1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92
| import struct
def pp(l): for i in l: print(hex(i))
addr2000 = [ 0x800287c0, 0x80028004, 0xbfc01550 ]
addr2800 = []
bs = open("28000.dump", "rb+").read()
for i in range(len(bs)//4): addr2800.append(struct.unpack(">I", bs[4*i:4*(i+1)])[0])
def swap32(i): return struct.unpack("<I", struct.pack(">I", i))[0]
addr = 0x80000610
x = 0xD3ABC0DE
epc_xor = addr ^ x
xored_list = [0x7EC5AB53, 0xFEE9AB53, 0x6EC5AB53, 0xEAE9AB53, 0x12C5AB53, 0x96E9AB53, 0x32C5AB53, 0x82E9AB53, 0xCEC6AB53, 0xAEE9AB53, 0xFEC6AB53, 0x5AE9AB53, 0xEEC6AB53, 0x46E9AB53, 0x96C6AB53, 0x72E9AB53, 0xBEC6AB53, 0x1EE9AB53, 0xAEC6AB53, 0x0AE9AB53, 0x4EC6AB53, 0x36E9AB53, 0x62C6AB53, 0x22E9AB53, 0x12C6AB53, 0xCEEAAB53, 0x3EC6AB53, 0xFAEAAB53, 0xDEC7AB53, 0xE6EAAB53, 0xE6C7AB53, 0x92EAAB53, 0x96C7AB53, 0xBEEAAB53, 0x52C7AB53, 0xAAEAAB53, 0x16C7AB53, 0x56EAAB53, 0xCAC8AB53, 0x42EAAB53, 0xEAC8AB53, 0x6EEAAB53, 0xA6C8AB53, 0x1AEAAB53, 0x46C8AB53, 0x06EAAB53, 0x7AC8AB53, 0x32EAAB53, 0x6AC8AB53, 0xDEEBAB53, 0x06C8AB53, 0xCAEBAB53, 0x3AC8AB53, 0xF6EBAB53, 0x2EC8AB53, 0xE2EBAB53, 0xDEC9AB53, 0x8EEBAB53, 0xFAC9AB53, 0xBAEBAB53, 0xEEC9AB53, 0xA6EBAB53, 0xE2C9AB53, 0x52EBAB53, 0x92C9AB53, 0x7EEBAB53, 0xA6C9AB53, 0x6AEBAB53, 0x5AC9AB53, 0x16EBAB53, 0x66C9AB53, 0x02EBAB53, 0x1AC9AB53, 0x2EEBAB53, 0x0EC9AB53, 0xDAECAB53, 0x3EC9AB53, 0xC6ECAB53, 0xD6CAAB53, 0xF2ECAB53, 0xCACAAB53, 0x9EECAB53, 0xFECAAB53, 0x8AECAB53, 0xEECAAB53, 0xB6ECAB53, 0x82CAAB53, 0xA2ECAB53, 0xB6CAAB53, 0x4EECAB53, 0x7ACAAB53, 0x7AECAB53, 0x66CAAB53, 0x66ECAB53, 0x2ACAAB53, 0x12ECAB53, 0xEECBAB53, 0x3EECAB53, 0x9ACBAB53, 0x2AECAB53, 0x5ECBAB53, 0xD6EDAB53, 0x7ECBAB53, 0xC2EDAB53, 0x16CBAB53, 0xEEEDAB53, 0xD2CCAB53, 0x9AEDAB53, 0xC6CCAB53, 0x86EDAB53, 0xEACCAB53, 0xB2EDAB53, 0x9ECCAB53, 0x5EEDAB53, 0x92CCAB53, 0x4AEDAB53, 0xBACCAB53, 0x76EDAB53, 0xAECCAB53, 0x62EDAB53, 0xA2CCAB53, 0x0EEDAB53, 0x4ECCAB53, 