ZXCLI
0bfb926892
- 逆向：Ghidra/IDA 全量反编译 CoreSDKLib.dll/ThermalSDK.dll/libthermalSDK.so/ libcoresdk.so(ARM64)/libmagcore.so，导出 analysis/ida/export/ - 解码官方渲染管线：DDT 校准表加载->快门端点选择->Q12 插值->ref(4x type1 帧 均值)->NUC 查表->盲元补偿->窗口->LUT1024 重建->2x 升采样->调色板 - 逐像素验证：NUC+盲元 0/19200、插值 0 误差、2x 0/76800、窗口一致 - demo3 v5：完整复刻官方管线（含 DDT 解析、FFC 状态机、快门温度驱动）， 修复 load_ddt 表错位导致的零像素问题 - 鬼影根因分析写入 analysis/reverse_20260813_full.md - 心跳/恢复机制：analysis/session_state.md + tools/resume_rev.ps1 - 新增 tsdk_pair3 增强采集工具；历史工具归档 csdk/tools/legacy/； 根目录抓帧残留删除，历史文档归档 analysis/history/ - csdk/README.md 完整使用文档；.gitignore/.gitattributes 补 LFS 规则
111 lines
3.0 KiB
C
111 lines
3.0 KiB
C
#include <idc.idc>
|
|
|
|
static dump_range(out, from, to)
|
|
{
|
|
auto ea;
|
|
ea = from;
|
|
while (ea != BADADDR && ea < to)
|
|
{
|
|
fprintf(out, "%08X: %s\n", ea, generate_disasm_line(ea, 0));
|
|
ea = next_head(ea, to);
|
|
}
|
|
}
|
|
|
|
static dump_xrefs(out, ea)
|
|
{
|
|
auto x, caller, from_ea, to_ea;
|
|
from_ea = ea - 0x80;
|
|
to_ea = ea + 0x80;
|
|
x = get_first_dref_to(ea);
|
|
if (x != BADADDR)
|
|
{
|
|
fprintf(out, " data refs from:\n");
|
|
while (x != BADADDR)
|
|
{
|
|
fprintf(out, " %08X\n", x);
|
|
x = get_next_dref_to(ea, x);
|
|
}
|
|
}
|
|
x = get_first_cref_to(ea);
|
|
if (x != BADADDR)
|
|
{
|
|
fprintf(out, " code refs from:\n");
|
|
while (x != BADADDR)
|
|
{
|
|
fprintf(out, " %08X (func %08X)\n", x, get_func_attr(x, FUNCATTR_START));
|
|
x = get_next_cref_to(ea, x);
|
|
}
|
|
}
|
|
}
|
|
|
|
static dump_fn(out, ea, decomp)
|
|
{
|
|
auto f, end, s, i, name;
|
|
f = get_func(ea);
|
|
if (f == 0)
|
|
{
|
|
fprintf(out, "### %08X NOT A FUNCTION (dumping 0x200 bytes)\n", ea);
|
|
dump_range(out, ea, ea + 0x200);
|
|
fprintf(out, "\n==================================================================\n\n");
|
|
return;
|
|
}
|
|
end = get_func_attr(f, FUNCATTR_END);
|
|
name = get_func_name(ea);
|
|
fprintf(out, "### FUNC %08X - %08X (%d bytes) name=%s\n", ea, end, end - ea, name);
|
|
dump_range(out, ea, end);
|
|
fprintf(out, "\n");
|
|
dump_xrefs(out, ea);
|
|
if (decomp)
|
|
{
|
|
s = decompile(ea);
|
|
if (s != 0)
|
|
{
|
|
fprintf(out, "\n;; DECOMPILED:\n%s\n", s);
|
|
}
|
|
else
|
|
{
|
|
fprintf(out, "\n;; DECOMPILE FAILED\n");
|
|
}
|
|
}
|
|
fprintf(out, "\n==================================================================\n\n");
|
|
}
|
|
|
|
static main()
|
|
{
|
|
auto dir, out, f, i, ea;
|
|
dir = "C:\\Project\\MAG160C\\analysis\\ida\\export\\";
|
|
f = fopen(dir + "coresdk_keyfuncs.txt", "w");
|
|
if (f == 0)
|
|
{
|
|
warning("cannot open output file");
|
|
return;
|
|
}
|
|
dump_fn(f, 0x180017200, 1); // NUC lookup
|
|
dump_fn(f, 0x180017330, 1); // blind pixel compensation
|
|
dump_fn(f, 0x180016ae0, 1); // sensor temp endpoint selection
|
|
dump_fn(f, 0x180016dd0, 1); // threshold Q12 interp
|
|
dump_fn(f, 0x180016f10, 1); // gain/off Q12 interp
|
|
dump_fn(f, 0x18000c760, 1); // table rebuild chunked write
|
|
dump_fn(f, 0x18000c620, 1); // ref push / smoother feed
|
|
dump_fn(f, 0x1800011a0, 1); // generic smoother
|
|
dump_fn(f, 0x18001e920, 1); // temporal filter
|
|
dump_fn(f, 0x18000a1d2, 1); // FFC trigger A
|
|
dump_fn(f, 0x180002f50, 1); // FFC trigger B
|
|
dump_fn(f, 0x180010780, 1); // temperature
|
|
fclose(f);
|
|
|
|
out = fopen(dir + "all_functions.txt", "w");
|
|
if (out != 0)
|
|
{
|
|
ea = get_first_func();
|
|
while (ea != BADADDR)
|
|
{
|
|
fprintf(out, "%08X %08X %s\n", ea, get_func_attr(ea, FUNCATTR_END),
|
|
get_func_name(ea));
|
|
ea = get_next_func(ea);
|
|
}
|
|
fclose(out);
|
|
}
|
|
msg("export done\n");
|
|
}
|