@ecopoesis/homebridge-dmx 0.1.0

package/tools/ghidra/dump-011c-callers.py

@@ -0,0 +1,140 @@
+# Dump the call chain around FUN_1001bbca0 (the 0x011c reply handler):
+#   - its 2 callers (FUN_1001bbc50, FUN_1001bc350) - see how param_3=0x00ec is set
+#     and what they DO with the 236-byte plaintext
+#   - FUN_1003f5740 (AES key install), FUN_1003f68e0 (AES-CBC decrypt)
+#   - FUN_1001ee4d0 (build_msg used here), FUN_1001f2c80 (register pending reply)
+#   - find the Stick3 device's vtable[+0xe8] function (the AES key getter)
+#
+# Also: dump the cross-refs to vt[+0xe8] = slot at offset 0xe8 (i.e. slot 29)
+# for the Stick3 device class vtables.
+#
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-011c-callers')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+listing = prog.getListing()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(decompile failed)\n'
+
+def dump_fn(ep, label):
+    a = addr(ep)
+    f = fm.getFunctionAt(a) or fm.getFunctionContaining(a)
+    if not f:
+        with open(os.path.join(OUT, '%s_%x.txt' % (label, ep)), 'w') as o:
+            o.write('NO FUNCTION at 0x%x\n' % ep)
+        return None
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:80]
+    fname = os.path.join(OUT, '%s_%s_%s.txt' % (label, f.getEntryPoint(), safe))
+    with open(fname, 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), f.getEntryPoint(), f.getBody().getNumAddresses()))
+        callees = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCalledFunctions(monitor)))
+        callers = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCallingFunctions(monitor)))
+        o.write('-- callees (%d) --\n  ' % len(callees) + '\n  '.join(callees) + '\n')
+        o.write('\n-- callers (%d) --\n  ' % len(callers) + '\n  '.join(callers) + '\n\n')
+        o.write('-- decompilation --\n')
+        o.write(decompile(f))
+    return f
+
+TARGETS = [
+    (0x1001bbc50, 'caller1'),       # caller of FUN_1001bbca0
+    (0x1001bc350, 'caller2'),       # caller of FUN_1001bbca0
+    (0x1001bbca0, 'handler_011c'),  # FUN_1001bbca0 itself, for reference
+    (0x1003f5740, 'aes_key_install'),
+    (0x1003f68e0, 'aes_cbc_decrypt'),
+    (0x1003f4530, 'aes_cfb_key_install'),
+    (0x1001ee4d0, 'build_msg'),
+    (0x1001f2c80, 'register_pending'),
+    (0x100195b20, 'get_reply_buf'),
+    (0x100195ec0, 'wait_reply'),
+    (0x1001b0df0, 'get_socket'),
+]
+
+print('dumping handler-related functions ...')
+for ep, label in TARGETS:
+    dump_fn(ep, label)
+
+# Hunt the vtable+0xe8 entry. We look at the existing Stick3-class typeinfo
+# pointers (from memory note) and try to identify the primary vtable.
+# Stick3ANet typeinfo @ 0x100970160 -- vtable for Stick3ANet is at
+# typeinfo - sizeof(some Itanium ABI overhead). Easier: find every place
+# in code where ".vt[0xe8]" is loaded then called for that device, and
+# dump those callees.
+print('finding vtable[+0xe8] load sites ...')
+ec_callsites = []
+instr_iter = listing.getInstructions(True)
+while instr_iter.hasNext():
+    ins = instr_iter.next()
+    # Pattern: "mov rax, [r?+0xe8]" followed shortly by "call rax".
+    # In Ghidra, easiest is to look at the mnemonic + scalar.
