From 6eb5a53182ff95625d93c718326275c27550303e Mon Sep 17 00:00:00 2001 From: Zachery Aaron Shores-Chmielewski Date: Fri, 21 Aug 2026 18:58:57 +0400 Subject: [PATCH] =?UTF-8?q?P1-C:=20U4=20resolved=20=E2=80=94=20WM=20dispat?= =?UTF-8?q?ch=20=3D=20runtime=20registration=20list=20(parser=200xe00412e6?= =?UTF-8?q?,=20arrays=20in=20r5);=20scan=5Fregistrations.py;=20130=20ABI-n?= =?UTF-8?q?amed=20WM=20handlers=20+=2029=20WA;=20Ghidra=20labels=20applied?= =?UTF-8?q?=20(400=20fns);=20findings=20F9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dataset/wa_handlers_named.txt | 29 ++ dataset/wm_handlers_named.txt | 422 ++++++++++++++++++++++++++ dataset/wm_registrations.txt | 422 ++++++++++++++++++++++++++ docs/findings.md | 45 ++- tools/ghidra_scripts/LabelHandlers.py | 46 +++ tools/scan_registrations.py | 53 ++++ 6 files changed, 1004 insertions(+), 13 deletions(-) create mode 100644 dataset/wa_handlers_named.txt create mode 100644 dataset/wm_handlers_named.txt create mode 100644 dataset/wm_registrations.txt create mode 100644 tools/ghidra_scripts/LabelHandlers.py create mode 100755 tools/scan_registrations.py diff --git a/dataset/wa_handlers_named.txt b/dataset/wa_handlers_named.txt new file mode 100644 index 0000000..e17e308 --- /dev/null +++ b/dataset/wa_handlers_named.txt @@ -0,0 +1,29 @@ +0x10201308 id=0x01 fn=0x10201bd0 MCU_EXT_CMD_EFUSE_ACCESS +0x1020130c id=0x02 fn=0x10201b90 MCU_EXT_CMD_DEV_INFO_UPDATE +0x10201310 id=0x03 fn=0x10201ba4 (MTK-internal id) +0x10201314 id=0x04 fn=0x10201b78 MCU_EXT_CMD_RF_TEST +0x10201320 id=0x07 fn=0x10201934 MCU_EXT_CMD_PM_STATE_CTRL +0x10201324 id=0x08 fn=0x10201910 MCU_EXT_CMD_CHANNEL_SWITCH +0x10201330 id=0x0b fn=0x1020164c (MTK-internal id) +0x1020133c id=0x0e fn=0x10201614 (MTK-internal id) +0x10201340 id=0x0f fn=0x102015f0 (MTK-internal id) +0x10201344 id=0x10 fn=0x102015c4 (MTK-internal id) +0x10201348 id=0x11 fn=0x102015a0 MCU_EXT_CMD_SET_TX_POWER_CTRL +0x1020134c id=0x12 fn=0x102018fc (MTK-internal id) +0x10201350 id=0x13 fn=0x102016fc MCU_EXT_CMD_FW_LOG_2_HOST +0x10201354 id=0x14 fn=0x102016bc (MTK-internal id) +0x10201358 id=0x15 fn=0x10201688 (MTK-internal id) +0x1020135c id=0x16 fn=0x1020158c (MTK-internal id) +0x10201360 id=0x17 fn=0x10201580 (MTK-internal id) +0x10201364 id=0x18 fn=0x1020155c (MTK-internal id) +0x10201368 id=0x19 fn=0x10201530 (MTK-internal id) +0x1020138c id=0x22 fn=0x102014fc (MTK-internal id) +0x10201390 id=0x23 fn=0x1020143c MCU_EXT_CMD_THERMAL_PROT +0x102013a4 id=0x28 fn=0x10201408 (MTK-internal id) +0x102013a8 id=0x29 fn=0x10201944 (MTK-internal id) +0x102013ac id=0x2a fn=0x102014e4 (MTK-internal id) +0x102013b0 id=0x2b fn=0x10201520 (MTK-internal id) +0x102013b4 id=0x2c fn=0x10201634 MCU_EXT_CMD_THERMAL_CTRL +0x102013c8 id=0x31 fn=0x10201668 (MTK-internal id) +0x102013cc id=0x32 fn=0x10201674 MCU_EXT_CMD_WTBL_UPDATE +0x10201404 id=0x40 fn=0x10201950 (MTK-internal id) diff --git a/dataset/wm_handlers_named.txt b/dataset/wm_handlers_named.txt new file mode 100644 index 0000000..283b729 --- /dev/null +++ b/dataset/wm_handlers_named.txt @@ -0,0 +1,422 @@ +# 9-entry {id,fn} array @ 0x02231ba8 (r5_t0_a02229800.bin) +0x02231ba8 id=0x00 fn=0xf009707c (MTK-internal id) +0x02231bb0 id=0x09 fn=0xf00963a6 (MTK-internal id) +0x02231bb8 id=0x0a fn=0xf0096430 (MTK-internal id) +0x02231bc0 id=0x0e fn=0xf0096846 (MTK-internal id) +0x02231bc8 id=0x0d fn=0xe0040280 (MTK-internal id) +0x02231bd0 id=0x0f fn=0xf0096b72 (MTK-internal id) +0x02231bd8 id=0x01 fn=0xe00795c8 MCU_EXT_CMD_EFUSE_ACCESS +0x02231be0 id=0x03 fn=0xe00799a8 (MTK-internal id) +0x02231be8 id=0x04 fn=0xe0067480 MCU_EXT_CMD_RF_TEST +# 29-entry {id,fn} array @ 0x02231bf8 (r5_t0_a02229800.bin) +0x02231bf8 id=0x06 fn=0xf00969ca (MTK-internal id) +0x02231c00 id=0x0b fn=0xe004649e (MTK-internal id) +0x02231c08 id=0x0c fn=0xf0096150 (MTK-internal id) +0x02231c10 id=0x10 fn=0xf009606e (MTK-internal id) +0x02231c18 id=0x11 fn=0xf00961a4 MCU_EXT_CMD_SET_TX_POWER_CTRL +0x02231c20 id=0x12 fn=0xe0098294 (MTK-internal id) +0x02231c28 id=0x14 fn=0xe00660b0 (MTK-internal id) +0x02231c30 id=0x24 fn=0xf00961f8 (MTK-internal id) +0x02231c38 id=0x18 fn=0xf0096000 (MTK-internal id) +0x02231c40 id=0x00 fn=0xe003fae4 (MTK-internal id) +0x02231c48 id=0x01 fn=0xe003fbe8 MCU_EXT_CMD_EFUSE_ACCESS +0x02231c50 id=0x02 fn=0xe003fc4c MCU_EXT_CMD_DEV_INFO_UPDATE +0x02231c58 id=0x03 fn=0xe003fcb0 (MTK-internal id) +0x02231c60 id=0x04 fn=0xe003fd14 MCU_EXT_CMD_RF_TEST +0x02231c68 id=0x05 fn=0xe003fd78 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x02231c70 id=0x06 fn=0xe003fda4 (MTK-internal id) +0x02231c78 id=0x07 fn=0xe003fdda MCU_EXT_CMD_PM_STATE_CTRL +0x02231c80 id=0x08 fn=0xe003ff5c MCU_EXT_CMD_CHANNEL_SWITCH +0x02231c88 id=0x09 fn=0xe0040000 (MTK-internal id) +0x02231c90 id=0x0a fn=0xe0040056 (MTK-internal id) +0x02231c98 id=0x0c fn=0xe003face (MTK-internal id) +0x02231ca0 id=0x0d fn=0xe0040082 (MTK-internal id) +0x02231ca8 id=0x0e fn=0xe003fae0 (MTK-internal id) +0x02231cb0 id=0x0f fn=0xe00400ae (MTK-internal id) +0x02231cb8 id=0x10 fn=0xe00401b8 (MTK-internal id) +0x02231cc0 id=0x11 fn=0xe003fe5e MCU_EXT_CMD_SET_TX_POWER_CTRL +0x02231cc8 id=0x13 fn=0xe00401e4 MCU_EXT_CMD_FW_LOG_2_HOST +0x02231cd0 id=0x12 fn=0xe00401f6 (MTK-internal id) +0x02231cd8 id=0x15 fn=0xe0040254 (MTK-internal id) +# 38-entry {id,fn} array @ 0x02231ea8 (r5_t0_a02229800.bin) +0x02231ea8 id=0x07 fn=0xe0040914 MCU_EXT_CMD_PM_STATE_CTRL +0x02231eb0 id=0x25 fn=0xf0097174 MCU_EXT_CMD_STA_REC_UPDATE +0x02231eb8 id=0x26 fn=0xe0092848 MCU_EXT_CMD_BSS_INFO_UPDATE +0x02231ec0 id=0x2a fn=0xe00928c6 (MTK-internal id) +0x02231ec8 id=0xbf fn=0xe009277c (MTK-internal id) +0x02231ed0 id=0x13 fn=0xe0042006 MCU_EXT_CMD_FW_LOG_2_HOST +0x02231ed8 id=0x27 fn=0xe005e710 MCU_EXT_CMD_EDCA_UPDATE +0x02231ee0 id=0x28 fn=0xe0060b5e (MTK-internal id) +0x02231ee8 id=0x47 fn=0xe005f636 MCU_EXT_CMD_RX_HDR_TRANS +0x02231ef0 id=0x48 fn=0xe005f796 MCU_EXT_CMD_MUAR_UPDATE +0x02231ef8 id=0x93 fn=0xe005f5ae (MTK-internal id) +0x02231f00 id=0x32 fn=0xe00402fa MCU_EXT_CMD_WTBL_UPDATE +0x02231f08 id=0x49 fn=0xe003ee7e