C-sky CPU reverse-engineering

Question

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think).

I am stuck in the following points :

• I am not able to properly identify the CPU architecture (probably MIPS).
• I am not able to properly identify the reset vector address to load the bootloader in IDA pro.

Does anyone have experience with these chips?

Update

• SDK and sources Ftp server down

• CPU instruction set found in a header file

• instruction set header file

Update 2

Using the toolchain of the CPU and disassembling the vectors.o found in the lib directory gave me this :

00000458 <__reset_vector>: 
458:    711b lrw        r1, 0xA2A25441 
45a:    0f21 cmpne      r1, r2 
45c:    e802 bf         0x462 
45e:    1082 mfcr       r2, ss2 
460:    1093 mfcr       r3, ss3 
00000462 <skip_SS_ATAG>: 
462:    0f21 cmpne      r1, r2 
464:    e003 bt         0x46c 
466:    7218 lrw        r2, 0x0 // from address pool at 0x4c8 
468:    35f3 bseti      r3, r3, 31 
46a:    9302 st r3, (r2, 0)

objdump -i Output :

elf32-csky-big
 (header big endian, data big endian)
  csky
elf32-csky-little
 (header little endian, data little endian)
  csky
elf32-little
 (header little endian, data little endian)
  csky
elf32-big
 (header big endian, data big endian)
  csky
srec
 (header endianness unknown, data endianness unknown)
  csky
symbolsrec
 (header endianness unknown, data endianness unknown)
  csky
verilog
 (header endianness unknown, data endianness unknown)
  csky
tekhex
 (header endianness unknown, data endianness unknown)
  csky
binary
 (header endianness unknown, data endianness unknown)
  csky
ihex
 (header endianness unknown, data endianness unknown)
  csky

 elf32-csky-big elf32-csky-little elf32-little elf32-big srec 
 csky elf32-csky-big elf32-csky-little elf32-little elf32-big srec   

 symbolsrec verilog tekhex binary ihex csky symbolsrec verilog tekhex binary ihex 

Answer 1

It seems very likely that this chip is indeed MIPS, so any MIPS disassembler should work. Remember to try both little-endian and big-endian variants. For finding the entrypoint, see here: Reverse Engineering MIPS Bootloader

Note that it may be possible that the firmware is packed or encrypted (check binwalk's entropy analysis); in that case reading it directly from the flash chip may be necessary.

EDIT: So, apparently the code is not MIPS after all. Going by the objdump output, the instruction set seems to be a derivative of the Motorola/Freescale MCORE (previously Motorola RCE), even if they call it "csky". You should be able to disassemble raw binary by specifying binary file format and architecture to objdump, e.g.:

objdump -D -b binary -m csky file.bin

In case you don't get good results, try adding -EB or -EL to force big-endian or little-endian disassembly. Note that sometimes you may get nonsense disassembly in case there is data intermixed with code (-D forces disassembly of the whole file).

EDIT2: C-sky support has been added to official binutils source tree. The commit message says:

V1 is derived from the MCore architecture while V2 is substantially different, with mixed 16- and 32-bit instructions, a larger register set, a different (but overlapping) ABI, etc.

EDIT3: C-SKY and Motorola MCore architecture support was added in Radare2 reverse engineering framework. You can use it with -a mcore radare2 switch, also it should recognize the architecture in the ELF file directly.

Answer 2

To clarify this thread:

C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC & PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little endian. The CK610M is a v1 ISA, which has the MMU, so it is able to run Linux, which contains support as of v4.19.

There are currently (since October 2018) a $6US C-Sky Development SBC's supporting the CK610M in the gx6605s SoC package produced by NationalChip. QEMU supports boot C-SKY v1 & v2 ISA.

https://c-sky.github.io/docs/gx6605s.html