ecutools 0.0.2

data/.bundle/config

@@ -0,0 +1,3 @@
+---
+BUNDLE_PATH: ecutools.gemspec
+BUNDLE_DISABLE_SHARED_GEMS: '1'

data/.gitignore

@@ -0,0 +1,4 @@
+/*.asm
+/*.gem
+/*.zip
+/.DS_Store

data/Gemfile

@@ -0,0 +1,4 @@
+source "http://rubygems.org"
+
+# Specify your gem's dependencies in gem_template.gemspec
+gemspec

data/Gemfile.lock

@@ -0,0 +1,17 @@
+PATH
+  remote: .
+  specs:
+    ecutools (0.0.1)
+      thor (>= 0.14)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    thor (0.14.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  ecutools!
+  thor (>= 0.14)

data/bin/ecutools

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+require 'cli'
+
+command = ECUTools::CLI.start

data/ecutools.gemspec

@@ -0,0 +1,29 @@
+# -*- encoding: utf-8 -*-
+$:.push File.expand_path("../lib", __FILE__)
+
+require 'version'
+
+Gem::Specification.new do |s|
+  s.name = "ecutools"
+  s.version     = ECUTools::VERSION
+  s.platform    = Gem::Platform::RUBY
+  s.authors = ["Javier Muniz"]
+  s.email = "javier@granicus.com"
+  s.summary = "Toolkit for disassembling and reverse engineering ECU ROMs"
+  s.homepage = "http://github.com/javiermuniz/ecutools"
+  s.description = "Toolkit for ECU disassembly and analysis"
+  
+  s.rubyforge_project = "ecutools"
+  
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  s.require_paths = ["lib"]
+  
+  
+  s.add_development_dependency('thor', '>= 0.14')
+  s.add_development_dependency('nokogiri', '>= 1.5')
+
+  s.add_dependency('thor', '>= 0.14')
+  s.add_dependency('nokogiri', '>= 1.5')
+end

data/lib/assembler.rb

@@ -0,0 +1,22 @@
+module ECUTools
+  class Assembler
+    @@instructions = [ 
+      :invalid, :add, :add3, :and, :and3, :or, :or3, :xor,
+      :xor3, :addi, :addv, :addv3, :addx, :bc8, :bc24, :beq, 
+      :beqz, :bgez, :bgtz, :blez, :bltz, :bnez, :bl8, :bl24, :bcl8, :bcl24, :bnc8, :bnc24,
+      :bne, :bra8, :bra24, :bncl8, :bncl24, :cmp, :cmpi, :cmpu, :cmpui, :cmpeq, :cmpz, :div, :divu, :rem,
+      :remu, :divh, :jc, :jnc, :jl, :jmp, :ld, :ld_d, :ldb, :ldb_d, :ldh, :ldh_d, :ldub,
+      :ldub_d, :lduh, :lduh_d, :ld_plus, :ld24, :ldi8, :ldi16, :lock, :machi, :machi_a, :maclo, :maclo_a, 
+      :macwhi, :macwhi_a, :macwlo, :macwlo_a, :mul, :mulhi, :mulhi_a, :mullo, :mullo_a, :mulwhi, 
+      :mulwhi_a, :mulwlo, :mulwlo_a, :mv, :mvfachi, :mvfachi_a, :mvfaclo, :mvfaclo_a, :mvfacmi, 
+      :mvfacmi_a, :mvfc, :mvtachi, :mvtachi_a, :mvtaclo, :mvtaclo_a, :mvtc,
+      :neg, :nop, :not, :rac, :rac_dsi, :rach, :rach_dsi, :rte, :seth, :sll, :sll3, :slli, :sra, :sra3,
+      :srai, :srl, :srl3, :srli, :st, :st_d, :stb, :stb_d, :sth, :sth_d, :st_plus, :st_minus,
+      :sub, :subv, :subx, :trap, :unlock, :satb, :sath, :sat, :pcmpbz, :sadd, :macwu1, :msblo,
+      :mulwu1, :maclh1, :sc, :snc, :max ]
+      
+    def initialize
+    end
+    
+  end
+end