0x3AEDAB53, 0x7ACCAB53, 0x26EDAB53, 0x16CCAB53, 0xD2EEAB53, 0xF2CDAB53, 0xFEEEAB53, 0x8ECDAB53, 0xEAEEAB53, 0xBACDAB53, 0x96EEAB53, 0xAACDAB53, 0x82EEAB53, 0x52CDAB53, 0xAEEEAB53, 0x66CDAB53, 0x5AEEAB53, 0x1ACDAB53, 0x46EEAB53, 0x36CDAB53, 0x72EEAB53, 0xC6CEAB53, 0x1EEEAB53, 0x8ECEAB53, 0x0AEEAB53, 0x82CEAB53, 0x36EEAB53, 0xAECEAB53, 0x22EEAB53, 0x5ACEAB53, 0xCEEFAB53, 0x4ECEAB53, 0xFAEFAB53, 0x7ECEAB53, 0xE6EFAB53, 0x66CEAB53, 0x92EFAB53, 0x06CEAB53, 0xBEEFAB53, 0xD6CFAB53, 0xAAEFAB53, 0xE2CFAB53, 0x56EFAB53, 0xA6CFAB53, 0x42EFAB53, 0x12CFAB53, 0x6EEFAB53, 0xCAD0AB53, 0x1AEFAB53, 0x46D0AB53, 0x06EFAB53, 0x06D0AB53, 0x32EFAB53, 0x26D0AB53, 0xDEF0AB53, 0xC6D1AB53, 0xCAF0AB53, 0xF2D1AB53, 0xF6F0AB53, 0x8ED1AB53, 0xE2F0AB53, 0xA6D1AB53, 0x8EF0AB53, 0x46D1AB53, 0xBAF0AB53, 0x62D1AB53, 0xA6F0AB53, 0x02D1AB53, 0x52F0AB53, 0xDAD2AB53, 0x7EF0AB53, 0xE6D2AB53, 0x6AF0AB53, 0x96D2AB53, 0x16F0AB53, 0xA6D2AB53, 0x02F0AB53, 0x6AD2AB53, 0x2EF0AB53, 0x02D2AB53, 0xDAF1AB53, 0xCED3AB53, 0xC6F1AB53, 0xFED3AB53, 0xF2F1AB53, 0x92D3AB53, 0x9EF1AB53, 0x5AD3AB53, 0x8AF1AB53, 0x1AD3AB53, 0xB6F1AB53, 0x0AD3AB53, 0xA2F1AB53, 0x36D3AB53, 0x4EF1AB53, 0xD2D4AB53, 0x7AF1AB53, 0xFED4AB53, 0x66F1AB53, 0x9AD4AB53, 0x12F1AB53, 0xAAD4AB53, 0x3EF1AB53, 0x7AD4AB53, 0x2AF1AB53, 0x6ED4AB53, 0xD6F2AB53, 0x16D4AB53, 0xC2F2AB53, 0x3AD4AB53, 0xEEF2AB53, 0xCAD5AB53, 0x9AF2AB53, 0xEAD5AB53, 0x86F2AB53, 0xA2D5AB53, 0xB2F2AB53, 0x42D5AB53, 0x5EF2AB53, 0x0ED5AB53, 0x4AF2AB53, 0x02D5AB53, 0x76F2AB53, 0x2AD5AB53, 0x62F2AB53, 0xC6D6AB53, 0x0EF2AB53, 0xBAD6AB53, 0x3AF2AB53, 0x5AD6AB53, 0x26F2AB53, 0x46D6AB53, 0xD2F3AB53, 0x72D6AB53, 0xFEF3AB53, 0x32D6AB53, 0xEAF3AB53, 0x22D6AB53, 0x96F3AB53, 0xCAD7AB53, 0x82F3AB53, 0xEAD7AB53, 0xAEF3AB53, 0x9AD7AB53, 0x5AF3AB53, 0x8AD7AB53, 0x46F3AB53, 0xB6D7AB53, 0x72F3AB53, 0xA2D7AB53, 0x1EF3AB53, 0x46D7AB53, 0x0AF3AB53, 0x6ED7AB53, 0x36F3AB53, 0x06D7AB53, 0x22F3AB53, 0x3AD7AB53, 