ZXCLI
0bfb926892
- 逆向：Ghidra/IDA 全量反编译 CoreSDKLib.dll/ThermalSDK.dll/libthermalSDK.so/ libcoresdk.so(ARM64)/libmagcore.so，导出 analysis/ida/export/ - 解码官方渲染管线：DDT 校准表加载->快门端点选择->Q12 插值->ref(4x type1 帧 均值)->NUC 查表->盲元补偿->窗口->LUT1024 重建->2x 升采样->调色板 - 逐像素验证：NUC+盲元 0/19200、插值 0 误差、2x 0/76800、窗口一致 - demo3 v5：完整复刻官方管线（含 DDT 解析、FFC 状态机、快门温度驱动）， 修复 load_ddt 表错位导致的零像素问题 - 鬼影根因分析写入 analysis/reverse_20260813_full.md - 心跳/恢复机制：analysis/session_state.md + tools/resume_rev.ps1 - 新增 tsdk_pair3 增强采集工具；历史工具归档 csdk/tools/legacy/； 根目录抓帧残留删除，历史文档归档 analysis/history/ - csdk/README.md 完整使用文档；.gitignore/.gitattributes 补 LFS 规则
112 lines
2.8 KiB
C
112 lines
2.8 KiB
C
#include <idc.idc>
|
|
|
|
static dump_range(out, from, to)
|
|
{
|
|
auto ea;
|
|
ea = from;
|
|
while (ea != BADADDR && ea < to)
|
|
{
|
|
fprintf(out, "%08X: %s\n", ea, generate_disasm_line(ea, 0));
|
|
ea = next_head(ea, to);
|
|
}
|
|
}
|
|
|
|
static dump_xrefs(out, ea)
|
|
{
|
|
auto x;
|
|
x = get_first_dref_to(ea);
|
|
if (x != BADADDR)
|
|
{
|
|
fprintf(out, " data refs from:\n");
|
|
while (x != BADADDR)
|
|
{
|
|
fprintf(out, " %08X\n", x);
|
|
x = get_next_dref_to(ea, x);
|
|
}
|
|
}
|
|
x = get_first_cref_to(ea);
|
|
if (x != BADADDR)
|
|
{
|
|
fprintf(out, " code refs from:\n");
|
|
while (x != BADADDR)
|
|
{
|
|
fprintf(out, " %08X (func %08X)\n", x, get_func_attr(x, FUNCATTR_START));
|
|
x = get_next_cref_to(ea, x);
|
|
}
|
|
}
|
|
}
|
|
|
|
static dump_fn(out, ea)
|
|
{
|
|
auto f, end, name;
|
|
f = get_func_attr(ea, FUNCATTR_START);
|
|
if (f == BADADDR)
|
|
{
|
|
fprintf(out, "### %08X NOT A FUNCTION (dumping 0x200 bytes)\n", ea);
|
|
dump_range(out, ea, ea + 0x200);
|
|
fprintf(out, "\n==================================================================\n\n");
|
|
return;
|
|
}
|
|
end = get_func_attr(f, FUNCATTR_END);
|
|
name = get_func_name(f);
|
|
fprintf(out, "### FUNC %08X - %08X (%d bytes) name=%s\n", f, end, end - f, name);
|
|
dump_range(out, f, end);
|
|
fprintf(out, "\n");
|
|
dump_xrefs(out, f);
|
|
fprintf(out, "\n==================================================================\n\n");
|
|
}
|
|
|
|
static main()
|
|
{
|
|
auto dir, f, i, ea, n, seed, first;
|
|
dir = "C:\\Project\\MAG160C\\analysis\\ida\\export\\";
|
|
|
|
f = fopen(dir + "coresdk_keyfuncs_disasm.txt", "w");
|
|
if (f == 0)
|
|
{
|
|
warning("cannot open keyfuncs output");
|
|
return;
|
|
}
|
|
dump_fn(f, 0x180017200);
|
|
dump_fn(f, 0x180017330);
|
|
dump_fn(f, 0x180016ae0);
|
|
dump_fn(f, 0x180016dd0);
|
|
dump_fn(f, 0x180016f10);
|
|
dump_fn(f, 0x18000c760);
|
|
dump_fn(f, 0x18000c620);
|
|
dump_fn(f, 0x1800011a0);
|
|
dump_fn(f, 0x18001e920);
|
|
dump_fn(f, 0x18000a1d2);
|
|
dump_fn(f, 0x180002f50);
|
|
dump_fn(f, 0x180010780);
|
|
fclose(f);
|
|
|
|
seed = get_func_attr(0x180001000, FUNCATTR_START);
|
|
if (seed == BADADDR)
|
|
seed = 0x180017200;
|
|
first = seed;
|
|
ea = get_prev_func(first);
|
|
while (ea != BADADDR)
|
|
{
|
|
first = ea;
|
|
ea = get_prev_func(first);
|
|
}
|
|
f = fopen(dir + "all_functions.txt", "w");
|
|
if (f == 0)
|
|
{
|
|
warning("cannot open allfuncs output");
|
|
return;
|
|
}
|
|
ea = first;
|
|
n = 0;
|
|
while (ea != BADADDR)
|
|
{
|
|
fprintf(f, "%08X %08X %s\n", ea, get_func_attr(ea, FUNCATTR_END), get_func_name(ea));
|
|
ea = get_next_func(ea);
|
|
n = n + 1;
|
|
}
|
|
fprintf(f, "TOTAL %d\n", n);
|
|
fclose(f);
|
|
msg("disasm export done: %d funcs\n", n);
|
|
}
|