@ecopoesis/homebridge-dmx 0.1.0

package/tools/ghidra/find-ctor.py

@@ -0,0 +1,109 @@
+# Locate the constructor(s) of XHL_Stick3CryptDmxUniverse and the
+# DasEccStreamCryptography subobject it embeds.
+#
+# Method: in x86_64 PIC code, a constructor sets the object's vptr via
+#   lea rax, [rip + delta]    ; rax = address of vt slot 0
+#   mov [rdi], rax            ; obj->vptr = rax
+# Ghidra creates a Reference of type DATA from the lea instruction's address
+# to the vtable's slot-0 address.
+#
+# So xrefs to vptr values from CODE locations = constructor / VTT setup.
+#
+# Vptrs of interest (per our fixup mining):
+#   Stick3CryptDmxUniverse  primary  vptr = 0x100962BE8  (= vt site + 8)
+#   Stick3CryptDmxUniverse  sub1     vptr = 0x100962CC8
+#   Stick3CryptDmxUniverse  sub2     vptr = 0x100962CF0
+#   Stick3CryptDmxUniverse  sub3     vptr = 0x100962D30
+#   Stick3CryptDmxUniverse  sub4     vptr = 0x100962D68
+#   Stick3CryptDmxUniverse  sub5     vptr = 0x100962DA8
+#   DasEccStreamCryptography vptr   = 0x100851F38
+#   DasEccAesCryptography    vptr   = 0x100851D88
+#   AesOStream               vptr   = 0x100851B20
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out9')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+ref_mgr = prog.getReferenceManager()
+mem = prog.getMemory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+VPTRS = {
+    'Stick3_primary':           0x100962BE8,
+    'Stick3_sub1':              0x100962CC8,
+    'Stick3_sub2':              0x100962CF0,
+    'Stick3_sub3':              0x100962D30,
+    'Stick3_sub4':              0x100962D68,
+    'Stick3_sub5':              0x100962DA8,
+    'DasEccStreamCryptography': 0x100851F38,
+    'DasEccAesCryptography':    0x100851D88,
+    'AesOStream':               0x100851B20,
+    'AesOStream_sec':           0x100851B48,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, vptr in VPTRS.items():
+    a = addr(vptr)
+    summary.write('\n#### %s  vptr @ 0x%x\n' % (label, vptr))
+    refs = list(ref_mgr.getReferencesTo(a))
+    code_callers = set()
+    for r in refs:
+        fa = r.getFromAddress()
+        f = fm.getFunctionContaining(fa)
+        if f is not None:
+            code_callers.add(f.getEntryPoint())
+        else:
+            summary.write('   data ref @ %s (no fn)\n' % fa)
+    summary.write('   code refs from %d function(s):\n' % len(code_callers))
+    for ep in sorted(code_callers):
+        f = fm.getFunctionAt(ep)
+        summary.write('     %s @ %s  (size %d)\n' %
+                      (f.getName(True), f.getEntryPoint(),
+                       f.getBody().getNumAddresses()))
+        if f.getEntryPoint() in seen: continue
+        seen.add(f.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                                (label, f.getEntryPoint(), safe)), 'w') as o:
+            dump(f, o)
+
+summary.write('\n=== total dumped: %d ===\n' % len(seen))
+summary.close()
+print('find-ctor: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/find-md5.py

@@ -0,0 +1,97 @@
+# Find every function that references the MD5 init constants table
+# at 0x1007C0290. That table is the H0 = {A,B,C,D} = {0x67452301, ...}.
+# The function reading it IS the MD5 init / compute function. From there
+# we can find callers and identify the KDF that produces the AES key.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out18')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+# Find any function that references the MD5 init table at 0x1007C0290.
+MD5_ADDR = 0x1007C0290
+summary.write('Refs to MD5 init constants @ 0x%x\n\n' % MD5_ADDR)
+refs = list(ref_mgr.getReferencesTo(addr(MD5_ADDR)))
+summary.write('total refs: %d\n' % len(refs))
+code_callers = set()
+for r in refs:
+    fa = r.getFromAddress()
+    rt = r.getReferenceType().getName()
+    f = fm.getFunctionContaining(fa)
+    if f is not None:
+        code_callers.add(f.getEntryPoint())
+        summary.write('  ref @ %s (%s) -> fn %s @ %s\n' %
+                      (fa, rt, f.getName(True), f.getEntryPoint()))
+    else:
+        summary.write('  ref @ %s (%s) - no fn\n' % (fa, rt))
+
+# Dump each MD5-using function + its callers (one hop UP)
+summary.write('\n=== MD5-init users + their callers ===\n')
+for ep in sorted(code_callers):
+    f = fm.getFunctionAt(ep)
+    if f is None: continue
+    summary.write('\n  MD5_user: %s @ %s (size %d)\n' %
+                  (f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses()))
+    summary.write('    callers of this fn:\n')
+    for c in sorted(f.getCallingFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('      %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+    # Dump the MD5 user itself
+    if ep not in seen:
+        seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'md5_user_%s_%s.txt' %
+                                (f.getEntryPoint(), safe)), 'w') as o:
+            dump(f, o)
+    # Dump each caller too
+    for c in f.getCallingFunctions(monitor):
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'md5_caller_%s_%s.txt' %
+                                (c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('find-md5: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/find-secret-users.py

