Log in

View Full Version : MIPS Decoding and Disassembly


peterg70
July 12th, 2007, 08:27
In todays gadget system it seems alot more devices are being built with smarts.

To cope with this they are based on linux based kernels for operation and provide interface to TV etc.
The current one I am looking at is personal Video recorder (PVR) and it has applications that be installed onto it to add functionality.

I hit one of those registration system that are just annoying and decided to have a look at the program thinking it would be reasonable straight forward to disassemble.

Loaded up IDA and program not identified. hmm
Then found was a MIPS based processor so again loaded IDA with MIPSB processor.
Then found that the format of the file is not just code but has a HEADER and Jump Tables. etc.
Went searching for an example with original source code
Started to disassemble the simple program.
Worked out the jump tables logic and IDA create functions which matched the source of the example.
Found the DATA table area and found that the assemble instructions call the correct data i.e. lw $s7,0x3444.
where 0x3444 contained an 0 terminated ascii string.

Then decided to look at the original program and found the similar struction but this time the lw $s7,xxxxx are not resolving correctly.
The file is alot larger than the sample program i.e. 0x3444 equivalent is now 0x954444
So the lw $s7,xxxxx is no longer referencing the ascii in the data table.

Any thoughts on MIPS systems and how they reference a working datatable.

If it seems I am rambling it close to midnight as I type.

LLXX
July 12th, 2007, 10:39
One word: relocation.

peterg70
July 14th, 2007, 06:22
My fault I didn't go enought into it.

Using IDA how can i get it to scan through and convert the relocations into actual reference data.

i.e. I have this

ROM:000011B8 lw $v0, 0x146($gp)
ROM:000011BC nop
ROM:000011C0 lw $v0, 0($v0)
ROM:000011C4 nop
ROM:000011C8 move $t9, $v0
ROM:000011CC jalr $t9

Where the unique call table reference is location on 11c0 which is called via the jalr.
Is there a way to get IDA to convert this to jumptoName option instead.

Also what would be the global pointer value. The location in memory where the executable is loaded. or the location of the code section?

LLXX
July 14th, 2007, 07:22
...since you mentioned Linux, is this an ELF file?

Also, I think IDA's analysis isn't powerful enough to identify the jump table, although you could always fix it manually by changing them all to addresses (how many entries?)

peterg70
July 14th, 2007, 20:28
The file is not in ELF format. At least the ELF format that is normally around.

This is a specific application that can be installed into a working Linux based operating system. Alot of these Linux based PVRS are appearing.

IDA is unable to autodetect. So manually have loaded as a ROM file with MIPSB processor. Then work through file converting unknown to double format.

On the small file its fairly straight forward looking up the jumptable.
On the larger file it can be a large amount of entries.

Another step is to decipher the external API as well.

Slow learning curve with IDA is some of the stumbling blocks.

Post Edit
I have in IDA
lw $v0, 0x7B8($s7)

Now I know that $s7 = A7000
How to I offset this instruction so that it shows the content of the A77B8 in place of the 0x7B8($s7)
I tried to offset by other segment but doesn't display the contents.
also tried user defined offset but this displays (loc_7B8 - AF7000)