MCU_EXT_CMD_BCN_OFFLOAD +0x02231f10 id=0xa6 fn=0xe005db74 (MTK-internal id) +0x02231f18 id=0xae fn=0xe005f706 (MTK-internal id) +0x02231f20 id=0x95 fn=0xe004297c MCU_EXT_CMD_FW_DBG_CTRL +0x02231f28 id=0x81 fn=0xe005d480 MCU_EXT_CMD_SET_SER_TRIGGER +0x02231f30 id=0x57 fn=0xe0042558 (MTK-internal id) +0x02231f38 id=0x9c fn=0xe0043588 (MTK-internal id) +0x02231f40 id=0x94 fn=0xe0040de4 MCU_EXT_CMD_TWT_AGRT_UPDATE +0x02231f48 id=0x02 fn=0xe007fade MCU_EXT_CMD_DEV_INFO_UPDATE +0x02231f50 id=0xb7 fn=0xe0042f70 (MTK-internal id) +0x02231f58 id=0xc4 fn=0xe0043248 (MTK-internal id) +0x02231f60 id=0x98 fn=0xe0061e48 (MTK-internal id) +0x02231f68 id=0x42 fn=0xe005f5ec (MTK-internal id) +0x02231f70 id=0x50 fn=0xe0047c90 (MTK-internal id) +0x02231f78 id=0x5a fn=0xe004166c MCU_EXT_CMD_GET_MIB_INFO +0x02231f80 id=0x3c fn=0xe00414ec (MTK-internal id) +0x02231f88 id=0x1e fn=0xe00663b2 MCU_EXT_CMD_TXBF_ACTION +0x02231f90 id=0x36 fn=0xe0062e16 MCU_EXT_CMD_SET_DRR_CTRL +0x02231f98 id=0x38 fn=0xe00640fe (MTK-internal id) +0x02231fa0 id=0x37 fn=0xe0062b62 (MTK-internal id) +0x02231fa8 id=0x4b fn=0xe0062bfe (MTK-internal id) +0x02231fb0 id=0x4a fn=0xe0062eae MCU_EXT_CMD_RX_AIRTIME_CTRL +0x02231fb8 id=0x67 fn=0xe0064714 MCU_EXT_CMD_CAL_CACHE +0x02231fc0 id=0x68 fn=0xe0063182 MCU_EXT_CMD_RED_ENABLE +0x02231fc8 id=0x6b fn=0xe00645da (MTK-internal id) +0x02231fd0 id=0x01 fn=0xe0090b8a MCU_EXT_CMD_EFUSE_ACCESS +# 31-entry {id,fn} array @ 0x02231fe0 (r5_t0_a02229800.bin) +0x02231fe0 id=0x04 fn=0xe008a8ae MCU_EXT_CMD_RF_TEST +0x02231fe8 id=0x08 fn=0xe0080680 MCU_EXT_CMD_CHANNEL_SWITCH +0x02231ff0 id=0x4e fn=0xe0080680 MCU_EXT_CMD_SET_RX_PATH +0x02231ff8 id=0x4f fn=0xe00897a0 MCU_EXT_CMD_EFUSE_FREE_BLOCK +0x02232000 id=0x19 fn=0xe00918a0 (MTK-internal id) +0x02232008 id=0x1f fn=0xe007d684 (MTK-internal id) +0x02232010 id=0x21 fn=0xe00804ac MCU_EXT_CMD_EFUSE_BUFFER_MODE +0x02232018 id=0x9b fn=0xe007ee5e (MTK-internal id) +0x02232020 id=0xbe fn=0xe007ef44 (MTK-internal id) +0x02232028 id=0x24 fn=0xe00407aa (MTK-internal id) +0x02232030 id=0x2c fn=0xe008bf86 MCU_EXT_CMD_THERMAL_CTRL +0x02232038 id=0x30 fn=0xe007a9b2 (MTK-internal id) +0x02232040 id=0x79 fn=0xe0080b88 (MTK-internal id) +0x02232048 id=0x17 fn=0xe0042d38 (MTK-internal id) +0x02232050 id=0x82 fn=0xe0082128 (MTK-internal id) +0x02232058 id=0x3d fn=0xe008a938 MCU_EXT_CMD_ATE_CTRL +0x02232060 id=0x3e fn=0xe0081686 MCU_EXT_CMD_PROTECT_CTRL +0x02232068 id=0x9f fn=0xe0045f3c MCU_EXT_CMD_MURU_CTRL +0x02232070 id=0x87 fn=0x0221cf98 (MTK-internal id) +0x02232078 id=0x3a fn=0xe007ce40 MCU_EXT_CMD_SET_RDD_CTRL +0x02232080 id=0xa3 fn=0xe007cb80 (MTK-internal id) +0x02232088 id=0xc5 fn=0xe007cd20 (MTK-internal id) +0x02232090 id=0x9d fn=0xe007c0c0 MCU_EXT_CMD_SET_RDD_TH +0x02232098 id=0xb2 fn=0xe007c138 (MTK-internal id) +0x022320a0 id=0x46 fn=0xe004174a MCU_EXT_CMD_MAC_INIT_CTRL +0x022320a8 id=0x44 fn=0xe0048392 (MTK-internal id) +0x022320b0 id=0x43 fn=0xe004197c (MTK-internal id) +0x022320b8 id=0x23 fn=0xe008bca8 MCU_EXT_CMD_THERMAL_PROT +0x022320c0 id=0x56 fn=0xe006cf68 (MTK-internal id) +0x022320c8 id=0x58 fn=0xe008cf2a MCU_EXT_CMD_TX_POWER_FEATURE_CTRL +0x022320d0 id=0xa1 fn=0xe00419c6 (MTK-internal id) +# 24-entry {id,fn} array @ 0x022320e0 (r5_t0_a02229800.bin) +0x022320e0 id=0xad fn=0xe00779ac MCU_EXT_CMD_PHY_STAT_INFO +0x022320e8 id=0xb5 fn=0xe0077e68 (MTK-internal id) +0x022320f0 id=0x73 fn=0xe0040778 (MTK-internal id) +0x022320f8 id=0x9a fn=0xe0080024 MCU_EXT_CMD_OFFCH_SCAN_CTRL +0x02232100 id=0xab fn=0xe008a67c MCU_EXT_CMD_GROUP_PRE_CAL_INFO +0x02232108 id=0xac fn=0xe008a6ce MCU_EXT_CMD_DPD_PRE_CAL_INFO +0x02232110 id=0xa8 fn=0xe0083ede MCU_EXT_CMD_SET_SPR +0x02232118 id=0xa4 fn=0xe008aadc (MTK-internal id) +0x02232120 id=0xb3 fn=0xe008ae7c (MTK-internal id) +0x02232128 id=0xb6 fn=0xe0078664 (MTK-internal id) +0x02232130 id=0xb8 fn=0xe0048010 (MTK-internal id) +0x02232138 id=0xb9 fn=0xe007944c (MTK-internal id) +0x02232140 id=0xba fn=0xe00814f0 (MTK-internal id) +0x02232148 id=0xc8 fn=0xe00419fc (MTK-internal id) +0x02232150 id=0x7a fn=0xe0041a42 (MTK-internal id) +0x02232158 id=0x7b fn=0xe00417d0 (MTK-internal id) +0x02232160 id=0x7c fn=0xe0041854 MCU_EXT_CMD_SET_RADAR_TH +0x02232168 id=0xc6 fn=0xe00418ae (MTK-internal id) +0x02232170 id=0xc7 fn=0xe0041702 (MTK-internal id) +0x02232178 id=0xc0 fn=0xe007ebc0 (MTK-internal id) +0x02232180 id=0xc2 fn=0xe00482e4 (MTK-internal id) +0x02232188 id=0xd5 fn=0xe005dde4 (MTK-internal id) +0x02232190 id=0x0f fn=0xe0046e14 (MTK-internal id) +0x02232198 id=0x5b fn=0xe0081550 (MTK-internal id) +# 43-entry {id,fn} array @ 0x022324ec (r5_t0_a02229800.bin) +0x022324ec id=0x01 fn=0xe0045a7e MCU_EXT_CMD_EFUSE_ACCESS +0x022324f4 id=0x06 fn=0xe0043b36 (MTK-internal id) +0x022324fc id=0x0b fn=0xe0043c6c (MTK-internal id) +0x02232504 id=0x14 fn=0xe00452b6 (MTK-internal id) +0x0223250c id=0x15 fn=0xe0043990 (MTK-internal id) +0x02232514 id=0x0c fn=0xe0043884 (MTK-internal id) +0x0223251c id=0x0d fn=0xe0043ba0 (MTK-internal id) +0x02232524 id=0x0e fn=0xe0044aec (MTK-internal id) +0x0223252c id=0x0f fn=0xe0043dc2 (MTK-internal id) +0x02232534 id=0x10 fn=0xe0044092 (MTK-internal id) +0x0223253c id=0x11 fn=0xe0045950 MCU_EXT_CMD_SET_TX_POWER_CTRL +0x02232544 id=0x12 fn=0xe0044b00 (MTK-internal id) +0x0223254c id=0x13 fn=0xe0043c06 MCU_EXT_CMD_FW_LOG_2_HOST +0x02232554 id=0x33 fn=0xe0043e1a (MTK-internal id) +0x0223255c id=0x18 fn=0xe00440ac (MTK-internal id) +0x02232564 id=0x19 fn=0xe0043a7a (MTK-internal id) +0x0223256c id=0x1a fn=0xe00441ac (MTK-internal id) +0x02232574 id=0x1b fn=0xe00441c8 (MTK-internal id) +0x0223257c id=0x50 fn=0xe00439a0 (MTK-internal id) +0x02232584 id=0x51 fn=0xe004552a (MTK-internal id) +0x0223258c id=0x64 fn=0xe004432a (MTK-internal id) +0x02232594 id=0x65 fn=0xe0043e58 (MTK-internal id) +0x0223259c id=0x66 fn=0xe0043b1c (MTK-internal id) +0x022325a4 id=0x67 fn=0xe0043cbe MCU_EXT_CMD_CAL_CACHE +0x022325ac id=0x68 fn=0xe0043ec2 MCU_EXT_CMD_RED_ENABLE +0x022325b4 id=0x69 fn=0xe0043a00 (MTK-internal id) +0x022325bc id=0x6a fn=0xe0043a1a (MTK-internal id) +0x022325c4 id=0xc8 