narmstrong changed the topic of #linux-amlogic to: Amlogic mainline kernel development discussion - our wiki http://linux-meson.com/ - ml linux-amlogic@lists.infradead.org - official channel moved from Freenode - publicly logged on https://libera.irclog.whitequark.org/linux-amlogic
jacobk has quit [Ping timeout: 250 seconds]
JohnnyonFlame has quit [Ping timeout: 240 seconds]
BlueMatt has quit [Quit: Quit]
BlueMatt has joined #linux-amlogic
jacobk has joined #linux-amlogic
LucasTanure has joined #linux-amlogic
LucasTanure has quit [Client Quit]
camus has quit [Remote host closed the connection]
f_|catgirl has joined #linux-amlogic
<f_|catgirl> Hi all!
<f_|catgirl> Let's continue our reverse-engineering efforts!
Daanct12 has joined #linux-amlogic
Daanct12 has quit [Client Quit]
f_|catgirl is now known as f_
f_ has quit [Quit: f_]
f_|catgirl has joined #linux-amlogic
f_|catgirl is now known as f_
f_ has quit [Quit: disconnecting!!!]
f_|catgirl_ has joined #linux-amlogic
f_|catgirl_ is now known as f_
<f_> I was distracted. Let's do it now.
<exkcnoe[m]> hi f_|catgirl:
<exkcnoe[m]> do u wear programming sock
<f_> ?
<exkcnoe[m]> i am talking a internet culture that u may not understandt
<f_> off-topic?
<f_> And why are you asking me this?
<exkcnoe[m]> joke
<f_> A bit weird tbh
<f_> I just appended '|catgirl' because I'm using catgirl..
<exkcnoe[m]> Ahh
<exkcnoe[m]> AAhhhhhhh
<f_> off-topic though
<exkcnoe[m]> i thoght catgirl is mean other thing
<exkcnoe[m]> yes
tyzef has joined #linux-amlogic
<f_> This time let's not name every function found by Ghidra, but instead name DDR-related ones and try to find which changes they made.
<f_> What they did as far as I can tell is add LPDDR support.
<f_> I'm also adding notes along the way.
<f_> So here's something interesting I found:
<f_> Functions with actual names are renamed by me, and other functions with "FUN_" are kept unnamed.
jpp has joined #linux-amlogic
<f_> Now take a look at the same function (wild guess) in their old sources:
<f_> Quite a difference, right?
<f_> Also I suspect "undefined8" is actually unsigned int.
<f_> Still have to identify what all those FUN_* functions actually do and their proper names..
<f_> But is anyone interested in the Ghidra project files?
<f_> For e.g. helping me and stuff.
<f_> Also forgot to mention, functions suffixed with "_new" are functions that (to my knowledge) didn't exist before and got added after Amlogic's BL2 obfuscation.
<f_> e.g. lpddr_init_new
tyzef has quit [Ping timeout: 246 seconds]
tyzef has joined #linux-amlogic
<f_> I also see lots of `_DAT_<address> = <value>;`, which I suspect to originally have been `wr_reg(<address>, <value>);`
<f_> And since wr_reg is a macro, it expanded, giving us...that
<f_> *it got expanded
<f_> One thing to note too from the screenshot: they seem to run most of those DDR init functions in a do{}while() loop.
<f_> ..which is interesting.
jacobk has quit [Ping timeout: 240 seconds]
<f_> I have something that may confirm chewitt's thoughts years ago.
<f_> 2020-10-27: <chewitt> I suspect they kept the bl2 code static, which is why we have separate firmware blobs in the fip sources
<f_> Seems like this is true.
<f_> See this?
<f_> if (!bVar3) { serial_puts(&DAT_d900959e); lpddr_init_new(1); break;}
<f_> And this?
<f_> bVar3 = false;
<f_> if ((DAT_d900a000 == 0xf) && (DAT_d900a2ca == 0)) {
<f_> <...>
<f_> bVar3 = true;
<f_> }
<f_> Ok ignore what I just said.
jacobk has joined #linux-amlogic
<f_> I have to say ghidra's decompiler is quite accurate tbh
<f_> Now I know why coreboot developers use it for reverse-engineering (apparently)
jacobk has quit [Ping timeout: 250 seconds]
jacobk has joined #linux-amlogic
tyzef has quit [Ping timeout: 240 seconds]
<f_> narmstrong: Would you like Ghidra project files? I added some notes and named some functions where that makes sense.
<f_> I will say again, Ghidra's decompiler is quite accurate. I do think that's impressive.
<f_> Well..not as accurate as giving the sources as functions and variables are unnamed ¯\_(ツ)_/¯
maku has quit [Ping timeout: 265 seconds]
Daanct12 has joined #linux-amlogic
Danct12 has quit [Ping timeout: 240 seconds]
<narmstrong> f_: it must be interesting ! Maybe chargpt can help you understand some codes !
<narmstrong> *chatgpt
<f_> ¯\_(ツ)_/¯
<f_> The code actually looks more understandable than what one may think. Good job on that one, NSA.
<f_> Ghidra is, according to some people, as good as IDA Pro!
<f_> narmstrong: Most of the time the code looks the same as in the old sources, except that macros are already expanded, and functions as well as variables don't have meaningful names
<f_> and ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ which means no macros!
<f_> narmstrong: I can also see that a lot of code was left unchanged!
<f_> aes_setkey() as found in plat/gxb/crypto/secureboot.c, for example, is exactly the same as the one found by Ghidra's decompiler!
<f_> (just without any comments and macros, of course, and no meaningful names, too)
<f_> But the logic is *exactly* the same.
<f_> I can tell, however, that they did do some changes to DDR init.
<f_> narmstrong: I honestly don't think ChatGPT is going to be useful.
<narmstrong> Interesting ! It’s funny it didn’t change a lot
<f_> But since you mentionned ChatGPT....https://github.com/trailofbits/Codex-Decompiler =)
<f_> narmstrong: It didn't change too much, fourtunately =)
<f_> Except they added LPDDR init support as far as I know.
<f_> narmstrong: https://bin.vitali64.duckdns.org/647b5021 I suspect this is ddr_init()
<f_> You can see it prints:
<f_> serial_puts((byte *)(s_Rank0_only_d9009240 + (long)(int)(DAT_d900a000 - 1) * 0xd));
<f_> Without checking anything
<f_> But if you take a look at old DDR init:
<f_> They check CONFIG_DDR0_RANK*
<f_> So yeah, chewitt's thought about a year or two ago is true
<f_> 2020-10-27: <chewitt> I suspect they kept the bl2 code static, which is why we have separate firmware blobs in the fip sources
<f_> Actually 3 years ago.
<f_> But yeah, they kept some of the code static it seems.
Daaanct12 has joined #linux-amlogic
Daanct12 has quit [Ping timeout: 256 seconds]
<f_> Ok no
<f_> That's part of their LPDDR init which never gets run I think.
jacobk has quit [Ping timeout: 250 seconds]
<f_> No
<f_> Their code is confusing.
<f_> I'll explain later. For now I have to go.
f_ has quit [Quit: f_]
maku has joined #linux-amlogic
vagrantc has joined #linux-amlogic
jacobk has joined #linux-amlogic
jacobk has quit [Ping timeout: 240 seconds]