(MCU 8051) STC15W204S
逆向STC-ISP V6.85I(Bus Hound)
雖然使用IDA Pro可以完整逆出原始程式碼的樣子，不過需要花費一些時間，因此，司徒打算使用較快速的方式，那就是使用Bus Hound錄取資料的傳輸過程並且參考網路上既有的逆向Protocol，這樣司徒就可以模仿傳送資料，達到在N900上燒錄的目標，接著就讓司徒介紹一下這個過程。
首先寫一個最簡單的GPIO輸出程式並且在Keil C上編譯輸出Hex檔案，主程式如下：
sfr p3 = 0xb0;
void main(void)
{
p3 = 0x00;
while(1);
}
Hex內容如下：
02 00 11 75 80 FF 75 90 FF 75 A0 FF E4 F5 B0 80 FE 78 7F E4 F6 D8 FD 75 81 07 02 00 03 00
Bus Hound錄到的燒錄過程：
Bus Hound 6.01 capture on Windows XP Service Pack 3 (x86). Complements of www.perisoft.net
Device - Device ID (followed by the endpoint for USB devices)
(15) Prolific USB-to-Serial Comm Port (COM3)
Address - FireWire async address or channel number
Length - Total transfer length
Phase - Phase Type
IN Data in transfer
OUT Data out transfer
Data - Hex dump of the data transferred
Descr - Description of the phase
Cmd... - Position in the captured data
Device Address Length Phase Data Description Cmd.Phase.Ofs(rep)
------ ------------------- -------- ----- ------------------------ ---------------- ------------------
15 1 OUT 7f . 1.1.0
15 1 IN 00 . 2.1.0
15 1 OUT 7f . 3.1.0(204)
15 1 IN 46 F 207.1.0
15 1 IN b9 . 208.1.0
15 1 IN 68 h 209.1.0
15 1 IN 00 . 210.1.0
15 1 IN 34 4 211.1.0
15 49 IN 50 91 11 6a 8a f7 ba 9f P..j.... 212.1.0
00 a8 ee e0 fd 26 03 03 .....&.. 212.1.8
81 72 54 00 f5 14 04 06 .rT..... 212.1.16
70 8a 02 29 2b 2f 30 2c p..)+/0, 212.1.24
00 14 10 04 e7 ec 6b bf ......k. 212.1.32
ff ff 15 08 25 01 12 0c ....%... 212.1.40
16 . 212.1.48
15 34 OUT 46 b9 6a 00 20 00 0b 00 F.j. ... 213.1.0
c0 80 c0 ff c0 00 80 80 ........ 213.1.8
80 ff 80 00 40 80 40 ff ....@.@. 213.1.16
40 00 00 80 00 00 00 0a @....... 213.1.24
12 16 .. 213.1.32
15 1 OUT fe . 214.1.0(23)
15 1 IN 46 F 237.1.0
15 1 IN b9 . 238.1.0
15 1 IN 68 h 239.1.0
15 1 IN 00 . 240.1.0
15 1 IN 20 241.1.0
15 29 IN 00 0b 0d 58 13 07 18 c0 ...X.... 242.1.0
1a 82 25 ae 30 da 36 1b ..%.0.6. 242.1.8
4c 55 61 db 54 c5 76 08 LUa.T.v. 242.1.16
00 00 08 28 16 ...(. 242.1.24
15 34 OUT 46 b9 6a 00 20 00 0c 69 F.j. ..i 243.1.0
80 6a 80 6b 80 6c 80 6d .j.k.l.m 243.1.8
80 6e 80 64 40 65 40 66 .n.d@e@f 243.1.16
40 67 40 68 40 69 40 0a @g@h@i@. 243.1.24
02 16 .. 243.1.32
15 1 OUT fe . 244.1.0(21)
15 1 IN 46 F 265.1.0
15 1 IN b9 . 266.1.0
15 1 IN 68 h 267.1.0
15 1 IN 00 . 268.1.0
15 1 IN 20 269.1.0
15 29 IN 00 0c 23 dd 23 fb 24 0f ..#.#.$. 270.1.0
24 32 24 4b 24 64 47 ff $2$K$dG. 270.1.8
48 2c 48 63 48 90 48 81 H,HcH.H. 270.1.16
48 a4 09 24 16 H..$. 270.1.24
15 16 OUT 46 b9 6a 00 0e 01 64 40 F.j...d@ 271.1.0
ff d0 80 6b 81 04 58 16 ...k..X. 271.1.8
15 1 IN 46 F 272.1.0
15 1 IN b9 . 273.1.0
15 1 IN 68 h 274.1.0
15 1 IN 00 . 275.1.0
15 1 IN 07 . 276.1.0
15 4 IN 01 00 70 16 ..p. 277.1.0
15 13 OUT 46 b9 6a 00 0b 05 00 00 F.j..... 278.1.0
5a a5 01 79 16 Z..y. 278.1.8
15 1 IN 46 F 279.1.0
15 1 IN b9 . 280.1.0
15 1 IN 68 h 281.1.0
15 1 IN 00 . 282.1.0
15 1 IN 07 . 283.1.0
15 4 IN 05 00 74 16 ..t. 284.1.0
15 13 OUT 46 b9 6a 00 0b 03 00 00 F.j..... 285.1.0
5a a5 01 77 16 Z..w. 285.1.8
15 1 IN 46 F 286.1.0
15 1 IN b9 . 287.1.0
15 1 IN 68 h 288.1.0
15 1 IN 00 . 289.1.0
15 1 IN 0e . 290.1.0
15 11 IN 03 f5 14 00 d6 05 aa 28 .......( 291.1.0
03 2f 16 ./. 291.1.8
15 141 OUT 46 b9 6a 00 8b 22 00 00 F.j..".. 292.1.0
5a a5 02 00 11 75 80 ff Z....u.. 292.1.8
75 90 ff 75 a0 ff e4 f5 u..u.... 292.1.16
b0 80 fe 78 7f e4 f6 d8 ...x.... 292.1.24
