|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "IDA Pro Setup"
ChronicDev (talk | contribs) (→Addresses of known functions / code locations) |
|||
| (7 intermediate revisions by 5 users not shown) | |||
| Line 26: | Line 26: | ||
* u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing |
* u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing |
||
* Alt+G = toggle the Register T from 0 / 1 to toggle arm and thumb mode when needed |
* Alt+G = toggle the Register T from 0 / 1 to toggle arm and thumb mode when needed |
||
| − | |||
| − | |||
| − | [http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001). |
||
== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )== |
== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )== |
||
| Line 43: | Line 40: | ||
Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) ! |
Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) ! |
||
| + | |||
| + | [http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py Script] with [http://d-dome.net/idapython/ IDAPython] |
||
| + | |||
| + | == IDA Pro Signature Files == |
||
| + | |||
| + | Link to download signature files that can be used in reversing the iPhone baseband. |
||
| + | |||
| + | They are mostly Real View runtime library sigs: |
||
| + | |||
| + | RVCT RTL 2.2 |
||
| + | RVCT RTL 3.1 |
||
| + | RVCT RTL 4.4 |
||
| + | |||
| + | ThreadX sig for iPhone 4 - however this only picks up a couple of functions, not sure how Apple compiled threadx, with which compiler, optimizations. |
||
| + | |||
| + | |||
| + | On an iPhone 4 firmware can pickup upto 800 functions when all the sigs applied. |
||
| + | |||
| + | [http://www.mediafire.com/?kz4dlcnzfwixkkv Sigs] |
||
==Addresses of known functions / code locations== |
==Addresses of known functions / code locations== |
||
| − | === |
+ | ===Baseband 02.28.00=== |
* 0x201497B0 - maybe AT Command handler? (uses strings such as "OK", "ERROR", "UNKNOWN COMMAND") |
* 0x201497B0 - maybe AT Command handler? (uses strings such as "OK", "ERROR", "UNKNOWN COMMAND") |
||
* 0x203C51BC - probably prints text |
* 0x203C51BC - probably prints text |
||
| Line 55: | Line 71: | ||
* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen) |
* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen) |
||
| − | ===iPod touch 2G Bootrom=== |
||
| − | I think this might not be a good idea, because this page will wind up getting huge, but in case anyone thinks differently I'll add these for the hell of it. |
||
| − | |||
| − | ====functions==== |
||
| − | * 0x067A - BootromStart |
||
| − | * 0x45BA - InitProcessor |
||
| − | * 0x4778 - SetupMMU |
||
| − | * 0x4734 - MMU_MapAddr |
||
| − | * 0x3A84 - Do_MMU_Mappings |
||
| − | * 0x34FC - EnableInterrupts |
||
| − | * 0x652C - Setup_SPI |
||
| − | * 0x36DC - Setup_IdleTask |
||
| − | * 0x4906 - PrepareNOR |
||
| − | * 0x49BC - nor_spi_read_range |
||
| − | * 0x178C - malloc |
||
| − | * 0x34D8 - DisableInterrupts |
||
| − | * 0x7840 - memset |
||
| − | * 0x7858 - memzero (this looks funny in IDA, kind of, but really it's just optimized as part of memset) |
||
| − | * 0x1954 - free |
||
| − | * 0x4844 - addNORtoBlockDevList |
||
| − | * 0x4804 - default_block_read |
||
| − | * 0x10C8 - blockdev_read_hook(void *BDevStruct, void *OutputBuffer, __int32 InputImageStartAddress, int Offset, __int32 Size) |
||
| − | * 0x1258 - fake_default_block_read |
||
| − | * 0x136E - blockdev_write_hook |
||
| − | * 0x1518 - default_block_write |
||
| − | * 0x151E - default_block_erase |
||
| − | * 0x1090 - get_block_device(const char* deviceName) |
||
| − | * 0x8354 - strcmp |
||
| − | * 0x1AF0 - CreateImageList |
||
| − | * 0x1F68 - DoCreateImageList |
||
| − | * 0x204C - GetImage(u32 imageFourccTag) |
||
| − | * 0x1BF0 - SetupMemzStruct(u32 LoadAddress, u32 FileSize, u32 flags) |
||
| − | * 0x30E8 - InitUSB |
||
| − | * 0x795C - memcpy |
||
| − | * 0x0E84 - USB_Core_Init |
||
| − | * 0x1058 - StopUSB |
||
| − | * 0x328C - GetSystemInfo |
||
| − | * 0x3D94 - Get_Chip_ID |
||
| − | * 0x3DA0 - Get_Chip_Revision |
||
| − | * 0x3D74 - Get_Security_Epoch |
||
| − | * 0x3AE4 - Get_Board_ID |
||
| − | * 0x3DD4 - Get_Unique_Chip_ID |
||
| − | * 0x8286 - snprintf |
||
| − | * 0x7D5C - vfprintf_like_thingy |
||
| − | * 0x82A8 - printf |
||
| − | * 0x8422 - putchar |
||
| − | * 0x2E98 - usb_print |
||
| − | * 0x83CC - strncat |
||
| − | * 0x1C18 - FreeMemzStruct |
||
| − | * 0x67DC - Reboot (via watchdog, so yeah it looks a bit odd) |
||
| − | * 0x0644 - LoadAndJumpToFWImage(struct MemzStruct *pMemzInfo, __int32 LoadAddress, __int32 FileSize) |
||
| − | * 0x3338 - ProperlyJumpToImage(void unkown, u32 address, void unknown) |
||
| − | * 0x4584 - PrepMMUForJump (?) |
||
