Need help disassembling Qualcomm QDSP6

Question

Im trying to disassemble a qualcomm QDSP6 modem file. According to the ELF header, there should be 26 sections(modem.b00-b25). However after dumping the device, b.16,b.17,b.25 are missing, making the file impossible to open with IDA.

The device is an Alcatel 4060-A. I have full access to the phone's emmc via usb download mode, also tried dumping the same modem partition via ADB. Same result, the partition is missing those 3 sections. Even reading the raw unpacked file in a hex editor, there is no mention of those 3 elf sections

Any suggestions?

Answer 1

You should check the program headers with readelf -a modem.b00. It will show you which sections have a FileSiz of zero bytes. These are probably the ones missing.

Then you can put together the original ELF file by loading each modem.bNN section at the right offset, as indicated by the Offset field in the readelf -a output.

I don't know which rom you used, i downloaded the one from xdadev

unzipped using unzip. Then extracted the modem.img file using 7z:

7z -omodem x modem.img

then in modem/image there are the modem.bNN files. of those: b04, b17, b18 and b25 are missing. When looking at readelf -a modem.b00, I can see that those are exactly the ones with FileSiz == 0.

Type    Offset   VirtAddr PhysAddr FileSiz  MemSiz   Flg Align
NULL    00000000 00000000 00000000 00000374 00000000     00000000    -- b00 ELF header
NULL    00001000 8d500000 8d500000 00001c68 00002000     00001000    -- b01 hashes, signature, certs
INTERP  01c47280 c1cbe280 89cbe280 00000001 00000001 R   00000001    -- b02
LOAD    00003000 c0000000 88000000 00001540 00001540 R E 00001000    -- b03
LOAD    00005000 c0004000 88004000 00000000 00001000 RW  00001000    -- 
LOAD    00005000 c0008000 88008000 0002c160 0002c160 RW  00001000    -- b05
LOAD    00032000 c0038000 88038000 0005e340 0005e340 RW  00001000    -- b06
LOAD    00091000 c00c0000 880c0000 00200000 00200000 R E 00001000    -- b07
LOAD    00291000 c02c0000 882c0000 00280000 00280000 R E 00001000    -- b08
LOAD    00511000 c0540000 88540000 00033a2c 00033a2c RWE 00001000    -- b09
LOAD    00545000 c0574000 88574000 000b0a2c 000b0a2c R E 00001000    -- b10
LOAD    005f6000 c0630000 88630000 000f78b4 000f78b4 R E 00001000    -- b11
LOAD    006ee000 c0728000 88728000 00df81d0 00df81d0 R E 00001000    -- b12
LOAD    014e7000 c1540000 89540000 00062fe0 00062fe0 RW  00001000    -- b13
LOAD    0154a000 c15c0000 895c0000 004fbb93 004fbb93 R   00001000    -- b14
LOAD    01a46000 c1abd000 89abd000 00208a83 00208a83 RW  00001000    -- b15
DYNAMIC 01c47284 c1cbe284 89cbe284 00000078 00000078 RW  00000004    -- b16
LOAD    01c4f000 c1cc6000 89cc6000 00000000 000ddc64 RW  00001000    -- 
LOAD    01c50000 c1da4000 89da4000 00000000 010b9000 RW  00001000    -- 
LOAD    01c4f000 c2e5d000 8ae5d000 00013e00 00013e00 RW  00001000    -- b19
LOAD    01c63000 c2e71000 8ae71000 00079648 00079648 R   00001000    -- b20 .. zlib
LOAD    01cdd000 c2eeb000 8aeeb000 00947000 00947000 R   00001000    -- b21 .. q6zip
LOAD    02625000 c3833000 8b833000 00013000 00013000 RW  00001000    -- b22 .. delta
LOAD    02639000 c3847000 8b847000 0008e000 0008e000 RWE 00001000    -- b23
LOAD    026c8000 c38d6000 8b8d6000 0006ecb4 0006ecb4 RW  00001000    -- b24
LOAD    02737000 c3945000 8b945000 00000000 01bbb000 RW  00001000    -- 

Other things to note:

• modem.mdt == modem.b00 + modem.b01
• modem.b01 contains sha256 hashes of all other non empty sections. And a signature and certificates.
• modem.b20 can be decompressed using zlib.decompress
• modem.b21 and modem.b22 use compression methods designed by qualcomm. Named q6zip and deltacompress respectivly.

I will soon post decompression tools for the delta and q6zip sections on my github account.

The qualcomm hexagon documentation can be found here, free registration required. The instruction set is described in Hexagon V62 Programmer's Reference Manual.

See also the README.md from https://github.com/gsmk/hexagon.

Answer 2

for decompressing RO or RW sections, I recommend using the utilities from the sources. q6zip_ro_uncompress.py or rw_decompress_file.py

universal method of unpacking - doesn't exist, even on one chipset, the algorithm, like add q6zip, or RO dictionary size can change. so, better has the same version of sources.

I can't give a more accurate answer, because while I was olny decompress the few RO section, RW - unpacked with errors.

unpack is better on Linux. and sources need recompile.

I also recommend trying to swith the device into download mode, and just dump the memory. although I'm not sure that there will be all the unpacked blocks, but worth a try.

I now have a similar problem with MDM9230, TCL(alcatel) Y900NB, I don't even know what version of dlpager is used (( and I can't unpack it too. (i haven't HW, I just work with SW)

in principle, all the above just flooding, I only want to ask Willem Hengeveld, maybe he will tell something more, but need rep 50 for comment, so need answer ))