@@ -0,0 +1,98 @@
+# Find every function that reads the deobfuscated hardcoded 33-byte secret.
+#
+# The chain is:
+#   obfuscated raw bytes  @ 0x1007B0490 (33 bytes in __TEXT __const)
+#   FUN_100182c80(&DAT_100cf8cf0, &DAT_1007b0490)  loads them to __DATA
+#   cipher vt[7] (FUN_100180E90) XORs with mask 0x51..0x71, leaves decoded
+#       buffer at &DAT_100cf8d11, returns its address
+#   <somebody> calls vt[7], reads 33 bytes, uses for cipher state seeding
+#
+# Anyone calling vt[7] via `(*((cipher)->vptr + 0x38))(cipher)` would not
+# show as a direct ref to FUN_100180E90. But anyone READING addresses
+# 0x100cf8cf0 / 0x100cf8d11 / 0x1007b0490 directly would.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out17')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# Addresses involved in the hardcoded-secret deobfuscation
+TARGETS = {
+    'raw_obfuscated':       0x1007B0490,   # 33 bytes XOR-masked
+    'staging_buffer':       0x100CF8CF0,   # bytes loaded here, then XOR'd
+    'decoded_pointer':      0x100CF8D11,   # vt[7] returns this; decoded bytes start
+    'guard_byte':           0x100CF8D38,   # __cxa_guard for one-time init
+    'deobfuscator_fn':      0x100180E90,
+    'loader_fn':            0x100182C80,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, a in TARGETS.items():
+    summary.write('\n#### %s @ 0x%x\n' % (label, a))
+    code_refs = set()
+    refs = list(ref_mgr.getReferencesTo(addr(a)))
+    summary.write('   total refs: %d\n' % len(refs))
+    for r in refs:
+        fa = r.getFromAddress()
+        rtype = r.getReferenceType().getName()
+        f = fm.getFunctionContaining(fa)
+        if f is not None:
+            code_refs.add(f.getEntryPoint())
+        else:
+            summary.write('     %s @ %s  (%s, not in any fn)\n' %
+                          (label, fa, rtype))
+    summary.write('   code refs from %d fn(s):\n' % len(code_refs))
+    for ep in sorted(code_refs):
+        f = fm.getFunctionAt(ep)
+        summary.write('     %s @ %s (size %d)\n' %
+                      (f.getName(True), f.getEntryPoint(),
+                       f.getBody().getNumAddresses()))
+        if ep in seen: continue
+        seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                                (label, f.getEntryPoint(), safe)), 'w') as o:
+            dump(f, o)
+
+summary.write('\n=== total dumped: %d ===\n' % len(seen))
+summary.close()
+print('find-secret-users: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/find-stick3-crypto.py