data/lib/cli.rb

@@ -0,0 +1,28 @@
+require 'optparse'
+require 'thor'
+require 'disassembler'
+
+module ECUTools
+  class CLI < Thor
+    include Thor::Actions
+
+    check_unknown_options!
+    
+    default_task :disassemble
+    
+    desc "disassemble <ROM>", "Disassembles a ROM into the current working directory"
+    long_desc <<-D
+      Dissassemble will take a hex or binary ROM and disassemble it into the proper M32R assembly code.
+      Tables and data will be disassembled as code, which will need to be sorted out by the user.
+    D
+    method_option "out", :type => :string, :aliases => "-o", :banner =>
+      "The output filename. If none is provided the rom name will be used with a .asm extension"
+    def disassemble(input)
+      outfile = "#{File.basename(input, File.extname(input))}.asm"
+      dasm = ECUTools::Disassembler.new(input, {:verbose => true})
+      dasm.analyze
+      dasm.write(outfile)
+    end
+
+  end
+end

data/lib/disassembler.rb

@@ -0,0 +1,219 @@
+require 'version'
+require 'instruction'
+require 'helpers'
+require 'nokogiri'
+
+module ECUTools
+  class Disassembler
+    include ECUTools::Helpers
+
+    def initialize(input = nil, options = {})
+      @options = options
+      @reference_addresses = {}
+      if(!input.nil?)
+        open input
+      end
+    end
+
+    def verbose
+      @options[:verbose]
+    end
+
+    def open(file)
+      $stderr.puts "Disassembling binary..." if verbose
+      h = '[\d|[a-f]|[A-F]]'
+      @assembly = []
+      io = IO.popen("gobjdump -b binary --architecture=m32r --disassemble-all --disassemble-zeroes -EB #{file}")
+      while line = io.gets
+        match = /\s+(#{h}+):\s+(#{h}{2}) (#{h}{2}) (#{h}{2}) (#{h}{2})\s+(.+)/.match(line)
+        if match
+          @assembly << Instruction.new(match[1], [ match[2], match[3], match[4], match[5] ], match[6])
+        end
+      end
+
+      $stderr.puts "Disassembly complete." if verbose
+    end
+
+    def write(file)
+      f = File.new(file,"w")
+      header = "; ecutools v#{ECUTools::VERSION}\n"
+      header << "; Generated assembly from ROM ID #{rom_id}\n"
+      header << "; Base Address: #{base_address}\n"
+      header << "; Disassembly:\n"
+      f.write(header)
+      $stderr.puts "Writing assembly..." if verbose
+      @assembly.each do |instruction|
+        f.write("#{instruction}\n")
+      end
+      $stderr.puts "Done." if verbose
+    end
+
+    def analyze
+      $stderr.puts "Analyzing assembly..." if verbose
+      annotate_tables
+      annotate_subroutines
+      annotate_code
+      $stderr.puts "Analyzation complete." if verbose
+    end
+
+    def annotate_tables
+      $stderr.puts "Annotating tables..." if verbose
+      tables = rom_xml.xpath('/rom/table')
+      count = 0
+      tables.each do |table|
+        elements = 1 # all tables start with one element
+        element_size = rom_xml.xpath("/rom/scaling[@name='#{table.attr('scaling')}']").attr('storagetype').value().gsub(/[^\d]+/,'').to_i / 8
+        address = from_hex table.attr('address')
+        is_data = false
+
+        table.xpath('table').each do |subtable|
+          elements = elements * subtable.attr('elements').to_i
+          is_data = true
+        end
+
+        possible_offsets = []
+
+        case elements
+        when 1,4
+          possible_offsets << 0
+        when 3..20
+          possible_offsets << 4
+          possible_offsets << 6
+        when 44
+          possible_offsets << 28  # wtf? maf scaling
+        else
+          possible_offsets << 7
+          possible_offsets << 10
+          possible_offsets << 16
+        end
+
+        possible_offsets.each do |offset|
+          offset_hex = (address - offset).to_s(16)
+          if verbose and @reference_addresses.include? offset_hex
+            $stderr.puts "WARNING: Reference hunt collision at 0x#{offset_hex} (#{@reference_addresses[offset_hex]} vs #{table.attr('name')})! Check code carefully!" 
+          end
+          @reference_addresses[offset_hex] = table.attr('name')
+        end
+
+        storage_size = element_size * elements
+
+        storage_size.times do |n|
+          instruction = instruction_at(address + n)
+          instruction.comments[0] = table.attr('name') + "(0x#{table.attr('address')} -> 0x#{(address + storage_size - 1).to_s(16)}, #{storage_size} bytes)"
