MicroHacker Forum

hello

in file system.elf there are many interesting things, ghidra better disassemblig as IDApro

shows many functions that are not visible in IDA

im found interesting function in system.elf


void FUN_9012a358(int param_1)

{
int iVar1;
char *pcVar2;
int iVar3;
uint uVar4;
char *pcVar5;
char *local_3c;
undefined auStack56 [12];
undefined2 local_2c;
int local_28;
int local_24;
int local_20;
int local_1c;
int local_18;

FUN_90164608(auStack56,"vCalulatePaths",7,0x7ba);
pcVar5 = (char *)0x0;
iVar1 = FUN_901641dc();
if (iVar1 != 0) {
pcVar5 = "/f_ls_rvc";
}
iVar1 = FUN_901641a0();
if (iVar1 != 0) {
pcVar5 = "/sgm710";
}
iVar1 = FUN_901641c8();
if (iVar1 != 0) {
pcVar5 = "/f_hs_rvc";
}
iVar1 = FUN_901641b4();
if (iVar1 != 0) {
pcVar5 = "/vw_ll_nf";
}
if (pcVar5 == (char *)0x0) {
pcVar5 = "/f_hs_rvc";
FUN_9013b414(0x1a8,0,7,0x7c6);
}
local_3c = (char *)0x0;
iVar1 = FUN_901641dc();
if (iVar1 != 0) {
local_3c = "/ford_lsr";
}
iVar1 = FUN_901641a0();
if (iVar1 != 0) {
local_3c = "/sgm710";
}
iVar1 = FUN_901641c8();
if (iVar1 != 0) {
local_3c = "/ford_hs2";
}
iVar1 = FUN_901641b4();
if (iVar1 != 0) {
local_3c = "/vw_ll_nf";
}
if (pcVar5 == (char *)0x0) {
local_3c = "/ford_hs2";
FUN_9013b414(0x1a8,0,7,0x7ce);
}
*(undefined4 *)(param_1 + 0x13d8) = 0;
iVar1 = *(int *)(param_1 + 0x13dc);
pcVar2 = "/dev/cdrom";
if (iVar1 != 1) {
if (iVar1 == 3) {
pcVar2 = "/dev/cd1";
}
else {
if (iVar1 == 4) {
pcVar2 = "/dev/cryptcard";
}
else {
if (iVar1 != 6) {
*(undefined4 *)(param_1 + 0x13d8) = 0x901693a0;
FUN_9013b414(0xb0,iVar1,7,0x7d9);
goto LAB_9012a44c;
}
pcVar2 = "/dev/usb_dnl";
}
}
}
*(char **)(param_1 + 0x13d8) = pcVar2;
LAB_9012a44c:
local_18 = param_1 + 0x94;
FUN_90001dd2(local_18,0,0xaf0);
uVar4 = 0;
do {
local_1c = uVar4 * 100 + param_1 + 0x94;
FUN_900ed508(local_1c,*(undefined4 *)(param_1 + 0x13d8));
pcVar2 = pcVar5;
if (((uVar4 == 0) || (uVar4 == 1)) || (uVar4 == 0xb)) {
FUN_900ed430(local_1c,"/dnl/bin/nav");
if (uVar4 != 0) {
iVar1 = local_1c;
if (uVar4 == 1) {
iVar1 = param_1 + 0xf8;
pcVar2 = local_3c;
}
goto LAB_9012a4a4;
}
}
else {
FUN_900ed430(local_1c,"/dnl/bin/system/arion");
iVar1 = local_1c;
LAB_9012a4a4:
FUN_900ed430(iVar1,pcVar2);
}
uVar4 = uVar4 + 1;
} while (uVar4 < 0x1c);
FUN_900ed430(param_1 + 0xf8,"/navarreg.uli");
FUN_900ed430(param_1 + 0x4e0,"/SPECIAL/navarreg.uli");
FUN_900ed430(local_18,"/common/navfx001.uli");
FUN_900ed430(param_1 + 0x15c,"/system.elf");
FUN_900ed430(param_1 + 0x1c0,"/system.bin");
FUN_900ed430(param_1 + 0x224,"/bootload.bin");
FUN_900ed430(param_1 + 0x418,"/plattapp.uli");
FUN_900ed430(param_1 + 0x47c,"/plattreg.uli");
FUN_900ed430(param_1 + 0x5a8,"/dsp.bin");
FUN_900ed430(param_1 + 0x6d4,"/basereg.uli");
FUN_900ed430(param_1 + 0x800,"/chinsi.elf");
FUN_900ed430(param_1 + 0x864,"/chinreg.uli");
FUN_900ed430(param_1 + 0x350,"/radio.dnl");
FUN_900ed430(param_1 + 0x92c,"/sdsapp.uli");
FUN_900ed430(param_1 + 0x990,"/sdsreg.uli");
FUN_900ed430(param_1 + 0x8c8,"/main_ver.bin");
FUN_900ed430(param_1 + 0x3b4,"/testman.bin");
local_20 = param_1 + 0x60c;
FUN_900ed430(local_20,"/ttslib.elf");
iVar1 = 0;
local_24 = param_1 + 0x670;
do {
FUN_90124e74();
iVar3 = FUN_90125290();
if (iVar3 == 2) {
pcVar2 = "/SEAT_fgs.dnl";
LAB_9012a6f2:
FUN_900ed430(local_24,pcVar2);
break;
}
FUN_90124e74();
iVar3 = FUN_90125290();
if (iVar3 == 1) {
pcVar2 = "/SKODA_fgs.dnl";
goto LAB_9012a6f2;
}
FUN_900ed430(local_24,"/fgs.dnl");
iVar1 = iVar1 + 1;
} while (iVar1 == 0);
if (DAT_9035fbc0 != '\0') {
FUN_900ed508(local_20,&DAT_9035fbc0);
iVar1 = FUN_9011ca92(0x2203,5);
if (iVar1 == 1) {
FUN_9011cb24(0x2203,5,1,5);
}
}
FUN_90001dd2(param_1 + 0xb84,0,2000);
uVar4 = 0;
do {
local_28 = uVar4 * 100 + param_1 + 0xb84;
FUN_900ed508(local_28,*(undefined4 *)(param_1 + 0x13d8));
if ((uVar4 != 1) && (uVar4 != 2)) {
FUN_900ed430(local_28,"/dnl/bin/system/arion");
FUN_900ed430(local_28,pcVar5);
}
uVar4 = uVar4 + 1;
} while (uVar4 < 0x14);
FUN_900ed430(param_1 + 0xbe8,&DAT_9012a8c0);
FUN_900ed430(param_1 + 0xc4c,&DAT_9012a8c8);
FUN_900ed430(param_1 + 0xcb0,"/erase.ffs");
FUN_900ed430(param_1 + 0x1160,"/permi.tmo");
FUN_900ed430(param_1 + 0xd14,"/force.nav");
FUN_900ed430(param_1 + 0xd78,"/force.sys");
FUN_900ed430(param_1 + 0xddc,"/force_ej.ect");
FUN_900ed430(param_1 + 0xe40,"/never_ej.ect");
FUN_900ed430(param_1 + 0xea4,"/ffsnand.bat");
FUN_900ed430(param_1 + 0xf08,"/ffsbat.ena");
FUN_900ed430(param_1 + 0xf6c,"/ffsbatdata");
FUN_900ed430(param_1 + 0xfd0,"/upgrade.btl");
FUN_900ed430(param_1 + 0x1034,"/dwngrade.btl");
FUN_900ed430(param_1 + 0x1098,"/replace.btl");
FUN_900ed430(param_1 + 0x10fc,"/ignore.btl");
FUN_900ed430(param_1 + 0x11c4,"/noreset.fgs");
FUN_900ed430(param_1 + 0x1228,"/noreset.850");
FUN_900ed430(param_1 + 0x12f0,"/cfgdev.fgs");
FUN_900ed508(param_1 + 0x128c,*(undefined4 *)(param_1 + 0x13d8));
FUN_900ed430(param_1 + 0x128c,"/ONLYSOP1.DAT");
local_2c = 0x856;
FUN_90164638(auStack56);
return;
}

memory map

Ghidra project with system.elf file disassembling

You find those functions with IDA also, but need a bit more effort as you must "scan" for them, because IDAs approach is to follow the execution paths. It cannot find code which is outside this path. Anyway, i don't see where IDA has not found anything in the system.elf. The function you found is here also: But i definitively should give Ghidra a try as it looks very sorted, also the disassembling!

So, do you understand what this function does?
This "/dev/usb_dnl" puzzles me, as it looks like there is some kind of USB update possibility inside. I found USB connections leading out to the service connector and even the quadlock (hidden, as the pins are cutted).

I also wonder where to get all those debug messages from, we find inside the image.

[quote=Go4IT

I also wonder where to get all those debug messages from, we find inside the image.
[/quote]

That are only strings, not hard to find. What i mean is how to get the runtime messages, if it's enabled anyhow. I see some nullsubs inside, maybe the debug message output code was just stripped from the binary. Would be great to have some port (Serial, USB, JTAG, SWD, or whatever) to see those messages when they appear.

But again, Ghidra seem to have all the same functionalty as IDA Pro, and costs nothing!

So, do you understand what this function does?
This "/dev/usb_dnl" puzzles me, as it looks like there is some kind of USB update possibility inside. I found USB connections leading out to the service connector and even the quadlock (hidden, as the pins are cutted).

Where you found USB connections ?
Can you send me picture?

Thenx

tomy75 wrote: ↑13 Jan 2020, 20:56 Ghidra project with system.elf file disassembling

ghidra travelpilof FX system.elf.rar

how do i open as its locked to you i need to share or somthing
first time i use Ghidra

tomy75 wrote: ↑13 Jan 2020, 20:56 Ghidra project with system.elf file disassembling

ghidra travelpilof FX system.elf.rar

I did try to look at your .elf but your project is not set ap a a share can we use git hub

Today, followin the wiring diagrams, i connect a FX to usb and my PC recognized a Blaupunkt.
Only connect de Data+ and Data- but the problem comes wit the driver.

i take a screen shot of my device manager:
next step is found a driver, but i think so hard to fount it.

Great work
We need found driver