Skip to content

Instantly share code, notes, and snippets.

@hexkyz hexkyz/tx_vmdis.py
Last active Sep 28, 2019

Embed
What would you like to do?
###########################################################
# TX SX OS MIPS VM disassembler - by hexkyz and naehrwert #
###########################################################
import os
import re
import struct
host_calls_0 = {
0x8E943DA2 : "host_crc32 (ptr r4r5, len r6)",
0xD4AC6D16 : "host_expmod (dst r4, mod r5, exp r6, exp_size r7)",
0x87205A64 : "host_read_u64 (r2r3 = *r4r5)",
0x5BECE776 : "host_aes_set_key (ptr r4)",
0xC58ACD13 : "host_call_function (ptr r4, arg r5)",
0xBA4FC26A : "host_memcmp (ptr1 r4r5, ptr2 r6r7, len stk4)",
0xFD859C9C : "host_data_cache_civac (ptr r4, len r5)",
0x6445C898 : "host_write_u64 (*r4r5 = r6r7)",
0x308EBEA4 : "host_get_ipc_result",
0xA4345EDA : "host_memmove (ptr1 r4, ptr2 r5, len r6)",
0xFB198D4C : "host_aes_enc_cbc",
0x93F23757 : "host_rsa_oaep",
0xB68EA896 : "host_aes_dec_cbc",
0x46915487 : "host_aes_ctr",
0x5045611F : "host_sha2 (ptr r4, len r5, dst ptr r6r7)",
0x2E3DB2AB : "host_vm_memcpy (dst r4, src r5, size r6)",
0x8CC2D88C : "host_sha2_hmac",
0x9D104BEC : "host_get_license_buf",
0x42D35BC8 : "host_get_field_98",
0x4F56CFC3 : "host_vm_get_ptr",
0x24083A54 : "host_parse_ipc_cmd",
0x37646C3F : "host_vm_memcmp",
0x418B8052 : "host_memcpy",
0xC2A24132 : "host_memcpy",
0x80A67D6D : "host_vm_memset",
0x680419E7 : "host_read_u32",
0x9D063E97 : "host_read_u8",
0x9BE8BFCA : "host_fat_open_file",
0x66E9BFF7 : "host_ipc_handle",
0x5CC2894D : "host_svcSendSyncRequest",
0x63F3D563 : "host_connect_to_service",
0x2F365F20 : "host_search_pattern",
0x70757343 : "host_write_u32",
0xE02CE3F9 : "host_memset",
}
host_calls_1 = {
0x9B40C841 : "host_crc32 (ptr r4r5, len r6)",
0xC8B077C8 : "host_expmod (dst r4, mod r5, exp r6, exp_size r7)",
0x921495FE : "host_read_u64 (r2r3 = *r4r5)",
0x5A6641E2 : "host_aes_set_key (ptr r4)",
0xC58ACD13 : "host_call_function (ptr r4, arg r5)",
0xB0BCD374 : "host_memcmp (ptr1 r4r5, ptr2 r6r7, len stk4)",
0xFD859C9C : "host_data_cache_civac (ptr r4, len r5)",
0x6F946C26 : "host_write_u64 (*r4r5 = r6r7)",
0x1ACB4B1B : "host_get_ipc_result",
0xA4345EDA : "host_memmove (ptr1 r4, ptr2 r5, len r6)",
0xF243B10F : "host_aes_enc_cbc",
0x9D39D484 : "host_rsa_oaep",
0xB08249FB : "host_aes_dec_cbc",
0x44AAA3FC : "host_aes_ctr",
0x4BE3D010 : "host_sha2 (ptr r4, len r5, dst ptr r6r7)",
0x0B7944DC : "host_vm_memcpy (dst r4, src r5, size r6)",
0x93217280 : "host_sha2_hmac",
0xAA840564 : "host_get_license_buf",
0x3766570A : "host_get_field_98",
0x45872313 : "host_vm_get_ptr",
0x001A6147 : "host_parse_ipc_cmd",
0x28DA2760 : "host_vm_memcmp",
0x370C4363 : "host_memcpy",
0xB66C364C : "host_memcpy",
0x8CFF0E3B : "host_vm_memset",
0x74ADB312 : "host_read_u32",
0xA9A17504 : "host_read_u8",
0xA049A7D6 : "host_fat_open_file",
0x70B8F5BF : "host_ipc_handle",
0x686E04E0 : "host_svcSendSyncRequest",
0x6C803A13 : "host_connect_to_service",
0x1205F934 : "host_search_pattern",
0x85DFF35C : "host_write_u32",
0xCC8A94A1 : "host_memset",
}
xor_block = re.sub(r"\W", "", """
F0 A4 46 B0 C6 B1 9A E0 81 83 F8 0A 0A CE B3 4A
56 57 BF 88 81 1E 7D 7A 0C D1 AE B4 C1 58 A3 B3
64 BE 39 BC F1 72 2E 7E 66 12 6B D2 8C 69 04 3A
CB 84 52 FB F1 AC 98 F0 94 92 6F E9 BD 83 E6 7E
51 12 55 A5 4B B2 73 39 55 BB 96 A5 B8 0B FD 49
42 33 5F 61 8D 16 2D B9 57 26 21 A0 23 C3 D0 B6
59 51 6A 5E BD A8 3C 77 1B DB CE D2 C5 ED 36 C1
