?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
- fix Building without Nagra not possible at Nagra_Merlin https://trac.streamboard...
[oscam.git] / reader-dre-st20.c
blobd605cde8a04e7bb68261973a20f90bfe7f963329
1 #include "globals.h"
2 #include "reader-dre-st20.h"
3
4 #define IPTR 0
5 #define WPTR 1
6 #define AREG 2
7 #define BREG 3
8 #define CREG 4
9
10 #define FLASHS 0x7FE00000
11 #define FLASHE 0x7FFFFFFF
12 #define RAMS 0x40000000
13 #define RAME 0x401FFFFF
14 #define IRAMS 0x80000000
15 #define IRAME 0x800017FF
16
17 #define ERR_ILL_OP -1
18 #define ERR_CNT -2
19 #define FLA_ERR -3
20 #define RAM_ERR -4
21
22 // ----------------------------------------------------------------
23
24 #define STACKMAX 16
25 #define STACKMASK (STACKMAX-1)
26
27 typedef struct
28 {
29 uint32_t Iptr, Wptr;
30 uint8_t *flash, *ram;
31 uint32_t flashSize, ramSize;
32 int sptr, stack[STACKMAX];
33 uint8_t iram[0x1800];
34 int invalid;
35 int verbose;
36 } st20_context_t;
37
38 static bool st20_set_flash(st20_context_t *ctx, uint8_t *m, uint32_t len);
39 static bool st20_set_ram(st20_context_t *ctx, uint8_t *m, uint32_t len);
40 static void st20_init(st20_context_t *ctx, uint32_t IPtr, uint32_t WPtr, int verbose);
41 static void st20_free(st20_context_t *ctx);
42
43 static void st20_set_call_frame(st20_context_t *ctx, uint32_t raddr, int p1, int p2, int p3);
44
45 static uint32_t st20_get_reg(st20_context_t *ctx, int reg);
46 static void st20_set_reg(st20_context_t *ctx, int reg, uint32_t val);
47 static uint8_t st20_rbyte(st20_context_t *ctx, uint32_t off);
48 static void st20_wbyte(st20_context_t *ctx, uint32_t off, uint8_t val);
49 static uint32_t st20_rword(st20_context_t *ctx, uint32_t off);
50 static void st20_wword(st20_context_t *ctx, uint32_t off, uint32_t val);
51
52 #define INVALID_VALUE 0xCCCCCCCC
53 #define ERRORVAL 0xDEADBEEF
54
55 #define MININT 0x7FFFFFFF
56 #define MOSTPOS 0x7FFFFFFF
57 #define MOSTNEG 0x80000000
58
59 #define POP() ctx->stack[(ctx->sptr++)&STACKMASK]
60 #define PUSH(v) do { int32_t __v=(v); ctx->stack[(--ctx->sptr)&STACKMASK]=__v; } while(0)
61 #define DROP(n) ctx->sptr+=n
62
63 #define AAA ctx->stack[ctx->sptr&STACKMASK]
64 #define BBB ctx->stack[(ctx->sptr+1)&STACKMASK]
65 #define CCC ctx->stack[(ctx->sptr+2)&STACKMASK]
66
67 #define GET_OP() operand|=op1&0x0F
68 #define CLEAR_OP() operand=0
69 #define JUMP(x) ctx->Iptr+=(x)
70 #define POP64() ({ uint32_t __b=POP(); ((uint64_t)POP()<<32)|__b; })
71 #define PUSHPOP(op,val) do { int32_t __a=val; AAA op##= (__a); } while(0)
72
73 #define RB(off) st20_rbyte(ctx, off)
74 #define RW(off) st20_rword(ctx, off)
75 #define WW(off,val) st20_wword(ctx, off, val)
76
77 static uint32_t st20_get_reg(st20_context_t *ctx, int32_t reg)
78 {
79 switch(reg)
80 {
81 case IPTR: return ctx->Iptr;
82 case WPTR: return ctx->Wptr;
83 case AREG: return AAA;
84 case BREG: return BBB;
85 case CREG: return CCC;
86 }
87 return 0;
88 }
89
90 static void st20_set_reg(st20_context_t *ctx, int32_t reg, uint32_t val)
91 {
92 switch(reg)
93 {
94 case IPTR: ctx->Iptr = val; return;
95 case WPTR: ctx->Wptr = val; return;