+          instruction.data = is_data
+        end
+
+        $stderr.puts "Annotated: #{table.attr('name')}" if verbose
+        count = count + 1
+      end
+      $stderr.puts "#{count} tables annotated." if verbose
+    end
+
+    def annotate_subroutines
+
+    end
+
+    def annotate_code
+      $stderr.puts "Annotating code..." if verbose
+      count = 0
+      found_rom_addresses = {}
+      found_ram_addresses = {}
+      @assembly.each do |instruction|
+        # annotate subroute prologue/epilogue
+        if instruction.assembly =~ /push lr/
+          c = 'begin subroutine'
+          c << " #{subroutine_descriptions[instruction.address]}" if subroutine_descriptions.include? instruction.address
+          instruction.comments << c
+        end
+        if instruction.assembly =~ /jmp lr/ 
+          instruction.comments << 'return'
+        end
+
+        # annotate subroutine calls
+        match = /bl 0x(\w+)/.match(instruction.assembly)
+        if match
+          address = match[1]
+          if subroutine_descriptions.include? address
+            instruction.comments << "Call #{subroutine_descriptions[address]}"
+          end
+        end
+        
+        # annotate table address references
+        address = /0x([\d|[a-f]|[A-F]]+)/.match(instruction.assembly)
+        if address and @reference_addresses.include? address[1]
+          instruction.comments << "contains possible reference to '#{@reference_addresses[address[1]]}'"
+          $stderr.puts "Annotated reference to: #{@reference_addresses[address[1]]} at #{instruction.address}" if verbose
+          count = count + 1
+          found_rom_addresses[@reference_addresses[address[1]]] = true 
+        end
+        
+        # annotate absolute RAM addressing ld24 r4,0x800700
+        match = /(\w+)\s+\w\w,0x(8\w\w\w\w\w)/.match(instruction.assembly)
+        if match
+          address = match[2]
+          display = address_descriptions[address]
+          
+          if match[1] == "ld24"
+            op = "Assign pointer to"
+          else
+            op = "Unknown op on"
+          end
+            
+          if !display.nil? and verbose
+            $stderr.puts "Found reference to absolute RAM address #{address} (#{display})"
+          end
+          instruction.comments << "#{op} RAM address 0x#{address}" + (display.nil? ? '' : " (#{display})")
+          found_ram_addresses[display] = true if !display.nil?
+          count = count + 1
+        end
+
+        # annotate relative RAM addressing
+        match = /(\w+)\s+.+?@\((-?\d+),fp\)/.match(instruction.assembly)
+        if match
+          address = absolute_address match[2].to_i
+          display = address_descriptions[address]
+
+          case match[1]
+          when "lduh"
+            op = "Load unsigned halfword from"
+          when "ldub"
+            op = "Load unsigned byte from"
+          when "ld"
+            op = "Load from"
+          when "ldb"
+            op = "Load byte from"
+          when "st" 
+            op = "Store at"
+          when "stb"
+            op = "Store byte at"
+          when "sth"
+            op = "Store half word at"
+          when "bclr"
+            op = "Clear bit in"
+          else
+            op = "Unknown op on"
+          end
+          if !display.nil? and verbose
+            $stderr.puts "Found reference to relative RAM address #{address} (#{display})"
+          end
+          instruction.comments << "#{op} RAM address 0x#{address}" + (display.nil? ? '' : " (#{display})")
+          found_ram_addresses[display] = true if !display.nil?
+          count = count + 1
+        end
+      
+      end
+
+      $stderr.puts "#{count} lines of code annotated." if verbose
+      if verbose
+        @reference_addresses.each_key do |key|
+          $stderr.puts "Unable to find any reference to table #{@reference_addresses[key]}" if !found_rom_addresses.include? @reference_addresses[key]
+          found_rom_addresses[@reference_addresses[key]] = true # stop multiple reports
+        end
+        address_descriptions.each_key do |key|
+          $stderr.puts "Unable to find any reference to RAM address #{address_descriptions[key]} (#{key})" if !found_ram_addresses.include? address_descriptions[key]
+        end
+      end
+    end
+
+  end
+end