0xCEF4AB53, 0xDED8AB53, 0xFAF4AB53, 0xCAD8AB53, 0xE6F4AB53, 0xEAD8AB53, 0x92F4AB53, 0x8AD8AB53, 0xBEF4AB53, 0xBED8AB53, 0xAAF4AB53, 0x5ED8AB53, 0x56F4AB53, 0x52D8AB53, 0x42F4AB53, 0x76D8AB53, 0x6EF4AB53, 0x1ED8AB53, 0x1AF4AB53, 0x0AD8AB53, 0x06F4AB53, 0x36D8AB53, 0x32F4AB53, 0xDAD9AB53, 0xDEF5AB53, 0xFED9AB53, 0xCAF5AB53, 0xE2D9AB53, 0xF6F5AB53, 0x96D9AB53, 0xE2F5AB53, 0x86D9AB53, 0x8EF5AB53, 0xB6D9AB53, 0xBAF5AB53, 0xA6D9AB53, 0xA6F5AB53, 0x4ED9AB53, 0x52F5AB53, 0x42D9AB53, 0x7EF5AB53, 0x6AD9AB53, 0x6AF5AB53, 0x02D9AB53, 0x16F5AB53, 0x32D9AB53, 0x02F5AB53, 0xD6DAAB53, 0x2EF5AB53, 0xCADAAB53, 0xDAF6AB53, 0xF2DAAB53, 0xC6F6AB53, 0x96DAAB53, 0xF2F6AB53, 0x8ADAAB53, 0x9EF6AB53, 0xB2DAAB53, 0x8AF6AB53, 0x56DAAB53, 0xB6F6AB53, 0x7EDAAB53, 0xA2F6AB53, 0x3EDAAB53, 0x4EF6AB53, 0x26DAAB53, 0x7AF6AB53, 0xCEDBAB53, 0x66F6AB53, 0xE2DBAB53, 0x12F6AB53, 0x8ADBAB53, 0x3EF6AB53, 0x46DBAB53, 0x2AF6AB53, 0x7ADBAB53, 0xD6F7AB53, 0x62DBAB53, 0xC2F7AB53, 0x16DBAB53, 0xEEF7AB53, 0x3EDBAB53, 0x9AF7AB53, 0x26DBAB53, 0x86F7AB53, 0xFEDCAB53, 0xB2F7AB53, 0xEEDCAB53, 0x5EF7AB53, 0x86DCAB53, 0x4AF7AB53, 0x46DCAB53, 0x76F7AB53, 0x66DCAB53, 0x62F7AB53, 0x26DCAB53, 0x0EF7AB53, 0xC2DDAB53, 0x3AF7AB53, 0xE2DDAB53, 0x26F7AB53, 0x82DDAB53, 0xD2F8AB53, 0xAEDDAB53, 0xFEF8AB53, 0x5EDDAB53, 0xEAF8AB53, 0x7EDDAB53, 0x96F8AB53, 0x12DDAB53, 0x82F8AB53, 0x06DDAB53, 0xAEF8AB53, 0xDADEAB53, 0x5AF8AB53, 0xC2DEAB53, 0x46F8AB53, 0xF6DEAB53, 0x72F8AB53, 0x8ADEAB53, 0x1EF8AB53, 0x42DEAB53, 0x0AF8AB53, 0x66DEAB53, 0x36F8AB53, 0x06DEAB53, 0x22F8AB53, 0xD2DFAB53, 0xCEF9AB53, 0xFEDFAB53, 0xFAF9AB53, 0x8EDFAB53, 0xE6F9AB53, 0xAADFAB53, 0x92F9AB53, 0x4ADFAB53, 0xBEF9AB53, 0x66DFAB53, 0xAAF9AB53, 0x3EDFAB53, 0x56F9AB53, 0xD6E0AB53, 0x42F9AB53, 0xC2E0AB53, 0x6EF9AB53, 0x9EE0AB53, 0x1AF9AB53, 0xA6E0AB53, 0x06F9AB53, 0x62E0AB53, 0x32F9AB53, 0x06E0AB53, 0xDEFAAB53, 0xD6E1AB53, 0xCAFAAB53, 0x9AE1AB53, 0xF6FAAB53, 0xBEE1AB53, 0xE2FAAB53, 