@ecopoesis/homebridge-dmx 0.1.0

package/tools/ghidra/dump-handshake.py

@@ -0,0 +1,76 @@
+# Find + decompile HWM's LSAG_ALL / 0x47 / 0x48 TCP-auth handshake builder.
+# Goal: learn what HWM puts in the 0x48 message — is the X25519 key a fresh
+# ephemeral, or derived from a stored credential? That decides whether the
+# auth is RE-able or needs "Security for Cloud Access" disabled.
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-handshake')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+listing = prog.getListing()
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(fail)\n'
+
+summary = open(os.path.join(OUT, 'SUMMARY.txt'), 'w')
+
+# 1. find interesting strings
+needles = ['LSAG_ALL', 'EccAesCryptography', 'DasNetEcc', 'Cloud', 'Security',
+           'curve25519', 'Curve25519', '25519', 'softwareName', 'authenticat']
+hits = {}
+for d in listing.getDefinedData(True):
+    v = d.getValue()
+    s = None
+    try:
+        if d.hasStringValue(): s = str(v)
+    except Exception:
+        pass
+    if not s: continue
+    for n in needles:
+        if n in s:
+            hits.setdefault(n, []).append((d.getAddress(), s[:90]))
+
+summary.write('=== string hits ===\n')
+for n, lst in hits.items():
+    for a, s in lst[:12]:
+        summary.write('  [%s] %s : %r\n' % (n, a, s))
+
+# 2. xref the LSAG_ALL / Ecc strings -> referencing functions -> decompile
+seen = set()
+def dump_fn(f, tag):
+    ep = str(f.getEntryPoint())
+    if ep in seen: return
+    seen.add(ep)
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:70]
+    with open(os.path.join(OUT, '%s_%s_%s.txt' % (tag, ep, safe)), 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), ep, f.getBody().getNumAddresses()))
+        callees = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCalledFunctions(monitor)))
+        o.write('callees:\n  ' + '\n  '.join(callees) + '\n\n')
+        o.write(decompile(f))
+    summary.write('  dumped %s : %s @ %s\n' % (tag, f.getName(True), ep))
+
+rm = prog.getReferenceManager()
+summary.write('\n=== functions referencing handshake strings ===\n')
+for n in ['LSAG_ALL', 'EccAesCryptography', 'DasNetEcc']:
+    for a, s in hits.get(n, []):
+        for r in rm.getReferencesTo(a):
+            f = fm.getFunctionContaining(r.getFromAddress())
+            if f: dump_fn(f, 'ref_' + n[:8])
+
+summary.write('\n=== total dumped: %d ===\n' % len(seen))
+summary.close()
+print('dump-handshake: %d functions -> %s' % (len(seen), OUT))