data/lib/helpers.rb

@@ -0,0 +1,84 @@
+module ECUTools
+  module Helpers
+    def rom_id
+      return @rom_id if @rom_id
+      $stderr.puts "Getting ROM ID..." if verbose
+      @rom_id = read_bytes("5002a", 4).join
+    end
+    
+    def read_bytes(address, number)
+      bytes = []
+      start = from_hex address
+      number.times do |n|
+        inst = instruction_at(start + n)
+        bytes << inst.bytes[(start+n) % 4]
+      end
+      bytes
+    end
+    
+    def instruction_at(address, strict = false)
+      address = from_hex address
+      if strict and (address % 4) > 0 
+        raise "Address #{address} does not fall on an instruction boundary and strict is enabled." 
+      end
+      @assembly[(address - (address % 4)) / 4]
+    end
+    
+    def from_hex(address)
+      if address.is_a? String
+        address.to_i(16)
+      else
+        address.to_i
+      end
+    end
+    
+    def base_address
+      return @base_address if @base_address
+      $stderr.puts "Getting base address..." if verbose
+      @assembly.each_with_index do |instruction,i|
+        if instruction.assembly == "st r3,@r0 \|\| nop"
+          match = /ld24 fp,(0x\w+)/.match(@assembly[i+1].assembly)
+          if match
+            @base_address = match[1]
+            @assembly[i+1].comments[0] = "Assign base address to #{@base_address}" 
+            return @base_address
+          end
+        end
+      end
+      
+      $stderr.puts "WARNING: Base address unknown! Setting to 0 (THIS IS WRONG!)" if verbose
+      @base_address = 0 
+    end
+    
+    def absolute_address(relative_address)
+      (base_address.to_i(16) + relative_address).to_s(16)
+    end
+    
+    def address_descriptions
+      return @address_descriptions if @address_descriptions
+      @address_descriptions = {}
+      xml = Nokogiri::XML(File.open(File.dirname(__FILE__) + "/../xml/ram/#{rom_id}.xml"))
+      xml.xpath('/EvoScanDataLogger/vehicle/ecu/Mode2/DataListItem').each do |node|
+        @address_descriptions[node.attr('RequestID')[2..-1]] = node.attr('Display')
+      end
+      
+      @address_descriptions
+    end
+    
+    def subroutine_descriptions
+      return @subroutine_descriptions if @subroutine_descriptions
+      @subroutine_descriptions = {}
+      xml = Nokogiri::XML(File.open(File.dirname(__FILE__) + "/../xml/code/#{rom_id}.xml"))
+      xml.xpath('/rom/routine').each do |node|
+        @subroutine_descriptions[node.attr('address')] = node.attr('name')
+      end
+      
+      @subroutine_descriptions
+    end
+    
+    def rom_xml
+      return @rom_xml if @rom_xml
+      @rom_xml = Nokogiri::XML(File.open(File.dirname(__FILE__) + "/../xml/rom/#{rom_id}.xml"))
+    end
+  end
+end

data/lib/instruction.rb

@@ -0,0 +1,53 @@
+module ECUTools
+  class Instruction
+    
+    def initialize(address, bytes, assembly)
+      @address = address
+      @bytes = bytes
+      @assembly = assembly
+      @comments = []
+      @data = !(/unknown/.match(assembly).nil?)
+    end
+    
+    def to_s
+      s = "0x#{@address}:\t#{@bytes.join(' ')}"
+      s << "\t#{@assembly}" if (!data) 
+      s << "\t; #{@comments.join(', ')}" if @comments.length > 0
+      s
+    end
+    
+    def address
+      @address
+    end
+    
+    def data
+      @data
+    end
+    
+    def data=(val)
+      @data=val
+    end
+    
+    def assembly
+      @assembly
+    end
+    
+    def assembly=(value)
+      @assembly = value
+      # TODO: Update bytes based on assembly instructions
+    end
+    
+    def binary
+      @bytes.join.to_a.pack("H*")
+    end
+    
+    def bytes
+      @bytes
+    end
+    
+    def comments
+      @comments
+    end
+    
+  end
+end