SPU Isolated Modules Reverse Engineering
anergistic
Using a static analysis (IDA) could give you a good view of what the program does, but sometimes you want to know what a program does in real time and how it reacts to different parameters, this is where anergistics becomes a powerful tool. It simulates the SPU including its communication, and storage.
Current repos
- https://github.com/kraiskil/anergistic.git
- http://git.gitbrew.org/ps3/anergistic.git/
- https://github.com/psfree/anergistic
- http://foxbrew.org/git/anergistic.git/
- http://git.fail0verflow.com/?p=anergistic.git
usage
anergistic can be launched in two different modes, one that only emulates (runs) the program through the SPU and the the other that lets you debug the process through gdb
only emulate
./anergistic spu_elf_name.elf
this mode runs an elf with all the parameters and actions defined on main.c, channel.c a
debug
terminal 1
./anergistic -g 1234 spu_elf_name.elf
simulate debug server in the local host on port 1234
terminal 2
spu-gdb spu_elf_name.elf (gdb)target remote :1234
connect to the local host on port 1234
(gdb)help will give you information of the command available
Documentation
- http://publib.boulder.ibm.com/infocenter/ieduasst/stgv1r0/topic/com.ibm.iea.cbe/cbe/1.0/LinuxOnCell/L2T1H1_31_LinuxonCellToolchainGDB.pdf
- SPU specific commands
this mode performs the same as above but lets you debug the process through gdb
Customizations
see example below
Running in aim_spu_module anergistic
Problems
Connection proble
when in debugger mode
Waiting for gdb to connect... Client connected. recv failed: Success
Solution
use spu-gdb
Tools
Use this to convert IDA disassembly into a format suitable for GNU AS. Literals in IDA are unsigned while AS expects signed literals. Conversion of literals is a work in progress.
aim_spu_module
It is used to retrieve the device type, device id, open psid and the pscode from the EID0 data that is passed in.
Debug messages
| Address | Message | |
|---|---|---|
| ? 3.41 ? | 355 CEX | |
| 0x36f0 | 0x3570 | "(spu)start aim spu module!\n" |
| 0x3710 | 0x3590 | "(spu) PU DMA area start address is not align 16byte\n" |
| 0x3750 | 0x35d0 | "(spu) PU EID area start address is not align 16byte\n" |
| 0x3790 | 0x3610 | "(spu) PU DMA area size is not equall to AIM_DMA_SIZE\n" |
This messages are DMAed to the ppu if a debug output address is specified.
Data
| Address | Message | |
|---|---|---|
| ? 3.41 ? | 355 CEX | |
| 0x37e0 | - | Reference tool fallback IDPS |
| 0x37f0 - ... | 0x3650 - ... | Start of AIM keys Keys#aim_keys |
| 0x3ac0 | 0x3870 | AES sbox (16*16 bytes) |
| 0x3c70 | 0x3a20 | AES inverse sbox (16*16 bytes) |
Functions
| Address | Name | Parameters | Info | |
|---|---|---|---|---|
| 3.41 CEX/DEX | 355 CEX | |||
| 0x9e0 | stop_func | unknown | Stops the module execution with various stop codes. | |
| 0xa18 | main_func | unknown | Main routine. | |
| 0xf18 | response | unknown | Sends response to ppu over DMA. | |
| 0x1158 | process_eid | unknown | Decrypts EID0. | |
| 0x1438 | prepare_print | unknown | Prepares debug output. | |
| 0x1440 | debug_print | unknown | As the name already states... (this outputs over DMA) | |
| 0x17f0 | - | - | AES 1 Part of aes implementation. | |
| 0x1c48 | aes_encrypt_ecb | - | AES 2 Part of aes implementation. | |
| 0x1df0 | cellCryptoSpuAesCbcCfb128Decrypt | - | AES 3 Probably part of aes implementation. | |
| 0x20f0 | aes_omac1 | - | AES 4 Probably part of aes implementation. | |
| 0x2300 | aes_set_key_dec | - | AES 5 Probably part of aes implementation. | |
| 0x2418 | aes_decrypt_ecb | - | AES 6 Part of aes implementation. | |
| 0x2608 | aes_decrypt_ecb_aligned | - | AES 7 Part of aes implementation. | |
| 0x30c0 | do_dma | ls_addr:$4, dma_effective_addr:$5, size:$6, tag_id:$7, unk0:$8, unk1:$9 | Used to dma data in and out of the isolated module's LS. | |
| 0x3168 | write_tag_mask_bit | mask_bit:$4 | Used to set a specific bit in MFC_WrTagMask. | |
Disasm
The complete disassembly is available at [1].
Decrypting EID
Dumper iso.self
Dumper Payload
Running in aim_spu_module anergistic
//Partial code modified to run aim_spu_module
isoldr
loads, decrypts, runs isolated modules, and creates through aes the required key in LS 0x0
Debug messages
This module doesnt contain debug messages
Data
| Address | Message | |
|---|---|---|
| ? 3.41 ? | 355 CEX | |
| 0x34C40 - ... | 0x34d10 | Start of isoldr keys Keys#Modules |
| 0x35130 | 0x35050 | AES sbox (16*16 bytes) |
| 0x35300 | 0x35220 | AES inverse sbox (16*16 bytes) |
Functions
| Address | Name | Parameters | Info | |
|---|---|---|---|---|
| ? 3.41 ? | 355 CEX | |||
| 0x259E0 | cleanup_jump_code | unknown | cleans all the registers and jump to the loader | |
| 0x259E0 | main_func | unknown | Main routine. | |
| 0x346B0 | write_tag_mask_bit | mask_bit:$4 | Used to set a specific bit in MFC_WrTagMask. | |
| 0x27438 | aes128_cbc_decrypt | |||
| 0x27508 | aes128_cbc_encrypt | |||
| 0x29DC0 | aes_ctr | |||
| 0x2BB28 | aes_set_key_enc | |||
| 0x2C0D0 | cellCryptoSpuAesCbcCfb128Encrypt | |||
| 0x2C240 | cellCryptoSpuAesCbcCfb128Decrypt | |||
| 0x2C540 | cellCryptoSpuAesCtr | |||
| 0x2C8D0 | aes_omac1 | |||
| 0x2CAE0 | sha1_buffer | |||
| 0x2CB70 | sha1_hmac_init | |||
| 0x2CC70 | sha1_hmac_update | |||
| 0x2CC90 | sha1_hmac_final | |||
| 0x2CD28 | sha1_hmac_buffer | |||
| 0x2CDC8 | aes_set_key_dec | |||
| 0x2CEE0 | aes_encrypt_ecb_aligned | |||
| 0x2D7C0 | aes_decrypt_ecb | |||
| 0x2D9B0 | aes_decrypt_ecb_aligned | |||
| 0x2E450 | sha1_init | |||
| 0x2E4C8 | sha1_update | |||
| 0x2E700 | sha1_final | |||
| 0x2EA88 | sha1_process | |||
from isoldr 3.41 iirc -> http://pastie.org/2774207 //offsets relative to segment start