+    if ins.getMnemonicString() not in ('MOV', 'CALL', 'JMP'):
+        continue
+    for i in range(ins.getNumOperands()):
+        for o in ins.getOpObjects(i):
+            try:
+                v = o.getValue() if hasattr(o, 'getValue') else None
+            except Exception:
+                v = None
+            if v == 0xe8:
+                ec_callsites.append((str(ins.getAddress()), ins.toString()))
+print('e8 displacement sites: %d' % len(ec_callsites))
+
+with open(os.path.join(OUT, 'vt_e8_sites.txt'), 'w') as o:
+    o.write('=== instructions with 0xe8 as a scalar operand ===\n')
+    for a, t in ec_callsites:
+        f = fm.getFunctionContaining(addr(int(a, 16)))
+        fn = f.getName(True) if f else '?'
+        o.write('  %s  %s  in %s\n' % (a, t, fn))
+
+# Dump FUN_1001bbca0's caller of vt[+0xe8] specifically.
+# Use the bytes pattern: search the binary for instruction sequences
+# that look like "callq [reg+0xe8]" -- in x86-64 that's FF 90 e8 00 00 00
+# or FF 50 + sign-extended -- "FF 90 E8 00 00 00".
+print('searching for byte pattern FF 90 E8 00 00 00 (call [reg+0xe8]) ...')
+pattern = bytes([0xff, 0x90, 0xe8, 0x00, 0x00, 0x00])
+mem_blocks = [b for b in mem.getBlocks() if b.isInitialized() and b.isExecute()]
+hits = []
+for block in mem_blocks:
+    start = block.getStart().getOffset()
+    end = block.getEnd().getOffset()
+    size = end - start + 1
+    if size > 64*1024*1024: continue
+    buf = bytearray(size)
+    try:
+        block.getBytes(block.getStart(), buf)
+    except Exception:
+        continue
+    i = 0
+    while True:
+        idx = buf.find(pattern, i)
+        if idx == -1: break
+        hits.append(start + idx)
+        i = idx + 1
+print('found %d call-via-[reg+0xe8] sites' % len(hits))
+
+with open(os.path.join(OUT, 'vt_e8_calls.txt'), 'w') as o:
+    o.write('=== call [reg+0xe8] sites (FF 90 E8 00 00 00) ===\n')
+    for h in hits:
+        a = addr(h)
+        f = fm.getFunctionContaining(a)
+        fn = f.getName(True) if f else '?'
+        o.write('  0x%x  in %s\n' % (h, fn))
+
+print('dump-011c-callers: done -> %s' % OUT)

package/tools/ghidra/dump-011c-handler.py

@@ -0,0 +1,158 @@
+# Find HWM's opcode-0x011c receive-handler + the 0x011 (go-live) precondition
+# check.
+#
+# Strategy: scan every instruction for immediate operands matching the
+# interesting constants and group by containing function:
+#   * 0x011c (= 284) -- the opcode we send + the reply length, almost
+#     certainly appears in HWM as a switch-case or `cmp r, 0x11c`.
+#   * 0x00ec (= 236) -- a 2-byte marker inside the 0x011c reply's
+#     258-byte payload at relative offset +0x12. A parser that examines
+#     the payload will compare against this constant.
+#   * 0x011  (= 17)  -- the go-live opcode. Very common immediate, so we
+#     ONLY take hits whose containing function ALSO references 0x011c or
+#     a Stick3 magic string, to filter false positives.
+#
+# Output goes to out-011c/.
+#
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-011c')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+listing = prog.getListing()
+rm = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(decompile failed)\n'
+
+def safe_name(f):
+    return re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:80]
+
+# ---------------------------------------------------------------------------
+# 1. Walk every instruction once; collect operand scalars we care about.
+# ---------------------------------------------------------------------------
+TARGETS = {0x011c, 0x00ec, 0x0011, 0x0010, 0x000f}
+hits = {v: {} for v in TARGETS}   # value -> { func_entry -> [addrs] }
+
+print('scanning instructions ...')
