# Notes about Ghidra

Can Ghidra be used as an alternative to IDA?
- yes: while lacking a debugger it is otherwise very similar in features to a combination of IDA Pro + Hex-Rays Decompiler, which would cost around $4000.

## Installation

Download from https://ghidra-sre.org

Install it on the host machine. Java 11 is required.

Change MAXMEM setting in ghidraRun command (shell script or .bat) to 4G or more.
2GB (default on 8GB machine) can result in OutOfMemory errors.

## Get the ROM files

Follow the instructions here https://www.magiclantern.fm/forum/index.php?topic=6785.msg187436#msg187436
to create the copied ROM files:

```./run_canon_fw.sh 77D,firmware="boot=0" -d romcpy```

Stop the emulator with Ctrl-C. A file ```77D/romcpy.sh``` will be created which can be used to create the copies of the ROM0.BIN file.

## Start Ghidra and create first project

- Execute ```ghidrarun```
- Create new project "77D"
- Run the CodeBrowser tool
- Import ROM0.BIN (or ROM1.BIN - whichever has the main code for your camera)
  - Format is "RAW Binary"
  - Select the correct "language": this is the processor architecture
    - For Digic 7 cameras: ARM Cortex 32 little endian
  - In options enter name ```rom0``` and base address ```0xe0000000```
    - This address varies on different models
    - Magiclantern confusingly uses ROMBASEADDR but this is _not_ a base address,
      it is the entrypoint.
    - You can find the base address by looking in ```platform/200D.101/Makefile.platform.default```
      for a line like ```ROMBASEADDR     = 0xE0040000``` and masking out the low bits
  - _Important_ Do not run the analyzer yet!
- It seems obvious to repeat this for the other ROM files, but this is wrong.
  A Ghidra "file" represents one memory space, and separate files cannot eg, call code in other files, which we require.
- Instead, in the listing for your main ROM, use File -> Add To Program and use Options to set the
  correct base address for each new file, eg:
  - ```77D.0x4000.bin``` to 0x4000
  - ```77D.0xDF002800.bin``` to 0xdf002800
- This loads the files into the same address space
- Addresses in the 0x40000000 region are mirrored to a lower address with a fixed offset,
  so these should be imported twice, one at each offset.
  - ```77D.0x40100000.bin``` to address 0x00100000 and again to 0x40100000
  - more as required if any of the referenced addresses are missing
  - TODO: can this be scripted in Ghidra? (yes; Ghidra supports scripting in Java and Python)
- You can auto-analyze the file now, but it is very slow and not that reliable (can crash after 8 hours, or never finish)
- Finding strings seems useful however, so, select Analysis -> One Shot
  - -> ASCII Strings
  - -> Embedded Media
- After the analysis is done save the project: File -> Save All
- You can now start disassembling

## Basic Ghidra commands

- "D" disassembles at your cursor.  This tries to guess if it's standard ARM or Thumb, and is normally good
- "F12" forces Thumb mode, "F11" forces standard ARM
- You can "Ctrl-Z" to undo your guess
  - So if "D" looks bad, you can undo and try both modes manually
- "C" unsets code to unknown; this is useful if you notice Ghidra has mistakenly disassembled something
  that is not code, eg, an array of pointers, or an ASCII string.  You can select a region then "C"
- "G" jumps to an address or label
- "Ctrl-Alt-U" goes to the next undefined byte; useful if "D" worked on a big block and you want to check
  the end of it
- "Alt-leftarrow" goes backwards in your movement history, "Alt-rightarrow" goes forward

## Start disassembling the bootloader

- Go to address ```0xE0000000```
- Press "L" to enter the label "bootloader" to make it easier to return here (e. g. with GoTo command on key "G")
- Press "F11" or right click and select "Disassemble ARM"

- Go to address ```0x40100000```
- Press "F12" or right click and select "Disassemble Thumb"

- Go to address ```0x00100000```
- Press "F12" or right click and select "Disassemble Thumb"

## Start disassembling the firmware

- Go to address ```0xE0040000``` (or whatever the entrypoint "ROMBASEADDR" is for your camera)
- Press "L" to enter the label "firmware_entry", this is the name the ML code uses
- Press "D"
- Ghidra will analyze all referenced code that it can find, so this will take a while.
- Find the stubs.S for your camera, and for every address that looks like a code address,
  do G, L (set label to stubs name), D
- eg for 200D, stubs.S has this line:
  - NSTUB(0xE00400FD,  cstart)
  - So G 0xe00400fd, L "cstart", D
- (this is about 200 labels, so I should really script this...)