0x4AE1AB53, 0x8EFAAB53, 0x6EE1AB53, 0xBAFAAB53, 0x0AE1AB53, 0xA6FAAB53, 0xCAE2AB53, 0x52FAAB53, 0xF6E2AB53, 0x7EFAAB53, 0xE6E2AB53, 0x6AFAAB53, 0x96E2AB53, 0x16FAAB53, 0x86E2AB53, 0x02FAAB53, 0x56E2AB53, 0x2EFAAB53, 0x62E2AB53, 0xDAFBAB53, 0x3EE2AB53, 0xC6FBAB53, 0xEAE3AB53, 0xF2FBAB53, 0x8AE3AB53, 0x9EFBAB53, 0xA2E3AB53, 0x8AFBAB53, 0x52E3AB53, 0xB6FBAB53, 0x7EE3AB53, 0xA2FBAB53, 0x6AE3AB53, 0x4EFBAB53, 0x06E3AB53, 0x7AFBAB53, 0x32E3AB53, 0x66FBAB53, 0xDEE4AB53, 0x12FBAB53, 0xFAE4AB53, 0x3EFBAB53, 0xE6E4AB53, 0x2AFBAB53, 0x92E4AB53, 0xD6FCAB53, 0xAEE4AB53, 0xC2FCAB53, 0x5EE4AB53, 0xEEFCAB53, 0x42E4AB53, 0x9AFCAB53, 0x12E4AB53, 0x86FCAB53, 0x02E4AB53, 0xB2FCAB53, 0xDEE5AB53, 0x5EFCAB53, 0xEAE5AB53, 0x4AFCAB53, 0x9EE5AB53, 0x76FCAB53, 0xAAE5AB53, 0x62FCAB53, 0x5EE5AB53, 0x0EFCAB53, 0x4EE5AB53, 0x3AFCAB53, 0x3EE5AB53, 0x26FCAB53, 0xDEE6AB53, 0xD2FDAB53, 0x00000000, 0x00000000, 0x2B8A463B, 0x009F369D] orig_list = [] for i in xored_list: orig_list.append(swap32(i))
def norm(epc, addr): if epc == addr: return 0 elif epc < addr: return -1 else: return 1 base = 0x80028000 base2 = 0xbfc20000 def convert(addr): first = addr2000[0] tmp1 = 0 tmp2 = 0 while addr2000[1] != first: tt = addr2800[(first-base)//4] r = norm(addr, orig_list[(tt-base2)//4]) if r == 1: first = addr2800[(first+0xC-base)//4] if first == addr2000[1]: break else: if tmp1 !=0: break elif r==-1: first = addr2800[(first+8-base)//4] if first == addr2000[1]: break else: if tmp1 !=0: break elif r==0: tmp1 = 1 tmp2 = addr2800[(first - base)//4] if first == addr2000[1]: break else: if tmp1 !=0: break
return tmp2
def get_address(inaddr): xored = inaddr ^ x outaddr = xored r1 = convert(xored) if r1 != 0: outaddr = orig_list[(r1 + 4 - base2)//4] return outaddr ^ x
mp = {} mpr = {}
for i in range(0x8000): addr = 0x80000000 + i outaddr = get_address(addr) mp[addr] = outaddr mpr[outaddr] = addr
print(hex(mp[0x80000D50]))
|