+total = 0
+instr_iter = listing.getInstructions(True)
+while instr_iter.hasNext():
+    ins = instr_iter.next()
+    total += 1
+    for i in range(ins.getNumOperands()):
+        objs = ins.getOpObjects(i)
+        for o in objs:
+            try:
+                v = o.getValue() if hasattr(o, 'getValue') else None
+            except Exception:
+                v = None
+            if v in TARGETS:
+                f = fm.getFunctionContaining(ins.getAddress())
+                if f is None: continue
+                ep = str(f.getEntryPoint())
+                hits[v].setdefault(ep, []).append(str(ins.getAddress()))
+print('scanned %d instructions' % total)
+
+# ---------------------------------------------------------------------------
+# 2. Identify "interesting" functions: any function that references 0x011c
+#    OR 0x00ec is a prime candidate (these constants are rare). 0x10/0x11/0xf
+#    are kept only if the SAME function also references 0x011c or 0x00ec.
+# ---------------------------------------------------------------------------
+prime = set(hits[0x011c].keys()) | set(hits[0x00ec].keys())
+
+# ---------------------------------------------------------------------------
+# 3. Also xref the Stick magic strings -- so we capture the network-receive
+#    dispatch even if it doesn't use 0x011c as a literal.
+# ---------------------------------------------------------------------------
+magic_xrefs = set()
+needles = ['Stick_3A', 'LSAG_ALL', 'Stick_U1', 'Siudi_7B']
+for d in listing.getDefinedData(True):
+    try:
+        if not d.hasStringValue(): continue
+        s = str(d.getValue())
+    except Exception:
+        continue
+    if s not in needles: continue
+    for r in rm.getReferencesTo(d.getAddress()):
+        f = fm.getFunctionContaining(r.getFromAddress())
+        if f: magic_xrefs.add(str(f.getEntryPoint()))
+
+# ---------------------------------------------------------------------------
+# 4. Dump.
+# ---------------------------------------------------------------------------
+summary = open(os.path.join(OUT, 'SUMMARY.txt'), 'w')
+summary.write('=== immediate-operand hit counts ===\n')
+for v in sorted(TARGETS):
+    summary.write('  0x%04x : %d functions, %d sites\n' %
+                  (v, len(hits[v]), sum(len(x) for x in hits[v].values())))
+summary.write('  magic-string xref funcs: %d\n' % len(magic_xrefs))
+summary.write('\n=== functions referencing 0x011c ===\n')
+for ep in sorted(hits[0x011c].keys()):
+    f = fm.getFunctionAt(af.getDefaultAddressSpace().getAddress(int(ep, 16)))
+    if not f: continue
+    summary.write('  %s  %s  sites=%d  size=%d  also_0xec=%s  magic_xref=%s\n' % (
+        ep, f.getName(True), len(hits[0x011c][ep]),
+        f.getBody().getNumAddresses(),
+        'Y' if ep in hits[0x00ec] else 'n',
+        'Y' if ep in magic_xrefs else 'n'))
+
+summary.write('\n=== functions referencing 0x00ec ===\n')
+for ep in sorted(hits[0x00ec].keys()):
+    f = fm.getFunctionAt(af.getDefaultAddressSpace().getAddress(int(ep, 16)))
+    if not f: continue
+    summary.write('  %s  %s  sites=%d  size=%d  also_0x11c=%s  magic_xref=%s\n' % (
+        ep, f.getName(True), len(hits[0x00ec][ep]),
+        f.getBody().getNumAddresses(),
+        'Y' if ep in hits[0x011c] else 'n',
+        'Y' if ep in magic_xrefs else 'n'))
+
+# Anchor list: every prime func, plus magic-xref funcs that also touch 0x11
+# (those are the network-dispatch loops).
