash(st20_context_t
*ctx
, uint8_t *m
, uint32_t len
);
39 static bool st20_set_ram(st20_context_t
*ctx
, uint8_t *m
, uint32_t len
);
40 static void st20_init(st20_context_t
*ctx
, uint32_t IPtr
, uint32_t WPtr
, int verbose
);
41 static void st20_free(st20_context_t
*ctx
);
43 static void st20_set_call_frame(st20_context_t
*ctx
, uint32_t raddr
, int p1
, int p2
, int p3
);
45 static uint32_t st20_get_reg(st20_context_t
*ctx
, int reg
);
46 static void st20_set_reg(st20_context_t
*ctx
, int reg
, uint32_t val
);
47 static uint8_t st20_rbyte(st20_context_t
*ctx
, uint32_t off
);
48 static void st20_wbyte(st20_context_t
*ctx
, uint32_t off
, uint8_t val
);
49 static uint32_t st20_rword(st20_context_t
*ctx
, uint32_t off
);
50 static void st20_wword(st20_context_t
*ctx
, uint32_t off
, uint32_t val
);
52 #define INVALID_VALUE 0xCCCCCCCC
53 #define ERRORVAL 0xDEADBEEF
55 #define MININT 0x7FFFFFFF
56 #define MOSTPOS 0x7FFFFFFF
57 #define MOSTNEG 0x80000000
59 #define POP() ctx->stack[(ctx->sptr++)&STACKMASK]
60 #define PUSH(v) do { int32_t __v=(v); ctx->stack[(--ctx->sptr)&STACKMASK]=__v; } while(0)
61 #define DROP(n) ctx->sptr+=n
63 #define AAA ctx->stack[ctx->sptr&STACKMASK]
64 #define BBB ctx->stack[(ctx->sptr+1)&STACKMASK]
65 #define CCC ctx->stack[(ctx->sptr+2)&STACKMASK]
67 #define GET_OP() operand|=op1&0x0F
68 #define CLEAR_OP() operand=0
69 #define JUMP(x) ctx->Iptr+=(x)
70 #define POP64() ({ uint32_t __b=POP(); ((uint64_t)POP()<<32)|__b; })
71 #define PUSHPOP(op,val) do { int32_t __a=val; AAA op##= (__a); } while(0)
73 #define RB(off) st20_rbyte(ctx, off)
74 #define RW(off) st20_rword(ctx, off)
75 #define WW(off,val) st20_wword(ctx, off, val)
77 static uint32_t st20_get_reg(st20_context_t
*ctx
, int32_t reg
)
81 case IPTR
: return ctx
->Iptr
;
82 case WPTR
: return ctx
->Wptr
;
83 case AREG
: return AAA
;
84 case BREG
: return BBB
;
85 case CREG
: return CCC
;
90 static void st20_set_reg(st20_context_t
*ctx
, int32_t reg
, uint32_t val
)
94 case IPTR
: ctx
->Iptr
= val
; return;
95 case WPTR
: ctx
->Wptr
= val
; return;
96 case AREG
: AAA
=val
; return;
97 case BREG
: BBB
=val
; return;
98 case CREG
: CCC
=val
; return;
102 static uint8_t *st20_addr(st20_context_t
*ctx
, uint32_t off
)
104 if(off
>= FLASHS
&& off
<= FLASHE
)
106 return &ctx
->flash
[off
- FLASHS
];
108 else if(off
>= RAMS
&& off
<= RAME
)
110 return &ctx
->ram
[off
- RAMS
];
112 else if(off
>= IRAMS
&& off
<= IRAME
)
114 return &ctx
->iram
[off
- IRAMS
];
117 ctx
->invalid
= ERRORVAL
;
118 return (uint8_t *) &ctx
->invalid
;
121 static uint32_t st20_rword(st20_context_t
*ctx
, uint32_t off
)
124 temp
= st20_addr(ctx
, off
);
126 return ((temp
[3] << 24) | (temp
[2] << 16) | (temp
[1] << 8) | temp
[0]);
129 static uint16_t st20_rshort(st20_context_t
*ctx
, uint32_t off
)
132 temp
= st20_addr(ctx
, off
);
134 return ((temp
[0] << 8) | temp
[1]);
137 static uint8_t st20_rbyte(st20_context_t
*ctx
, uint32_t off
)
139 return *st20_addr(ctx
, off
);
142 static void st20_wword(st20_context_t
*ctx
