Well, that was my thought 2 days ago, when I was informed by Kai, DG4KLU that a open source reverse engineering tool, developed by the NSA had just been released to the public.
For more details visit https://ghidra-sre.org/
This is great news in relation with reverse engineering the GD-77 firmware, because Ghidra has a lot of the features, previously only available in very expensive programs like IDA Pro.
Armed with Ghidra, I have started to explore the internals of the firmware.
There are multiple ways to attempt to understand what each function does in the firmware, but one way is to work backwards from the hardware registers in the MK22 MCU, which do things like send data to the AT1846 RF transceiver chip, and to the external SPI Flash memory, the external EEPROM and also the keypad and the screen.
The memory addresses of these registers is documented in the reference document for the MK22, but since there are over 1300 registers, manually correlating each memory address in found in the firmware back to its name and function in the reference, would take forever.
Luckily I found out that its possible to create a Processor Specification (PSPEC) file for any microprocessor and use it when the firmware binary is imported into Ghidra
However, getting data on all 1300 registers, from the PDF reference document into the XML PSPEC file required a number of stages of manual and automatic processing, which I won’t bore you all with at the moment.
But eventually, I was able to use my newly minted PSPEC file to annotate all the disassembled and decompiled firmware code.
For example here, is some code which interacts with the SPI interface (though at the moment I don’t know which SPI device or what its sending or receiving)
Ghidra is also capable of decompiling to C code, and even though this could could not be recompiled back into a working version of the firmware, its a great way to get a better idea of what each function does
(this is not the same function as show in the disassembly view in the image above)
And there are also graphic features available to show the hierarchy of functions
And also Function Graphs
Not to get anyone’s hopes up, because there is still a big mountain to climb, in terms of understanding the internal workings of the firmware, so that it can be enhanced or bug fixed, but it does look like things will be a bit easier by using Ghidra
As requested by various people. Here is my PSPEC file for the MK22 processor.
Note I just added the hardware registers. I have not had time to add processor specific ISR vectors, but they would be easy to add
Also. I’ve taken some more memory snapshots, including these 2, one during transmission and one when receiving a signal from VK4NBL
So here are those files
My DMR ID is 5053238 (and my callsign is VK3KYY)
I’m pretty sure VK4NBL’s id is 5054068
Note. To import the memory snapshots, you have to press ALT+I which then appends / merges the file to the existing memory map
Don’t forget to use offset 0x1fff0000 when importing the RAM snapshot
In firmware 3.1.8
Using the memory dumps I have found a few interesting memory addresses
I’m now sure that the current channel data structure is located at 0x1fff3a04, or possibly a bit lower in the memory
0x1fff3a04 upper byte seems to be a flag, as its set to 0x05 when I’m on channel and 0x90 when I’m on a VFO
The next remaining 3 bytes are the Tx TG.
And the Rx Group list starts at 0x1fff3a08
If I change 0x1fff3a04 then press PTT it transmits on the TG I specified.
It looks like the function at address 0x27b52 is called constantly, and if the memory location pointed to by register r1 is contains 0x0F, it seems to indicate that a signal has been received.
So if you put a break point on 0x27b5a the code only halts when there is a new signal received.
Looking at what references the function at 0x27b52, I found this
PTR_LAB_00027b8c+1_00027f50 XREF: FUN_00027b90:00027cd0(R)
00027f50 8d 7b 02 00 addr LAB_00027b8c+1
00027f54 91 7b 02 00 addr FUN_00027b90+1
00027f58 53 7b 02 00 addr FUN_00027b52_event_loop+1
(I labelled the function at 0x27f58 with the extra text “_event_loop” , to make it easier to find, but I should have probably called it “_task”, as it looks like these 2 functions are possibly the top level task list which is bring run by the RTOS.)
Jason VK7ZJA has kindly sent me a list of what all the pins on the MK22 MCU seem to be connected to.
You can download the text file from here MK22 connections GD-77
Hopefully this will help getting to grips with the firmware