fn=0xe0044292 (MTK-internal id) +0x022325cc id=0xc9 fn=0xe00442c0 (MTK-internal id) +0x022325d4 id=0xca fn=0xe0043a42 (MTK-internal id) +0x022325dc id=0xcb fn=0xe0044b10 (MTK-internal id) +0x022325e4 id=0xcc fn=0xe0043a64 (MTK-internal id) +0x022325ec id=0xcd fn=0xe0043aa6 (MTK-internal id) +0x022325f4 id=0xd2 fn=0xe0043f1a (MTK-internal id) +0x022325fc id=0xd3 fn=0xe0043f4a (MTK-internal id) +0x02232604 id=0xd0 fn=0xe0043f8c (MTK-internal id) +0x0223260c id=0xd1 fn=0xe0043fbc (MTK-internal id) +0x02232614 id=0x96 fn=0xe0043abc (MTK-internal id) +0x0223261c id=0x97 fn=0xe00441ee (MTK-internal id) +0x02232624 id=0xd4 fn=0xe0043fec (MTK-internal id) +0x0223262c id=0xfe fn=0xe0044bde (MTK-internal id) +0x02232634 id=0xce fn=0xe0043d32 (MTK-internal id) +0x0223263c id=0xcf fn=0xe0043aca (MTK-internal id) +# 8-entry {id,fn} array @ 0x0223670c (r5_t0_a02229800.bin) +0x0223670c id=0x00 fn=0xe0077a2c (MTK-internal id) +0x02236714 id=0x01 fn=0xe0077a5c MCU_EXT_CMD_EFUSE_ACCESS +0x0223671c id=0x02 fn=0xe007758c MCU_EXT_CMD_DEV_INFO_UPDATE +0x02236724 id=0x03 fn=0xe007747c (MTK-internal id) +0x0223672c id=0x04 fn=0xe0077aa2 MCU_EXT_CMD_RF_TEST +0x02236734 id=0x05 fn=0xe00776a8 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x0223673c id=0x06 fn=0xe0077478 (MTK-internal id) +0x02236744 id=0x07 fn=0xe00776b6 MCU_EXT_CMD_PM_STATE_CTRL +# 92-entry {id,fn} array @ 0x02236bf0 (r5_t0_a02229800.bin) +0x02236bf0 id=0x01 fn=0xe0083c88 MCU_EXT_CMD_EFUSE_ACCESS +0x02236bf8 id=0x02 fn=0xe00844f2 MCU_EXT_CMD_DEV_INFO_UPDATE +0x02236c00 id=0x03 fn=0xe00838c6 (MTK-internal id) +0x02236c08 id=0x04 fn=0xe008453c MCU_EXT_CMD_RF_TEST +0x02236c10 id=0x05 fn=0xe0083aa0 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x02236c18 id=0x06 fn=0xe008461a (MTK-internal id) +0x02236c20 id=0x07 fn=0xe0083d1e MCU_EXT_CMD_PM_STATE_CTRL +0x02236c28 id=0x08 fn=0xe0084666 MCU_EXT_CMD_CHANNEL_SWITCH +0x02236c30 id=0x09 fn=0xe0083d62 (MTK-internal id) +0x02236c38 id=0x0a fn=0xe00846b2 (MTK-internal id) +0x02236c40 id=0x0b fn=0xe00838dc (MTK-internal id) +0x02236c48 id=0x0c fn=0xe0084586 (MTK-internal id) +0x02236c50 id=0x0d fn=0xe00838f2 (MTK-internal id) +0x02236c58 id=0x0e fn=0xe00845d0 (MTK-internal id) +0x02236c60 id=0x0f fn=0xe0083908 (MTK-internal id) +0x02236c68 id=0x10 fn=0xe00846fe (MTK-internal id) +0x02236c70 id=0x11 fn=0xe008391a MCU_EXT_CMD_SET_TX_POWER_CTRL +0x02236c78 id=0x12 fn=0xe0084748 (MTK-internal id) +0x02236c80 id=0x13 fn=0xe008392c MCU_EXT_CMD_FW_LOG_2_HOST +0x02236c88 id=0x14 fn=0xe0084792 (MTK-internal id) +0x02236c90 id=0x15 fn=0xe008393e (MTK-internal id) +0x02236c98 id=0x16 fn=0xe00847dc (MTK-internal id) +0x02236ca0 id=0x17 fn=0xe0083950 (MTK-internal id) +0x02236ca8 id=0x18 fn=0xe0084826 (MTK-internal id) +0x02236cb0 id=0x19 fn=0xe0083962 (MTK-internal id) +0x02236cb8 id=0x1a fn=0xe008486e (MTK-internal id) +0x02236cc0 id=0x1b fn=0xe0083974 (MTK-internal id) +0x02236cc8 id=0x1c fn=0xe00848b8 (MTK-internal id) +0x02236cd0 id=0x1d fn=0xe0083986 (MTK-internal id) +0x02236cd8 id=0x1e fn=0xe0084902 MCU_EXT_CMD_TXBF_ACTION +0x02236ce0 id=0x1f fn=0xe0083998 (MTK-internal id) +0x02236ce8 id=0x20 fn=0xe008494c (MTK-internal id) +0x02236cf0 id=0x21 fn=0xe00839aa MCU_EXT_CMD_EFUSE_BUFFER_MODE +0x02236cf8 id=0x22 fn=0xe0084996 (MTK-internal id) +0x02236d00 id=0x23 fn=0xe00839c2 MCU_EXT_CMD_THERMAL_PROT +0x02236d08 id=0x24 fn=0xe00849e2 (MTK-internal id) +0x02236d10 id=0x25 fn=0xe00839da MCU_EXT_CMD_STA_REC_UPDATE +0x02236d18 id=0x26 fn=0xe0084a2e MCU_EXT_CMD_BSS_INFO_UPDATE +0x02236d20 id=0x27 fn=0xe00839f2 MCU_EXT_CMD_EDCA_UPDATE +0x02236d28 id=0x28 fn=0xe0084a7a (MTK-internal id) +0x02236d30 id=0x29 fn=0xe0083db0 (MTK-internal id) +0x02236d38 id=0x2a fn=0xe0084ac6 (MTK-internal id) +0x02236d40 id=0x2b fn=0xe0083d8e (MTK-internal id) +0x02236d48 id=0x2c fn=0xe0084b12 MCU_EXT_CMD_THERMAL_CTRL +0x02236d50 id=0x2d fn=0xe0083a20 (MTK-internal id) +0x02236d58 id=0x2e fn=0xe0084b5e (MTK-internal id) +0x02236d60 id=0x31 fn=0xe0083a38 (MTK-internal id) +0x02236d68 id=0x32 fn=0xe0084baa MCU_EXT_CMD_WTBL_UPDATE +0x02236d70 id=0x33 fn=0xe0083a50 (MTK-internal id) +0x02236d78 id=0x34 fn=0xe0084bf6 (MTK-internal id) +0x02236d80 id=0x80 fn=0xe0083ddc MCU_EXT_CMD_MWDS_SUPPORT +0x02236d88 id=0x81 fn=0xe0084d06 MCU_EXT_CMD_SET_SER_TRIGGER +0x02236d90 id=0x82 fn=0xe0083ccc (MTK-internal id) +0x02236d98 id=0x83 fn=0xe0084c42 (MTK-internal id) +0x02236da0 id=0x84 fn=0xe0084cae (MTK-internal id) +0x02236da8 id=0x85 fn=0xe008385c (MTK-internal id) +0x02236db0 id=0x86 fn=0xe0083884 (MTK-internal id) +0x02236db8 id=0x87 fn=0xe0083b6a (MTK-internal id) +0x02236dc0 id=0x88 fn=0xe0083fc2 (MTK-internal id) +0x02236dc8 id=0x89 fn=0xe0083cec (MTK-internal id) +0x02236dd0 id=0x8a fn=0xe0084d5a (MTK-internal id) +0x02236dd8 id=0xc0 fn=0xe0083b10 (MTK-internal id) +0x02236de0 id=0xc1 fn=0xe00840cc (MTK-internal id) +0x02236de8 id=0xc2 fn=0xe0083b24 (MTK-internal id) +0x02236df0 id=0xc3 fn=0xe0084112 (MTK-internal id) +0x02236df8 id=0xc4 fn=0xe0083ba0 (MTK-internal id) +0x02236e00 id=0xc5 fn=0xe00841a0 (MTK-internal id) +0x02236e08 id=0xc6 fn=0xe0083bb4 (MTK-internal id) +0x02236e10 id=0xc7 fn=0xe00841e6 (MTK-internal id) +0x02236e18 id=0xc8 fn=0xe0083bc8 (MTK-internal id) +0x02236e20 id=0xc9 fn=0xe008422c (MTK-internal id) +0x02236e28 id=0xca fn=0xe0083bdc (MTK-internal id) +0x02236e30 id=0xcb fn=0xe0084272 (MTK-internal id) +0x02236e38 id=0xcc fn=0xe0083bf0 (MTK-internal id) +0x02236e40 id=0xcd fn=0xe00842b8 (MTK-internal id) +0x02236e48 id=0xce fn=0xe0083f4e (MTK-internal id) +0x02236e50 id=0xcf fn=0xe00842fe (MTK-internal id) +0x02236e58 id=0xd0 fn=0xe0083c1a (MTK-internal id) +0x02236e60 id=0xd1 fn=0xe0084394 (MTK-internal id) +0x02236e68 id=0xd2 fn=0xe0083c04 (MTK-internal id) +0x02236e70 id=0xd3 fn=0xe0083aec (MTK-internal id) +0x02236e78 id=0xd4 fn=0xe0084158 (MTK-internal id) +0x02236e80 id=0xd5 fn=0xe0083c2e (MTK-internal id) +0x02236e88 id=0xd6 fn=0xe00843da (MTK-internal id) +0x02236e90 id=0xd7 fn=0xe0083c42 (MTK-internal id) +0x02236e98 id=0xd8 fn=0xe0084420 (MTK-internal id) +0x02236ea0 id=0xd9 