package/tools/ghidra/dump-kdf-chain.py

@@ -0,0 +1,105 @@
+# Decompile the X25519 -> AES-256-key KDF call chain.
+# Chain (lldb Path D, ESA2 file addrs):
+#   on_listWidgetDevice_itemSelectionChanged
+#    -> 0x1005e1bd6 -> 0x1005e267b -> 0x1001780d1
+#    -> 0x10010780e -> 0x1003f57c6  (key installer)
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-kdf')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def func_for(a):
+    ad = addr(a)
+    return fm.getFunctionAt(ad) or fm.getFunctionContaining(ad)
+
+def decompile(func):
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        return res.getDecompiledFunction().getC()
+    return '(decompilation failed: %s)\n' % res.getErrorMessage()
+
+def dump(func, out, with_decomp=True):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    if with_decomp:
+        out.write('\n-- decompilation --\n')
+        out.write(decompile(func))
+    out.write('\n')
+
+# Chain call sites -> the function each address sits inside.
+CHAIN = [
+    ('callsite_1005e1bd6', 0x1005e1bd6),
+    ('callsite_1005e267b', 0x1005e267b),
+    ('kdf_outer_1001780d1', 0x1001780d1),
+    ('kdf_1001780d1_fn',   0x1001780d1),
+    ('kdf_inner_10010780e', 0x10010780e),
+    ('key_installer_1003f57c6', 0x1003f57c6),
+]
+
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+seen = set()
+
+# 1. Dump every function in the chain.
+chain_funcs = []
+for label, a in CHAIN:
+    f = func_for(a)
+    if f is None:
+        summary.write('  %-26s 0x%x  (NO FUNCTION)\n' % (label, a))
+        continue
+    ep = f.getEntryPoint()
+    summary.write('  %-26s 0x%x -> %s @ %s  size=%d callees=%d\n' %
+                  (label, a, f.getName(True), ep,
+                   f.getBody().getNumAddresses(),
+                   len(set(f.getCalledFunctions(monitor)))))
+    if str(ep) in seen:
+        continue
+    seen.add(str(ep))
+    chain_funcs.append((label, f))
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:80]
+    with open(os.path.join(OUT_DIR, '1_%s_%s.txt' % (label, safe)), 'w') as o:
+        dump(f, o)
+
+# 2. Decompile every direct callee of the two KDF-critical functions, so the
+#    actual hash/curve arithmetic is visible.
+KDF_CRITICAL = [0x1001780d1, 0x10010780e]
+callee_seen = set(seen)
+for a in KDF_CRITICAL:
+    f = func_for(a)
+    if f is None: continue
+    for callee in sorted(f.getCalledFunctions(monitor), key=lambda x: str(x.getEntryPoint())):
+        ep = str(callee.getEntryPoint())
+        if ep in callee_seen: continue
+        callee_seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', callee.getName(True))[:80]
+        with open(os.path.join(OUT_DIR, '2_callee_%s_%s.txt' %
+                                (callee.getEntryPoint(), safe)), 'w') as o:
+            dump(callee, o)
+        summary.write('    callee %s @ %s size=%d\n' %
+                      (callee.getName(True), callee.getEntryPoint(),
+                       callee.getBody().getNumAddresses()))
+
+summary.write('\n=== chain funcs: %d, callees dumped: %d ===\n' %
+              (len(chain_funcs), len(callee_seen) - len(seen)))
+summary.close()
+print('dump-kdf-chain: done -> %s' % OUT_DIR)

package/tools/ghidra/dump-kdf-context.py

@@ -0,0 +1,72 @@
+# Dump everything around the SHA-1 KDF candidate to confirm role.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out19')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+ROOTS = {
+    'sha1_init_FUN_100407940':       0x100407940,   # 39B — should be a tiny init
+    'sha1_update_FUN_100407970':     0x100407970,   # update
+    'sha1_final_FUN_100407a60':      0x100407a60,   # 615B
+    'kdf_candidate_FUN_10065aad0':   0x10065aad0,   # KDF candidate using sha1 + salt
+    'dest_FUN_1006420d0':            0x1006420d0,   # what kdf writes via
+    'getter_FUN_1006aebb0':          0x1006aebb0,   # what supplies KDF input
+    'kdf_caller_FUN_10065ac20':      0x10065ac20,
+    'kdf_caller_FUN_10065d160':      0x10065d160,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, fp in ROOTS.items():
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        summary.write('  %s 0x%x  (no fn)\n' % (label, fp)); continue
+    summary.write('  %-32s = %s @ %s  size=%d  callees=%d\n' %
+                  (label, f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses(),
+                   len(set(f.getCalledFunctions(monitor)))))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                            (label, f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('dump-kdf-context: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-profile.py

@@ -0,0 +1,59 @@
+# Decompile HmSoftwareProfile::HmSoftwareProfile (+ its callees) — the
+# constructor that hardcodes the software name + the auth key used as the
+# HMAC-SHA256 key for the 0x48 handshake.
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-profile')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+st = prog.getSymbolTable()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(fail)\n'
+
+seen = set()
+def dump(f, tag, depth=0):
+    if f is None or str(f.getEntryPoint()) in seen: return
+    seen.add(str(f.getEntryPoint()))
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:70]
+    cs = sorted(set(f.getCalledFunctions(monitor)), key=lambda x: str(x.getEntryPoint()))
+    with open(os.path.join(OUT, '%s_%s_%s.txt' % (tag, f.getEntryPoint(), safe)), 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), f.getEntryPoint(), f.getBody().getNumAddresses()))
+        o.write('callees: ' + ', '.join(str(c.getEntryPoint()) for c in cs) + '\n\n')
+        o.write(decompile(f))
+    if depth > 0:
+        for c in cs:
+            nm = c.getName(True)
+            if nm.startswith('_') or 'std::' in nm or 'operator' in nm or 'QArray' in nm \
+               or 'QString' in nm or 'QDir' in nm: continue
+            dump(c, tag + '_c', depth - 1)
+
+summary = open(os.path.join(OUT, 'SUMMARY.txt'), 'w')
+
+# find any symbol mentioning HmSoftwareProfile
+hits = []
+for s in st.getAllSymbols(True):
+    n = s.getName(True)
+    if 'HmSoftwareProfile' in n or 'SoftwareProfile' in n:
+        hits.append((n, s.getAddress()))
+summary.write('=== HmSoftwareProfile symbols ===\n')
+for n, a in hits[:40]:
+    summary.write('  %s @ %s\n' % (n, a))
+    f = fm.getFunctionContaining(a)
+    if f and ('HmSoftwareProfile' in f.getName(True)):
+        dump(f, 'profile', depth=2)
+
+summary.write('\n=== dumped %d ===\n' % len(seen))
+summary.close()
+print('dump-profile: %d functions, %d symbol hits -> %s' % (len(seen), len(hits), OUT))