96 case AREG: AAA=val; return;
97 case BREG: BBB=val; return;
98 case CREG: CCC=val; return;
99 }
100 }
101
102 static uint8_t *st20_addr(st20_context_t *ctx, uint32_t off)
103 {
104 if(off >= FLASHS && off <= FLASHE)
105 {
106 return &ctx->flash[off - FLASHS];
107 }
108 else if(off >= RAMS && off <= RAME)
109 {
110 return &ctx->ram[off - RAMS];
111 }
112 else if(off >= IRAMS && off <= IRAME)
113 {
114 return &ctx->iram[off - IRAMS];
115 }
116
117 ctx->invalid = ERRORVAL;
118 return (uint8_t *) &ctx->invalid;
119 }
120
121 static uint32_t st20_rword(st20_context_t *ctx, uint32_t off)
122 {
123 uint8_t *temp;
124 temp = st20_addr(ctx, off);
125
126 return ((temp[3] << 24) | (temp[2] << 16) | (temp[1] << 8) | temp[0]);
127 }
128
129 static uint16_t st20_rshort(st20_context_t *ctx, uint32_t off)
130 {
131 uint8_t *temp;
132 temp = st20_addr(ctx, off);
133
134 return ((temp[0] << 8) | temp[1]);
135 }
136
137 static uint8_t st20_rbyte(st20_context_t *ctx, uint32_t off)
138 {
139 return *st20_addr(ctx, off);
140 }
141
142 static void st20_wword(st20_context_t *ctx, uint32_t off, uint32_t val)
143 {
144 uint8_t *temp;
145 temp = st20_addr(ctx, off);
146 temp[3] = (val >> 24) & 0xFF;
147 temp[2] = (val >> 16) & 0xFF;
148 temp[1] = (val >> 8) & 0xFF;
149 temp[0] = val & 0xFF;
150 }
151
152 static void st20_wbyte(st20_context_t *ctx, uint32_t off, uint8_t val)
153 {
154 uint8_t *temp;
155 temp = st20_addr(ctx, off);
156 temp[0] = val;
157 }
158
159 static int32_t st20_decode(st20_context_t *ctx, int32_t count)
160 {
161 int32_t operand = 0;
162 CLEAR_OP();
163
164 while(ctx->Iptr != 0)
165 {
166 int32_t a, op1 = RB(ctx->Iptr++);
167 GET_OP();
168
169 switch(op1 >> 4)
170 {
171 case 0x0: // j / jump
172 JUMP(operand);
173 CLEAR_OP();
174 break;
175
176 case 0x1: // ldlp
177 PUSH(ctx->Wptr + (operand * 4));
178 CLEAR_OP();
179 break;
180
181 case 0x2: // positive prefix
182 operand <<= 4;
183 break;
184
185 case 0x3: // ldnl
186 AAA=RW(AAA + (operand * 4));
187 CLEAR_OP();
188 break;
189
190 case 0x4: // ldc
191 PUSH(operand);
192 CLEAR_OP();
193 break;
194
195 case 0x5: // ldnlp
196 PUSHPOP(+, operand * 4);
197 CLEAR_OP();
198 break;
199
200 case 0x6: // negative prefix
201 operand = (~operand) << 4;
202 break;
203
204 case 0x7: // ldl
205 PUSH(RW(ctx->Wptr + (operand * 4)));
206 CLEAR_OP();
207 break;
208
209 case 0x8: // adc
210 PUSHPOP(+, operand);
211 CLEAR_OP();
212 break;
213
214 case 0x9: // call
215 ctx->Wptr -= 16;
216 WW(ctx->Wptr, ctx->Iptr); WW(ctx->Wptr + 4, POP()); WW(ctx->Wptr + 8, POP()); WW(ctx->Wptr + 12, POP());
217 PUSH(ctx->Iptr);
218 JUMP(operand);
219 CLEAR_OP();
220 break;
221
222 case 0xA: // cj / conditional jump
223 if(AAA) { DROP(1); } else { JUMP(operand); }
224 CLEAR_OP();
225 break;
226
227 case 0xB: // ajw / adjust workspace
228 ctx->Wptr += operand * 4;
229 CLEAR_OP();
230 break;
231
232 case 0xC: // eqc / equals constant
233 AAA = (operand == AAA ? 1 : 0);
234 CLEAR_OP();
235 break;
236
237 case 0xD: // stl
238 WW(ctx->Wptr + (operand * 4), POP());
239 CLEAR_OP();
240 break;
241
242 case 0xE: // stnl
