I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think).
I am stuck in the following points :
- I am not able to properly identify the CPU architecture (probably MIPS).
- I am not able to properly identify the reset vector address to load the bootloader in IDA pro.
Does anyone have experience with these chips?
Update
SDK and sources Ftp server down
CPU instruction set found in a header file
Update 2
Using the toolchain of the CPU and disassembling the vectors.o
found in the lib directory gave me this :
00000458 <__reset_vector>:
458: 711b lrw r1, 0xA2A25441
45a: 0f21 cmpne r1, r2
45c: e802 bf 0x462
45e: 1082 mfcr r2, ss2
460: 1093 mfcr r3, ss3
00000462 <skip_SS_ATAG>:
462: 0f21 cmpne r1, r2
464: e003 bt 0x46c
466: 7218 lrw r2, 0x0 // from address pool at 0x4c8
468: 35f3 bseti r3, r3, 31
46a: 9302 st r3, (r2, 0)
objdump -i
Output :
elf32-csky-big
(header big endian, data big endian)
csky
elf32-csky-little
(header little endian, data little endian)
csky
elf32-little
(header little endian, data little endian)
csky
elf32-big
(header big endian, data big endian)
csky
srec
(header endianness unknown, data endianness unknown)
csky
symbolsrec
(header endianness unknown, data endianness unknown)
csky
verilog
(header endianness unknown, data endianness unknown)
csky
tekhex
(header endianness unknown, data endianness unknown)
csky
binary
(header endianness unknown, data endianness unknown)
csky
ihex
(header endianness unknown, data endianness unknown)
csky
elf32-csky-big elf32-csky-little elf32-little elf32-big srec
csky elf32-csky-big elf32-csky-little elf32-little elf32-big srec
symbolsrec verilog tekhex binary ihex csky symbolsrec verilog tekhex binary ihex