IDA Pro Setup - Revision history

JackR1 at 09:18, 10 February 2012

2012-02-10T09:18:33Z

JackR1: /* Baseband 02.28.00 */

2011-01-03T10:05:42Z

‎Baseband 02.28.00

Eandrade at 21:25, 5 October 2010

2010-10-05T21:25:48Z

Http: removed broken external link

2010-04-14T22:27:19Z

removed broken external link

Blackhorn at 13:55, 14 August 2009

2009-08-14T13:55:29Z

Blackhorn at 13:55, 14 August 2009

2009-08-14T13:55:05Z

Blackhorn at 13:54, 14 August 2009

2009-08-14T13:54:42Z

OPK: /* Bsaeband 02.28.00 */

2009-05-18T10:11:33Z

‎Bsaeband 02.28.00

ChronicDev: /* Addresses of known functions / code locations */

2009-05-17T20:55:17Z

‎Addresses of known functions / code locations

Oranav: Known addresses - please add more :)

2009-05-17T18:27:06Z

Known addresses - please add more :)

← Older revision		Revision as of 09:18, 10 February 2012
Line 42:		Line 42:

	[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py Script] with [http://d-dome.net/idapython/ IDAPython]		[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py Script] with [http://d-dome.net/idapython/ IDAPython]
		+
		+	== IDA Pro Signature Files ==
		+
		+	Link to download signature files that can be used in reversing the iPhone baseband.
		+
		+	They are mostly Real View runtime library sigs:
		+
		+	RVCT RTL 2.2
		+	RVCT RTL 3.1
		+	RVCT RTL 4.4
		+
		+	ThreadX sig for iPhone 4 - however this only picks up a couple of functions, not sure how Apple compiled threadx, with which compiler, optimizations.
		+
		+
		+	On an iPhone 4 firmware can pickup upto 800 functions when all the sigs applied.
		+
		+	[http://www.mediafire.com/?kz4dlcnzfwixkkv Sigs]

	==Addresses of known functions / code locations==		==Addresses of known functions / code locations==

← Older revision		Revision as of 10:05, 3 January 2011
Line 53:		Line 53:
	* 0x20165998 - NU_Receive_From_Mailbox (according to Darkmen)		* 0x20165998 - NU_Receive_From_Mailbox (according to Darkmen)
	* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen)		* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen)
		+
		+
		+	===Baseband 5.12.01 3.1.3 (Build 7E18)===
		+	* 0x203C2714 - IMEI routine
		+	* 0x2062CF28 - default IMEI (0A 40 99 09 01 46 00 00)

