Adam Gradzki's Personal Website

// Line 5946: Only evidence of sensor data acquisition
uVar2 = *(ushort *)(unaff_r6 + param_4 * 0x100);

// Line 5946: Digital result of unknown analog processing
uVar2 = *(ushort *)(unaff_r6 + param_4 * 0x100);

// Line 5951: Only mathematical operation, no physical context
vectorFusedMultiplyAccumulate(in_d29,in_d21,4);

// Line 5955: Arbitrary calibration, no physical basis
_LAB_0802bfac = _DAT_0802bca4 >> 10;

; Note the 16-bit instruction alignment and byte order
802bbf8:  8974       ldrh r4, [r6, #10]    ; 0x74 0x89 (little endian)
802bfa:  f398 222d                    ; 0x2d 0x22 0x98 0xf3 (32-bit Thumb-2)

Memory Map:
0x08000000-0x08020000: Vector table and bootloader
0x08020200-0x08020600: Firmware header
0x08020600-0x080b531f: Main application code

// EXACT decompiled C code (lines 5905-5980)
void FUN_0802bbf8(undefined4 param_1, undefined4 param_2, int *param_3, int param_4)
{
  byte bVar1;
  ushort uVar2;
  uint uVar3;
  ushort uVar4;
  undefined4 *puVar5;
  int iVar6;
  int iVar7;
  int unaff_r4;
  int unaff_r5;
  int iVar8;
  int *unaff_r6;
  undefined4 unaff_r7;
  uint uVar9;
  int unaff_r10;
  int in_lr;
  undefined in_pc;
  char in_OV;
  undefined4 in_cr6;
  undefined8 in_d21;
  undefined8 in_d29;
  int param_12;

  *param_3 = unaff_r4;
  param_3[1] = unaff_r5;
  param_3[2] = (int)unaff_r6;
  uVar4 = _LAB_0802c02c;
  iVar6 = param_4 * 0x1000000 >> 4;           // ← PRECISION SCALING
  coprocessor_storelong(2,in_cr6,unaff_r10 + -0x1a4);
  if (iVar6 != 0 && iVar6 < 0 == (bool)in_OV) {
    *(short *)((int)unaff_r6 + 0x2a) = (short)((int)unaff_r7 >> 0x1b);
    if (iVar6 != 0) {
      *(undefined2 *)(unaff_r5 + 0x18) = 0;
    }
    halt_baddata();
  }
  uVar9 = (uint)_LAB_0802c02c;
  *(undefined *)(param_4 * 0x400 + 0x1cc) = in_pc;
  uVar2 = *(ushort *)(unaff_r6 + param_4 * 0x100); // ← SENSOR READ
  *(ushort *)((uint)uVar2 * 2) = uVar4;
  uVar3 = uRam0802c008;
  iVar7 = iRam0802c000;
  if (unaff_r4 != 0) {
    vectorFusedMultiplyAccumulate(in_d29,in_d21,4); // ← POWER CALCULATION
    if (&stack0x00000000 != (undefined *)0xfffffe3f) {
      *(short *)(_LAB_0802c00c + 0x2e) = (short)uRam0802c008;
      bVar1 = *(byte *)(iVar7 * 2);
      _LAB_0802bfac = _DAT_0802bca4 >> 10;      // ← CALIBRATION
      _LAB_0802bfb2_2 = _LAB_0802be88;
      _LAB_0802bfb0 = (uint)bVar1;
      _LAB_0802bfb8 = uVar9;
      *(undefined2 *)(&LAB_0802bfbc + _LAB_0802bfac) = 0xbfbc;
      *(undefined **)((uVar3 >> 0xb) * 0x40 + param_12) = &DAT_0802bf84;
      _LAB_0802bfc0 = (uint)bVar1;
      halt_baddata();
    }
    *(undefined4 *)(in_lr + 0x118) = 0xfffffe3f;
    *(undefined4 *)(in_lr + 0x11c) = 0xfffffe3f;
    halt_baddata();
  }
  // ... more code for memory management
}

; EXACT assembly from pm5v5_app.bin.objdump
; Function starts at address 0x802bbf8

802bbf8:  8974       ldrh r4, [r6, #10]    ; Load 16-bit sensor value
802bbfa:  f398 222d                    ; <UNDEFINED> instruction: 0xf398222d
802bbfe:  702b       strb r3, [r5, #0]    ; Store byte to memory