@@ -0,0 +1,190 @@
+# Locate XHL_Stick3CryptDmxUniverse + related crypto vtables and dump methods.
+#
+# Now that we know the real class names (with XHL_ prefix and namespaces):
+#   XHL_Stick3ANet::XHL_Stick3CryptDmxUniverse        ← DE3 DMX cipher class
+#   XHL_DasNetCryptDmxUniverse                        ← base class
+#   XHL_AesOStream / XHL_AesIStream                   ← block cipher streams
+#   XHL_AesOStreamBuffer / XHL_AesIStreamBuffer       ← buffered variants
+#   XHL_DasDhRsaCryptography<1024>/<512>              ← DH+RSA handshake
+#   XHL_DasEccAesCryptography                         ← ECC+AES
+#   XHL_DasEccStreamCryptography
+#   XHL_DasCryptography(KeySize)
+#
+# We dump the full method table of each, plus every called function — that
+# walks us into the actual AES inlining and the per-session key derivation.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out3')
+try:
+    os.makedirs(OUT_DIR)
+except OSError:
+    pass
+
+prog = currentProgram
+fm   = prog.getFunctionManager()
+st   = prog.getSymbolTable()
+af   = prog.getAddressFactory()
+mem  = prog.getMemory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+# Substrings to match in mangled or demangled symbol names
+KEYWORDS = [
+    'Stick3CryptDmxUniverse',
+    'Stick5CryptDmxUniverse',
+    'DasNetCryptDmxUniverse',
+    'AesOStream',
+    'AesIStream',
+    'DasDhRsaCryptography',
+    'DasEccAesCryptography',
+    'DasEccStreamCryptography',
+    'DasCryptography',
+    # Also: any function whose source-file string contains these
+    'XHL_Stick3',
+    'XHL_DasNet',
+]
+
+
+def addr(a):
+    return af.getDefaultAddressSpace().getAddress(a)
+
+
+def get_ptr(a):
+    try:
+        return mem.getLong(a) & 0xFFFFFFFFFFFFFFFF
+    except Exception:
+        return None
+
+
+def dump_function_full(func, out, depth=0):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('signature: %s\n' % func.getPrototypeString(True, True))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees:
+        out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers:
+        out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 180, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# Find all symbols (any) whose name contains any keyword.
+all_hits = []  # list of (kw, symbol)
+for sym in st.getAllSymbols(False):
+    n = sym.getName(True)
+    for kw in KEYWORDS:
+        if kw in n:
+            all_hits.append((kw, sym))
+            break
+
+summary_path = os.path.join(OUT_DIR, 'SUMMARY.txt')
+out_summary = open(summary_path, 'w')
+out_summary.write('Stick3 crypto search — ESA2 HardwareManager (2024-03-21)\n\n')
+
+# Bucket by kind
+funcs = []          # symbols that are functions
+vtables = []        # vtable symbols (__ZTV)
+typeinfos = []      # __ZTI
+typenames = []      # __ZTS
+others = []
+for kw, sym in all_hits:
+    n = sym.getName(False) or ''
+    nfull = sym.getName(True)
+    if fm.getFunctionAt(sym.getAddress()):
+        funcs.append(sym)
+    elif n.startswith('__ZTV') or 'vtable' in nfull:
+        vtables.append(sym)
+    elif n.startswith('__ZTI') or 'typeinfo' in nfull and 'name' not in nfull:
+        typeinfos.append(sym)
+    elif n.startswith('__ZTS') or 'typeinfo-name' in nfull:
+        typenames.append(sym)
+    else:
+        others.append(sym)
+
+out_summary.write('=== Summary counts ===\n')
+out_summary.write('  functions:      %d\n' % len(funcs))
+out_summary.write('  vtables:        %d\n' % len(vtables))
+out_summary.write('  typeinfos:      %d\n' % len(typeinfos))
+out_summary.write('  type-names:     %d\n' % len(typenames))
+out_summary.write('  other:          %d\n\n' % len(others))
+
+out_summary.write('=== Functions (named methods) ===\n')
+for s in sorted(funcs, key=lambda s: s.getAddress()):
+    out_summary.write('  %s @ %s\n' % (s.getName(True), s.getAddress()))
+
+out_summary.write('\n=== Vtables ===\n')
+for s in sorted(vtables, key=lambda s: s.getAddress()):
+    out_summary.write('  %s @ %s\n' % (s.getName(True), s.getAddress()))
+
+out_summary.write('\n=== Typeinfos ===\n')
+for s in sorted(typeinfos, key=lambda s: s.getAddress()):
+    out_summary.write('  %s @ %s\n' % (s.getName(True), s.getAddress()))
+
+out_summary.write('\n=== Type-name strings ===\n')
+for s in sorted(typenames, key=lambda s: s.getAddress()):
+    out_summary.write('  %s @ %s\n' % (s.getName(True), s.getAddress()))
+
+# Walk every vtable: dump fn-pointer slots and full decomp of each
+seen = set()
+out_summary.write('\n\n=== Vtable layouts ===\n')
+for s in sorted(vtables, key=lambda s: s.getAddress()):
+    name = s.getName(True)
+    a = s.getAddress()
+    out_summary.write('\n--- %s @ %s ---\n' % (name, a))
+    base = int(a.getOffset())
+    for slot in range(0, 32):
+        slot_off = 0x10 + slot * 8  # skip offset-to-top + typeinfo
+        slot_addr = addr(base + slot_off)
+        fp = get_ptr(slot_addr)
+        if fp is None or fp == 0:
+            break
+        # Heuristic to stop at end of vtable: if the qword is itself another
+        # vtable symbol's address or clearly not code, bail.
+        fa = addr(fp)
+        f = fm.getFunctionAt(fa) or fm.getFunctionContaining(fa)
+        if f is None:
+            out_summary.write('  +0x%02x: 0x%x  (no fn)\n' % (slot_off, fp))
+            continue
+        out_summary.write('  +0x%02x: %s @ %s\n' %
+                          (slot_off, f.getName(True), f.getEntryPoint()))
+        if f.getEntryPoint() in seen:
+            continue
+        seen.add(f.getEntryPoint())
+        safe_cls = re.sub(r'[^A-Za-z0-9._-]', '_', name)[:80]
+        safe_fn  = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        path = os.path.join(OUT_DIR, '%s_+%02x_%s.txt' % (safe_cls, slot_off, safe_fn))
+        with open(path, 'w') as o:
+            dump_function_full(f, o)
+
+# Also dump every named function we matched directly
+for s in sorted(funcs, key=lambda s: s.getAddress()):
+    f = fm.getFunctionAt(s.getAddress())
+    if f is None or f.getEntryPoint() in seen:
+        continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:140]
+    path = os.path.join(OUT_DIR, 'fn_%s_%s.txt' % (f.getEntryPoint(), safe))
+    with open(path, 'w') as o:
+        dump_function_full(f, o)
+
+out_summary.close()
+print('find-stick3-crypto: dumped %d functions to %s' % (len(seen), OUT_DIR))
+print('find-stick3-crypto: summary at %s' % summary_path)