| − | * 0x1B78 - LoadFirmwareImage |
||
| − | * 0x2144 - doLoadFirmwareImage |
||
| − | * 0x1D04 - VerifyImage |
||
| − | * 0x5EA8 - ComputeSHA1(void *Input_Data, int Data_Size, void *SHA1_Of_Data) |
||
| − | * 0x4150 - AdjustClock |
||
| − | * 0x5E54 - CopyBlockToSHA1Engine |
||
| − | * 0x372E - yield |
||
| − | * 0x2400 - DecryptRSASignature |
||
| − | * 0x0898 - DoCrypto(int CryptOption, void *Input_Buffer, void *Output_Buffer, __int32 Size, int AESMode, void *Key, void *IV) [CryptOption 0x10 == encrypt, 0x11 == decrypt] |
||
| − | * 0x5010 - aes_encrypt |
||
| − | * 0x4DB8 - do_aes_encrypt |
||
| − | * 0x4D38 - send_key_to_aes |
||
| − | * 0x4D88 - send_iv_to_aes |
||
| − | * 0x4F44 - aes_decrypt |
||
| − | * 0x4E80 - do_aes_decrypt |
||
| − | * 0x2668 - parse_certificate_and_signature(void *pCertsData, int sizeOfCerts, void *pImageRsaSha1, int sizeofRsaSha1, void *pComputedImageSha1, int sha1Size, void *pImageBuffer, int imageFullSize) |
||
| − | * 0x356C - CheckIfDiagnosticDevice |
||
| − | * 0x3D64 - Get_Security_Domain |
||
| − | * 0x3D44 - Get_Production_Mode |
||
| − | * 0x1F00 - Find_Data_For_Tag |
||
| − | * 0x346C - Panic |
||
| − | * 0x0634 - WaitForInterrupt |
||
| − | * 0x4618 - UndefinedInstructionVector |
||
| − | * 0x46F0 - UndefinedInstructionHandler |
||
| − | * 0x4628 - SoftwareInterruptVector |
||
| − | * 0x4700 - SoftwareInterruptHandler |
||
| − | * 0x4640 - PrefetchAbortVector |
||
| − | * 0x46B4 - PrefetchAbortHandler |
||
| − | * 0x4664 - DataAbortVector |
||
| − | * 0x46A2 - DataAbortHandler |
||
| − | * 0x467C - AddressExceptionTrapVector |
||
| − | * 0x4680 - InterruptRequestVector |
||
| − | * 0x4710 - InterruptRequestHandler |
||
| − | * 0x4BEC - HandleInterruptRequest |
||
| − | * 0x4690 - FastInterruptRequestVector |
||
| − | * 0x4722 - FastInterruptRequestHandler |
||
| − | * 0x4C40 - HandleFastInterruptRequest |
||
| + | ===Baseband 5.12.01 3.1.3 (Build 7E18)=== |
||
| − | ====variables==== |
||
| + | * 0x203C2714 - IMEI routine |
||
| − | * 0x220240D4 - SHA1 accelerator register table |
||
| + | * 0x2062CF28 - default IMEI (0A 40 99 09 01 46 00 00) |
||
| − | * 0x22024200 - Block Device List |
||
| − | * 0x220250A0 - Permissions Flags |
||
| − | * 0x220254E0 - Interrupt Table |
||
| − | * 0x2202C000 - Page table |
||
Latest revision as of 09:18, 10 February 2012
Contents
How to set up IDA pro to reverse the 3G baseband
The X-Gold 608 has a memory map, as seen in it's page.
The Secpack 2.0 takes up the first 0xCF8 of the .fls file.
So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)
For real noobs:
1. Drag the fls file into IDA 2. Select ARM 3. Change ROM start address to 0x20040000 4. Change Loading address to 0x20040000 5. Change File offset to 0xCF8 6. Copy Loading size into ROM size 7. Press OK 8. The entry point is the address at 0x20040408 9. Go to 20100004 and Press "C" to start. ~Deco 10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco
Here are some key combinations to use:
- c = turn the 'gibberish' into code
- d = turn the 'gibberish' into data
- a = turn the 'gibberish' into a string
- u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
- Alt+G = toggle the Register T from 0 / 1 to toggle arm and thumb mode when needed
some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )
The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:
Most code is 'embraced' by 'embracing' code: - push / pop for thumb mod - STMFD / LDMFD for arm mode
Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?! The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1). After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text.
Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !
IDA Pro Signature Files
Link to download signature files that can be used in reversing the iPhone baseband.
They are mostly Real View runtime library sigs:
RVCT RTL 2.2 RVCT RTL 3.1 RVCT RTL 4.4
ThreadX sig for iPhone 4 - however this only picks up a couple of functions, not sure how Apple compiled threadx, with which compiler, optimizations.
On an iPhone 4 firmware can pickup upto 800 functions when all the sigs applied.
Addresses of known functions / code locations
Baseband 02.28.00
- 0x201497B0 - maybe AT Command handler? (uses strings such as "OK", "ERROR", "UNKNOWN COMMAND")
- 0x203C51BC - probably prints text
- 0x201420AC - malloc (according to Darkmen)
- 0x203C58A0 - bytecpy (according to Darkmen)
- 0x203FB540 - NU_Create_Task (according to Darkmen)
- 0x2046DD00 - sprintf (according to Darkmen)
- 0x20165998 - NU_Receive_From_Mailbox (according to Darkmen)
- 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen)
Baseband 5.12.01 3.1.3 (Build 7E18)
- 0x203C2714 - IMEI routine
- 0x2062CF28 - default IMEI (0A 40 99 09 01 46 00 00)
