peterg70
July 12th, 2007, 08:27
In todays gadget system it seems alot more devices are being built with smarts.
To cope with this they are based on linux based kernels for operation and provide interface to TV etc.
The current one I am looking at is personal Video recorder (PVR) and it has applications that be installed onto it to add functionality.
I hit one of those registration system that are just annoying and decided to have a look at the program thinking it would be reasonable straight forward to disassemble.
Loaded up IDA and program not identified. hmm
Then found was a MIPS based processor so again loaded IDA with MIPSB processor.
Then found that the format of the file is not just code but has a HEADER and Jump Tables. etc.
Went searching for an example with original source code
Started to disassemble the simple program.
Worked out the jump tables logic and IDA create functions which matched the source of the example.
Found the DATA table area and found that the assemble instructions call the correct data i.e. lw $s7,0x3444.
where 0x3444 contained an 0 terminated ascii string.
Then decided to look at the original program and found the similar struction but this time the lw $s7,xxxxx are not resolving correctly.
The file is alot larger than the sample program i.e. 0x3444 equivalent is now 0x954444
So the lw $s7,xxxxx is no longer referencing the ascii in the data table.
Any thoughts on MIPS systems and how they reference a working datatable.
If it seems I am rambling it close to midnight as I type.
To cope with this they are based on linux based kernels for operation and provide interface to TV etc.
The current one I am looking at is personal Video recorder (PVR) and it has applications that be installed onto it to add functionality.
I hit one of those registration system that are just annoying and decided to have a look at the program thinking it would be reasonable straight forward to disassemble.
Loaded up IDA and program not identified. hmm
Then found was a MIPS based processor so again loaded IDA with MIPSB processor.
Then found that the format of the file is not just code but has a HEADER and Jump Tables. etc.
Went searching for an example with original source code
Started to disassemble the simple program.
Worked out the jump tables logic and IDA create functions which matched the source of the example.
Found the DATA table area and found that the assemble instructions call the correct data i.e. lw $s7,0x3444.
where 0x3444 contained an 0 terminated ascii string.
Then decided to look at the original program and found the similar struction but this time the lw $s7,xxxxx are not resolving correctly.
The file is alot larger than the sample program i.e. 0x3444 equivalent is now 0x954444
So the lw $s7,xxxxx is no longer referencing the ascii in the data table.
Any thoughts on MIPS systems and how they reference a working datatable.
If it seems I am rambling it close to midnight as I type.