package/tools/ghidra/find-stick3-device.py

@@ -0,0 +1,111 @@
+# Trace UP from the Stick3CryptDmxUniverse factory to find the XHL_Stick3
+# device class — where the cipher state is actually initialized.
+#
+# Known facts:
+#   - FUN_100178bb0 = Stick3CryptDmxUniverse factory
+#   - Called by FUN_100179050
+#   - The cipher object lives at (device + 0x1618), embedded inside the
+#     device class. The device's ctor writes the embedded cipher's vptr.
+#
+# Goal: dump FUN_100179050 + its callers (probably the XHL_Stick3 device's
+# methods), and dump the 7 big constructors (2.7-8KB) that we identified as
+# touching the encrypt-fn vtables — one of them is XHL_Stick3 itself.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out12')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# 1. Caller of Stick3 factory + its callers (one more hop up)
+factory_caller = 0x100179050
+roots = {'caller_of_factory': factory_caller}
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+f = fm.getFunctionAt(addr(factory_caller))
+if f:
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, 'A_factorycaller_%s_%s.txt' %
+                            (f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+    summary.write('factory_caller = %s @ %s (size %d)\n' %
+                  (f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses()))
+    summary.write('  one-up callers:\n')
+    for c in sorted(f.getCallingFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('    %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'B_oneUp_%s_%s.txt' %
+                                (c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+# 2. The 7 big constructors that touched encrypt-fn vtables
+BIG_CTORS = [
+    0x1002385b0,
+    0x10027d350,
+    0x100283f60,
+    0x1002b7360,
+    0x1002c1920,
+    0x1002c8ac0,
+    0x1002ceaf0,
+]
+summary.write('\n=== Big constructors touching encrypt-fn vtables ===\n')
+for fp in BIG_CTORS:
+    f = fm.getFunctionAt(addr(fp))
+    if f is None: continue
+    summary.write('  %s @ %s (size %d)\n' %
+                  (f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses()))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, 'C_bigctor_%s_%s.txt' %
+                            (f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('find-stick3-device: %d functions dumped to %s' % (len(seen), OUT_DIR))