, uint32_t off
, uint32_t val
)
145 temp
= st20_addr(ctx
, off
);
146 temp
[3] = (val
>> 24) & 0xFF;
147 temp
[2] = (val
>> 16) & 0xFF;
148 temp
[1] = (val
>> 8) & 0xFF;
149 temp
[0] = val
& 0xFF;
152 static void st20_wbyte(st20_context_t
*ctx
, uint32_t off
, uint8_t val
)
155 temp
= st20_addr(ctx
, off
);
159 static int32_t st20_decode(st20_context_t
*ctx
, int32_t count
)
164 while(ctx
->Iptr
!= 0)
166 int32_t a
, op1
= RB(ctx
->Iptr
++);
171 case 0x0: // j / jump
177 PUSH(ctx
->Wptr
+ (operand
* 4));
181 case 0x2: // positive prefix
186 AAA
=RW(AAA
+ (operand
* 4));
196 PUSHPOP(+, operand
* 4);
200 case 0x6: // negative prefix
201 operand
= (~operand
) << 4;
205 PUSH(RW(ctx
->Wptr
+ (operand
* 4)));
216 WW(ctx
->Wptr
, ctx
->Iptr
); WW(ctx
->Wptr
+ 4, POP()); WW(ctx
->Wptr
+ 8, POP()); WW(ctx
->Wptr
+ 12, POP());
222 case 0xA: // cj / conditional jump
223 if(AAA
) { DROP(1); } else { JUMP(operand
); }
227 case 0xB: // ajw / adjust workspace
228 ctx
->Wptr
+= operand
* 4;
232 case 0xC: // eqc / equals constant
233 AAA
= (operand
== AAA
? 1 : 0);
238 WW(ctx
->Wptr
+ (operand
* 4), POP());
243 a
= POP(); WW(a
+ (operand
* 4), POP());
247 case 0xF: // opr (secondary ins)
250 case 0x00: a
= AAA
; AAA
= BBB
; BBB
= a
; break;
251 case 0x01: AAA
= RB(AAA
); break;
252 case 0x02: PUSHPOP(+, POP()); break;
253 case 0x04: PUSHPOP(-, POP()); break;
254 case 0x05: PUSHPOP(+, POP()); break;
255 case 0x06: a
= AAA
; AAA
= ctx
->Iptr
; ctx
->Iptr
= a
; break;
256 case 0x08: PUSHPOP(*, POP()); break;
257 case 0x09: a
=POP(); AAA
= (AAA
> a
); break;
258 case 0x0A: a
=POP(); AAA
= a
+ (AAA
* 4); break;
259 case 0x0C: PUSHPOP(-, POP()); break;
260 case 0x1A: { a
= POP(); uint64_t ll
= POP64(); PUSH(ll
% (uint32_t)a
); PUSH(ll
/ (uint32_t)a
); } break;
261 case 0x1B: PUSHPOP(+, ctx
->Iptr
); break;
262 case 0x1D: CCC
= BBB
; BBB
= (AAA
>= 0 ? 0 : -1); break;
263 case 0x1F: PUSHPOP(%, POP()); break;
264 case 0x20: ctx
->Iptr
= RW(ctx
->Wptr
); ctx
->Wptr
= ctx
->Wptr
+ 16; break;
265 case 0x2C: PUSHPOP(/, POP()); break;
267 case 0x32: AAA
=~ AAA
; break;
268 case 0x33: PUSHPOP(^, POP()); break;
269 case 0x34: PUSHPOP(*, 4); break;
270 case 0x35: { a
= POP(); uint64_t ll
= POP64() >> a
; PUSH((ll
>> 32) & 0xFFFFFFFF); PUSH(ll
& 0xFFFFFFFF); } break;
271 case 0x36: { a
= POP(); uint64_t ll
= POP64() << a
; PUSH((ll
>> 32) & 0xFFFFFFFF); PUSH(ll
& 0xFFFFFFFF); } break;
272 case 0x3B: a
= POP(); st20_wbyte(ctx
, a
, POP()); break;
273 case 0x3F: a
= POP(); PUSH(a
& 3); PUSH((uint32_t)a
>> 2); break;
274 case 0x40: a
= POP(); AAA
= (uint32_t)AAA
>> a
; break;
275 case 0x41: a
= POP(); AAA
= (uint32_t)AAA
<< a
; break;
276 case 0x42: PUSH(MOSTNEG
); break;
277 case 0x46: PUSHPOP(&, POP()); break;
278 case 0x4A: { a
= POP(); int32_t b
= POP(); int32_t c
= POP(); while(a
--) st20_wbyte(ctx
, b
++, st20_rbyte(ctx
, c
++)); } break;
279 case 0x4B: PUSHPOP(|, POP()); break;
280 case 0x53: PUSHPOP(*, POP()); break;
281 case 0x5A: PUSH(AAA
); break;
282 case 0x5F: a
= POP(); AAA
= ((uint32_t)AAA