fn=0xe0083c56 (MTK-internal id) +0x02236ea8 id=0xda fn=0xe0084466 (MTK-internal id) +0x02236eb0 id=0xdb fn=0xe00844ac (MTK-internal id) +0x02236eb8 id=0xdc fn=0xe0083c6a (MTK-internal id) +0x02236ec0 id=0xdd fn=0xe0084346 (MTK-internal id) +0x02236ec8 id=0xea fn=0xe0083a6a (MTK-internal id) +# 10-entry {id,fn} array @ 0x0223833c (r5_t0_a02229800.bin) +0x0223833c id=0x00 fn=0xe008f91e (MTK-internal id) +0x02238344 id=0x01 fn=0xe008f068 MCU_EXT_CMD_EFUSE_ACCESS +0x0223834c id=0x02 fn=0xe008f080 MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238354 id=0x03 fn=0xe008f098 (MTK-internal id) +0x0223835c id=0x04 fn=0xe008f18e MCU_EXT_CMD_RF_TEST +0x02238364 id=0x05 fn=0xe008f1ba MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x0223836c id=0x06 fn=0xe008f1d8 (MTK-internal id) +0x02238374 id=0x07 fn=0xe008ee6c MCU_EXT_CMD_PM_STATE_CTRL +0x0223837c id=0x08 fn=0xe008f164 MCU_EXT_CMD_CHANNEL_SWITCH +0x02238384 id=0x0b fn=0xe008e3e0 (MTK-internal id) +# 9-entry {id,fn} array @ 0x02238534 (r5_t0_a02229800.bin) +0x02238534 id=0x00 fn=0xe0091a16 (MTK-internal id) +0x0223853c id=0x01 fn=0xe0091a8c MCU_EXT_CMD_EFUSE_ACCESS +0x02238544 id=0x02 fn=0xe0091aec MCU_EXT_CMD_DEV_INFO_UPDATE +0x0223854c id=0x03 fn=0xe0091ee8 (MTK-internal id) +0x02238554 id=0x04 fn=0xe009227c MCU_EXT_CMD_RF_TEST +0x0223855c id=0x05 fn=0xe0091ba2 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x02238564 id=0x00 fn=0xe00918f6 (MTK-internal id) +0x0223856c id=0x01 fn=0xe00929b0 MCU_EXT_CMD_EFUSE_ACCESS +0x02238574 id=0x02 fn=0xe0091c4e MCU_EXT_CMD_DEV_INFO_UPDATE +# 10-entry {id,fn} array @ 0x0223858c (r5_t0_a02229800.bin) +0x0223858c id=0x07 fn=0xe0091cd8 MCU_EXT_CMD_PM_STATE_CTRL +0x02238594 id=0x0a fn=0xe0079520 (MTK-internal id) +0x0223859c id=0x0b fn=0xe0091d64 (MTK-internal id) +0x022385a4 id=0x0c fn=0xe0091d96 (MTK-internal id) +0x022385ac id=0x0d fn=0xe0091de0 (MTK-internal id) +0x022385b4 id=0x0e fn=0xe0092690 (MTK-internal id) +0x022385bc id=0x0f fn=0xe00924a0 (MTK-internal id) +0x022385c4 id=0x10 fn=0xe0092568 (MTK-internal id) +0x022385cc id=0x11 fn=0xe003f5d4 MCU_EXT_CMD_SET_TX_POWER_CTRL +0x022385d4 id=0x1b fn=0xe00925d4 (MTK-internal id) +# 49-entry {id,fn} array @ 0x02238a5c (r5_t0_a02229800.bin) +0x02238a5c id=0x00 fn=0xe00af53c (MTK-internal id) +0x02238a64 id=0x01 fn=0xe00af544 MCU_EXT_CMD_EFUSE_ACCESS +0x02238a6c id=0x02 fn=0xe00af54c MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238a74 id=0x03 fn=0xe00af554 (MTK-internal id) +0x02238a7c id=0x00 fn=0xe00af578 (MTK-internal id) +0x02238a84 id=0x01 fn=0xe00af55c MCU_EXT_CMD_EFUSE_ACCESS +0x02238a8c id=0x02 fn=0xe00af568 MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238a94 id=0x03 fn=0xe00af574 (MTK-internal id) +0x02238a9c id=0x04 fn=0xe00af580 MCU_EXT_CMD_RF_TEST +0x02238aa4 id=0x05 fn=0xe00af58c MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x02238aac id=0x06 fn=0xe00af598 (MTK-internal id) +0x02238ab4 id=0x07 fn=0xe00af5a8 MCU_EXT_CMD_PM_STATE_CTRL +0x02238abc id=0x11 fn=0xe00af5b8 MCU_EXT_CMD_SET_TX_POWER_CTRL +0x02238ac4 id=0x13 fn=0xe00af5c4 MCU_EXT_CMD_FW_LOG_2_HOST +0x02238acc id=0x16 fn=0xe00af5d0 (MTK-internal id) +0x02238ad4 id=0x17 fn=0xe00af5e0 (MTK-internal id) +0x02238adc id=0x00 fn=0xe00af5f0 (MTK-internal id) +0x02238ae4 id=0x01 fn=0xe00af604 MCU_EXT_CMD_EFUSE_ACCESS +0x02238aec id=0x02 fn=0xe00af61c MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238af4 id=0x03 fn=0xe00af630 (MTK-internal id) +0x02238afc id=0x04 fn=0xe00af644 MCU_EXT_CMD_RF_TEST +0x02238b04 id=0x05 fn=0xe00af658 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x02238b0c id=0x06 fn=0xe00af670 (MTK-internal id) +0x02238b14 id=0x07 fn=0xe00af604 MCU_EXT_CMD_PM_STATE_CTRL +0x02238b1c id=0x08 fn=0xe00af5f0 MCU_EXT_CMD_CHANNEL_SWITCH +0x02238b24 id=0x09 fn=0xe00af670 (MTK-internal id) +0x02238b2c id=0x0a fn=0xe00af604 (MTK-internal id) +0x02238b34 id=0x0b fn=0xe00af604 (MTK-internal id) +0x02238b3c id=0x00 fn=0xe00af684 (MTK-internal id) +0x02238b44 id=0x01 fn=0xe00af690 MCU_EXT_CMD_EFUSE_ACCESS +0x02238b4c id=0x02 fn=0xe00af69c MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238b54 id=0x03 fn=0xe00af6b0 (MTK-internal id) +0x02238b5c id=0x0d fn=0xe00af6b8 (MTK-internal id) +0x02238b64 id=0x0e fn=0xe00af6c0 (MTK-internal id) +0x02238b6c id=0x0f fn=0xe00af6c8 (MTK-internal id) +0x02238b74 id=0x10 fn=0xe00af6d0 (MTK-internal id) +0x02238b7c id=0x00 fn=0xe00af6d4 (MTK-internal id) +0x02238b84 id=0x01 fn=0xe00a68d0 MCU_EXT_CMD_EFUSE_ACCESS +0x02238b8c id=0x02 fn=0xe00af6d0 MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238b94 id=0x03 fn=0xe00af6e4 (MTK-internal id) +0x02238b9c id=0x04 fn=0xe00a6988 MCU_EXT_CMD_RF_TEST +0x02238ba4 id=0x05 fn=0xe00af6e8 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL +0x02238bac id=0x06 fn=0xe00af6ec (MTK-internal id) +0x02238bb4 id=0x07 fn=0xe00af6fc MCU_EXT_CMD_PM_STATE_CTRL +0x02238bbc id=0x08 fn=0xe00af704 MCU_EXT_CMD_CHANNEL_SWITCH +0x02238bc4 id=0x09 fn=0xe00af714 (MTK-internal id) +0x02238bcc id=0x0a fn=0xe00af71c (MTK-internal id) +0x02238bd4 id=0x0b fn=0xe00af728 (MTK-internal id) +0x02238bdc id=0x0c fn=0xe00af734 (MTK-internal id) +# 33-entry {id,fn} array @ 0x02238e44 (r5_t0_a02229800.bin) +0x02238e44 id=0x00 fn=0xe003e66e (MTK-internal id) +0x02238e4c id=0x01 fn=0xe003e696 MCU_EXT_CMD_EFUSE_ACCESS +0x02238e54 id=0x16 fn=0xe003c370 (MTK-internal id) +0x02238e5c id=0x17 fn=0xe003c370 (MTK-internal id) +0x02238e64 id=0x18 fn=0xe003c370 (MTK-internal id) +0x02238e6c id=0x19 fn=0xe003c370 (MTK-internal id) +0x02238e74 id=0x28 fn=0xe003c63e (MTK-internal id) +0x02238e7c id=0x2b fn=0xe003c63e (MTK-internal id) +0x02238e84 id=0x00 fn=0xe003c3aa (MTK-internal id) +0x02238e8c id=0x29 fn=0xe003c3ac (MTK-internal id) +0x02238e94 id=0x1a fn=0xe003c028 (MTK-internal id) +0x02238e9c id=0x1b fn=0xe003c028 (MTK-internal id) +0x02238ea4 id=0x1c fn=0xe003c028 (MTK-internal id) +0x02238eac id=0x1d fn=0xe003c028 (MTK-internal id) +0x02238eb4 id=0x12 fn=0xe003c34c (MTK-internal id) +0x02238ebc id=0x13 fn=0xe003c34c MCU_EXT_CMD_FW_LOG_2_HOST +0x02238ec4 id=0x14 