Zanzamar

[Zanzamar @zanzamar]

@bookazoid_ @mattaereal The answer is: simlock.
And ARM+DSP SoCs were common already at least 5 years before 6600 (i.e. Nokia 3210 released in 1999)

[Zanzamar @zanzamar]

@evm_sec @b1ack0wl In my experience, “niche weird” starts right outside Intel/ARM+Win/Linux bubble. Binja has so many cool things (modern API, universal ILs for all architectures etc), but it still chokes on simplest Cortex-M startup code due to lack of manual control like “set function end” 🙁

[Zanzamar @zanzamar]

@ghidraninja A few quirks:
- already mentioned ADUMx160-based isolators are not 2.0 but 1.1 indeed (no HS support)
- Many 3.0 isolators don’t support speeds lower than SS at all.
Reason: it is really difficult to isolate USB HS (yes, SS is easier! it uses capacitive coupling already).

[Zanzamar @zanzamar]

@whitequark @vector35 There is something similar by @travisgoodspeed together with a plugin collecting peripheral addresses automatically and a big SVD database, perhaps worth a look, the name is Symgrate

[Zanzamar @zanzamar]

@HexRaysSA Any reason for not automating that instead?

[Zanzamar @zanzamar]

@FelixCLC_ BXJ (Branch and eXchange to Java state) on older ARMs with -J suffix.

Also, an
ickill
dckill
sequence in a typical QDSP startup code looks menacing :)

[Zanzamar @zanzamar]

@ret2systems Would be cool to see JTAG-side LA traces of the process. Perhaps it can be ported to OpenOCD and common JTAG interfaces.

[Zanzamar @zanzamar]

@BonfieldJames @dvyukov But the pointer itself is not const and can be reassigned later, so in the most general case the pointer var should be allocated in data (and take another 8 bytes).

[Zanzamar @zanzamar]

@travisgoodspeed MYK82 ROM? Try IDA’s FindCrypt or something similar on both LE and BE dumps, perhaps there’ll be some useful difference in results

[Zanzamar @zanzamar]

@HexRaysSA Perhaps syntax choice is the only problem of x86 reassembly, but on other platforms there are much bigger problems like no assembler understanding struct definitions output by IDA, local labels are not really local etc.

[Zanzamar @zanzamar]

@XenoKovah DSLogic Plus does 400MSPS/16ch/QSPI decoding for $150

[Zanzamar @zanzamar]

@travisgoodspeed TI GSM baseband processors of early 2000s had similar markings, i.e. XF741728, XF741979

[Zanzamar @zanzamar]

@in7egral @HexRaysSA They have this case covered: it stops working if you don’t pay (see above)

[Zanzamar @zanzamar]

@pedrib1337 @HexRaysSA Fantastic! Imagine the following situation: you have an idb created with a "perpetual" version. You switch to subscription, view that idb in a new version, get it converted to a newer format and voila! - it couldn’t be opened anymore if you terminate the subscription 🤬

[Zanzamar @zanzamar]

@Tailsnic_Retro @Curroquevedo @_PDCV_ @zooo_es @MuseoRecreativo No, en este caso fue “tin whiskers” (no se en Español) debajo de RA4 (red de resistencias)