#!/usr/bin/env python3 """ Python-based decompilation of key GSP firmware functions. Uses our decoded instruction stream to generate pseudo-C. """ import struct import json import os FWIMAGE_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "gsp-570.144.fwimage.bin") OUTPUT_DIR = os.path.dirname(os.path.abspath(__file__)) BASE_ADDR = 0x04000000 # Key functions to decompile TARGET_FUNCTIONS = [ (0x057a1ac0, "rpc_dispatcher_primary"), (0x04ed39dc, "rpc_dispatcher_secondary"), (0x04cc58f8, "rpc_dispatcher_tertiary"), (0x05723ef4, "rpc_dispatcher_quaternary"), (0x04cb8189, "rpc_bar_trap_handler"), (0x04009000, "entry_point"), (0x057e94ec, "rpc_alloc_handler"), (0x04d00a18, "rpc_alloc_handler_2"), (0x051efbf4, "rpc_schedule_handler"), (0x04efeac8, "top_call_target"), ] def read_binary(path): with open(path, 'rb') as f: return f.read() def decode_instruction(data, offset): """Decode instruction at offset, return (inst_dict, size)""" if offset + 4 > len(data): return None, 0 first16 = struct.unpack('> 7) & 0x7; rs2 = (inst >> 10) & 0x7 return {'mnemonic': 'c.mv', 'rd': rd+8, 'rs2': rs2+8, 'str': f'c.mv s{rd}, s{rs2}'} if (inst & 0xE003) == 0x6001: rd = (inst >> 7) & 0x7 imm = ((inst >> 2) & 0x3F) | ((inst >> 12) & 0x1) << 6 if imm & 0x40: imm -= 0x80 return {'mnemonic': 'c.addi', 'rd': rd+8, 'imm': imm, 'str': f'c.addi s{rd}, {imm}'} if (inst & 0xF07F) == 0x8067: rs1 = (inst >> 7) & 0x1F return {'mnemonic': 'c.jalr', 'rs1': rs1, 'str': f'c.jalr x{rs1}'} if (inst & 0xE003) == 0x6003: rd = (inst >> 10) & 0x7; rs1 = (inst >> 7) & 0x7 off = ((inst >> 2) & 0x1F) | ((inst >> 13) & 0x3) << 5 return {'mnemonic': 'c.ld', 'rd': rd+8, 'rs1': rs1+8, 'offset': off*8, 'str': f'c.ld s{rd}, {off*8}(s{rs1})'} if (inst & 0xE003) == 0xE000: rs1 = (inst >> 7) & 0x7; rs2 = (inst >> 10) & 0x7 off = ((inst >> 2) & 0x1F) | ((inst >> 13) & 0x3) << 5 return {'mnemonic': 'c.sd', 'rs1': rs1+8, 'rs2': rs2+8, 'offset': off*8, 'str': f'c.sd s{rs2}, {off*8}(s{rs1})'} return {'mnemonic': 'c.unknown', 'raw': inst, 'str': f'c.0x{inst:04x}'} def decode_32bit(inst, offset): opcode = inst & 0x7F funct3 = (inst >> 12) & 0x7 rd = (inst >> 7) & 0x1F rs1 = (inst >> 15) & 0x1F rs2 = (inst >> 20) & 0x1F reg_name = lambda r: ['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'][r] if r < 32 else f'x{r}' def fmt_imm(imm): return str(imm) if imm >= 0 else str(imm) if opcode == 0x13 and funct3 == 0: # addi imm = (inst >> 20) & 0xFFF if imm >= 0x800: imm -= 0x1000 return {'mnemonic': 'addi', 'rd': rd, 'rs1': rs1, 'imm': imm, 'str': f'addi {reg_name(rd)}, {reg_name(rs1)}, {imm}'} if opcode == 0x23 and funct3 == 3: # sd off = ((inst >> 7) & 0x1F) | ((inst >> 25) & 0x7F) << 5 return {'mnemonic': 'sd', 'rs1': rs1, 'rs2': rs2, 'offset': off, 'str': f'sd {reg_name(rs2)}, {off}({reg_name(rs1)})'} if opcode == 0x03 and funct3 == 3: # ld off = (inst >> 20) & 0xFFF if off >= 0x800: off -= 0x1000 return {'mnemonic': 'ld', 'rd': rd, 'rs1': rs1, 'offset': off, 'str': f'ld {reg_name(rd)}, {off}({reg_name(rs1)})'} if opcode == 0x6F: # jal imm = ((inst >> 31) & 0x1) << 20 | ((inst >> 12) & 0xFF) << 12 | ((inst >> 20) & 0x1) << 11 | ((inst >> 21) & 0x3FF) << 1 if imm & 0x100000: imm -= 0x200000 target = BASE_ADDR + offset + imm return {'mnemonic': 'jal', 'rd': rd, 'imm': imm, 'target': target, 'str': f'jal {reg_name(rd)}, 0x{target:08x}'} if opcode == 0x67 and funct3 == 0: # jalr imm = (inst >> 20) & 0xFFF if imm >= 0x800: imm -= 0x1000 return {'mnemonic': 'jalr', 'rd': rd, 'rs1': rs1, 'imm': imm, 'str': f'jalr {reg_name(rd)}, {imm}({reg_name(rs1)})'} if opcode == 0x63: # branch imm = ((inst >> 31) & 0x1) << 12 | ((inst >> 7) & 0x1) << 11 | ((inst >> 25) & 0x3F) << 5 | ((inst >> 8) & 0xF) << 1 if imm & 0x1000: imm -= 0x2000 target = BASE_ADDR + offset + imm btype = ['beq','bne','?','?','blt','bge','bltu','bgeu'][funct3] return {'mnemonic': btype, 'rs1': rs1, 'rs2': rs2, 'imm': imm, 'target': target, 'str': f'{btype} {reg_name(rs1)}, {reg_name(rs2)}, 0x{target:08x}'} if opcode == 0x17: # auipc imm = (inst >> 12) & 0xFFFFF return {'mnemonic': 'auipc', 'rd': rd, 'imm': imm, 'str': f'auipc {reg_name(rd)}, 0x{imm:05x}'} if opcode == 0x37: # lui imm = (inst >> 12) & 0xFFFFF return {'mnemonic': 'lui', 'rd': rd, 'imm': imm, 'str': f'lui {reg_name(rd)}, 0x{imm:05x}'} if opcode == 0x33: # arithmetic funct7 = (inst >> 25) & 0x7F ops = {0:'add', 0x20:'sub', 1:'sll', 4:'xor', 5:'srl', 0x25:'sra', 6:'or', 7:'and'} op = ops.get(funct7, f'arith{funct7}') return {'mnemonic': op, 'rd': rd, 'rs1': rs1, 'rs2': rs2, 'str': f'{op} {reg_name(rd)}, {reg_name(rs1)}, {reg_name(rs2)}'} if opcode == 0x0F: # fence return {'mnemonic': 'fence', 'str': 'fence'} if opcode == 0x73: # system return {'mnemonic': 'ecall/ebreak', 'str': 'ecall/ebreak'} return {'mnemonic': 'unknown', 'raw': inst, 'str': f'0x{inst:08x}'} def trace_function(data, start_offset, max_bytes=2000): """Trace a function and return instruction list""" instructions = [] i = 0 while i < max_bytes: offset = start_offset + i if offset >= len(data): break inst_info, size = decode_instruction(data, offset) if inst_info is None: i += 2; continue inst_info['offset'] = BASE_ADDR + offset inst_info['rel_offset'] = i instructions.append(inst_info) i += size # Stop at return if inst_info['mnemonic'] in ('jalr', 'c.jalr') and inst_info.get('rd', 1) == 0 and inst_info.get('imm', 0) == 0 and inst_info.get('rs1', 1) == 1: break return instructions def analyze_function(instructions, func_name): """Analyze instructions for patterns""" analysis = { 'name': func_name, 'stack_size': None, 'ra_save_reg': None, 'ra_restore_reg': None, 'calls': [], 'rpc_refs': [], 'strings': [], } RPC_TYPES = {1:'ALLOC',2:'FREE',3:'MAP',4:'UNMAP',5:'PIN',6:'UNPIN',7:'SCHEDULE',8:'YIELD',9:'NOTIFY',10:'BAR_TRAP',11:'MIGRATE',0xFF:'DEBUG'} for inst in instructions: mnemonic = inst.get('mnemonic', '') # Prologue if mnemonic == 'addi' and inst.get('rd') == 2 and inst.get('rs1') == 2 and inst.get('imm', 0) < -16: analysis['stack_size'] = -inst['imm'] # Save ra if mnemonic == 'addi' and inst.get('rs1') == 1 and inst.get('imm') == 0 and 9 <= inst.get('rd', 0) <= 18: if analysis['ra_save_reg'] is None: analysis['ra_save_reg'] = inst['rd'] if mnemonic == 'c.mv' and inst.get('rs2') == 1 and 8 <= inst.get('rd', 0) <= 15: if analysis['ra_save_reg'] is None: analysis['ra_save_reg'] = inst['rd'] # Restore ra if mnemonic == 'addi' and inst.get('rd') == 1 and inst.get('imm') == 0 and 9 <= inst.get('rs1', 0) <= 18: analysis['ra_restore_reg'] = inst['rs1'] if mnemonic == 'c.mv' and inst.get('rd') == 1 and 8 <= inst.get('rs2', 0) <= 15: analysis['ra_restore_reg'] = inst['rs2'] # Calls if mnemonic == 'jal': analysis['calls'].append(inst.get('target')) # RPC type refs if mnemonic in ('addi', 'andi', 'ori') and inst.get('imm') in RPC_TYPES: analysis['rpc_refs'].append((inst['rel_offset'], RPC_TYPES[inst['imm']])) if mnemonic in ('beq','bne','blt','bge','bltu','bgeu') and inst.get('rs1') != 0: # Could be comparing register with RPC type pass return analysis def generate_pseudo_c(instructions, func_name, analysis): """Generate pseudo-C from instructions""" lines = [f"// {func_name}", f"// Stack: {analysis['stack_size'] or 'unknown'} bytes", f"// RA save: s{analysis['ra_save_reg']-8 if analysis['ra_save_reg'] else '?'