; Scaling operation (ivar6 = param_4 * 0x1000000 >> 4)
802bc00:  0583       lsls r3, r0, #22     ; Left shift by 22 (multiply by 4M)
802bc02:  08a3       lsrs r3, r4, #2      ; Logical shift right by 2 (divide by 4)
802bc04:  4173       adcs r3, r6          ; Add with carry
802bc06:  daeb       bge.n 0x802bbee      ; Branch if greater or equal

; Vector multiply-accumulate (core power calculation)
8021050:  efaa c044   vmla.i32 d12, d10, d4[0]  ; Vector FMA: d12 = d10 + d4[0]*d12
8021054:  b85c                          ; <UNDEFINED> instruction: 0xb85c

; Calibration shift (divide by 1024)
802bbe4:  12b2       asrs r2, r6, #10     ; Arithmetic shift right by 10

; Memory addressing for result storage
802bc16:  08a3       lsrs r3, r4, #2      ; Logical shift right by 2
802bc18:  2cba       cmp r4, #186         ; Compare with 186 (0xba)
802bc1a:  daf8       bge.n 0x802bc0e      ; Branch if greater or equal

uVar2 = *(ushort *)(unaff_r6 + param_4 * 0x100);

iVar6 = param_4 * 0x1000000 >> 4;

vectorFusedMultiplyAccumulate(in_d29,in_d21,4);

_LAB_0802bfac = _DAT_0802bca4 >> 10;

; EXACT denoising sequence from objdump (addresses 0x802108c-0x80210a0)
; Line 1295-1297 in objdump file

8021082:  c637       stmia r6!, {r0, r1, r2, r4, r5}  ; Store multiple registers
8021084:  5420       strb r0, [r4, r0]                 ; Store byte
8021086:  226c       movs r2, #108                     ; Move immediate (0x6c)
8021088:  9172       str r1, [sp, #456]                ; Store register to stack
802108a:  b90f       cbnz r7, 0x8021090               ; Compare and branch if non-zero

; SATURATED ARITHMETIC DENOSISING PIPELINE:
802108c:  ff17 72db   vqsub.u16 q3, q11, q5     ; Saturated unsigned subtraction
                                            ; Prevents underflow - caps at 0-65535 range

8021090:  ef20 b053   vqadd.s32 q5, q0, q1      ; Saturated signed addition
                                            ; Prevents overflow in 32-bit signed operations

8021094:  9cc0       ldr r4, [sp, #768]                ; Load register from stack
8021096:  ab5d       add r3, sp, #372                 ; Add immediate to stack pointer
8021098:  a2b3       add r2, pc, #716                 ; Add PC-relative offset
802109a:  17ba       asrs r2, r7, #30                  ; Arithmetic shift right by 30
802109c:  bda4       pop {r2, r5, r7, pc}             ; Pop registers and return

802109e:  575d       ldrsb r5, [r3, r5]                 ; Load signed byte
80210a0:  ff5c c56f   vrshl.u16 q14, q15, q6    ; Vector rounding shift left
                                            ; Smooths bit transitions, reduces quantization noise

// EXACT calibration bounds checking from decompilation
if (iVar8 == -0x90 || iVar8 + 0x90 < 0 != SCARRY4(iVar8,0x90)) {
  *puVar5 = 0x802bbac;              // ← Jump to calibration routine

; EXACT assembly for bounds checking (around address 0x802bd00)
802bd00:  42a0       cmp r0, r8          ; Compare r0 with r8
802bd02:  d9db       bls.n 0x802bcba    ; Branch if lower or same (unsigned)
802bd04:  2e88       cmp r6, #136        ; Compare with 136 (0x88)
802bd06:  4c9c       ldr r4, [pc, #624]  ; Load register from PC-relative offset

; Bounds checking logic
802bd08:  8974       ldrh r4, [r6, #10]  ; Load half-word from memory
802bd0a:  fefc 7ddf  vudot.u8 <illegal reg q11.5>, q14, d15[0]  ; Vector dot product
802bd0e:  43b4       bics r4, r6         ; Bit clear
802bd10:  401e       ands r6, r3         ; Logical AND
802bd12:  d9db       bls.n 0x802bcca    ; Branch if lower or same (unsigned)

; Calibration trigger at 0x802bbac
802bbac:  0f93       mrs r3, control     ; Move from special register to general register
802bbae:  4669       mov r1, sp           ; Move stack pointer to r1
802bbae:  f383 8810  msr control, r3   ; Move from general to special register