+dump_set = set(prime)
+for ep in magic_xrefs:
+    if ep in hits[0x0011] or ep in hits[0x0010] or ep in hits[0x000f]:
+        dump_set.add(ep)
+
+summary.write('\n=== dumping %d candidate functions ===\n' % len(dump_set))
+for ep in sorted(dump_set):
+    addr = af.getDefaultAddressSpace().getAddress(int(ep, 16))
+    f = fm.getFunctionAt(addr) or fm.getFunctionContaining(addr)
+    if not f: continue
+    name = safe_name(f)
+    sites_11c = hits[0x011c].get(ep, [])
+    sites_ec  = hits[0x00ec].get(ep, [])
+    fname = os.path.join(OUT, 'fn_%s_%s.txt' % (ep, name))
+    with open(fname, 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), f.getEntryPoint(), f.getBody().getNumAddresses()))
+        o.write('sites of 0x011c : %s\n' % ', '.join(sites_11c))
+        o.write('sites of 0x00ec : %s\n' % ', '.join(sites_ec))
+        o.write('sites of 0x0011 : %s\n' % ', '.join(hits[0x0011].get(ep, [])))
+        o.write('sites of 0x0010 : %s\n' % ', '.join(hits[0x0010].get(ep, [])))
+        o.write('sites of 0x000f : %s\n' % ', '.join(hits[0x000f].get(ep, [])))
+        o.write('magic-string xref: %s\n' % ('YES' if ep in magic_xrefs else 'no'))
+        callees = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCalledFunctions(monitor)))
+        callers = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCallingFunctions(monitor)))
+        o.write('\n-- callees (%d) --\n  ' % len(callees) + '\n  '.join(callees) + '\n')
+        o.write('\n-- callers (%d) --\n  ' % len(callers) + '\n  '.join(callers) + '\n\n')
+        o.write('-- decompilation --\n')
+        o.write(decompile(f))
+    summary.write('  dumped %s -> fn_%s_%s.txt\n' % (f.getName(True), ep, name))
+
+summary.close()
+print('dump-011c-handler: %d functions -> %s' % (len(dump_set), OUT))

package/tools/ghidra/dump-aes-candidates.py

@@ -0,0 +1,99 @@
+# Dump all candidate AES encrypt method addresses + walk one hop deep into
+# the most-promising primary candidate (DasEccStreamCryptography vt[3] @
+# 0x100108200) so we see the actual AES round logic / S-box.
+#
+# Vtables under inspection:
+#   AesOStream primary @ vptr 0x100851B20: vt[0]=0x100105900, vt[1]=0x1001059B0
+#   AesOStream secondary @ vptr 0x100851B48: vt[0]=0x100105950, vt[1]=0x100105A10
+#   DasEccStreamCryptography primary @ vptr 0x100851F38:
+#     vt[0]=0x100107BA0, vt[1]=0x100107BD0, vt[2]=0x100106290, vt[3]=0x100108200
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out8')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+CANDIDATES = {
+    'AesOStream_primary_vt0':       0x100105900,
+    'AesOStream_primary_vt1':       0x1001059B0,
+    'AesOStream_secondary_vt0':     0x100105950,
+    'AesOStream_secondary_vt1':     0x100105A10,
+    'DasEccStreamCrypto_vt0':       0x100107BA0,
+    'DasEccStreamCrypto_vt1':       0x100107BD0,
+    'DasEccStreamCrypto_vt2':       0x100106290,
+    'DasEccStreamCrypto_vt3_ENC?':  0x100108200,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, fp in CANDIDATES.items():
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        summary.write('  %s 0x%x  (no fn)\n' % (label, fp))
+        continue
+    summary.write('  %-32s = %s @ %s  size=%d  callees=%d\n' %
+                  (label, f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses(),
+                   len(set(f.getCalledFunctions(monitor)))))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                            (label, f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+# Walk one deeper into the candidate encrypt (DasEccStreamCrypto vt[3])
+candidate_enc = fm.getFunctionAt(addr(0x100108200))
+if candidate_enc:
+    summary.write('\n=== depth-1 callees of DasEccStreamCrypto vt[3] (candidate ENCRYPT) ===\n')
+    for c in sorted(candidate_enc.getCalledFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('  callee: %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'depth1_%s_%s.txt' %
+                                (c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('dump-aes-candidates: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-anchors.py

@@ -0,0 +1,192 @@
+# Ghidra headless post-script — dump the named anchor functions in the
+# 2024-03-21 ESA2 HardwareManager so we can locate the real DMX cipher.
