6

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think).

I am stuck in the following points :

  • I am not able to properly identify the CPU architecture (probably MIPS).
  • I am not able to properly identify the reset vector address to load the bootloader in IDA pro.

Does anyone have experience with these chips?

Update

Update 2

Using the toolchain of the CPU and disassembling the vectors.o found in the lib directory gave me this :

00000458 <__reset_vector>: 
458:    711b lrw        r1, 0xA2A25441 
45a:    0f21 cmpne      r1, r2 
45c:    e802 bf         0x462 
45e:    1082 mfcr       r2, ss2 
460:    1093 mfcr       r3, ss3 
00000462 <skip_SS_ATAG>: 
462:    0f21 cmpne      r1, r2 
464:    e003 bt         0x46c 
466:    7218 lrw        r2, 0x0 // from address pool at 0x4c8 
468:    35f3 bseti      r3, r3, 31 
46a:    9302 st r3, (r2, 0)

objdump -i Output :

elf32-csky-big
 (header big endian, data big endian)
  csky
elf32-csky-little
 (header little endian, data little endian)
  csky
elf32-little
 (header little endian, data little endian)
  csky
elf32-big
 (header big endian, data big endian)
  csky
srec
 (header endianness unknown, data endianness unknown)
  csky
symbolsrec
 (header endianness unknown, data endianness unknown)
  csky
verilog
 (header endianness unknown, data endianness unknown)
  csky
tekhex
 (header endianness unknown, data endianness unknown)
  csky
binary
 (header endianness unknown, data endianness unknown)
  csky
ihex
 (header endianness unknown, data endianness unknown)
  csky

 elf32-csky-big elf32-csky-little elf32-little elf32-big srec 
 csky elf32-csky-big elf32-csky-little elf32-little elf32-big srec   

 symbolsrec verilog tekhex binary ihex csky symbolsrec verilog tekhex binary ihex 
  • Too little info. What's the STB model/manufacturer? Firmware downloads? Do they provide GPL sources? binwalk output? – Igor Skochinsky Feb 8 '17 at 10:57
  • STB info : 6605-dvbs2 CHIp =GX3201 CPU family=CSLY the chip is manifactured by nationalchip.com/en – Steavebba Feb 8 '17 at 12:05
  • i have found the trace of source code for the same device at this link link but the ftp server is down at the moment. the only thing that i have is cksy toolchain for ecos operating system i have found a header file ck_opcodes.h with mips like instruction set am trying to write radar2 plugin with the opcodes in this file. – Steavebba Feb 8 '17 at 12:17
  • I'm pretty sure r2 already supports MIPS, why are you writing a plugin? – Igor Skochinsky Feb 8 '17 at 15:37
  • When i run binwalk against the lib files of the csky-ecos toolchain i get this. ELF, 32-bit LSB relocatable, Motorola RCE, version 1 (SYSV) binwalk -A outputs nothing....! – Steavebba Feb 8 '17 at 18:32
3

It seems very likely that this chip is indeed MIPS, so any MIPS disassembler should work. Remember to try both little-endian and big-endian variants. For finding the entrypoint, see here: Reverse Engineering MIPS Bootloader

Note that it may be possible that the firmware is packed or encrypted (check binwalk's entropy analysis); in that case reading it directly from the flash chip may be necessary.

EDIT: So, apparently the code is not MIPS after all. Going by the objdump output, the instruction set seems to be a derivative of the Motorola/Freescale MCORE (previously Motorola RCE), even if they call it "csky". You should be able to disassemble raw binary by specifying binary file format and architecture to objdump, e.g.:

objdump -D -b binary -m csky file.bin

In case you don't get good results, try adding -EB or -EL to force big-endian or little-endian disassembly. Note that sometimes you may get nonsense disassembly in case there is data intermixed with code (-D forces disassembly of the whole file).

EDIT2: C-sky support has been added to official binutils source tree. The commit message says:

V1 is derived from the MCore architecture while V2 is substantially different, with mixed 16- and 32-bit instructions, a larger register set, a different (but overlapping) ABI, etc.

  • thank you for the hints, the bootloader is not packed, i can see all the strings, i found the complete toolchain with the cross compilers, how can this help me ? – Steavebba Feb 8 '17 at 19:15
  • 2
    if the toolchain has objdump, try using it to disassemble the firmware. – Igor Skochinsky Feb 8 '17 at 19:17
  • I cant disassemble directly the firmware with objdump (unknown file format) but disassembling the vectors.o in the lib directory gave me this : '00000458 <__reset_vector>: 458: 711b lrw r1, 0xA2A25441 45a: 0f21 cmpne r1, r2 45c: e802 bf 0x462 45e: 1082 mfcr r2, ss2 460: 1093 mfcr r3, ss3 00000462 <skip_SS_ATAG>: 462: 0f21 cmpne r1, r2 464: e003 bt 0x46c 466: 7218 lrw r2, 0x0 // from address pool at 0x4c8 468: 35f3 bseti r3, r3, 31 46a: 9302 st r3, (r2, 0)' – Steavebba Feb 8 '17 at 23:19
  • @Steavebba please add this info to the question, as well as output of "objdump -i" – Igor Skochinsky Feb 8 '17 at 23:23
  • dose the BF instruction belong to the MIPS instruction set, i can find it in the M-CORE doc a branch instruction (BR, BT, BF) that has a backwards branch distance between 4 and 64 instructions must be detected. This short backwards branch instruction is called the sbb. – Steavebba Feb 8 '17 at 23:56
2

To clarify this thread:

C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC & PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little endian. The CK610M is a v1 ISA, which has the MMU, so it is able to run Linux, which contains support as of v4.19.

There are currently (since October 2018) a $6US C-Sky Development SBC's supporting the CK610M in the gx6605s SoC package produced by NationalChip. QEMU supports boot C-SKY v1 & v2 ISA.

https://c-sky.github.io/docs/gx6605s.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.