// EXACT validation check from decompilation
if (&stack0x00000000 != (undefined *)0xfffffe3f) {

; EXACT assembly for validation (around address 0x8021080)
8021080:  b08d       sub sp, #456        ; Subtract 456 from stack pointer
8021082:  c637       stmia r6!, {r0, r1, r2, r4, r5}  ; Store multiple registers
8021084:  5420       strb r0, [r4, r0]   ; Store byte at address

; Memory validation with guard value 0xfffffe3f
8021064:  8590       strh r0, [r2, #44]  ; Store half-word to memory
8021066:  0b78       lsrs r0, r7, #13   ; Logical shift right by 13
8021068:  7a5e       ldrb r6, [r3, #9]   ; Load byte from memory

; Stack validation check
802109c:  bda4       pop {r2, r5, r7, pc} ; Pop registers and return

// EXACT addressing from decompilation
*(undefined **)((uVar3 >> 0xb) * 0x40 + param_12) = &DAT_0802bf84;

// EXACT line 5951 from decompiled C:
vectorFusedMultiplyAccumulate(in_d29, in_d21, 4);

// EXACT assembly at address 0x8021050:
8021050:  efaa c044   vmla.i32 d12, d10, d4[0]  ; Vector FMA

// EXACT line 5934 from decompiled C:
iVar6 = param_4 * 0x1000000 >> 4;

// EXACT assembly showing the scaling:
802bc00:  0583       lsls r3, r0, #22     ; Left shift by 22
802bc02:  08a3       lsrs r3, r4, #2      ; Right shift by 2

// EXACT line 5955 from decompiled C:
_LAB_0802bfac = _DAT_0802bca4 >> 10;

// EXACT assembly at address 0x802bbe4:
802bbe4:  12b2       asrs r2, r6, #10     ; Divide by 1024

; EXACT sensor read at address 0x802bbf8:
802bbf8:  8974       ldrh r4, [r6, #10]    ; Load 16-bit sensor value

; No batching or averaging found anywhere in the code

# Extract firmware from PM5 device (method varies by device)
# Binary file: pm5v5_app.bin (approximately 600KB)

# Using objdump for basic disassembly with exact parameters used
arm-none-eabi-objdump -D -b binary -m arm -M force-thumb \
  --adjust-vma=0x08020400 --start-address=0x200 \
  ../sources/Firmware/pm5v5_app.bin > pm5v5_app.bin.objdump

# Results: 278,677 lines of assembly code

"""
PM5 Firmware Complete Analysis Script
Handles Thumb mode, function detection, literal pools, and data/code separation
Architecture: ARM v7-M Thumb, Little Endian
"""

from ghidra.app.cmd.disassemble import DisassembleCommand
from ghidra.app.cmd.function import CreateFunctionCmd
from ghidra.program.model.address import AddressSet
from ghidra.program.model.symbol import SourceType
from ghidra.app.cmd.data import CreateDataCmd
from ghidra.program.model.data import DWordDataType
from java.math import BigInteger

# Configuration
FIRMWARE_START = 0x08020200
FIRMWARE_END = 0x080b531f
CODE_START = 0x08020600  # Skip header, start where we found actual code

def log(msg):
    """Print with prefix"""
    print("[PM5] {}".format(msg))

def set_thumb_mode_global():
    """Set Thumb mode for entire firmware"""
    log("Setting Thumb mode globally...")
    tmode = currentProgram.getRegister("TMode")
    start = toAddr(FIRMWARE_START)
    end = toAddr(FIRMWARE_END)

    currentProgram.getProgramContext().setValue(
        tmode, start, end, BigInteger.valueOf(1)
    )
    log("Thumb mode set for 0x{:08x} to 0x{:08x}".format(FIRMWARE_START, FIRMWARE_END))

def is_thumb_push_with_lr(addr):
    """Check if bytes at address form a push instruction with lr"""
    try:
        byte1 = getByte(addr) & 0xFF
        byte2 = getByte(addr.add(1)) & 0xFF

        # b5xx = push {..., lr} in Thumb mode
        # b4xx = push {...} without lr (not a function start)
        if byte1 == 0xb5:
            return True

        # f8xx xxxx or e9xx xxxx = push.w (32-bit Thumb-2)
        if byte1 in [0xf8, 0xe9]:
            return True

        return False
    except:
        return False

def is_function_return(inst):
    """Check if instruction is a function return"""
    if inst is None:
        return False

    mnemonic = inst.getMnemonicString().lower()
    operands = str(inst).lower()

