-
Notifications
You must be signed in to change notification settings - Fork 11
/
firmloader.py
167 lines (147 loc) · 7.42 KB
/
firmloader.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
import os
import json
import idaapi
import idc
import ida_funcs
import ida_segment
import ida_segment
import ida_xref
import ida_bytes
import idautils
import ida_kernwin
class FirmwareChooser(ida_kernwin.Choose):
def __init__(self, firmwares):
ida_kernwin.Choose.__init__(self, "Select firmware", [["Name", 30 | ida_kernwin.CHCOL_PLAIN]], flags = ida_kernwin.CH_QFLT)
self.firmware_list = firmwares
def OnGetSize(self):
return len(self.firmware_list)
def OnGetLine(self, n):
return [self.firmware_list[n]["name"]]
class Firmloader(idaapi.action_handler_t):
def __init__(self):
idaapi.action_handler_t.__init__(self)
def activate(self, ctx):
firmware_list = []
for file_name in sorted(os.listdir(os.path.join(os.path.dirname(os.path.realpath(__file__)),"firmloader_data"))):
with open(os.path.join(os.path.dirname(os.path.realpath(__file__)),"firmloader_data",file_name)) as data_file:
data = json.load(data_file)
key = file_name.replace(".json","")
if data["family"]:
display_name = data["brand"] + "/" + data["family"] + "/"+ data["name"]
else:
display_name = data["brand"] + "/" + data["name"]
firmware_list.append({"key": key, "name": display_name})
chooser = FirmwareChooser(firmware_list)
if (sel := chooser.Show(True)) == -1:
return
chosen_key = firmware_list[sel]["key"]
found_rom = False
rom_segment = 0
for segment_ea in idautils.Segments():
# Default ROM segment
if idc.get_segm_name(segment_ea) == "ROM":
found_rom = True
rom_segment = segment_ea
# If there is no ROM segment warn user and close
if not found_rom:
ida_kernwin.warning("Segment with name \"ROM\" does not exist. Please, rename the main code segment to \"ROM\" and run the plugin again.")
return
with open(os.path.join(os.path.dirname(os.path.realpath(__file__)), "firmloader_data", chosen_key + ".json")) as data_file:
current_mcu = json.load(data_file)
# Create segments
for segment in current_mcu["segments"]:
start = int(segment["start"],16)
end = int(segment["end"],16)
ida_segment.add_segm(0,start,end,segment["name"],segment["type"],0)
# Set mode
for segment_ea in idautils.Segments():
# Set mode Thumb/ARM if ARM architecture
if idaapi.get_inf_structure().procname == 'ARM' and found_rom:
idaapi.split_sreg_range(rom_segment, idaapi.str2reg("T"), current_mcu["mode"], idaapi.SR_user)
# Create peripherals
if ida_kernwin.ask_yn(1, "Would you like to load peripherals?"):
for peripheral in current_mcu["peripherals"]:
# Start of the peripheral struct
start = int(peripheral["start"],16)
end = int(peripheral["end"],16)
ida_segment.add_segm(0,start,end,peripheral["name"],"DATA",0)
if peripheral["registers"]:
for register in peripheral["registers"]:
offset = int(register["offset"],16)
idc.set_name(start + offset, f'{peripheral["name"]}_{register["name"]}', idc.SN_NOCHECK)
# Add comment if any
idc.set_cmt(start,peripheral["comment"],False)
# Crate vector table
if current_mcu["vector_table"]:
if ida_kernwin.ask_yn(1, "Would you like to also populate the vector table?"):
vector_address = ida_kernwin.ask_str(hex(rom_segment),0,"Set vector table at address:")
try:
if "x" in vector_address:
vector_address = int(vector_address,16)
else:
vector_address = int(vector_address)
except:
ida_kernwin.info("Invalid address!")
return
if not idc.get_segm_name(vector_address):
ida_kernwin.info("Invalid address!")
return
else:
for vector in current_mcu["vector_table"]:
#
addr = vector_address + int(vector["addr"],16)
# Create a data value
if current_mcu["bits"] == 8:
ida_bytes.create_byte(addr,1)
elif current_mcu["bits"] == 16:
ida_bytes.create_qword(addr,2)
elif current_mcu["bits"] == 32:
ida_bytes.create_dword(addr,4)
elif current_mcu["bits"] == 64:
ida_bytes.create_qword(addr,8)
# Set name of the address
idc.set_name(addr, vector["name"]+"_vector", idc.SN_NOCHECK)
# Set comment
idc.set_cmt(addr,vector["comment"],False)
# Get XREF destination
destination = ida_bytes.get_32bit(addr)
# If ARM account for Thumb mode
if idaapi.get_inf_structure().procname == 'ARM' and destination % 2 == 1: # Thumb mode
destination = destination - 1
# If the segment is CODE
if ida_segment.get_segm_class(ida_segment.getseg(destination)) == "CODE":
# Create code reference
ida_xref.add_cref(addr,destination,1)
# If the name does not exist or is unk_*
if idc.get_name(destination) == "" or idc.get_name(destination).startswith("unk_"):
ida_funcs.add_func(destination)
idc.set_name(destination, vector["name"] + "_handler", idc.SN_NOCHECK | idc.SN_PUBLIC)
# All is done at this point, mark the ROM segment for auto-analysis
if found_rom:
idc.auto_mark_range(rom_segment,idc.get_segm_end(rom_segment),idaapi.AU_WEAK) # Let IDA decide what is code and what is not
# This action is always available.
def update(self, ctx):
return idaapi.AST_ENABLE_ALWAYS
class firmloader_t(idaapi.plugin_t):
comment = "FirmLoader"
help = "This script helps when working with various microcontroller firmware files."
wanted_name = "FirmLoader"
wanted_hotkey = ""
flags = idaapi.PLUGIN_KEEP
def init(self):
load_action_id = "firmloader:load"
load_action = idaapi.action_desc_t(
load_action_id,
"Apply firmware info...",
Firmloader(),
'',
"Apply known firmware info to the database."
)
idaapi.register_action(load_action)
idaapi.attach_action_to_menu("Edit/FirmLoader/Apply firmware info...", load_action_id, idaapi.SETMENU_APP)
def run(self):
pass
def term(self):
pass
def PLUGIN_ENTRY():
return firmloader_t()