I am currently investigating GSL touch-screen controllers firmwares.
A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw
In case the link goes down, here is a random relevant extract of said file:
04 60 03 9A 08 E0 C7 81 00 00 E8 81 73 26 08 C2 6C 25 00 DA 6F 00 80 00 01 60 00 82 7F 25 08 D8 01 40 5B 9A 01 20 03 98 00 00 80 81 00 00 00 01 00 00 00 01 00 00 00 01 0C 40 73 9A 6C 25 20 DA 00 20 10 96 02 E0 2A 83 6C 25 00 D8 B6 63 10 DA 0C 40 5B 9A 07 60 33 9B 01 E0 02 96 03 E0 A2 80 F9 FF BF 04 20 65 20 DA C0 23 00 C2 00 60 A0 80 07 00 80 02 01 30 10 82 00 22 00 C2 00 60 A0 80 05 00 80 22 40 25 00 C2 01 30 10 82 2C 25 20 C2 40 25 00 C2 00 60 A0 80 70 00 80 00 05 00 80 02 88 22 00 C2 01 60 30 9B 02 60 30 83 0D 40 00 82 1C 25 20 C2 07 00 00 03 44 62 C0 81 00 00 00 01 00 00 00 01 98 BF E3 9D 08 23 00 C2 01 60 00 82 FC 22 00 E0 01 00 A4 80 1E 00 80 0A 01 20 10 A4 F8 22 00 C2 01 80 A4 80 17 00 80 38 08 23 00 C2 02 20 2C 83 68 60 00 A2 EC 2F 00 C2 12 00 10 92 00 60 A0 80 01 A0 04 A4 04 00 80 02 10 00 10 90 00 40 C0 9F 00 00 00 01 1C 00 00 03 71 00 80 00 00 62 10 98 0C 40 04 DA 04 62 10 82 01 40 24 DA 0C 40 24 C0 F8 22 00 C2 01 80 A4 80 F0 FF BF 08 68 60 04 A2 08 23 00 C2 FF 3F 04 A0 E3 FF BF 10 01 60 00 82 00 23 00 C2 01 60 00 82 F8 22 00 E4 01 80 A4 80 20 00 80 0A 1A A0 5C A6 01 20 10 A0 08 23 00 C2 01 00 A4 80 15 00 80 18 02 E0 2C 83 04 60 00 A2 EC 2F 00 C2 10 00 10 90 00 60 A0 80 01 20 04 A0 04 00 80 02 12 00 10 92 00 40 C0 9F 72 00 80 00 00 00 00 01 1C 00 00 03 00 62 10 98 0C 40 04 DA 68 62 10 82 01 40 24 DA 0C 40 24 C0 08 23 00 C2 01 00 A4 80 F0 FF BF 08 04 60 04 A2 00 23 00 C2 FF BF 04 A4 01 60 00 82 01 80 A4 80 E4 FF BF 1A E6 FF 04 A6 08 E0 C7 81 00 00 E8 81 98 BF E3 9D 48 25 00 C2 00 61 88 80 00 20 10 AC
I have tried disassembling this file for quite a few architectures, but the result does not look like coherent machine code.
Which architecture should I use to disassemble this firmware?
Some info I found:
- Endianness should be flipped. This way, the strings at the end are readable.
- There are a lot of null bytes, making me wonder if this is even executable code. If it is not, what else could it be? It is supposedly the firmware.
- The beginning of the file looks like configuration data. Looking at offset e.g. 0x2000 seems more interesting
- http://dl.linux-sunxi.org/touchscreen/GSL1680.pdf Page 9: we learn the MCU has a 32-bit CPU
- There are a lot of recurring patterns, such as "00 00 00 01".
- Plot of the bytes occurrences (log scale). "Rounds values" (e.g. 0x40,0x60,0x80) appear much more.
I am hopping someone more experiences would recognize the machine code signature of the specific CPU.