2D B9 68 3F 44 BC FB 70 88 7D 74 F2 9E 70 4E FF
F3 19 72 9E 32 06 91 BF D9 42 47 EE 1C 3B B8 D9
BB CF 0C C7 29 EC F2 A3 E2 46 6B EC 68 41 4C DA
2C 9D 05 02 F0 6D F8 24 41 7E 5E B6 78 37 18 95
1D EB FB 27 8F 34 A1 B1 7D 3B C8 87 51 E7 D0 BB
68 09 D2 8F 42 38 D1 01 81 93 CB 0E 7D 1B ED B8
0A 0E 58 CF D9 FC 3E C6 0D 6A F5 41 DC 7D C7 11
BD D5 B3 88 02 8D 74 87 A2 FD 2C 52 20 B5 8B D5
D2 41 BF 36 5E 5F C4 85 90 37 9E 7F 67 CA 87 10
""").decode("hex")
rnam = [
"$zero",
"$at",
"$v0", "$v1",
"$a0", "$a1", "$a2", "$a3",
"$t0", "$t1", "$t2", "$t3", "$t4", "$t5", "$t6", "$t7",
"$s0", "$s1", "$s2", "$s3", "$s4", "$s5", "$s6", "$s7",
"$t8", "$t9",
"$k0", "$k1",
"$gp",
"$sp",
"$fp",
"$ra",
]
def vm_get_instr(p, i):
xi = (i & 0xFF)
x = struct.unpack("I", xor_block[xi : xi + 4])[0]
y = struct.unpack("I", p[i : i + 4])[0]
return x ^ y
def str_simm16(imm):
return "{0}0x{1:X}".format("-" if imm < 0 else "", -imm if imm < 0 else imm)
def decode_simm16(imm):
return -(0xFFFF - imm + 1) if imm & 0x8000 else imm
def vm_dis(p, version):
jal_targ = []
b_targ = []
lis_val = [-1] * 32
lines = [[""] for i in xrange(0, len(p), 4)]
for i in xrange(0, len(p), 4):
lines[i/4].append("{0:04X}\t\t".format(i))
inst = vm_get_instr(p, i)
op = inst >> 26
if ((version == 0) and (op == 53)) \
or ((version == 1) and (op == 20)):
reg = (inst >> 21) & 0x1F
off = inst & 0xFFFF
lines[i/4].append("bgz {0}, loc_{1:X}".format(rnam[reg], i + 4 * off))
b_targ.append(i + 4 * off)
elif ((version == 0) and (op == 15)) \
or ((version == 1) and (op == 34)):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("ld.32 {0}, [{1} + {2}]".format(rnam[dst_reg], rnam[src_reg], str_simm16(off)))
elif ((version == 0) and (op == 56)) \
or ((version == 1) and (op == 26)):
reg1 = (inst >> 16) & 0x1F
reg2 = (inst >> 21) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("beq {0}, {1}, loc_{2:X}".format(rnam[reg1], rnam[reg2], i + 4 * off))
b_targ.append(i + 4 * off)
elif ((version == 0) and (op == 28)) \
or ((version == 1) and (op == 57)):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
imm = decode_simm16(inst & 0xFFFF)
lines[i/4].append("addi {0}, {1}, {2}".format(rnam[dst_reg], rnam[src_reg], str_simm16(imm)))
elif ((version == 0) and (op == 1 or op == 49)) \
or ((version == 1) and ((op == 6) or (op == 14))):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("ld.8 {0}, [{1} + {2}]".format(rnam[dst_reg], rnam[src_reg], str_simm16(off)))
elif ((version == 0) and (op == 20)) \
or ((version == 1) and (op == 0)):
imm = 4 * (inst & 0x3FFFFFF)
lines[i/4].append("j loc_{0:X}".format(imm))
b_targ.append(imm)
elif ((version == 0) and (op == 23)) \
or ((version == 1) and (op == 4)):
dst_reg = (inst >> 16) & 0x1F
imm = (inst << 16) & 0xFFFF0000
lines[i/4].append("lis {0}, 0x{1:X}".format(rnam[dst_reg], imm >> 16))
lis_val[dst_reg] = imm
elif ((version == 0) and (op == 21)) \
or ((version == 1) and (op == 37)):
reg1 = (inst >> 16) & 0x1F
reg2 = (inst >> 21) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("beq {0}, {1}, loc_{2:X}".format(rnam[reg1], rnam[reg2], i + 4 * off))
b_targ.append(i + 4 * off)
elif ((version == 0) and (op == 10)) \
or ((version == 1) and (op == 31)):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
lines[i/4].append("unk {0}, {1}, {2:X}, {3:X}, {4:X}".format(rnam[dst_reg], rnam[src_reg], inst & 0x7FF, ((inst >> 6) & 0x1F), (inst & 0xFFFF) >> 11))
elif ((version == 0) and (op == 24)) \