243 a = POP(); WW(a + (operand * 4), POP());
244 CLEAR_OP();
245 break;
246
247 case 0xF: // opr (secondary ins)
248 switch(operand)
249 {
250 case 0x00: a = AAA; AAA = BBB; BBB = a; break;
251 case 0x01: AAA = RB(AAA); break;
252 case 0x02: PUSHPOP(+, POP()); break;
253 case 0x04: PUSHPOP(-, POP()); break;
254 case 0x05: PUSHPOP(+, POP()); break;
255 case 0x06: a = AAA; AAA = ctx->Iptr; ctx->Iptr = a; break;
256 case 0x08: PUSHPOP(*, POP()); break;
257 case 0x09: a=POP(); AAA = (AAA > a); break;
258 case 0x0A: a=POP(); AAA = a + (AAA * 4); break;
259 case 0x0C: PUSHPOP(-, POP()); break;
260 case 0x1A: { a = POP(); uint64_t ll = POP64(); PUSH(ll % (uint32_t)a); PUSH(ll / (uint32_t)a); } break;
261 case 0x1B: PUSHPOP(+, ctx->Iptr); break;
262 case 0x1D: CCC = BBB; BBB = (AAA >= 0 ? 0 : -1); break;
263 case 0x1F: PUSHPOP(%, POP()); break;
264 case 0x20: ctx->Iptr = RW(ctx->Wptr); ctx->Wptr = ctx->Wptr + 16; break;
265 case 0x2C: PUSHPOP(/, POP()); break;
266 case 0x30: break;
267 case 0x32: AAA =~ AAA; break;
268 case 0x33: PUSHPOP(^, POP()); break;
269 case 0x34: PUSHPOP(*, 4); break;
270 case 0x35: { a = POP(); uint64_t ll = POP64() >> a; PUSH((ll >> 32) & 0xFFFFFFFF); PUSH(ll & 0xFFFFFFFF); } break;
271 case 0x36: { a = POP(); uint64_t ll = POP64() << a; PUSH((ll >> 32) & 0xFFFFFFFF); PUSH(ll & 0xFFFFFFFF); } break;
272 case 0x3B: a = POP(); st20_wbyte(ctx, a, POP()); break;
273 case 0x3F: a = POP(); PUSH(a & 3); PUSH((uint32_t)a >> 2); break;
274 case 0x40: a = POP(); AAA = (uint32_t)AAA >> a; break;
275 case 0x41: a = POP(); AAA = (uint32_t)AAA << a; break;
276 case 0x42: PUSH(MOSTNEG); break;
277 case 0x46: PUSHPOP(&, POP()); break;
278 case 0x4A: { a = POP(); int32_t b = POP(); int32_t c = POP(); while(a--) st20_wbyte(ctx, b++, st20_rbyte(ctx, c++)); } break;
279 case 0x4B: PUSHPOP(|, POP()); break;
280 case 0x53: PUSHPOP(*, POP()); break;
281 case 0x5A: PUSH(AAA); break;
282 case 0x5F: a = POP(); AAA = ((uint32_t)AAA > (uint32_t)a); break;
283 case 0x78: { a = POP(); int32_t b = POP(); int32_t bb = 0; while(a--){bb <<= 1; bb |= b & 1; b >>= 1;} PUSH(bb);} break;
284 case 0xCA: AAA = st20_rshort(ctx, AAA); break;
285 default:
286 cs_log("[icg] unknown opcode %X", operand);
287 return ERR_ILL_OP;
288 }
289 CLEAR_OP();
290 break;
291 }
292
293 if(--count <= 0 && operand == 0)
294 {
295 return ERR_CNT;
296 }
297 }
298 return 0;
299 }
300
301 static bool st20_set_flash(st20_context_t *ctx, uint8_t *m, uint32_t len)
302 {
303 if (len)
304 {
305 ctx->flash = (uint8_t *)malloc(len);
306 ctx->flashSize = len;
307 }
308 else
309 {
310 cs_log("ERROR len!");
311 ctx->flashSize = 0;
312 return false;
313 }
314
315 if (ctx->flash == NULL)
316 {
317 cs_log("ERROR, malloc!");
318 ctx->flashSize = 0;
319 return false;
320 }
321 else
322 {
323 if(m == NULL)
324 {
325 memset(ctx->flash, 0, len);
326 }
327 else
328 {
329 memcpy(ctx->flash, m, len);
330 }
331 }
332
333 return true;
334 }
335
336 static bool st20_set_ram(st20_context_t *ctx, uint8_t *m, uint32_t len)
337 {
338 if (len)
339 {
340 ctx->ram = (uint8_t *)malloc(len);
341 ctx->ramSize = len;