← Older revision		Revision as of 21:25, 5 October 2010
Line 53:		Line 53:
	* 0x20165998 - NU_Receive_From_Mailbox (according to Darkmen)		* 0x20165998 - NU_Receive_From_Mailbox (according to Darkmen)
	* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen)		* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen)
−
−	===iPod touch 2G Bootrom===
−	I think this might not be a good idea, because this page will wind up getting huge, but in case anyone thinks differently I'll add these for the hell of it.
−
−	====functions====
−	* 0x067A - BootromStart
−	* 0x45BA - InitProcessor
−	* 0x4778 - SetupMMU
−	* 0x4734 - MMU_MapAddr
−	* 0x3A84 - Do_MMU_Mappings
−	* 0x34FC - EnableInterrupts
−	* 0x652C - Setup_SPI
−	* 0x36DC - Setup_IdleTask
−	* 0x4906 - PrepareNOR
−	* 0x49BC - nor_spi_read_range
−	* 0x178C - malloc
−	* 0x34D8 - DisableInterrupts
−	* 0x7840 - memset
−	* 0x7858 - memzero (this looks funny in IDA, kind of, but really it's just optimized as part of memset)
−	* 0x1954 - free
−	* 0x4844 - addNORtoBlockDevList
−	* 0x4804 - default_block_read
−	* 0x10C8 - blockdev_read_hook(void BDevStruct, void OutputBuffer, __int32 InputImageStartAddress, int Offset, __int32 Size)
−	* 0x1258 - fake_default_block_read
−	* 0x136E - blockdev_write_hook
−	* 0x1518 - default_block_write
−	* 0x151E - default_block_erase
−	* 0x1090 - get_block_device(const char* deviceName)
−	* 0x8354 - strcmp
−	* 0x1AF0 - CreateImageList
−	* 0x1F68 - DoCreateImageList
−	* 0x204C - GetImage(u32 imageFourccTag)
−	* 0x1BF0 - SetupMemzStruct(u32 LoadAddress, u32 FileSize, u32 flags)
−	* 0x30E8 - InitUSB
−	* 0x795C - memcpy
−	* 0x0E84 - USB_Core_Init
−	* 0x1058 - StopUSB
−	* 0x328C - GetSystemInfo
−	* 0x3D94 - Get_Chip_ID
−	* 0x3DA0 - Get_Chip_Revision
−	* 0x3D74 - Get_Security_Epoch
−	* 0x3AE4 - Get_Board_ID
−	* 0x3DD4 - Get_Unique_Chip_ID
−	* 0x8286 - snprintf
−	* 0x7D5C - vfprintf_like_thingy
−	* 0x82A8 - printf
−	* 0x8422 - putchar
−	* 0x2E98 - usb_print
−	* 0x83CC - strncat
−	* 0x1C18 - FreeMemzStruct
−	* 0x67DC - Reboot (via watchdog, so yeah it looks a bit odd)
−	* 0x0644 - LoadAndJumpToFWImage(struct MemzStruct *pMemzInfo, __int32 LoadAddress, __int32 FileSize)
−	* 0x3338 - ProperlyJumpToImage(void unkown, u32 address, void unknown)
−	* 0x4584 - PrepMMUForJump (?)
−	* 0x1B78 - LoadFirmwareImage
−	* 0x2144 - doLoadFirmwareImage
−	* 0x1D04 - VerifyImage
−	* 0x5EA8 - ComputeSHA1(void Input_Data, int Data_Size, void SHA1_Of_Data)
−	* 0x4150 - AdjustClock
−	* 0x5E54 - CopyBlockToSHA1Engine
−	* 0x372E - yield
−	* 0x2400 - DecryptRSASignature
−	* 0x0898 - DoCrypto(int CryptOption, void Input_Buffer, void Output_Buffer, __int32 Size, int AESMode, void Key, void IV) [CryptOption 0x10 == encrypt, 0x11 == decrypt]
−	* 0x5010 - aes_encrypt
−	* 0x4DB8 - do_aes_encrypt
−	* 0x4D38 - send_key_to_aes
−	* 0x4D88 - send_iv_to_aes
−	* 0x4F44 - aes_decrypt
−	* 0x4E80 - do_aes_decrypt
−	* 0x2668 - parse_certificate_and_signature(void pCertsData, int sizeOfCerts, void pImageRsaSha1, int sizeofRsaSha1, void pComputedImageSha1, int sha1Size, void pImageBuffer, int imageFullSize)
−	* 0x356C - CheckIfDiagnosticDevice
−	* 0x3D64 - Get_Security_Domain
−	* 0x3D44 - Get_Production_Mode
−	* 0x1F00 - Find_Data_For_Tag
−	* 0x346C - Panic
−	* 0x0634 - WaitForInterrupt
−	* 0x4618 - UndefinedInstructionVector
−	* 0x46F0 - UndefinedInstructionHandler
−	* 0x4628 - SoftwareInterruptVector
−	* 0x4700 - SoftwareInterruptHandler
−	* 0x4640 - PrefetchAbortVector
−	* 0x46B4 - PrefetchAbortHandler
−	* 0x4664 - DataAbortVector
−	* 0x46A2 - DataAbortHandler
−	* 0x467C - AddressExceptionTrapVector
−	* 0x4680 - InterruptRequestVector
−	* 0x4710 - InterruptRequestHandler
−	* 0x4BEC - HandleInterruptRequest
−	* 0x4690 - FastInterruptRequestVector
−	* 0x4722 - FastInterruptRequestHandler
−	* 0x4C40 - HandleFastInterruptRequest
−
−	====variables====
−	* 0x220240D4 - SHA1 accelerator register table
−	* 0x22024200 - Block Device List
−	* 0x220250A0 - Permissions Flags
−	* 0x220254E0 - Interrupt Table
−	* 0x2202C000 - Page table

@@ Line 26: / Line 26: @@
 * u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
 * Alt+G = toggle the Register T from 0 / 1 to toggle arm and thumb mode when needed
 == some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

@@ Line 44: / Line 44: @@
 Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !
-[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py link Script] with [http://d-dome.net/idapython/ link IDAPython]
+[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py Script] with [http://d-dome.net/idapython/ IDAPython]
 ==Addresses of known functions / code locations==

← Older revision		Revision as of 13:55, 14 August 2009
Line 43:		Line 43:

	Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !		Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !
		+
−	[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py link Script] with [http://d-dome.net/idapython/ link IDAPython
		+	[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py link Script] with [http://d-dome.net/idapython/ link IDAPython]

	==Addresses of known functions / code locations==		==Addresses of known functions / code locations==

← Older revision		Revision as of 13:54, 14 August 2009
Line 43:		Line 43:

	Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !		Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !
		+	[http://code.assembla.com/ks360/subversion/nodes/utils/Analyze.py link Script] with [http://d-dome.net/idapython/ link IDAPython

	==Addresses of known functions / code locations==		==Addresses of known functions / code locations==

@@ Line 45: / Line 45: @@
 ==Addresses of known functions / code locations==
-===Bsaeband 02.28.00===
+===Baseband 02.28.00===
 * 0x201497B0 - maybe AT Command handler? (uses strings such as "OK", "ERROR", "UNKNOWN COMMAND")
 * 0x203C51BC - probably prints text

← Older revision		Revision as of 18:27, 17 May 2009
Line 43:		Line 43:

	Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !		Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !
		+
		+	==Addresses of known functions / code locations==
		+	===02.28.00===
		+	* 0x201497B0 - maybe AT Command handler? (uses strings such as "OK", "ERROR", "UNKNOWN COMMAND")
		+	* 0x203C51BC - probably prints text
		+	* 0x201420AC - malloc (according to Darkmen)
		+	* 0x203C58A0 - bytecpy (according to Darkmen)
		+	* 0x203FB540 - NU_Create_Task (according to Darkmen)
		+	* 0x2046DD00 - sprintf (according to Darkmen)
		+	* 0x20165998 - NU_Receive_From_Mailbox (according to Darkmen)
		+	* 0x203ED568 - NU_Send_To_Mailbox (according to Darkmen)