or ((version == 1) and (op == 56)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("mul {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (op == 51)) \
or ((version == 1) and (op == 47)):
dst_reg = (inst >> 21) & 0x1F
src_reg = (inst >> 16) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("st.8 [{0} + {1}], {2}".format(rnam[dst_reg], str_simm16(off), rnam[src_reg]))
elif ((version == 0) and ((op == 26) or (op == 35))) \
or ((version == 1) and ((op == 24) or (op == 35))):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
imm = inst & 0xFFFF
lines[i/4].append("sltiu {0}, {1}, 0x{2:X}".format(rnam[dst_reg], rnam[src_reg], imm))
elif ((version == 0) and (op == 17)) \
or ((version == 1) and (op == 60)):
imm = 4 * (inst & 0x3FFFFFF)
lines[i/4].append("jal sub_{0:X}".format(imm))
jal_targ.append(imm)
elif ((version == 0) and (op == 37)) \
or ((version == 1) and (op == 1)):
reg1 = (inst >> 16) & 0x1F
reg2 = (inst >> 21) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("bne {0}, {1}, loc_{2:X}".format(rnam[reg1], rnam[reg2], i + 4 * off))
b_targ.append(i + 4 * off)
elif ((version == 0) and (op == 4)) \
or ((version == 1) and (op == 63)):
reg1 = (inst >> 16) & 0x1F
reg2 = (inst >> 21) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("bneq {0}, {1}, loc_{2:X}".format(rnam[reg1], rnam[reg2], i + 4 * off))
b_targ.append(i + 4 * off)
elif ((version == 0) and (op == 39)) \
or ((version == 1) and (op == 30)):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
imm = inst & 0xFFFF
lines[i/4].append("ori {0}, {1}, 0x{2:X}".format(rnam[dst_reg], rnam[src_reg], imm))
if dst_reg == src_reg and lis_val[dst_reg] != -1:
val = lis_val[dst_reg] | imm
lis_val[dst_reg] = -1
lines[i/4].append("; = 0x{0:X}".format(val))
if dst_reg == 2:
if ((version == 0) and (val in host_calls_0)):
lines[i/4].append(" - {0}".format(host_calls_0[val]))
elif ((version == 1) and (val in host_calls_1)):
lines[i/4].append(" - {0}".format(host_calls_1[val]))
else:
lines[i/4].append(" - UNK")
elif ((version == 0) and (op == 32)) \
or ((version == 1) and (op == 51)):
dst_reg = (inst >> 21) & 0x1F
src_reg = (inst >> 16) & 0x1F
off = decode_simm16(inst & 0xFFFF)
lines[i/4].append("st.32 [{0} + {1}], {2}".format(rnam[dst_reg], str_simm16(off), rnam[src_reg]))
elif ((version == 0) and (op == 29)) \
or ((version == 1) and (op == 61)):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
imm = inst & 0xFFFF
lines[i/4].append("xori {0}, {1}, 0x{2:X}".format(rnam[dst_reg], rnam[src_reg], imm))
elif ((version == 1) and (op == 21)):
dst_reg = (inst >> 16) & 0x1F
src_reg = (inst >> 21) & 0x1F
imm = inst & 0xFFFF
lines[i/4].append("andi {0}, {1}, 0x{2:X}".format(rnam[dst_reg], rnam[src_reg], imm))
elif ((version == 0) and (op == 18)) \
or ((version == 1) and (op == 3)):
sop = inst & 0x3F
if ((version == 0) and (sop == 12)) \
or ((version == 1) and (sop == 15)):
dst_reg = (inst >> 11) & 0x1F
src_reg = (inst >> 16) & 0x1F
imm = (inst >> 6) & 0x1F
lines[i/4].append("shr {0}, {1}, 0x{2:X}".format(rnam[dst_reg], rnam[src_reg], imm))
elif ((version == 0) and (sop == 48)) \
or ((version == 1) and (sop == 20)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("ashr {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 52)) \
or ((version == 1) and (sop == 6)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("shr {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 53)) \
