2 #include "reader-dre-st20.h"
10 #define FLASHS 0x7FE00000
11 #define FLASHE 0x7FFFFFFF
12 #define RAMS 0x40000000
13 #define RAME 0x401FFFFF
14 #define IRAMS 0x80000000
15 #define IRAME 0x800017FF
20 // ----------------------------------------------------------------
23 #define STACKMASK (STACKMAX-1)
29 uint32_t flashSize
, ramSize
;
30 int sptr
, stack
[STACKMAX
];
36 static void st20_set_flash(st20_context_t
*ctx
, uint8_t *m
, int len
);
37 static void st20_set_ram(st20_context_t
*ctx
, uint8_t *m
, int len
);
38 static void st20_init(st20_context_t
*ctx
, uint32_t IPtr
, uint32_t WPtr
, int verbose
);
39 static void st20_free(st20_context_t
*ctx
);
41 static void st20_set_call_frame(st20_context_t
*ctx
, uint32_t raddr
, int p1
, int p2
, int p3
);
43 static uint32_t st20_get_reg(st20_context_t
*ctx
, int reg
);
44 static void st20_set_reg(st20_context_t
*ctx
, int reg
, uint32_t val
);
45 static uint8_t st20_rbyte(st20_context_t
*ctx
, uint32_t off
);
46 static void st20_wbyte(st20_context_t
*ctx
, uint32_t off
, uint8_t val
);
47 static uint32_t st20_rword(st20_context_t
*ctx
, uint32_t off
);
48 static void st20_wword(st20_context_t
*ctx
, uint32_t off
, uint32_t val
);
50 #define INVALID_VALUE 0xCCCCCCCC
51 #define ERRORVAL 0xDEADBEEF
53 #define MININT 0x7FFFFFFF
54 #define MOSTPOS 0x7FFFFFFF
55 #define MOSTNEG 0x80000000
57 #define POP() ctx->stack[(ctx->sptr++)&STACKMASK]
58 #define PUSH(v) do { int32_t __v=(v); ctx->stack[(--ctx->sptr)&STACKMASK]=__v; } while(0)
59 #define DROP(n) ctx->sptr+=n
61 #define AAA ctx->stack[ctx->sptr&STACKMASK]
62 #define BBB ctx->stack[(ctx->sptr+1)&STACKMASK]
63 #define CCC ctx->stack[(ctx->sptr+2)&STACKMASK]
65 #define GET_OP() operand|=op1&0x0F
66 #define CLEAR_OP() operand=0
67 #define JUMP(x) ctx->Iptr+=(x)
68 #define POP64() ({ uint32_t __b=POP(); ((uint64_t)POP()<<32)|__b; })
69 #define PUSHPOP(op,val) do { int32_t __a=val; AAA op##= (__a); } while(0)
71 #define RB(off) st20_rbyte(ctx, off)
72 #define RW(off) st20_rword(ctx, off)
73 #define WW(off,val) st20_wword(ctx, off, val)
75 static uint32_t st20_get_reg(st20_context_t
*ctx
, int32_t reg
)
79 case IPTR
: return ctx
->Iptr
;
80 case WPTR
: return ctx
->Wptr
;
81 case AREG
: return AAA
;
82 case BREG
: return BBB
;
83 case CREG
: return CCC
;
88 static void st20_set_reg(st20_context_t
*ctx
, int32_t reg
, uint32_t val
)
92 case IPTR
: ctx
->Iptr
= val
; return;
93 case WPTR
: ctx
->Wptr
= val
; return;
94 case AREG
: AAA
=val
; return;
95 case BREG
: BBB
=val
; return;
96 case CREG
: CCC
=val
; return;
100 static uint8_t *st20_addr(st20_context_t
*ctx
, uint32_t off
)
102 if(off
>= FLASHS
&& off
<= FLASHE
)
104 return &ctx
->flash
[off
- FLASHS
];
106 else if(off
>= RAMS
&& off
<= RAME
)
108 return &ctx
->ram
[off
- RAMS
];
110 else if(off
>= IRAMS
&& off
<= IRAME
)
112 return &ctx
->iram
[off
- IRAMS
];
115 ctx
->invalid
= ERRORVAL
;
116 return (uint8_t *) &ctx
->invalid
;
119 static uint32_t st20_rword(st20_context_t
*ctx
, uint32_t off
)
122 temp
= st20_addr(ctx
, off
);
124 return ((temp
[3] << 24) | (temp