> (uint32_t)a
); break;
283 case 0x78: { a
= POP(); int32_t b
= POP(); int32_t bb
= 0; while(a
--){bb
<<= 1; bb
|= b
& 1; b
>>= 1;} PUSH(bb
);} break;
284 case 0xCA: AAA
= st20_rshort(ctx
, AAA
); break;
286 cs_log("[icg] unknown opcode %X", operand
);
293 if(--count
<= 0 && operand
== 0)
301 static bool st20_set_flash(st20_context_t
*ctx
, uint8_t *m
, uint32_t len
)
305 ctx
->flash
= (uint8_t *)malloc(len
);
306 ctx
->flashSize
= len
;
310 cs_log("ERROR len!");
315 if (ctx
->flash
== NULL
)
317 cs_log("ERROR, malloc!");
325 memset(ctx
->flash
, 0, len
);
329 memcpy(ctx
->flash
, m
, len
);
336 static bool st20_set_ram(st20_context_t
*ctx
, uint8_t *m
, uint32_t len
)
340 ctx
->ram
= (uint8_t *)malloc(len
);
345 cs_log("ERROR len!");
350 if (ctx
->ram
== NULL
)
352 cs_log("ERROR, malloc!");
360 memset(ctx
->ram
, 0, len
);
364 memcpy(ctx
->ram
, m
, len
);
371 static void st20_init(st20_context_t
*ctx
, uint32_t IPtr
, uint32_t WPtr
, int32_t verbose
)
375 memset(ctx
->stack
, INVALID_VALUE
, sizeof(ctx
->stack
));
376 ctx
->sptr
= STACKMAX
- 3;
377 memset(ctx
->iram
, 0, sizeof(ctx
->iram
));
378 ctx
->verbose
= verbose
;
381 static void st20_free(st20_context_t
*ctx
)
398 static void st20_set_call_frame(st20_context_t
*ctx
, uint32_t raddr
, int32_t p1
, int32_t p2
, int32_t p3
)
401 st20_wword(ctx
, ctx
->Wptr
, raddr
); // RET
402 st20_wword(ctx
, ctx
->Wptr
+ 4, p1
); // Areg
403 st20_wword(ctx
, ctx
->Wptr
+ 8, p1
); // Breg
404 st20_wword(ctx
, ctx
->Wptr
+ 12, p1
); // Creg
405 st20_wword(ctx
, ctx
->Wptr
+ 16, p2
);
406 st20_wword(ctx
, ctx
->Wptr
+ 20, p3
);
407 st20_set_reg(ctx
, AREG
, raddr
); // RET
410 int st20_run(uint8_t* snip
, uint32_t snip_len
, int addr
, uint8_t *data
, uint16_t overcryptId
)
415 cs_log("[icg] decrypt address = 0x%X, id = %04X", addr
, overcryptId
);
417 cs_log("[icg] CW: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X ",
418 data
[0], data
[1], data
[2], data
[3], data
[4], data
[5], data
[6], data
[7],
419 data
[8], data
[9], data
[10], data
[11], data
[12], data
[13], data
[14], data
[15]);
421 for(n
= 0; n
< 2; n
++)
423 memset(&ctx
, 0, sizeof(st20_context_t
));
424 if (!st20_set_ram(&ctx
, 0, 0x1000))
429 if (!st20_set_flash(&ctx
, snip
+ 0x48, (int) (snip_len
- 0x48)))
434 st20_init(&ctx
, FLASHS
+ addr
, RAMS
+ 0x100, 1);
435 st20_set_call_frame(&ctx
, 0, RAMS
, RAMS
, RAMS
);
437 for(i
= 0; i
< 8; i
++)
439 st20_wbyte(&ctx
, RAMS
+ i
, data
[i
+ n
* 8]);
442 if((error
= st20_decode(&ctx
, 800000)) < 0)
447 cs_log("[icg] cw%d ret = %d, AREG = %X", n
+ 1, error
, st20_get_reg(&ctx
, AREG
));
449 for(i
= 0; i
< 8; i
++)
451 data
[i
+ n
* 8] = st20_rbyte(&ctx
, RAMS
+ i
);
458 //in error case ensure free ctx!
461 cs_log("[icg] st20 processing failed with error %d", error
);
465 cs_log("[icg] DW: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X ",
466 data
[0], data
[1], data
[2], data
[3], data
[4], data
[5], data
[6], data
[7],
467 data
[8], data
[9], data
[10], data
[11], data
[12], data
[13], data
[14], data
[15]);