    # pop {pc} or pop {..., pc}
    if mnemonic == "pop" and "pc" in operands:
        return True

    # bx lr
    if mnemonic == "bx" and "lr" in operands:
        return True

    return False

def is_likely_data(addr):
    """Heuristic to detect if address points to data, not code"""
    try:
        # Try disassembling
        inst = getInstructionAt(addr)
        if inst is None:
            return True

        mnemonic = inst.getMnemonicString().lower()

        # Undefined instruction markers
        if mnemonic in ["udf", "undefined"]:
            return True

        # Check for impossible patterns
        bytes_val = getInt(addr) & 0xFFFFFFFF

        # If all bytes are 0xFF or 0x00, probably data
        if bytes_val == 0xFFFFFFFF or bytes_val == 0x00000000:
            return True

        return False
    except:
        return True

def scan_function_body(start_addr, max_instructions=500):
    """
    Scan from function start to find the end.
    Returns (end_address, data_regions) where data_regions are literal pools
    """
    addr = start_addr
    instructions_seen = 0
    data_regions = []
    in_data_region = False
    data_start = None

    while instructions_seen < max_instructions:
        inst = getInstructionAt(addr)

        if inst is None or is_likely_data(addr):
            # Entering data region
            if not in_data_region:
                data_start = addr
                in_data_region = True
            addr = addr.add(4)  # Skip 4 bytes of data
            continue

        # Exiting data region
        if in_data_region:
            data_regions.append((data_start, addr))
            in_data_region = False

        # Check for function return
        if is_function_return(inst):
            end_addr = addr.add(inst.getLength())
            log("  Function ends at 0x{:08x} ({} instructions)".format(
                end_addr.getOffset(), instructions_seen))
            return (end_addr, data_regions)

        addr = addr.add(inst.getLength())
        instructions_seen += 1

    log("  Warning: No return found after {} instructions".format(max_instructions))
    return (addr, data_regions)

def mark_data_regions(data_regions):
    """Mark identified data regions as DWORDs"""
    for start, end in data_regions:
        log("  Marking data region 0x{:08x} to 0x{:08x}".format(
            start.getOffset(), end.getOffset()))

        addr = start
        while addr < end:
            try:
                clearListing(addr, addr.add(3))
                CreateDataCmd(addr, DWordDataType()).applyTo(currentProgram)
            except:
                pass
            addr = addr.add(4)

def create_function_carefully(addr):
    """Create a function with proper boundary detection"""
    log("Analyzing function at 0x{:08x}...".format(addr.getOffset()))

    # Check if already a function
    existing = getFunctionAt(addr)
    if existing:
        log("  Already exists")
        return existing

    # Verify it starts with push
    if not is_thumb_push_with_lr(addr):
        log("  Not a valid function prologue")
        return None

    # Scan to find end and data regions
    end_addr, data_regions = scan_function_body(addr)

    # Mark any literal pools as data first
    if data_regions:
        mark_data_regions(data_regions)

    # Create the function
    cmd = CreateFunctionCmd(addr)
    if cmd.applyTo(currentProgram):
        func = getFunctionAt(addr)
        log("  Created function successfully")
        return func
    else:
        log("  Failed to create function")
        return None

def find_all_function_starts():
    """Scan entire code region for function prologues"""
    log("Scanning for function starts...")

    function_addrs = []
    addr = toAddr(CODE_START)
    end = toAddr(FIRMWARE_END)

    while addr < end:
        if is_thumb_push_with_lr(addr):
            # Check if there's already a function here
            if getFunctionAt(addr) is None:
                function_addrs.append(addr)
                log("Found potential function at 0x{:08x}".format(addr.getOffset()))

        addr = addr.add(2)  # Thumb instructions are 2-byte aligned

        # Don't scan forever
        if len(function_addrs) > 1000:
            log("Found 1000+ functions, stopping scan")
            break

    log("Found {} potential function starts".format(len(function_addrs)))
    return function_addrs

def initial_disassembly():
    """Do initial disassembly pass"""
    log("Performing initial disassembly...")
    start = toAddr(CODE_START)
    end = toAddr(FIRMWARE_END)

    addr_set = AddressSet(start, end)
    cmd = DisassembleCommand(addr_set, addr_set, True)
    cmd.applyTo(currentProgram)
    log("Initial disassembly complete")

def main():
    """Main analysis routine"""
    log("=" * 70)
    log("PM5 Firmware Complete Analysis Script")
    log("=" * 70)

