2

can you tell me why objdump does not correctly disassemble the firmware for the C-SKY (ck803s) processor? what is .long: between the lines, unknown instructions? or am I setting the parameters for objdump incorrectly? here are mine: ./objdump -D -b binary -m csky:cs803 -EL firmware.bin

enter image description here

from off. sources use CK803S processor

enter image description here

this is how the bootloader works

enter image description here

The firmware is launched from the specified address at offset 0x04, look at the dump merged from the flash drive

enter image description here

objdump output

enter image description here

11
  • Are you sure that’s a code segment? I haven’t used objdump for ages, but it does say data at the top not code. Do you know what the entry point for the loaded firmware is? Commented Jan 29, 2024 at 8:50
  • There is no 32-bit instruction from the entire dump Commented Jan 29, 2024 at 12:33
  • I had an idea to write my own disassembler, but then the first instruction is 0xC001112C, according to the description this is a 32-bit instruction, this is indicated by bits 30 and 31, but I did not find such an instruction in the documentation Commented Jan 29, 2024 at 13:56
  • Is it possible to tell objdump that the data and instructions are 32 bit? it even selects the data as 16-bit little-endian Commented Jan 29, 2024 at 14:54
  • 2
    please do not post pictures of text ... post the text instead ... idownvotedbecau.se/imageofcode Commented Jan 30, 2024 at 3:00

2 Answers 2

3

The whole problem is that all versions of objdump and even llvm-objdump incorrectly disassemble 32-bit instructions of C-SKY processors, I managed to find a working objdump version 2.27 on the website https://www.xrvm.cn/ there is also an Eclipse-based IDE

enter image description here

1

You've asked multiple questions. I don't know that version of objdump enough to comment on whether its a bug or missing option.

However, I can explain how the 32-bit instructions work.

The c-sky instruction stream is a series of 16-bit words. If bits 15 and 14 of the instruction word are NOT both 1s then it's a 16-bit instruction. However, if bits 15 and 14 of the instruction word are both 1s then it's a 32-bit instruction with the low 16-bits of the instruction in the following word.

Consider a hypothetical instruction with hex coding C1234567.

This will be stored as two 16-bit words C123 and 4567 in that order

In a big-endian environment, this will be stored as the following bytes -

C1 23 45 67 

In a little-endian environment, this will be stored as the following bytes -

23 C1 67 45 

In your firmware above the instruction at 3001000 is correct but the following instruction at 3001002 is actually C0016420

03001000: 112c lrw r1, 0x80000100 03001002: c0016420 mtcr r1, cr<0,0> 

Writing to control registers is very plausible in boot/init code.

The later 32-bit instruction with .long in the objdump output also seem to make sense.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.