[2] << 16) | (temp
[1] << 8) | temp
[0]);
127 static uint16_t st20_rshort(st20_context_t
*ctx
, uint32_t off
)
130 temp
= st20_addr(ctx
, off
);
132 return ((temp
[0] << 8) | temp
[1]);
135 static uint8_t st20_rbyte(st20_context_t
*ctx
, uint32_t off
)
137 return *st20_addr(ctx
, off
);
140 static void st20_wword(st20_context_t
*ctx
, uint32_t off
, uint32_t val
)
143 temp
= st20_addr(ctx
, off
);
144 temp
[3] = (val
>> 24) & 0xFF;
145 temp
[2] = (val
>> 16) & 0xFF;
146 temp
[1] = (val
>> 8) & 0xFF;
147 temp
[0] = val
& 0xFF;
150 static void st20_wbyte(st20_context_t
*ctx
, uint32_t off
, uint8_t val
)
153 temp
= st20_addr(ctx
, off
);
157 static int32_t st20_decode(st20_context_t
*ctx
, int32_t count
)
162 while(ctx
->Iptr
!= 0)
164 int32_t a
, op1
= RB(ctx
->Iptr
++);
169 case 0x0: // j / jump
175 PUSH(ctx
->Wptr
+ (operand
* 4));
179 case 0x2: // positive prefix
184 AAA
=RW(AAA
+ (operand
* 4));
194 PUSHPOP(+, operand
* 4);
198 case 0x6: // negative prefix
199 operand
= (~operand
) << 4;
203 PUSH(RW(ctx
->Wptr
+ (operand
* 4)));
214 WW(ctx
->Wptr
, ctx
->Iptr
); WW(ctx
->Wptr
+ 4, POP()); WW(ctx
->Wptr
+ 8, POP()); WW(ctx
->Wptr
+ 12, POP());
220 case 0xA: // cj / conditional jump
221 if(AAA
) { DROP(1); } else { JUMP(operand
); }
225 case 0xB: // ajw / adjust workspace
226 ctx
->Wptr
+= operand
* 4;
230 case 0xC: // eqc / equals constant
231 AAA
= (operand
== AAA
? 1 : 0);
236 WW(ctx
->Wptr
+ (operand
* 4), POP());
241 a
= POP(); WW(a
+ (operand
* 4), POP());
245 case 0xF: // opr (secondary ins)
248 case 0x00: a
= AAA
; AAA
= BBB
; BBB
= a
; break;
249 case 0x01: AAA
= RB(AAA
); break;
250 case 0x02: PUSHPOP(+, POP()); break;
251 case 0x04: PUSHPOP(-, POP()); break;
252 case 0x05: PUSHPOP(+, POP()); break;
253 case 0x06: a
= AAA
; AAA
= ctx
->Iptr
; ctx
->Iptr
= a
; break;
254 case 0x08: PUSHPOP(*, POP()); break;
255 case 0x09: a
=POP(); AAA
= (AAA
> a
); break;
256 case 0x0A: a
=POP(); AAA
= a
+ (AAA
* 4); break;
257 case 0x0C: PUSHPOP(-, POP()); break;
258 case 0x1A: { a
= POP(); uint64_t ll
= POP64(); PUSH(ll
% (uint32_t)a
); PUSH(ll
/ (uint32_t)a
); } break;
259 case 0x1B: PUSHPOP(+, ctx
->Iptr
); break;
260 case 0x1D: CCC
= BBB
; BBB
= (AAA
>= 0 ? 0 : -1); break;
261 case 0x1F: PUSHPOP(%, POP()); break;
262 case 0x20: ctx
->Iptr
= RW(ctx
->Wptr
); ctx
->Wptr
= ctx
->Wptr
+ 16; break;
263 case 0x2C: PUSHPOP(/, POP()); break;
265 case 0x32: AAA
=~ AAA
; break;
266 case 0x33: PUSHPOP(^, POP()); break;
267 case 0x34: PUSHPOP(*, 4); break;
268 case 0x35: { a
= POP(); uint64_t ll
= POP64() >> a
; PUSH((ll
>> 32) & 0xFFFFFFFF); PUSH(ll
& 0xFFFFFFFF); } break;
269 case 0x36: { a
= POP(); uint64_t ll
= POP64() << a
; PUSH((ll
>> 32) & 0xFFFFFFFF); PUSH(ll
& 0xFFFFFFFF); } break;
270 case 0x3B: a
= POP(); st20_wbyte(ctx
, a
, POP()); break;
271 case 0x3F: a
= POP(); PUSH(a
& 3); PUSH((uint32_t)a
>> 2); break;
272 case 0x40: a
= POP(); AAA
= (uint32_t)AAA
>> a
; break;
273 case 0x41: a
= POP(); AAA
= (uint32_t)AAA
<< a
; break;
274 case 0x42: PUSH(MOSTNEG
); break;
275 case 0x46: PUSHPOP(&, POP()); break;
276 case 0x4A: { a
