search

sualk / ghidra-blackfin

Blackfin CPU support for ghidra
22 stars 2 forks source link

Any chance of BF70x support? #2

Open hughsie opened 2 years ago

hughsie commented 2 years ago

I'm trying to decompile some code for a module with a BF70x DSP. I'm aware that BF52x is what's targetted here, but I'm wondering how much work it would be to support the new DSP type. I don't think even IDA supports this weird chip either. :(

sualk commented 2 years ago

The blackfin+ instruction set is a superset of the blackfin one. So adding support means to add the missing instructions. Everything else e.g. name and number of registers is the same.

The added instructions are mainly more DSP instructions and some instructions to directly load 32bit immediate values.

You can try with the current blackfin variant and see how often you encounter unknown instructions.

hughsie commented 2 years ago

The added instructions are mainly more DSP instructions and some instructions to directly load 32bit immediate values.

Ahh, I didn't know BF70x was blackfin+ -- thanks for the help there. I did expect to get some kind of control flow output out of the initial setup if nothing else, and only seemed to get junk. Perhaps the decompiler is a little less accepting of padding/data in the header and tail? If it's interesting, the image I'm trying to decompile is https://github.com/hughsie/mobis-vess/raw/main/backup.bin -- it's entirely possible I need to offset the start somehow. Any advice or hints very welcome. Thanks!

sualk commented 2 years ago

That file contains a blackfin boot stream at the beginning. For me it loads fine with this extension and decompiles as far as possible without proper blackfin+ support.

Did you import it as raw binary or as blackfin boot stream?

hughsie commented 2 years ago

Did you import it as raw binary or as blackfin boot stream?

Ahh! I tried blackfin boot stream, but I get much further with a raw binary + blackfin-default; 4 functions decompiled -- many thanks for that. Did you get further than me?

sualk commented 2 years ago

You should import it as blackfin boot stream. This removes all the headers in the file and loads the binary to the correct address. It also marks the entry point of the code. But without support for at least the 64bit wide instructions you will not get far.

I pushed a new branch blackfin+ with some very minimal support for these 64 bit instructions. This should help a lot with your file.

hughsie commented 2 years ago

import it as blackfin boot stream

Wow, with the blackfin+ branch I get a lot more output; although a lot of the functions have the dreaded Bad instruction - Truncating control flow. Is there anything I can do to help, I feel really grateful for what you've done for me so far.

sualk commented 2 years ago

Depending on how much you want to learn about sleigh you can look at the documentation in $GHIDRA_HOME/docs/languages/ especially the sleigh manual and start implementing the missing instructions you encounter. Most of them should be new variants of already implemented instructions, so you can take them as example.