I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to

  1. calculate and print a "machine key" to the serial port,
  2. close JTAG port forever, and
  3. write one-off AES key.

The machine key is required when downloading other demo firmware, reversing which is NOT the primary target of this post. For more context, see this thread. The point of the reversing is to figure out how to get the machine key without disabling JTAG permanently.

A quick analysis by binwalk yields nothing interesting.

$ binwalk -e key_gen_v1.2.bin


Entropy analysis suggests that the firmware uses no obfuscation

enter image description here

Here is the output of strings

sP00sP 0sP@0sP@4
V (%lu) %s: misaligned load recovered at %08lx. len:%02d,addr:%08lx,reg:%02d,data:%016lx,signed:%1d,float:%1d
V (%lu) %s: misaligned store recovered at %08lx. len:%02d,addr:%08lx,reg:%02d,data:%016lx,float:%1d
[0;31mE (%lu) %s: Out of memory
[0;33mW (%lu) %s: sys_exit called by core %ld with 0x%lx
[0;31mE (%lu) %s: Unsupported syscall %ld: a0=%lx, a1=%lx, a2=%lx!
?Error:  No workable settings found.
Error:  No appropriate ratio found.

In Reversing the WRT120N’s Firmware Obfuscation, the breakthrough was made by observing the output on the serial port. However, this particular firmware doesn't output much useful information to the serial port. In addition, I have yet find a decent disassembler for RISC-V (like IDA for ARM).

What can I do next?



As of early December Ghidra has RISC-V support in master. It should be added to the 9.2 release, until then you would have to build from source.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.