= POP(); int32_t b
= POP(); int32_t c
= POP(); while(a
--) st20_wbyte(ctx
, b
++, st20_rbyte(ctx
, c
++)); } break;
277 case 0x4B: PUSHPOP(|, POP()); break;
278 case 0x53: PUSHPOP(*, POP()); break;
279 case 0x5A: PUSH(AAA
); break;
280 case 0x5F: a
= POP(); AAA
= ((uint32_t)AAA
> (uint32_t)a
); break;
281 case 0x78: { a
= POP(); int32_t b
= POP(); int32_t bb
= 0; while(a
--){bb
<<= 1; bb
|= b
& 1; b
>>= 1;} PUSH(bb
);} break;
282 case 0xCA: AAA
= st20_rshort(ctx
, AAA
); break;
284 cs_log("[icg] unknown opcode %X", operand
);
291 if(--count
<= 0 && operand
== 0)
299 static void st20_set_flash(st20_context_t
*ctx
, uint8_t *m
, int32_t len
)
305 ctx
->flash
= malloc(len
);
309 memcpy(ctx
->flash
, m
, len
);
313 memset(ctx
->flash
, 0, len
);
315 ctx
->flashSize
= len
;
318 static void st20_set_ram(st20_context_t
*ctx
, uint8_t *m
, int32_t len
)
324 ctx
->ram
= malloc(len
);
328 memcpy(ctx
->ram
, m
, len
);
332 memset(ctx
->ram
, 0, len
);
337 static void st20_init(st20_context_t
*ctx
, uint32_t IPtr
, uint32_t WPtr
, int32_t verbose
)
341 memset(ctx
->stack
, INVALID_VALUE
, sizeof(ctx
->stack
));
342 ctx
->sptr
= STACKMAX
- 3;
343 memset(ctx
->iram
, 0, sizeof(ctx
->iram
));
344 ctx
->verbose
= verbose
;
347 static void st20_free(st20_context_t
*ctx
)
362 static void st20_set_call_frame(st20_context_t
*ctx
, uint32_t raddr
, int32_t p1
, int32_t p2
, int32_t p3
)
365 st20_wword(ctx
, ctx
->Wptr
, raddr
); // RET
366 st20_wword(ctx
, ctx
->Wptr
+ 4, p1
); // Areg
367 st20_wword(ctx
, ctx
->Wptr
+ 8, p1
); // Breg
368 st20_wword(ctx
, ctx
->Wptr
+ 12, p1
); // Creg
369 st20_wword(ctx
, ctx
->Wptr
+ 16, p2
);
370 st20_wword(ctx
, ctx
->Wptr
+ 20, p3
);
371 st20_set_reg(ctx
, AREG
, raddr
); // RET
374 int st20_run(uint8_t* snip
, uint32_t snip_len
, int addr
, uint8_t *data
, uint16_t overcryptId
)
379 cs_log("[icg] decrypt address = 0x%X, id = %04X", addr
, overcryptId
);
381 cs_log("[icg] CW: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X ",
382 data
[0], data
[1], data
[2], data
[3], data
[4], data
[5], data
[6], data
[7],
383 data
[8], data
[9], data
[10], data
[11], data
[12], data
[13], data
[14], data
[15]);
385 for(n
= 0; n
< 2; n
++)
387 memset(&ctx
, 0, sizeof(st20_context_t
));
388 st20_set_ram(&ctx
, NULL
, 0x1000);
389 st20_set_flash(&ctx
, snip
+ 0x48, (int) (snip_len
- 0x48));
390 st20_init(&ctx
, FLASHS
+ addr
, RAMS
+ 0x100, 1);
391 st20_set_call_frame(&ctx
, 0, RAMS
, RAMS
, RAMS
);
393 for(i
= 0; i
< 8; i
++)
395 st20_wbyte(&ctx
, RAMS
+ i
, data
[i
+ n
* 8]);
398 if((error
= st20_decode(&ctx
, 800000)) < 0)
403 cs_log("[icg] cw%d ret = %d, AREG = %X", n
+ 1, error
, st20_get_reg(&ctx
, AREG
));
405 for(i
= 0; i
< 8; i
++)
407 data
[i
+ n
* 8] = st20_rbyte(&ctx
, RAMS
+ i
);
414 cs_log("[icg] st20 processing failed with error %d", error
);
418 cs_log("[icg] DW: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X ",
419 data
[0], data
[1], data
[2], data
[3], data
[4], data
[5], data
[6], data
[7],
420 data
[8], data
[9], data
[10], data
[11], data
[12], data
[13], data
[14], data
[15]);