Silipwn / bl602-re

Reverse engineering of BL602 blobs

Pine64’s BL602 reverse engineering working group

Notes

• The blobs were compiled using riscv32-unknown-elf-gcc_8.3.0 -march=rv32imfc -mabi=ilp32f -gdwarf -Os -std=gnu99 -ffunction-sections -fdata-sections -fstrict-volatile-bitfields -fshort-enums -ffreestanding -fno-strict-aliasing

• The target likely supports atomics. If so we may use -march=rv32imafc.

Toolset

• RISC-V GNU Compiler Toolchain

• Cutter, a graphical frontend for radare2

• DWARF Explorer, an explorer for DWARF debugging data

  • The proprietary libraries still contain DWARF data, but tool support for showing it varies greatly. This will show you the raw DWARF information (e.g. structures, function local variables, inlined function information).

• Add your favorite disassembly tools here. If the tool is not free, mark it with (non-free).

Resources

• Pine64 SDK fork’s documentation, if you figure something out that’s documentation-worthy, please update that documentation.

• BL602/BL604 Datasheet

• BL602/BL604 Reference Manual

• SDK

• BL602 ISP Protocol Documentation

• Official Open-Source Flasher for Bouffalo Chips

• Linux Driver and Firmware for SDIO WiFi & BT Module based on BL602

Work log (top-down append-only)

WildCryptoFox (29 Oct 2020)

• Initialized README.adoc and copied LICENSE from the SDK.

• Split objects out of archives ar x libx.a.

• Disassembled objects to their assembly git/github/pine64/bl_iot_sdk/toolchain/riscv/Linux/bin/riscv64-unknown-elf-objdump -d -r xx.o"

Yangff (30 Oct 2020)

• Added three statically linked elf built from bl_iot_sdk to provide clear symbols for reverse engineering

• The three examples are from commit 9a10205e96a6b10e22069c87625550cad666b1b4, bl602_demo_at, bl602_demo_wifi and sdk_app_ble_sync.

• They are compiled with the riscv toolchain shipped with the sdk and using make -j directly in the folders with CONFIG_CHIP_NAME=BL602 and CONFIG_LINK_ROM=1. The disassembly is generated with riscv64-unknown-elf-objdump -d ./x.elf > ./x.S