fn=0xe003c34c (MTK-internal id) +0x02238ecc id=0x15 fn=0xe003c34c (MTK-internal id) +0x02238ed4 id=0x06 fn=0xe003c012 (MTK-internal id) +0x02238edc id=0x07 fn=0xe003c012 MCU_EXT_CMD_PM_STATE_CTRL +0x02238ee4 id=0x08 fn=0xe003c012 MCU_EXT_CMD_CHANNEL_SWITCH +0x02238eec id=0x09 fn=0xe003c012 (MTK-internal id) +0x02238ef4 id=0x0a fn=0xe003c012 (MTK-internal id) +0x02238efc id=0x0b fn=0xe003c012 (MTK-internal id) +0x02238f04 id=0x0c fn=0xe003c012 (MTK-internal id) +0x02238f0c id=0x0d fn=0xe003c012 (MTK-internal id) +0x02238f14 id=0x2e fn=0xe003e624 (MTK-internal id) +0x02238f1c id=0x2f fn=0xe003e624 (MTK-internal id) +0x02238f24 id=0x01 fn=0xe003e586 MCU_EXT_CMD_EFUSE_ACCESS +0x02238f2c id=0x02 fn=0xe003e586 MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238f34 id=0x03 fn=0xe003e586 (MTK-internal id) +0x02238f3c id=0x04 fn=0xe003e586 MCU_EXT_CMD_RF_TEST +0x02238f44 id=0x23 fn=0xe003c38c MCU_EXT_CMD_THERMAL_PROT +# 9-entry {id,fn} array @ 0x02238f74 (r5_t0_a02229800.bin) +0x02238f74 id=0xef fn=0xe0041460 (MTK-internal id) +0x02238f7c id=0xed fn=0xe00412e6 (MTK-internal id) +0x02238f84 id=0x04 fn=0xe0040680 MCU_EXT_CMD_RF_TEST +0x02238f8c id=0x02 fn=0xe0042ebe MCU_EXT_CMD_DEV_INFO_UPDATE +0x02238f94 id=0x8d fn=0xe004276c (MTK-internal id) +0x02238f9c id=0x10 fn=0xe0043330 (MTK-internal id) +0x02238fa4 id=0x4b fn=0xe00433fa (MTK-internal id) +0x02238fac id=0x7d fn=0xe004375c MCU_EXT_CMD_SET_RDD_PATTERN +0x02238fb4 id=0xfc fn=0xe00437a4 (MTK-internal id) +# 13-entry {id,fn} array @ 0x02238ffc (r5_t0_a02229800.bin) +0x02238ffc id=0x06 fn=0xf009b6d6 (MTK-internal id) +0x02239004 id=0x07 fn=0xf009b6d6 MCU_EXT_CMD_PM_STATE_CTRL +0x0223900c id=0x08 fn=0xf009b6d6 MCU_EXT_CMD_CHANNEL_SWITCH +0x02239014 id=0x09 fn=0xf009b6d6 (MTK-internal id) +0x0223901c id=0x0a fn=0xf009b6d6 (MTK-internal id) +0x02239024 id=0x0b fn=0xf009b6d6 (MTK-internal id) +0x0223902c id=0x0c fn=0xf009b6d6 (MTK-internal id) +0x02239034 id=0x0d fn=0xf009b6d6 (MTK-internal id) +0x0223903c id=0x0e fn=0xf009b6d6 (MTK-internal id) +0x02239044 id=0x0f fn=0xf009b6d6 (MTK-internal id) +0x0223904c id=0x10 fn=0xe006946e (MTK-internal id) +0x02239054 id=0x11 fn=0xe003d7b4 MCU_EXT_CMD_SET_TX_POWER_CTRL +0x0223905c id=0x12 fn=0xe00471f6 (MTK-internal id) \ No newline at end of file diff --git a/dataset/wm_registrations.txt b/dataset/wm_registrations.txt new file mode 100644 index 0000000..1ccf751 --- /dev/null +++ b/dataset/wm_registrations.txt @@ -0,0 +1,422 @@ +# 9-entry {id,fn} array @ 0x02231ba8 (r5_t0_a02229800.bin) +0x02231ba8 id=0x00 fn=0xf009707c +0x02231bb0 id=0x09 fn=0xf00963a6 +0x02231bb8 id=0x0a fn=0xf0096430 +0x02231bc0 id=0x0e fn=0xf0096846 +0x02231bc8 id=0x0d fn=0xe0040280 +0x02231bd0 id=0x0f fn=0xf0096b72 +0x02231bd8 id=0x01 fn=0xe00795c8 +0x02231be0 id=0x03 fn=0xe00799a8 +0x02231be8 id=0x04 fn=0xe0067480 +# 29-entry {id,fn} array @ 0x02231bf8 (r5_t0_a02229800.bin) +0x02231bf8 id=0x06 fn=0xf00969ca +0x02231c00 id=0x0b fn=0xe004649e +0x02231c08 id=0x0c fn=0xf0096150 +0x02231c10 id=0x10 fn=0xf009606e +0x02231c18 id=0x11 fn=0xf00961a4 +0x02231c20 id=0x12 fn=0xe0098294 +0x02231c28 id=0x14 fn=0xe00660b0 +0x02231c30 id=0x24 fn=0xf00961f8 +0x02231c38 id=0x18 fn=0xf0096000 +0x02231c40 id=0x00 fn=0xe003fae4 +0x02231c48 id=0x01 fn=0xe003fbe8 +0x02231c50 id=0x02 fn=0xe003fc4c +0x02231c58 id=0x03 fn=0xe003fcb0 +0x02231c60 id=0x04 fn=0xe003fd14 +0x02231c68 id=0x05 fn=0xe003fd78 +0x02231c70 id=0x06 fn=0xe003fda4 +0x02231c78 id=0x07 fn=0xe003fdda +0x02231c80 id=0x08 fn=0xe003ff5c +0x02231c88 id=0x09 fn=0xe0040000 +0x02231c90 id=0x0a fn=0xe0040056 +0x02231c98 id=0x0c fn=0xe003face +0x02231ca0 id=0x0d fn=0xe0040082 +0x02231ca8 id=0x0e fn=0xe003fae0 +0x02231cb0 id=0x0f fn=0xe00400ae +0x02231cb8 id=0x10 fn=0xe00401b8 +0x02231cc0 id=0x11 fn=0xe003fe5e +0x02231cc8 id=0x13 fn=0xe00401e4 +0x02231cd0 id=0x12 fn=0xe00401f6 +0x02231cd8 id=0x15 fn=0xe0040254 +# 38-entry {id,fn} array @ 0x02231ea8 (r5_t0_a02229800.bin) +0x02231ea8 id=0x07 fn=0xe0040914 +0x02231eb0 id=0x25 fn=0xf0097174 +0x02231eb8 id=0x26 fn=0xe0092848 +0x02231ec0 id=0x2a fn=0xe00928c6 +0x02231ec8 id=0xbf fn=0xe009277c +0x02231ed0 id=0x13 fn=0xe0042006 +0x02231ed8 id=0x27 fn=0xe005e710 +0x02231ee0 id=0x28 fn=0xe0060b5e +0x02231ee8 id=0x47 fn=0xe005f636 +0x02231ef0 id=0x48 fn=0xe005f796 +0x02231ef8 id=0x93 fn=0xe005f5ae +0x02231f00 id=0x32 fn=0xe00402fa +0x02231f08 id=0x49 fn=0xe003ee7e +0x02231f10 id=0xa6 fn=0xe005db74 +0x02231f18 id=0xae fn=0xe005f706 +0x02231f20 id=0x95 fn=0xe004297c +0x02231f28 id=0x81 fn=0xe005d480 +0x02231f30 id=0x57 fn=0xe0042558 +0x02231f38 id=0x9c fn=0xe0043588 +0x02231f40 id=0x94 fn=0xe0040de4 +0x02231f48 id=0x02 fn=0xe007fade +0x02231f50 id=0xb7 fn=0xe0042f70 +0x02231f58 id=0xc4 fn=0xe0043248 +0x02231f60 id=0x98 fn=0xe0061e48 +0x02231f68 id=0x42 fn=0xe005f5ec +0x02231f70 id=0x50 fn=0xe0047c90 +0x02231f78 id=0x5a fn=0xe004166c +0x02231f80 id=0x3c fn=0xe00414ec +0x02231f88 id=0x1e fn=0xe00663b2 +0x02231f90 id=0x36 fn=0xe0062e16 +0x02231f98 id=0x38 fn=0xe00640fe +0x02231fa0 id=0x37 fn=0xe0062b62 +0x02231fa8 id=0x4b fn=0xe0062bfe +0x02231fb0 id=0x4a fn=0xe0062eae +0x02231fb8 id=0x67 fn=0xe0064714 +0x02231fc0 id=0x68 fn=0xe0063182 +0x02231fc8 id=0x6b fn=0xe00645da +0x02231fd0 id=0x01 fn=0xe0090b8a +# 31-entry {id,fn} array @ 0x02231fe0 (r5_t0_a02229800.bin) +0x02231fe0 id=0x04 fn=0xe008a8ae +0x02231fe8 id=0x08 fn=0xe0080680 +0x02231ff0 id=0x4e fn=0xe0080680 +0x02231ff8 id=0x4f fn=0xe00897a0 +0x02232000 id=0x19 fn=0xe00918a0 +0x02232008 id=0x1f fn=0xe007d684 +0x02232010 id=0x21 fn=0xe00804ac +0x02232018 id=0x9b fn=0xe007ee5e +0x02232020 id=0xbe fn=0xe007ef44 +0x02232028 id=0x24 fn=0xe00407aa +0x02232030 id=0x2c fn=0xe008bf86 +0x02232038 id=0x30 fn=0xe007a9b2 +0x02232040 id=0x79 fn=0xe0080b88 +0x02232048 id=0x17 fn=0xe0042d38 +0x02232050 id=0x82 fn=0xe0082128 +0x02232058 id=0x3d fn=0xe008a938 +0x02232060 id=0x3e fn=0xe0081686 +0x02232068 id=0x9f fn=0xe0045f3c +0x02232070 id=0x87 fn=0x0221cf98 +0x02232078 id=0x3a fn=0xe007ce40 +0x02232080 id=0xa3 fn=0xe007cb80 +0x02232088 id=0xc5 fn=0xe007cd20 +0x02232090 id=0x9d fn=0xe007c0c0 +0x02232098 