package/tools/ghidra/dump-real-encrypt.py

@@ -0,0 +1,90 @@
+# Dump the ACTUAL encrypt function at FUN_100107950 (Stick3 cipher vt[3]).
+# Plus walk callees to find the keystream generator.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out15')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+# Full Stick3 cipher vtable @ 0x10095F830 (typeinfo_ptr):
+ROOTS = {
+    'vt0_FUN_100177990':  0x100177990,
+    'vt1_FUN_100177CB0':  0x100177CB0,
+    'vt2_FUN_100106290':  0x100106290,
+    'vt3_REAL_ENCRYPT_FUN_100107950': 0x100107950,
+    'vt4_FUN_1001C0650':  0x1001C0650,
+    'vt5_FUN_1001C0A50':  0x1001C0A50,
+    'vt6_FUN_1001C0CF0':  0x1001C0CF0,
+    'vt7_FUN_100180E90':  0x100180E90,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, fp in ROOTS.items():
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        summary.write('  %s 0x%x  (no fn)\n' % (label, fp))
+        continue
+    summary.write('  %-40s = %s @ %s  size=%d  callees=%d\n' %
+                  (label, f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses(),
+                   len(set(f.getCalledFunctions(monitor)))))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                            (label, f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+# Walk into real-encrypt's callees
+enc = fm.getFunctionAt(addr(0x100107950))
+if enc:
+    summary.write('\n=== depth-1 callees of real encrypt fn ===\n')
+    for c in sorted(enc.getCalledFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('  callee: %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'depth1_%s_%s.txt' %
+                                (c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('dump-real-encrypt: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-secret.py