+#
+# This is Jython 2.7 (Ghidra script API). Run via analyzeHeadless:
+#
+#   $(brew --prefix)/share/ghidra/support/analyzeHeadless \
+#       tools/ghidra HwmESA2 \
+#       -import /Applications/ESA2/HardwareManager/HardwareManager.app/Contents/MacOS/HardwareManager \
+#       -scriptPath tools/ghidra \
+#       -postScript dump-anchors.py
+#
+# Output lands in tools/ghidra/out/.
+#
+# Anchors (from stick-aes-symbolized-breakthrough memory):
+#   * DmxUniversePage::onTimerSendReceive  @ 0x100074090 (NOT live path)
+#   * DmxWidget::onTimerSendAndReceive     (live path; posts QtConcurrent task)
+#   * aes_encrypt_key128 / aes_encrypt / fcrypt_*  — Gladman (NOT DMX cipher)
+#   * CryptDmxUniverse / AesOStream / AesIStream   — RTTI-only (no method names)
+#   * DasEccAesCryptography / DasDhRsaCryptography / DasEccStreamCryptography
+#
+# Goal: for each named function, write its decompilation + callers/callees so
+# we can walk:  DmxWidget::onTimerSendAndReceive -> QtConcurrent::run target
+# -> custom AES encrypt -> sendto(2). Also note xrefs into the RTTI strings
+# (CryptDmxUniverse etc.) — those reach the vtables; vtable entries are the
+# method addresses even when symbol names are absent.
+
+# @category Stick
+
+import os, re
+
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out')
+try:
+    os.makedirs(OUT_DIR)
+except OSError:
+    pass
+
+# Symbols we want decompiled (substring match, case-sensitive).
+WANTED_SUBSTRINGS = [
+    # Live DMX path
+    'onTimerSendAndReceive',
+    'onTimerSendReceive',
+    'sendDmx',
+    'receiveDmx',
+    # Qt async dispatch
+    'QtConcurrent',
+    # Known-not-DMX Gladman (sanity check + showfile/cloud crypto)
+    'aes_encrypt_key128',
+    'aes_encrypt_key',
+    'aes_encrypt',
+    'aes_decrypt',
+    'fcrypt_init',
+    'fcrypt_encrypt',
+    'fcrypt_decrypt',
+    # RTTI-anchored classes (likely only as data; we still report addresses)
+    'CryptDmxUniverse',
+    'AesOStream',
+    'AesIStream',
+    'DasEccAesCryptography',
+    'DasDhRsaCryptography',
+    'DasEccStreamCryptography',
+    'DasCryptography',
+    # libc sinks worth seeing callers of
+    'sendto',
+]
+
+# Known explicit addresses (file vmaddr) to dump if symbol lookup misses them.
+EXPLICIT_ADDRS = [
+    0x100074090,  # DmxUniversePage::onTimerSendReceive (per memory)
+    0x1006d2150,  # aes_encrypt_key128 (per memory)
+    0x1006d2d30,  # aes_encrypt_key
+    0x1006d0600,  # aes_encrypt
+    0x1006d1380,  # aes_decrypt
+    0x1006d4990,  # aes_init
+    0x1006d49f0,  # fcrypt_init
+    0x1006d4b10,  # fcrypt_encrypt
+    0x1006d4c10,  # fcrypt_decrypt
+]
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+st = prog.getSymbolTable()
+af = prog.getAddressFactory()
+listing = prog.getListing()
+monitor = ConsoleTaskMonitor()
+
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a):
+    return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump_function(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('signature: %s\n' % func.getPrototypeString(True, True))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+
+    # Callees
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees:
+        out.write('  ' + c + '\n')
+
+    # Callers
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers:
+        out.write('  ' + c + '\n')
+
+    # Decompilation
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 120, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+def find_funcs_by_substring(subs):
+    hits = {}
+    # Walk all defined functions
+    for f in fm.getFunctions(True):
+        name = f.getName(True)  # includes namespace
+        for s in subs:
+            if s in name:
+                hits.setdefault(s, []).append(f)
+    # Also walk symbol table for non-function symbols (RTTI strings etc.)