342 }
343 else
344 {
345 cs_log("ERROR len!");
346 ctx->ramSize = 0;
347 return false;
348 }
349
350 if (ctx->ram == NULL)
351 {
352 cs_log("ERROR, malloc!");
353 ctx->ramSize = 0;
354 return false;
355 }
356 else
357 {
358 if(m == NULL)
359 {
360 memset(ctx->ram, 0, len);
361 }
362 else
363 {
364 memcpy(ctx->ram, m, len);
365 }
366 }
367
368 return true;
369 }
370
371 static void st20_init(st20_context_t *ctx, uint32_t IPtr, uint32_t WPtr, int32_t verbose)
372 {
373 ctx->Wptr = WPtr;
374 ctx->Iptr = IPtr;
375 memset(ctx->stack, INVALID_VALUE, sizeof(ctx->stack));
376 ctx->sptr = STACKMAX - 3;
377 memset(ctx->iram, 0, sizeof(ctx->iram));
378 ctx->verbose = verbose;
379 }
380
381 static void st20_free(st20_context_t *ctx)
382 {
383 if(ctx->flashSize)
384 {
385 free(ctx->flash);
386 ctx->flashSize = 0;
387 }
388 ctx->flash = NULL;
389
390 if(ctx->ramSize)
391 {
392 free(ctx->ram);
393 ctx->ramSize = 0;
394 }
395 ctx->ram = NULL;
396 }
397
398 static void st20_set_call_frame(st20_context_t *ctx, uint32_t raddr, int32_t p1, int32_t p2, int32_t p3)
399 {
400 ctx->Wptr -= 16;
401 st20_wword(ctx, ctx->Wptr, raddr); // RET
402 st20_wword(ctx, ctx->Wptr + 4, p1); // Areg
403 st20_wword(ctx, ctx->Wptr + 8, p1); // Breg
404 st20_wword(ctx, ctx->Wptr + 12, p1); // Creg
405 st20_wword(ctx, ctx->Wptr + 16, p2);
406 st20_wword(ctx, ctx->Wptr + 20, p3);
407 st20_set_reg(ctx, AREG, raddr); // RET
408 }
409
410 int st20_run(uint8_t* snip, uint32_t snip_len, int addr, uint8_t *data, uint16_t overcryptId)
411 {
412 int error = 0, i, n;
413 st20_context_t ctx;
414
415 cs_log("[icg] decrypt address = 0x%X, id = %04X", addr, overcryptId);
416
417 cs_log("[icg] CW: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X ",
418 data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7],
419 data[8], data[9], data[10], data[11], data[12], data[13], data[14], data[15]);
420
421 for(n = 0; n < 2; n++)
422 {
423 memset(&ctx, 0, sizeof(st20_context_t));
424 if (!st20_set_ram(&ctx, 0, 0x1000))
425 {
426 error = RAM_ERR;
427 break;
428 }
429 if (!st20_set_flash(&ctx, snip + 0x48, (int) (snip_len - 0x48)))
430 {
431 error = FLA_ERR;
432 break;
433 }
434 st20_init(&ctx, FLASHS + addr, RAMS + 0x100, 1);
435 st20_set_call_frame(&ctx, 0, RAMS, RAMS, RAMS);
436
437 for(i = 0; i < 8; i++)
438 {
439 st20_wbyte(&ctx, RAMS + i, data[i + n * 8]);
440 }
441
442 if((error = st20_decode(&ctx, 800000)) < 0)
443 {
444 break;
445 }
446
447 cs_log("[icg] cw%d ret = %d, AREG = %X", n + 1, error, st20_get_reg(&ctx, AREG));
448
449 for(i = 0; i < 8; i++)
450 {
451 data[i + n * 8] = st20_rbyte(&ctx, RAMS + i);
452 }
453 st20_free(&ctx);
454 }
455
456 if(error < 0)
457 {
458 //in error case ensure free ctx!
459 st20_free(&ctx);
460
461 cs_log("[icg] st20 processing failed with error %d", error);
462 return 0;
463 }
464
465 cs_log("[icg] DW: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X ",
466 data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7],
467 data[8], data[9], data[10], data[11], data[12], data[13], data[14], data[15]);
468 return 1;
469 }
Open Source Conditional Access Modul