id=0xb2 fn=0xe007c138 +0x022320a0 id=0x46 fn=0xe004174a +0x022320a8 id=0x44 fn=0xe0048392 +0x022320b0 id=0x43 fn=0xe004197c +0x022320b8 id=0x23 fn=0xe008bca8 +0x022320c0 id=0x56 fn=0xe006cf68 +0x022320c8 id=0x58 fn=0xe008cf2a +0x022320d0 id=0xa1 fn=0xe00419c6 +# 24-entry {id,fn} array @ 0x022320e0 (r5_t0_a02229800.bin) +0x022320e0 id=0xad fn=0xe00779ac +0x022320e8 id=0xb5 fn=0xe0077e68 +0x022320f0 id=0x73 fn=0xe0040778 +0x022320f8 id=0x9a fn=0xe0080024 +0x02232100 id=0xab fn=0xe008a67c +0x02232108 id=0xac fn=0xe008a6ce +0x02232110 id=0xa8 fn=0xe0083ede +0x02232118 id=0xa4 fn=0xe008aadc +0x02232120 id=0xb3 fn=0xe008ae7c +0x02232128 id=0xb6 fn=0xe0078664 +0x02232130 id=0xb8 fn=0xe0048010 +0x02232138 id=0xb9 fn=0xe007944c +0x02232140 id=0xba fn=0xe00814f0 +0x02232148 id=0xc8 fn=0xe00419fc +0x02232150 id=0x7a fn=0xe0041a42 +0x02232158 id=0x7b fn=0xe00417d0 +0x02232160 id=0x7c fn=0xe0041854 +0x02232168 id=0xc6 fn=0xe00418ae +0x02232170 id=0xc7 fn=0xe0041702 +0x02232178 id=0xc0 fn=0xe007ebc0 +0x02232180 id=0xc2 fn=0xe00482e4 +0x02232188 id=0xd5 fn=0xe005dde4 +0x02232190 id=0x0f fn=0xe0046e14 +0x02232198 id=0x5b fn=0xe0081550 +# 43-entry {id,fn} array @ 0x022324ec (r5_t0_a02229800.bin) +0x022324ec id=0x01 fn=0xe0045a7e +0x022324f4 id=0x06 fn=0xe0043b36 +0x022324fc id=0x0b fn=0xe0043c6c +0x02232504 id=0x14 fn=0xe00452b6 +0x0223250c id=0x15 fn=0xe0043990 +0x02232514 id=0x0c fn=0xe0043884 +0x0223251c id=0x0d fn=0xe0043ba0 +0x02232524 id=0x0e fn=0xe0044aec +0x0223252c id=0x0f fn=0xe0043dc2 +0x02232534 id=0x10 fn=0xe0044092 +0x0223253c id=0x11 fn=0xe0045950 +0x02232544 id=0x12 fn=0xe0044b00 +0x0223254c id=0x13 fn=0xe0043c06 +0x02232554 id=0x33 fn=0xe0043e1a +0x0223255c id=0x18 fn=0xe00440ac +0x02232564 id=0x19 fn=0xe0043a7a +0x0223256c id=0x1a fn=0xe00441ac +0x02232574 id=0x1b fn=0xe00441c8 +0x0223257c id=0x50 fn=0xe00439a0 +0x02232584 id=0x51 fn=0xe004552a +0x0223258c id=0x64 fn=0xe004432a +0x02232594 id=0x65 fn=0xe0043e58 +0x0223259c id=0x66 fn=0xe0043b1c +0x022325a4 id=0x67 fn=0xe0043cbe +0x022325ac id=0x68 fn=0xe0043ec2 +0x022325b4 id=0x69 fn=0xe0043a00 +0x022325bc id=0x6a fn=0xe0043a1a +0x022325c4 id=0xc8 fn=0xe0044292 +0x022325cc id=0xc9 fn=0xe00442c0 +0x022325d4 id=0xca fn=0xe0043a42 +0x022325dc id=0xcb fn=0xe0044b10 +0x022325e4 id=0xcc fn=0xe0043a64 +0x022325ec id=0xcd fn=0xe0043aa6 +0x022325f4 id=0xd2 fn=0xe0043f1a +0x022325fc id=0xd3 fn=0xe0043f4a +0x02232604 id=0xd0 fn=0xe0043f8c +0x0223260c id=0xd1 fn=0xe0043fbc +0x02232614 id=0x96 fn=0xe0043abc +0x0223261c id=0x97 fn=0xe00441ee +0x02232624 id=0xd4 fn=0xe0043fec +0x0223262c id=0xfe fn=0xe0044bde +0x02232634 id=0xce fn=0xe0043d32 +0x0223263c id=0xcf fn=0xe0043aca +# 8-entry {id,fn} array @ 0x0223670c (r5_t0_a02229800.bin) +0x0223670c id=0x00 fn=0xe0077a2c +0x02236714 id=0x01 fn=0xe0077a5c +0x0223671c id=0x02 fn=0xe007758c +0x02236724 id=0x03 fn=0xe007747c +0x0223672c id=0x04 fn=0xe0077aa2 +0x02236734 id=0x05 fn=0xe00776a8 +0x0223673c id=0x06 fn=0xe0077478 +0x02236744 id=0x07 fn=0xe00776b6 +# 92-entry {id,fn} array @ 0x02236bf0 (r5_t0_a02229800.bin) +0x02236bf0 id=0x01 fn=0xe0083c88 +0x02236bf8 id=0x02 fn=0xe00844f2 +0x02236c00 id=0x03 fn=0xe00838c6 +0x02236c08 id=0x04 fn=0xe008453c +0x02236c10 id=0x05 fn=0xe0083aa0 +0x02236c18 id=0x06 fn=0xe008461a +0x02236c20 id=0x07 fn=0xe0083d1e +0x02236c28 id=0x08 fn=0xe0084666 +0x02236c30 id=0x09 fn=0xe0083d62 +0x02236c38 id=0x0a fn=0xe00846b2 +0x02236c40 id=0x0b fn=0xe00838dc +0x02236c48 id=0x0c fn=0xe0084586 +0x02236c50 id=0x0d fn=0xe00838f2 +0x02236c58 id=0x0e fn=0xe00845d0 +0x02236c60 id=0x0f fn=0xe0083908 +0x02236c68 id=0x10 fn=0xe00846fe +0x02236c70 id=0x11 fn=0xe008391a +0x02236c78 id=0x12 fn=0xe0084748 +0x02236c80 id=0x13 fn=0xe008392c +0x02236c88 id=0x14 fn=0xe0084792 +0x02236c90 id=0x15 fn=0xe008393e +0x02236c98 id=0x16 fn=0xe00847dc +0x02236ca0 id=0x17 fn=0xe0083950 +0x02236ca8 id=0x18 fn=0xe0084826 +0x02236cb0 id=0x19 fn=0xe0083962 +0x02236cb8 id=0x1a fn=0xe008486e +0x02236cc0 id=0x1b fn=0xe0083974 +0x02236cc8 id=0x1c fn=0xe00848b8 +0x02236cd0 id=0x1d fn=0xe0083986 +0x02236cd8 id=0x1e fn=0xe0084902 +0x02236ce0 id=0x1f fn=0xe0083998 +0x02236ce8 id=0x20 fn=0xe008494c +0x02236cf0 id=0x21 fn=0xe00839aa +0x02236cf8 id=0x22 fn=0xe0084996 +0x02236d00 id=0x23 fn=0xe00839c2 +0x02236d08 id=0x24 fn=0xe00849e2 +0x02236d10 id=0x25 fn=0xe00839da +0x02236d18 id=0x26 fn=0xe0084a2e +0x02236d20 id=0x27 fn=0xe00839f2 +0x02236d28 id=0x28 fn=0xe0084a7a +0x02236d30 id=0x29 fn=0xe0083db0 +0x02236d38 id=0x2a fn=0xe0084ac6 +0x02236d40 id=0x2b fn=0xe0083d8e +0x02236d48 id=0x2c fn=0xe0084b12 +0x02236d50 id=0x2d fn=0xe0083a20 +0x02236d58 id=0x2e fn=0xe0084b5e +0x02236d60 id=0x31 fn=0xe0083a38 +0x02236d68 id=0x32 fn=0xe0084baa +0x02236d70 id=0x33 fn=0xe0083a50 +0x02236d78 id=0x34 fn=0xe0084bf6 +0x02236d80 id=0x80 fn=0xe0083ddc +0x02236d88 id=0x81 fn=0xe0084d06 +0x02236d90 id=0x82 fn=0xe0083ccc +0x02236d98 id=0x83 fn=0xe0084c42 +0x02236da0 id=0x84 fn=0xe0084cae +0x02236da8 id=0x85 fn=0xe008385c +0x02236db0 id=0x86 fn=0xe0083884 +0x02236db8 id=0x87 fn=0xe0083b6a +0x02236dc0 id=0x88 fn=0xe0083fc2 +0x02236dc8 id=0x89 fn=0xe0083cec +0x02236dd0 id=0x8a fn=0xe0084d5a +0x02236dd8 id=0xc0 fn=0xe0083b10 +0x02236de0 id=0xc1 fn=0xe00840cc +0x02236de8 id=0xc2 fn=0xe0083b24 +0x02236df0 id=0xc3 fn=0xe0084112 +0x02236df8 id=0xc4 fn=0xe0083ba0 +0x02236e00 id=0xc5 fn=0xe00841a0 +0x02236e08 id=0xc6 fn=0xe0083bb4 +0x02236e10 id=0xc7 fn=0xe00841e6 +0x02236e18 id=0xc8 fn=0xe0083bc8 +0x02236e20 id=0xc9 fn=0xe008422c +0x02236e28 id=0xca fn=0xe0083bdc +0x02236e30 id=0xcb fn=0xe0084272 +0x02236e38 id=0xcc fn=0xe0083bf0 +0x02236e40 id=0xcd fn=0xe00842b8 +0x02236e48 id=0xce fn=0xe0083f4e +0x02236e50 id=0xcf fn=0xe00842fe +0x02236e58 id=0xd0 fn=0xe0083c1a +0x02236e60 id=0xd1 fn=0xe0084394 +0x02236e68 id=0xd2 fn=0xe0083c04 +0x02236e70 id=0xd3 fn=0xe0083aec +0x02236e78 id=0xd4 fn=0xe0084158 +0x02236e80 id=0xd5 fn=0xe0083c2e +0x02236e88 id=0xd6 fn=0xe00843da +0x02236e90 id=0xd7 fn=0xe0083c42 +0x02236e98 id=0xd8 fn=0xe0084420 +0x02236ea0 id=0xd9 fn=0xe0083c56 +0x02236ea8 id=0xda fn=0xe0084466 +0x02236eb0 id=0xdb