@@ -0,0 +1,84 @@
+# Decompile the 33-byte-secret deobfuscator + locate its obfuscated source,
+# and find the initializer that populates the P-256 curve constants.
+# @category Stick
+
+import os, struct
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-secret')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+rm = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def rd(a, n):
+    buf = bytearray(n)
+    try:
+        mem.getBytes(addr(a), buf); return bytes(buf)
+    except Exception:
+        return None
+
+def decompile(func):
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        return res.getDecompiledFunction().getC()
+    return '(decompile failed: %s)\n' % res.getErrorMessage()
+
+out = open(os.path.join(OUT_DIR, 'REPORT.txt'), 'w')
+
+# memory blocks
+out.write('=== MEMORY BLOCKS ===\n')
+for b in mem.getBlocks():
+    out.write('  %-20s %s - %s  init=%s  %s\n' %
+              (b.getName(), b.getStart(), b.getEnd(),
+               b.isInitialized(), 'rwx'[0] if b.isRead() else '-'))
+
+# deobfuscators + network exchange + state getter
+out.write('\n=== DEOBFUSCATORS / NETWORK / STATE ===\n')
+for fp, label in [(0x100180E90, 'vt38_deobf_180E90'),
+                  (0x100180D40, 'deobf_180D40'),
+                  (0x1001C0650, 'vt20_net_exchange_1C0650'),
+                  (0x1001C0A50, 'vt28_state_getter_1C0A50'),
+                  (0x1001C0CF0, 'vt30_1C0CF0'),
+                  (0x1004029b0, 'EC_decomp_rhs_4029b0')]:
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        out.write('%s: no fn\n' % label); continue
+    out.write('\n---- %s : %s @ %s ----\n' % (label, f.getName(True), f.getEntryPoint()))
+    out.write(decompile(f))
+
+# hunt the obfuscated 33-byte source: scan __const for plausible region,
+# and read candidate addresses
+out.write('\n=== CANDIDATE OBFUSCATED-SECRET BYTES ===\n')
+for a in [0x1007b0490, 0x1007b04a0, 0x1007af9c0, 0x1007c0240, 0x1007c0250]:
+    b = rd(a, 0x21)
+    out.write('  0x%x : %s\n' % (a, b.hex() if b else '(unreadable)'))
+
+# references to curve-constant addresses -> find the initializer
+out.write('\n=== XREFS TO CURVE CONSTANTS ===\n')
+for ca, label in [(0x100cf5bf0, 'prime_p'), (0x100cf5c10, 'order_n'),
+                   (0x100cf5c30, 'generator_G'), (0x100cf8d11, 'decoded_secret')]:
+    out.write('\n-- %s @ 0x%x --\n' % (label, ca))
+    refs = rm.getReferencesTo(addr(ca))
+    cnt = 0
+    for r in refs:
+        cnt += 1
+        if cnt > 30:
+            out.write('  ... (more)\n'); break
+        fa = r.getFromAddress()
+        f = fm.getFunctionContaining(fa)
+        out.write('  %s  %s  from %s\n' %
+                  (r.getReferenceType(), fa,
+                   (f.getName(True) + ' @ ' + str(f.getEntryPoint())) if f else '(no fn)'))
+
+out.close()
+print('dump-secret: done -> %s' % OUT_DIR)

package/tools/ghidra/dump-setsoftware.py

@@ -0,0 +1,63 @@
+# Find XHL_XHardwareLibrary::setSoftware() and its caller — the caller passes
+# the hardcoded software-code / software-name / software-KEY. That key is the
+# HMAC-SHA256 key for the 0x48 auth handshake. Also decompile the hash init
+# (FUN_100408420) to confirm the hash algorithm.
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-sw')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+rm = prog.getReferenceManager()
+mem = prog.getMemory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(fail)\n'
+
+seen = set()
+def dump(f, tag, callers=False):
+    if f is None or str(f.getEntryPoint()) in seen: return
+    seen.add(str(f.getEntryPoint()))
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:60]
+    with open(os.path.join(OUT, '%s_%s_%s.txt' % (tag, f.getEntryPoint(), safe)), 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), f.getEntryPoint(), f.getBody().getNumAddresses()))
+        cs = sorted(set(f.getCalledFunctions(monitor)), key=lambda x: str(x.getEntryPoint()))
+        o.write('callees: ' + ', '.join(str(c.getEntryPoint()) for c in cs) + '\n\n')
+        o.write(decompile(f))
+    if callers:
+        for c in sorted(set(f.getCallingFunctions(monitor)), key=lambda x: str(x.getEntryPoint())):
+            dump(c, tag + '_caller', False)
+
+summary = open(os.path.join(OUT, 'SUMMARY.txt'), 'w')
+
+# 1. setSoftware — xref the __PRETTY_FUNCTION__ string at 0x10081a947
+summary.write('=== setSoftware (xref 0x10081a947) ===\n')
+for r in rm.getReferencesTo(addr(0x10081a947)):
+    f = fm.getFunctionContaining(r.getFromAddress())
+    if f:
+        summary.write('  setSoftware = %s @ %s\n' % (f.getName(True), f.getEntryPoint()))
+        dump(f, '1_setSoftware', callers=True)
+
+# 2. the hash init/update/final used by the HMAC
+summary.write('\n=== HMAC hash primitives ===\n')
+for fp, t in [(0x100408420, '2_hash_init'), (0x10040aee0, '2_hash_update'),
+              (0x10040afb0, '2_hash_final'), (0x10040b290, '2_hash_oneshot')]:
+    f = fm.getFunctionAt(addr(fp))
+    if f: dump(f, t, False)
+
+# 3. also dump bytes around the "software" cstring region for nearby key data
+summary.write('\n=== done, %d fns ===\n' % len(seen))
+summary.close()
+print('dump-setsoftware: %d functions -> %s' % (len(seen), OUT))