+    extra = []
+    for sym in st.getAllSymbols(False):
+        name = sym.getName(True)
+        for s in subs:
+            if s in name and not fm.getFunctionAt(sym.getAddress()):
+                extra.append((s, sym))
+    return hits, extra
+
+
+hits, extras = find_funcs_by_substring(WANTED_SUBSTRINGS)
+
+summary_path = os.path.join(OUT_DIR, 'SUMMARY.txt')
+with open(summary_path, 'w') as summary:
+    summary.write('Ghidra anchor dump for ESA2 HardwareManager (2024-03-21)\n')
+    summary.write('Binary: %s\n\n' % prog.getExecutablePath())
+
+    summary.write('=== Function hits by substring ===\n')
+    for s in WANTED_SUBSTRINGS:
+        funcs = hits.get(s, [])
+        summary.write('%-32s %d function(s)\n' % (s, len(funcs)))
+        for f in funcs:
+            summary.write('    %s @ %s\n' % (f.getName(True), f.getEntryPoint()))
+    summary.write('\n=== Non-function symbols (RTTI, data, etc.) ===\n')
+    for s, sym in extras:
+        summary.write('%-32s %s @ %s\n' % (s, sym.getName(True), sym.getAddress()))
+
+# Dump each matched function to its own file
+seen = set()
+for s, funcs in hits.items():
+    for f in funcs:
+        ep = f.getEntryPoint()
+        if ep in seen:
+            continue
+        seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        path = os.path.join(OUT_DIR, '%s_%s.txt' % (ep, safe))
+        with open(path, 'w') as out:
+            dump_function(f, out)
+
+# Also dump the explicit addresses (in case symbol lookup missed any)
+for raw in EXPLICIT_ADDRS:
+    a = addr(raw)
+    f = fm.getFunctionAt(a)
+    if f is None:
+        f = fm.getFunctionContaining(a)
+    if f is None:
+        continue
+    ep = f.getEntryPoint()
+    if ep in seen:
+        continue
+    seen.add(ep)
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    path = os.path.join(OUT_DIR, '%s_%s.txt' % (ep, safe))
+    with open(path, 'w') as out:
+        dump_function(f, out)
+
+print('dump-anchors: %d functions dumped to %s' % (len(seen), OUT_DIR))
+print('dump-anchors: summary at %s' % summary_path)

package/tools/ghidra/dump-auth2.py

@@ -0,0 +1,50 @@
+# Decompile the 0x48 body builder (FUN_1001ee530), the 0x47 body builder
+# (FUN_1001ee730), the packet wrapper (FUN_1001e3890), and authenticate()'s
+# caller (FUN_10019e4d0) — to see exactly what the 0x48 auth message contains.
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-auth2')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(fail)\n'
+
+seen = set()
+def dump(fp, label, depth=0):
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None or str(f.getEntryPoint()) in seen: return
+    seen.add(str(f.getEntryPoint()))
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:60]
+    callees = sorted(set(f.getCalledFunctions(monitor)), key=lambda x: str(x.getEntryPoint()))
+    with open(os.path.join(OUT, '%s_%s.txt' % (label, f.getEntryPoint())), 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), f.getEntryPoint(), f.getBody().getNumAddresses()))
+        o.write('callees: ' + ', '.join('%s' % c.getEntryPoint() for c in callees) + '\n\n')
+        o.write(decompile(f))
+    # one level of non-libc callees for the body builders
+    if depth > 0:
+        for c in callees:
+            nm = c.getName(True)
+            if nm.startswith('_') or 'std::' in nm or 'operator' in nm: continue
+            dump(int(str(c.getEntryPoint()), 16), label + '_c', depth - 1)
+
+for fp, label in [(0x1001ee530, 'build_0x48'),
+                  (0x1001ee730, 'build_0x47'),
+                  (0x1001e3890, 'packet_wrap'),
+                  (0x10019e4d0, 'auth_caller')]:
+    dump(fp, label, depth=1)
+
+print('dump-auth2: %d functions -> %s' % (len(seen), OUT))