fn=0xe00844ac +0x02236eb8 id=0xdc fn=0xe0083c6a +0x02236ec0 id=0xdd fn=0xe0084346 +0x02236ec8 id=0xea fn=0xe0083a6a +# 10-entry {id,fn} array @ 0x0223833c (r5_t0_a02229800.bin) +0x0223833c id=0x00 fn=0xe008f91e +0x02238344 id=0x01 fn=0xe008f068 +0x0223834c id=0x02 fn=0xe008f080 +0x02238354 id=0x03 fn=0xe008f098 +0x0223835c id=0x04 fn=0xe008f18e +0x02238364 id=0x05 fn=0xe008f1ba +0x0223836c id=0x06 fn=0xe008f1d8 +0x02238374 id=0x07 fn=0xe008ee6c +0x0223837c id=0x08 fn=0xe008f164 +0x02238384 id=0x0b fn=0xe008e3e0 +# 9-entry {id,fn} array @ 0x02238534 (r5_t0_a02229800.bin) +0x02238534 id=0x00 fn=0xe0091a16 +0x0223853c id=0x01 fn=0xe0091a8c +0x02238544 id=0x02 fn=0xe0091aec +0x0223854c id=0x03 fn=0xe0091ee8 +0x02238554 id=0x04 fn=0xe009227c +0x0223855c id=0x05 fn=0xe0091ba2 +0x02238564 id=0x00 fn=0xe00918f6 +0x0223856c id=0x01 fn=0xe00929b0 +0x02238574 id=0x02 fn=0xe0091c4e +# 10-entry {id,fn} array @ 0x0223858c (r5_t0_a02229800.bin) +0x0223858c id=0x07 fn=0xe0091cd8 +0x02238594 id=0x0a fn=0xe0079520 +0x0223859c id=0x0b fn=0xe0091d64 +0x022385a4 id=0x0c fn=0xe0091d96 +0x022385ac id=0x0d fn=0xe0091de0 +0x022385b4 id=0x0e fn=0xe0092690 +0x022385bc id=0x0f fn=0xe00924a0 +0x022385c4 id=0x10 fn=0xe0092568 +0x022385cc id=0x11 fn=0xe003f5d4 +0x022385d4 id=0x1b fn=0xe00925d4 +# 49-entry {id,fn} array @ 0x02238a5c (r5_t0_a02229800.bin) +0x02238a5c id=0x00 fn=0xe00af53c +0x02238a64 id=0x01 fn=0xe00af544 +0x02238a6c id=0x02 fn=0xe00af54c +0x02238a74 id=0x03 fn=0xe00af554 +0x02238a7c id=0x00 fn=0xe00af578 +0x02238a84 id=0x01 fn=0xe00af55c +0x02238a8c id=0x02 fn=0xe00af568 +0x02238a94 id=0x03 fn=0xe00af574 +0x02238a9c id=0x04 fn=0xe00af580 +0x02238aa4 id=0x05 fn=0xe00af58c +0x02238aac id=0x06 fn=0xe00af598 +0x02238ab4 id=0x07 fn=0xe00af5a8 +0x02238abc id=0x11 fn=0xe00af5b8 +0x02238ac4 id=0x13 fn=0xe00af5c4 +0x02238acc id=0x16 fn=0xe00af5d0 +0x02238ad4 id=0x17 fn=0xe00af5e0 +0x02238adc id=0x00 fn=0xe00af5f0 +0x02238ae4 id=0x01 fn=0xe00af604 +0x02238aec id=0x02 fn=0xe00af61c +0x02238af4 id=0x03 fn=0xe00af630 +0x02238afc id=0x04 fn=0xe00af644 +0x02238b04 id=0x05 fn=0xe00af658 +0x02238b0c id=0x06 fn=0xe00af670 +0x02238b14 id=0x07 fn=0xe00af604 +0x02238b1c id=0x08 fn=0xe00af5f0 +0x02238b24 id=0x09 fn=0xe00af670 +0x02238b2c id=0x0a fn=0xe00af604 +0x02238b34 id=0x0b fn=0xe00af604 +0x02238b3c id=0x00 fn=0xe00af684 +0x02238b44 id=0x01 fn=0xe00af690 +0x02238b4c id=0x02 fn=0xe00af69c +0x02238b54 id=0x03 fn=0xe00af6b0 +0x02238b5c id=0x0d fn=0xe00af6b8 +0x02238b64 id=0x0e fn=0xe00af6c0 +0x02238b6c id=0x0f fn=0xe00af6c8 +0x02238b74 id=0x10 fn=0xe00af6d0 +0x02238b7c id=0x00 fn=0xe00af6d4 +0x02238b84 id=0x01 fn=0xe00a68d0 +0x02238b8c id=0x02 fn=0xe00af6d0 +0x02238b94 id=0x03 fn=0xe00af6e4 +0x02238b9c id=0x04 fn=0xe00a6988 +0x02238ba4 id=0x05 fn=0xe00af6e8 +0x02238bac id=0x06 fn=0xe00af6ec +0x02238bb4 id=0x07 fn=0xe00af6fc +0x02238bbc id=0x08 fn=0xe00af704 +0x02238bc4 id=0x09 fn=0xe00af714 +0x02238bcc id=0x0a fn=0xe00af71c +0x02238bd4 id=0x0b fn=0xe00af728 +0x02238bdc id=0x0c fn=0xe00af734 +# 33-entry {id,fn} array @ 0x02238e44 (r5_t0_a02229800.bin) +0x02238e44 id=0x00 fn=0xe003e66e +0x02238e4c id=0x01 fn=0xe003e696 +0x02238e54 id=0x16 fn=0xe003c370 +0x02238e5c id=0x17 fn=0xe003c370 +0x02238e64 id=0x18 fn=0xe003c370 +0x02238e6c id=0x19 fn=0xe003c370 +0x02238e74 id=0x28 fn=0xe003c63e +0x02238e7c id=0x2b fn=0xe003c63e +0x02238e84 id=0x00 fn=0xe003c3aa +0x02238e8c id=0x29 fn=0xe003c3ac +0x02238e94 id=0x1a fn=0xe003c028 +0x02238e9c id=0x1b fn=0xe003c028 +0x02238ea4 id=0x1c fn=0xe003c028 +0x02238eac id=0x1d fn=0xe003c028 +0x02238eb4 id=0x12 fn=0xe003c34c +0x02238ebc id=0x13 fn=0xe003c34c +0x02238ec4 id=0x14 fn=0xe003c34c +0x02238ecc id=0x15 fn=0xe003c34c +0x02238ed4 id=0x06 fn=0xe003c012 +0x02238edc id=0x07 fn=0xe003c012 +0x02238ee4 id=0x08 fn=0xe003c012 +0x02238eec id=0x09 fn=0xe003c012 +0x02238ef4 id=0x0a fn=0xe003c012 +0x02238efc id=0x0b fn=0xe003c012 +0x02238f04 id=0x0c fn=0xe003c012 +0x02238f0c id=0x0d fn=0xe003c012 +0x02238f14 id=0x2e fn=0xe003e624 +0x02238f1c id=0x2f fn=0xe003e624 +0x02238f24 id=0x01 fn=0xe003e586 +0x02238f2c id=0x02 fn=0xe003e586 +0x02238f34 id=0x03 fn=0xe003e586 +0x02238f3c id=0x04 fn=0xe003e586 +0x02238f44 id=0x23 fn=0xe003c38c +# 9-entry {id,fn} array @ 0x02238f74 (r5_t0_a02229800.bin) +0x02238f74 id=0xef fn=0xe0041460 +0x02238f7c id=0xed fn=0xe00412e6 +0x02238f84 id=0x04 fn=0xe0040680 +0x02238f8c id=0x02 fn=0xe0042ebe +0x02238f94 id=0x8d fn=0xe004276c +0x02238f9c id=0x10 fn=0xe0043330 +0x02238fa4 id=0x4b fn=0xe00433fa +0x02238fac id=0x7d fn=0xe004375c +0x02238fb4 id=0xfc fn=0xe00437a4 +# 13-entry {id,fn} array @ 0x02238ffc (r5_t0_a02229800.bin) +0x02238ffc id=0x06 fn=0xf009b6d6 +0x02239004 id=0x07 fn=0xf009b6d6 +0x0223900c id=0x08 fn=0xf009b6d6 +0x02239014 id=0x09 fn=0xf009b6d6 +0x0223901c id=0x0a fn=0xf009b6d6 +0x02239024 id=0x0b fn=0xf009b6d6 +0x0223902c id=0x0c fn=0xf009b6d6 +0x02239034 id=0x0d fn=0xf009b6d6 +0x0223903c id=0x0e fn=0xf009b6d6 +0x02239044 id=0x0f fn=0xf009b6d6 +0x0223904c id=0x10 fn=0xe006946e +0x02239054 id=0x11 fn=0xe003d7b4 +0x0223905c id=0x12 fn=0xe00471f6 diff --git a/docs/findings.md b/docs/findings.md index fe894a1..23bb3ee 100644 --- a/docs/findings.md +++ b/docs/findings.md @@ -154,18 +154,39 @@ Next: same scan on WM; handler-by-handler decompile + naming pass. Ghidra project `wm`: forced disassembly to **555,385 instructions / 4,422 functions** (import-time analysis alone: 226K/4,355). -- Code model differs from patch/WA: only **27 GP-relative references** in - the whole image → WM uses (near-)absolute global addressing, so GP-base - inference is not the unlock it would otherwise be. -- Structural dispatch scan (scan_tables.py) across every region pairing - found **no absolute function-pointer table** (unlike WA's 65-entry - table, F7). WM command dispatch must use another mechanism — - FP/register-relative tables, switch jump tables, or runtime handler - registration (unknown U4). +- ~~Code model claim: "only 27 GP-relative refs"~~ CORRECTED in F9: WM is + GP-relative; the operand-object scan undercounted (missed memory-operand + forms). GP value still unsolved, but the dispatcher's GP-relative + constants identified the registration array structurally. +- Structural scan found no *absolute-pointer* dispatch table — resolved in + F9: dispatch is a runtime registration list, and the static registration + arrays use GP-reachable data in region r5. - Regions: code 0xe003b000 (398KB) + 0xe009c400 (473KB mixed); data 0x0231dc00 (205KB), 0x0041xxxx pair; 0xf0xxxxxx block (feat 0x80) still uncharacterized (U1). +## F9 — WM dispatch solved: runtime registration list (2026-08-20, U4 resolved) + +WM's command parser found via string xref (`EXT_CMD_ID:0x%02x, SEQ:%u...