Skip to content

Instantly share code, notes, and snippets.

@ashquarky
Last active September 23, 2016 23:57
Show Gist options
  • Save ashquarky/1c56f020eb28d77f4323d09f34034ef1 to your computer and use it in GitHub Desktop.
Save ashquarky/1c56f020eb28d77f4323d09f34034ef1 to your computer and use it in GitHub Desktop.
Reverse-engineering of the important bits of MasterAgent_ProcessPacket. By important, I mean gdb_query and *nothing else*.
struct _globals {
unsigned int isDebuggerPresent;
unsigned short word_100D1378; //referenced in start()
unsigned int dword_100523D8; //referenced in start()
unsigned int tickStorage; //dword_100523D0, also referenced in start()
char* stringStorage; //dword_1004F964
}
struct _globals globals;
typedef struct _MasterAgent_Packet {
unsigned char command;
//This is different depending on which command you pick
//More REing will be needed
//This is weird; it seems that this is a bunch of chars;
//NOT a char* to somewhere else.
//This is a dynamic length; the code can handle strings of other lengths.
char s, u, p, p, o, r, t, e, d, nullchar;
//TODO: re-check pointers, is there actually a nullchar?
//the real memory location of param1 is dynamic, based on the length of the above string
unsigned char param1;
} MasterAgent_Packet;
void MasterAgent_ProcessPacket(MasterAgent_Packet* packet) {
if (packet->command == 0x71) {
gdb_query(packet);
}
}
void gdb_query(MasterAgent_Packet* packet) {
int ret = __gdb_strncmp(packet->s, "Supported", 9);
if (ret != 0) {
//loc_203D9D4
/*
Involves "Attached", "1" and writestring
*/
} else {
if (packet->param1 == 0x3A) {
//loc_203D9C8
/*
Many branches and __gdb_strncmps ensue.
I can take a look if you *really* want...
*/
} else {
//loc_203D80C
globals.isDebuggerPresent = 1;
globals.word_100D1378++;
globals.tickStorage = globals.dword_100523D8 + OSGetSystemTick();
//sub_2039158
globals.stringStorage = 0;
//return
writestring("PacketSize=");
char* buf = 0x100D855C;
AFunctionThatIsProbablySnprintf(buf, 0x64, "%x", 0x800);
writestring(buf);
writestring(";qXfer:libraries:read+");
writestring("COSver=");
AFunctionThatIsProbablySnprintf(buf, 0x64, "%d", 0x5335);
writestring(buf);
SomeSortOfLoggingFunction(0);
}
}
}
//sub_203B6B4
//this doesn't look quite right
void writestring(char* string) {
if (string[0] == 0) {
globals.stringStorage = globals.stringStorage; //yes, really
return;
}
int val = 0;
int i = 0;
while (globals.stringStorage < 0x7FC) {
char* addr = 0x100D0000 | globals.stringStorage;
globals.stringStorage++;
*(addr + 0x6CF4) = string[i];
i++;
if (string[i] == 0) {
break;
}
}
//globals.stringStorage is written to memory down here
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment