Editing SPU Isolated Modules Reverse Engineering

== anergistic ==

Using a static analysis (IDA) could give you a good view of what the program does, but sometimes you want to know what a program does in real time and how it reacts to different parameters, this is where anergistics becomes a powerful tool. It simulates the SPU including its communication, and storage.

=== Current repos===

*https://github.com/kraiskil/anergistic.git
*http://git.gitbrew.org/ps3/anergistic.git/
*https://github.com/psfree/anergistic
*<span style="text-decoration: line-through;">http://foxbrew.org/git/anergistic.git/</span>
*<span style="text-decoration: line-through;">http://git.fail0verflow.com/?p=anergistic.git</span>

=== usage ===

anergistic can be launched in two different modes, one that '''only emulates''' (runs) the program through the SPU and the the other that lets you '''debug''' the process through gdb 

==== only emulate ====

{{keyboard|content=./anergistic spu_elf_name.elf}}

this mode runs an elf with all the parameters and actions defined on main.c, channel.c a

==== debug ====
terminal 1
{{keyboard|content=./anergistic -g1234 spu_elf_name.elf}}

simulate debug server in the local host on port 1234


terminal 2
{{keyboard|content=spu-gdb spu_elf_name.elf 
(gdb)target remote :1234}}

connect to the local host on port 1234

(gdb)help will give you information of the command available

==== Documentation ====

*http://publib.boulder.ibm.com/infocenter/ieduasst/stgv1r0/topic/com.ibm.iea.cbe/cbe/1.0/LinuxOnCell/L2T1H1_31_LinuxonCellToolchainGDB.pdf
*SPU specific commands
**http://sourceware.org/gdb/onlinedocs/gdb/SPU.html

this mode performs the same as above but lets you debug the process through gdb

=== Customizations ===

see example below

'''Running in aim_spu_module anergistic''' 

=== Problems ===

====Connection proble====
when in debugger mode
<pre>
Waiting for gdb to connect...
Client connected.
recv failed: Success
</pre>
====Solution====
use spu-gdb

===  Tools ===
[http://pastie.org/2810870 gnuify_ida.pl][http://paste.ubuntu.com/25615421/ mirror]

Use this to convert IDA disassembly into a format suitable for GNU AS. Literals in IDA are unsigned while AS expects signed literals. Conversion of literals is a work in progress.

== aim_spu_module ==
It is used to retrieve the device type, device id, open psid and the pscode from the EID0 data that is passed in.


=== Debug messages ===
{| class="wikitable"
! colspan="2" | Address !! rowspan="2" | Message
|-
! ?&nbsp;3.41&nbsp;? !! 355&nbsp;CEX
|-
| 0x36f0 || 0x3570 || "(spu)start aim spu module!\n"
|-
| 0x3710 || 0x3590 || "(spu) PU DMA area start address is not align 16byte\n"
|-
| 0x3750 || 0x35d0 || "(spu) PU EID area start address is not align 16byte\n"
|-
| 0x3790 || 0x3610 || "(spu) PU DMA area size is not equall to AIM_DMA_SIZE\n"
|}
This messages are DMAed to the ppu if a debug output address is specified.


=== Data ===
{| class="wikitable"
! colspan="2" | Address !! rowspan="2" | Message
|-
! ?&nbsp;3.41&nbsp;? !! 355&nbsp;CEX
|-
| 0x37e0 || - || Reference Tool fallback IDPS
|-
| 0x37f0 - ... || 0x3650 - ... || Start of [[Keys#aim_spu_module_Keys|aim_spu_module keys]]
|-
| 0x3ac0 || 0x3870 || AES sbox (16*16 bytes)
|-
| 0x3c70 || 0x3a20 || AES inverse sbox (16*16 bytes)
|}

=== Functions ===
{| class="wikitable"
! colspan="2" | Address !! rowspan="2" | Name !! rowspan="2" | Parameters !! rowspan="2" | Info
|-
! &nbsp;3.41&nbsp; CEX/DEX !! 355&nbsp;CEX
|-
| 0x9e0 ||  || stop_func || unknown || Stops the module execution with various stop codes.
|-
| 0xa18 ||  || main_func || unknown || Main routine.
|-
| 0xf18 ||  || response || unknown || Sends response to ppu over DMA.
|-
| 0x1158 ||  || process_eid || unknown || Decrypts EID0.
|-
| 0x1438 ||  || prepare_print || unknown || Prepares debug output.
|-
| 0x1440 ||  || debug_print || unknown || As the name already states... (this outputs over DMA)
|-
| 0x17f0 ||  || - || - || AES 1 Part of aes implementation.
|-
| 0x1c48 ||  || aes_encrypt_ecb || - || AES 2 Part of aes implementation.
|-
| 0x1df0 ||  || cellCryptoSpuAesCbcCfb128Decrypt || - || AES 3 Probably part of aes implementation.
|-
| 0x20f0 ||  || aes_omac1 || - || AES 4 Probably part of aes implementation.
|-
| 0x2300 ||  || aes_set_key_dec || - || AES 5 Probably part of aes implementation.
|-
| 0x2418 ||  || aes_decrypt_ecb || - || AES 6 Part of aes implementation.
|-
| 0x2608 ||  || aes_decrypt_ecb_aligned || - || AES 7 Part of aes implementation.
|-
| 0x30c0 ||  || do_dma || ls_addr:$4, dma_effective_addr:$5, size:$6, tag_id:$7, unk0:$8, unk1:$9 || Used to dma data in and out of the isolated module's LS.
|-
| 0x3168 ||  || write_tag_mask_bit || mask_bit:$4 || Used to set a specific bit in MFC_WrTagMask.
|}