` +@0xe00a64b0 → **FUN_0xe00412e6**): walks a handler registration array +`{u8 cmd_id; code* handler}` (stride 8) at `gp+0x1b6a0`, count at +`gp+0x227bc`; match → `handler(msg)`; miss → `Not_handled_ucExtenCID`. +A top-level class array (r5 @0x02238f74) maps class 0xed → this parser. + +Region r5 (0x02229800) holds the *static* registration arrays: +**15 arrays / 407 `{id,fn}` entries** (`tools/scan_registrations.py` → +`dataset/wm_registrations.txt`). Enum join names **130 handlers** from +mt76's ABI (`dataset/wm_handlers_named.txt`) — e.g. 0x08 +CHANNEL_SWITCH→0xe003ff5c, 0x25 STA_REC_UPDATE, 0x32 WTBL→0xe00402fa, +0x81 SER_TRIGGER→0xe005d480, 0x94 TWT→0xe0040de4, 0x9f +MURU_CTRL→0xe0045f3c; 277 entries carry MTK-internal ids beyond the public +enum (discovery list). + +Labels applied (`LabelHandlers.py`): WM **371 functions** (115 created + +256 renamed), WA **29** (from F7's table). r5 additionally carries 192 +function-name strings (`wsysWfdmaCmdHandle`, `muruExtCmdSetMuruStatistic`, +...) — `__FUNCTION__`-style assert anchors for the next naming pass. + ## Unknowns registry - **U1 — `feature_set` bit 7 (0x80):** observed only on WM regions at @@ -177,11 +198,9 @@ functions** (import-time analysis alone: 226K/4,355). bytes before/around the string (F2) are uninterpreted. - **U3 — WO container:** `mt7981_wo.bin` uses the mtk_wed loader (`mtk_wed_mcu.c`), a different format; not yet parsed. -- **U4 — WM command dispatch mechanism:** no absolute-pointer handler - table exists in any WM region (structural scan, F8); GP usage negligible. - Candidate mechanisms: FP-relative tables, switch jump tables, runtime - registration. Next lever: locate WM's command-receive loop via - CCIF/mailbox strings and read its dispatch expression. +- **U4 — WM command dispatch mechanism: RESOLVED (F9)** — runtime + registration list at gp+0x1b6a0; static arrays in region r5; parser + 0xe00412e6. ## Related verified facts diff --git a/tools/ghidra_scripts/LabelHandlers.py b/tools/ghidra_scripts/LabelHandlers.py new file mode 100644 index 0000000..38c585e --- /dev/null +++ b/tools/ghidra_scripts/LabelHandlers.py @@ -0,0 +1,46 @@ +# Headless post-script: label command handlers from a named-handler map. +# Reads files listed in env MTK_HANDLER_MAPS (colon-separated), lines like: +# 0x02231eb0 id=0x25 fn=0xf0097174 MCU_EXT_CMD_STA_REC_UPDATE +# Creates a function at each fn address (if missing) and renames it +# cmdHdlr__. +#@category Analysis + +import os +import re +from ghidra.program.model.symbol import SourceType +from ghidra.app.cmd.function import CreateFunctionCmd +from ghidra.app.cmd.label import RenameLabelCmd + +maps = os.environ.get('MTK_HANDLER_MAPS', '') +fm = currentProgram.getFunctionManager() +created = renamed = skipped = 0 +pat = re.compile(r'id=(0x[0-9a-f]+) fn=(0x[0-9a-f]+) (MCU_[A-Z0-9_]+|\(MTK-internal id\))') + +for path in maps.split(':'): + if not path: + continue + print('map file: %s' % path) + for ln in open(path): + m = pat.search(ln) + if not m: + continue + cid, fns, nm = int(m.group(1), 16), m.group(2), m.group(3) + name = 'cmdHdlr_%02x_%s' % (cid, nm.strip('()').replace('-internal id', 'internal')) + addr = currentProgram.getAddressFactory().getAddress(fns) + f = fm.getFunctionAt(addr) + tx = currentProgram.startTransaction('label') + try: + if f is None: + f = createFunction(addr, name) + if f is not None: + created += 1 + else: + skipped += 1 + print(' ! could not create %s at %s' % (name, fns)) + else: + f.setName(name, SourceType.USER_DEFINED) + renamed += 1 + print(' %s -> %s' % (fns, name)) + finally: + currentProgram.endTransaction(tx, True) +print('label summary: created=%d renamed=%d skipped=%d' % (created, renamed, skipped)) diff --git a/tools/scan_registrations.py b/tools/scan_registrations.py new file mode 100755 index 0000000..f12f23e --- /dev/null +++ b/tools/scan_registrations.py @@ -0,0 +1,53 @@ +#!/usr/bin/env python3 +"""Scan MediaTek Connac2 firmware regions for {id, fn*} registration arrays. + +WM registers command handlers as sparse {u8 cmd_id, code*} arrays (see +findings F9: dispatcher walks gp+0x1b6a0, stride 8). This tool finds every +such array across a blob's regions — the recoverable handler map. + +Usage: scan_registrations.py [min_run] > out.txt +(blob-stem-dir = extracted/mt7981_wm; scans all rN region files) +""" +import struct +import sys +from pathlib import Path + + +def code_p(w, ranges): + return any(lo <= w < hi for lo, hi in ranges) + + +def scan(f: Path, ranges, min_run): + d = f.read_bytes() + base = int(f.name.split('_a')[1][:8], 16) + n = len(d) // 4 + ws = struct.unpack_from('<%dI' % n, d) + out = [] + i = 0 + while i < n - 1: + j, run = i, 0 + while j < n - 1 and ws[j] < 0x100 and code_p(ws[j + 1], ranges): + run += 1 + j += 2 + if run >= min_run: + out.append((base + i * 4, run, ws[i:j])) + i = j + 2 if run else i + 1 + return out + + +def main(): + stem = Path(sys.argv[1]) + min_run = int(sys.argv[2]) if len(sys.argv) > 2 else 8 + ranges = [] + for f in sorted(stem.glob('r*.bin')): + base = int(f.name.split('_a')[1][:8], 16) + ranges.append((base, base + f.stat().st_size)) + for f in sorted(stem.glob('r*.bin')): + for addr, run, ws in scan(f, ranges, min_run): + print('# %d-entry {id,fn} array @ 0x%08x (%s)' % (run, addr, f.name)) + for k in range(run): + print('0x%08x id=0x%02x fn=0x%08x' % (addr + k * 8, ws[2 * k], ws[2 * k + 1])) + + +if __name__ == '__main__': + main()