or ((version == 1) and (sop == 23)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("sub {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 7)) \
or ((version == 1) and (sop == 0)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("xor {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 63)) \
or ((version == 1) and (sop == 3)):
reg = (inst >> 21) & 0x1F
lines[i/4].append("jr {0}".format(rnam[reg]))
elif ((version == 0) and (sop == 62)) \
or ((version == 1) and (sop == 37)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("and {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 6)) \
or ((version == 1) and (sop == 55)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("add {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 30)) \
or ((version == 1) and (sop == 12)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("nor {0}, ~{1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 14)) \
or ((version == 1) and (sop == 52)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("cmov.nz {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 27)) \
or ((version == 1) and (sop == 24)):
dst_reg = (inst >> 11) & 0x1F
src_reg = (inst >> 16) & 0x1F
imm = (inst >> 6) & 0x1F
if (dst_reg == 0) and (src_reg == 0) and (imm == 0):
lines[i/4].append("nop")
else:
lines[i/4].append("shl {0}, {1}, 0x{2:X}".format(rnam[dst_reg], rnam[src_reg], imm))
elif ((version == 0) and (sop == 49)) \
or ((version == 1) and (sop == 40)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("shl {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 3)) \
or ((version == 1) and (sop == 14)):
dst_reg = (inst >> 11) & 0x1F
src_reg = (inst >> 21) & 0x1F
lines[i/4].append("brx {0}, {1}".format(rnam[dst_reg], rnam[src_reg]))
elif ((version == 0) and (sop == 33)) \
or ((version == 1) and (sop == 18)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("or {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 43)) \
or ((version == 1) and (sop == 11)):
dst_reg = (inst >> 11) & 0x1F
src1_reg = (inst >> 21) & 0x1F
src2_reg = (inst >> 16) & 0x1F
lines[i/4].append("slt {0}, {1}, {2}".format(rnam[dst_reg], rnam[src1_reg], rnam[src2_reg]))
elif ((version == 0) and (sop == 1)) \
or ((version == 1) and (sop == 36)):
lines[i/4].append("host_call")
else:
lines[i/4].append("extended op 0x{0:X}".format(sop))
else:
lines[i/4].append("unknown op 0x{0:X}".format(op))
for i in xrange(0, len(p), 4):
if i in jal_targ:
lines[i/4] = ["\n;------- subroutine -------\nsub_{0:X}:\n".format(i)] + lines[i/4]
elif i in b_targ:
lines[i/4] = ["\nloc_{0:X}:\n".format(i)] + lines[i/4]
return lines
# Open main file
f = open("boot.dat", "rb")
b = f.read()
f.close()
# Extract the version
boot_ver = struct.unpack("II", b[0x08:0x10])
# Only support the most relevant versions
if boot_ver[1] == 0x342E3156: # TX BOOT V1.4
vm_off = 0x4E470
vm_size = 0x194C
vm_version = 0
elif (boot_ver[1] == 0) and (boot_ver[0] == 0x392E3256): # TX BOOT V2.9
vm_off = 0xA45C8
vm_size = 0x1ED4
vm_version = 1
else:
exit()
# Enter the Loader KIP's directory
if os.path.exists("./sxos/firmware/Loader/"):
os.chdir("./sxos/firmware/Loader/")
else:
exit()
# Open and read the extracted Loader binary
f = open("Loader.bin", "rb")
v = f.read()
f.close()
# Locate and disassemble the MIPS VM
f = open("Loader_VM.asm", "w")
lines = vm_dis(v[vm_off:vm_off+vm_size], vm_version)
for l in lines:
f.write("%s\n" % "".join(l));
f.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.