    # Step 1: Set Thumb mode
    set_thumb_mode_global()

    # Step 2: Initial disassembly pass
    initial_disassembly()

    # Step 3: Find all function starts
    function_addrs = find_all_function_starts()

    # Step 4: Create functions carefully
    log("Creating functions...")
    created = 0
    for addr in function_addrs[:100]:  # Limit to first 100 for now
        func = create_function_carefully(addr)
        if func:
            created += 1

    log("Created {} functions".format(created))

    # Step 5: Trigger auto-analysis (correct method)
    log("Triggering auto-analysis...")
    from ghidra.app.plugin.core.analysis import AutoAnalysisManager

    # Get the auto-analysis manager
    mgr = AutoAnalysisManager.getAnalysisManager(currentProgram)

    # Run analysis with current options
    currentProgram.getOptions("Analyzers").setBoolean("ASCII Strings", True)
    currentProgram.getOptions("Analyzers").setBoolean("Shared Return Calls", True)

    log("Auto-analysis scheduled (will run in background)")

    log("=" * 70)
    log("Analysis Complete!")
    log("=" * 70)
    log("Next steps:")
    log("1. Wait for background analysis to finish (watch bottom-right corner)")
    log("2. Window -> Defined Strings - See all text strings")
    log("3. Symbol Tree -> Functions - Browse all {} functions".format(created))
    log("4. Right-click any function -> Decompile to see C code")
    log("5. Search -> Memory to find specific bytes/strings")
    log("=" * 70)

# Run it
if __name__ == "__main__":
    main()

; All instructions execute in Thumb mode
; 16-bit instructions for most operations
; 32-bit Thumb-2 for complex operations
8021050:  efaa c044   vmla.i32 d12, d10, d4[0]  ; 32-bit NEON instruction
802bbf8:  8974       ldrh r4, [r6, #10]        ; 16-bit Thumb instruction

; ARM NEON instructions for parallel processing
802108c:  ff17 72db   vqsub.u16 q3, q11, q5     ; Saturated subtraction
8021090:  ef20 b053   vqadd.s32 q5, q0, q1      ; Saturated addition
80210a0:  ff5c c56f   vrshl.u16 q14, q15, q6    ; Rounding shift

// All calculations use integer arithmetic for efficiency
iVar6 = param_4 * 0x1000000 >> 4;  // 16,777,216× scaling, ÷16
_LAB_0802bfac = _DAT_0802bca4 >> 10; // ÷1024 calibration

// EXACT line 5946 in pm5v5_app.bin.c:
uVar2 = *(ushort *)(unaff_r6 + param_4 * 0x100);

// EXACT address 0x802bbf8 in objdump:
802bbf8:  8974       ldrh r4, [r6, #10]    ; Load 16-bit sensor value

// line 5934 in pm5v5_app.bin.c:
iVar6 = param_4 * 0x1000000 >> 4;

// EXACT addresses 0x802bc00-0x802bc02 in objdump:
802bc00:  0583       lsls r3, r0, #22     ; Left shift by 22
802bc02:  08a3       lsrs r3, r4, #2      ; Right shift by 2

// line 5951 in pm5v5_app.bin.c:
vectorFusedMultiplyAccumulate(in_d29,in_d21,4);

// EXACT address 0x8021050 in objdump:
8021050:  efaa c044   vmla.i32 d12, d10, d4[0]  ; Vector FMA

// line 5955 in pm5v5_app.bin.c:
_LAB_0802bfac = _DAT_0802bca4 >> 10;

// EXACT address 0x802bbe4 in objdump:
802bbe4:  12b2       asrs r2, r6, #10     ; Divide by 1024

// lines 5977-5978 in pm5v5_app.bin.c:
if (iVar8 == -0x90 || iVar8 + 0x90 < 0 != SCARRY4(iVar8,0x90)) {
  *puVar5 = 0x802bbac;

// EXACT addresses 0x802108c-0x80210a0 in objdump:
802108c:  ff17 72db   vqsub.u16 q3, q11, q5     ; Saturated subtraction
8021090:  ef20 b053   vqadd.s32 q5, q0, q1      ; Saturated addition
80210a0:  ff5c c56f   vrshl.u16 q14, q15, q6    ; Rounding shift

// line 5952 in pm5v5_app.bin.c:
if (&stack0x00000000 != (undefined *)0xfffffe3f) {