}", ""] # Track stack slots stack_vars = {} var_counter = 0 for inst in instructions: mnemonic = inst.get('mnemonic', '') rel = inst['rel_offset'] addr = inst['offset'] # Add label for branch targets lines.append(f"L_{rel:04x}: // 0x{addr:08x}") if mnemonic == 'addi': rd = inst['rd']; rs1 = inst['rs1']; imm = inst['imm'] if rd == 2 and rs1 == 2 and imm < 0: lines.append(f" sp = sp + {imm}; // allocate stack frame ({-imm} bytes)") elif rd == 8 and rs1 == 2: lines.append(f" s0 = sp + {imm}; // frame pointer") elif rs1 == 1 and imm == 0 and rd >= 9: lines.append(f" s{rd-8} = ra; // save return address") elif rd == 1 and imm == 0 and rs1 >= 9: lines.append(f" ra = s{rs1-8}; // restore return address") else: regs = ['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'] lines.append(f" {regs[rd]} = {regs[rs1]} + {imm};") elif mnemonic == 'sd': lines.append(f" *(uint64_t*)({inst['rs1']} + {inst['offset']}) = {['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'][inst['rs2']]};") elif mnemonic == 'ld': lines.append(f" {['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'][inst['rd']]} = *(uint64_t*)({['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'][inst['rs1']]} + {inst['offset']});") elif mnemonic == 'jal': target = inst.get('target', 0) lines.append(f" ra = 0x{addr+4:08x}; // return address") lines.append(f" goto 0x{target:08x}; // call FUNC_{target:08X}") elif mnemonic == 'jalr': if inst.get('rd') == 0 and inst.get('imm') == 0 and inst.get('rs1') == 1: lines.append(f" return; // ret") else: lines.append(f" ra = 0x{addr+4:08x}; goto *({['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'][inst['rs1']]} + {inst['imm']});") elif mnemonic in ('beq','bne','blt','bge','bltu','bgeu'): target = inst.get('target', 0) regs = ['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'] lines.append(f" if ({regs[inst['rs1']]} {mnemonic} {regs[inst['rs2']]}) goto 0x{target:08x};") elif mnemonic in ('auipc', 'lui'): lines.append(f" {['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'][inst['rd']]} = {mnemonic} 0x{inst['imm']:05x};") elif mnemonic in ('add','sub','sll','xor','srl','sra','or','and'): regs = ['x0','ra','sp','gp','tp','t0','t1','t2','s0','s1','a0','a1','a2','a3','a4','a5','a6','a7','s2','s3','s4','s5','s6','s7','s8','s9','s10','s11','t3','t4','t5','t6'] lines.append(f" {regs[inst['rd']]} = {regs[inst['rs1']]} {mnemonic} {regs[inst['rs2']]};") elif mnemonic.startswith('c.'): lines.append(f" {inst['str']};") else: lines.append(f" {inst['str']};") return '\n'.join(lines) def main(): print("Reading firmware...") data = read_binary(FWIMAGE_PATH) print(f"Binary size: {len(data)} bytes") all_results = {} for addr, name in TARGET_FUNCTIONS: offset = addr - BASE_ADDR if offset < 0 or offset >= len(data): print(f"Skipping {name} at 0x{addr:08x} - out of bounds") continue print(f"\nDecompiling {name} at 0x{addr:08x}...") instructions = trace_function(data, offset, max_bytes=2000) analysis = analyze_function(instructions, name) pseudo_c = generate_pseudo_c(instructions, name, analysis) # Save filename = f"{OUTPUT_DIR}/decompiled_{name}.c" with open(filename, 'w') as f: f.write(pseudo_c) print(f" Saved to {filename}") # Print summary print(f" Instructions: {len(instructions)}") print(f" Stack: {analysis['stack_size']}") print(f" RA save: s{analysis['ra_save_reg']-8 if analysis['ra_save_reg'] else '?'}") print(f" RA restore: s{analysis['ra_restore_reg']-8 if analysis['ra_restore_reg'] else '?'}") print(f" Calls: {len(analysis['calls'])}") print(f" RPC refs: {analysis['rpc_refs'][:10]}") all_results[name] = { 'address': f"0x{addr:08x}", 'instruction_count': len(instructions), 'analysis': analysis, } # Save summary with open(f"{OUTPUT_DIR}/decompilation_summary.json", 'w') as f: json.dump(all_results, f, indent=2) print(f"\nSummary saved to {OUTPUT_DIR}/decompilation_summary.json") if __name__ == "__main__": main()