==== Disasm ====
The complete disassembly is available at [http://pastebin.com/7vArGweJ].


==Decrypting EID==

=== Dumper iso.self ===

=== Dumper Payload ===
* <span style="text-decoration: line-through;">http://pastie.org/pastes/2101977</span>
* http://paste.ubuntu.com/25615310/

=== Running in aim_spu_module anergistic ===
//Partial code modified to run aim_spu_module
* <span style="text-decoration: line-through;">http://pastie.org/2000330 [http://www.ps3devwiki.com/files/devtools/anergistic/#2000330-Pastie.txt]</span>
* http://paste.ubuntu.com/25615344/

== isoldr ==
loads, decrypts, runs isolated modules, and creates through aes the required key in LS 0x0


=== Debug messages ===
This module doesnt contain debug messages

=== Data ===
{| class="wikitable"
! colspan="2" | Address !! rowspan="2" | Message
|-
! ?&nbsp;3.41&nbsp;? !! 355&nbsp;CEX
|-
|-
| 0x34C40 - ... || 0x34d10 || Start of isoldr keys [[Keys#Modules]]
|-
| 0x35130 || 0x35050 || AES sbox (16*16 bytes)
|-
| 0x35300 || 0x35220 || AES inverse sbox (16*16 bytes)
|}

=== Functions ===
{| class="wikitable"
! colspan="2" | Address !! rowspan="2" | Name !! rowspan="2" | Parameters !! rowspan="2" | Info
|-
! ?&nbsp;3.41&nbsp;? !! 355&nbsp;CEX
|-
| 0x259E0 ||  || cleanup_jump_code || unknown || cleans all the registers and jump to the loader
|-
| 0x259E0 ||  || main_func || unknown || Main routine.
|-
| 0x346B0 ||  || write_tag_mask_bit || mask_bit:$4 || Used to set a specific bit in MFC_WrTagMask.
|-
| 0x27438 ||	||	aes128_cbc_decrypt		||	||	
|-
| 0x27508 ||	||	aes128_cbc_encrypt		||	||	
|-
| 0x29DC0 ||	||	aes_ctr		||	||	
|-
| 0x2BB28 ||	||	aes_set_key_enc		||	||	
|-
| 0x2C0D0 ||	||	cellCryptoSpuAesCbcCfb128Encrypt	||	||	
|-
| 0x2C240 ||	||	cellCryptoSpuAesCbcCfb128Decrypt	||	||	
|-
| 0x2C540 ||	||	cellCryptoSpuAesCtr		||	||	
|-
| 0x2C8D0 ||	||	aes_omac1		||	||	
|-
| 0x2CAE0 ||	||	sha1_buffer		||	||	
|-
| 0x2CB70 ||	||	sha1_hmac_init		||	||	
|-
| 0x2CC70 ||	||	sha1_hmac_update		||	||	
|-
| 0x2CC90 ||	||	sha1_hmac_final		||	||	
|-
| 0x2CD28 ||	||	sha1_hmac_buffer	||	||	
|-
| 0x2CDC8 ||	||	aes_set_key_dec		||	||	
|-
| 0x2CEE0 ||	||	aes_encrypt_ecb_aligned	||	||	
|-
| 0x2D7C0 ||	||	aes_decrypt_ecb		||	||	
|-
| 0x2D9B0 ||	||	aes_decrypt_ecb_aligned	||	||	
|-
| 0x2E450 ||	||	sha1_init		||	||	
|-
| 0x2E4C8 ||	||	sha1_update		||	||	
|-
| 0x2E700 ||	||	sha1_final		||	||	
|-
| 0x2EA88 ||	||	sha1_process		||	||	
|}

from isoldr 3.41 iirc -> http://pastie.org/2774207 [http://paste.ubuntu.com/25615363/ mirror] //offsets relative to segment start


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>