fd 75 81 07 02 00 03 ff .u...... 292.1.32
ff ff ff ff ff ff ff ff ........ 292.1.40
ff ff ff ff ff ff ff ff ........ 292.1.48
ff ff ff ff ff ff ff ff ........ 292.1.56
ff ff ff ff ff ff ff ff ........ 292.1.64
ff ff ff ff ff ff ff ff ........ 292.1.72
ff ff ff ff ff ff ff ff ........ 292.1.80
ff ff ff ff ff ff ff ff ........ 292.1.88
ff ff ff ff ff ff ff ff ........ 292.1.96
ff ff ff ff ff ff ff ff ........ 292.1.104
ff ff ff ff ff ff ff ff ........ 292.1.112
ff ff ff ff ff ff ff ff ........ 292.1.120
ff ff ff ff ff ff ff ff ........ 292.1.128
ff ff 74 81 16 ..t.. 292.1.136
15 1 IN 46 F 293.1.0
15 1 IN b9 . 294.1.0
15 1 IN 68 h 295.1.0
15 1 IN 00 . 296.1.0
15 1 IN 08 . 297.1.0
15 5 IN 02 54 00 c6 16 .T... 298.1.0
15 141 OUT 46 b9 6a 00 8b 02 00 80 F.j..... 299.1.0
5a a5 ff ff ff ff ff ff Z....... 299.1.8
ff ff ff ff ff ff ff ff ........ 299.1.16
ff ff ff ff ff ff ff ff ........ 299.1.24
ff ff ff ff ff ff ff ff ........ 299.1.32
ff ff ff ff ff ff ff ff ........ 299.1.40
ff ff ff ff ff ff ff ff ........ 299.1.48
ff ff ff ff ff ff ff ff ........ 299.1.56
ff ff ff ff ff ff ff ff ........ 299.1.64
ff ff ff ff ff ff ff ff ........ 299.1.72
ff ff ff ff ff ff ff ff ........ 299.1.80
ff ff ff ff ff ff ff ff ........ 299.1.88
ff ff ff ff ff ff ff ff ........ 299.1.96
ff ff ff ff ff ff ff ff ........ 299.1.104
ff ff ff ff ff ff ff ff ........ 299.1.112
ff ff ff ff ff ff ff ff ........ 299.1.120
ff ff ff ff ff ff ff ff ........ 299.1.128
ff ff 81 f6 16 ..... 299.1.136
15 1 IN 46 F 300.1.0
15 1 IN b9 . 301.1.0
15 1 IN 68 h 302.1.0
15 1 IN 00 . 303.1.0
15 1 IN 08 . 304.1.0
15 5 IN 02 54 00 c6 16 .T... 305.1.0
15 141 OUT 46 b9 6a 00 8b 02 01 00 F.j..... 306.1.0
5a a5 ff ff ff ff ff ff Z....... 306.1.8
ff ff ff ff ff ff ff ff ........ 306.1.16
ff ff ff ff ff ff ff ff ........ 306.1.24
ff ff ff ff ff ff ff ff ........ 306.1.32
ff ff ff ff ff ff ff ff ........ 306.1.40
ff ff ff ff ff ff ff ff ........ 306.1.48
ff ff ff ff ff ff ff ff ........ 306.1.56
ff ff ff ff ff ff ff ff ........ 306.1.64
ff ff ff ff ff ff ff ff ........ 306.1.72
ff ff ff ff ff ff ff ff ........ 306.1.80
ff ff ff ff ff ff ff ff ........ 306.1.88
ff ff ff ff ff ff ff ff ........ 306.1.96
ff ff ff ff ff ff ff ff ........ 306.1.104
ff ff ff ff ff ff ff ff ........ 306.1.112
ff ff ff ff ff ff ff ff ........ 306.1.120
ff ff ff ff ff ff ff ff ........ 306.1.128
ff ff 81 77 16 ...w. 306.1.136
15 1 IN 46 F 307.1.0
15 1 IN b9 . 308.1.0
15 1 IN 68 h 309.1.0
15 1 IN 00 . 310.1.0
15 1 IN 08 . 311.1.0
15 5 IN 02 54 00 c6 16 .T... 312.1.0
15 141 OUT 46 b9 6a 00 8b 02 01 80 F.j..... 313.1.0
5a a5 ff ff ff ff ff ff Z....... 313.1.8
ff ff ff ff ff ff ff ff ........ 313.1.16
ff ff ff ff ff ff ff ff ........ 313.1.24
ff ff ff ff ff ff ff ff ........ 313.1.32
ff ff ff ff ff ff ff ff ........ 313.1.40
ff ff ff ff ff ff ff ff ........ 313.1.48
ff ff ff ff ff ff ff ff ........ 313.1.56
ff ff ff ff ff ff ff ff ........ 313.1.64
ff ff ff ff ff ff ff ff ........ 313.1.72
ff ff ff ff ff ff ff ff ........ 313.1.80
ff ff ff ff ff ff ff ff ........ 313.1.88
ff ff ff ff ff ff ff ff ........ 313.1.96
ff ff ff ff ff ff ff ff ........ 313.1.104
ff ff ff ff ff ff ff ff ........ 313.1.112
ff ff ff ff ff ff ff ff ........ 313.1.120
ff ff ff ff ff ff ff ff ........ 313.1.128
ff ff 81 f7 16 ..... 313.1.136
15 1 IN 46 F 314.1.0
15 1 IN b9 . 315.1.0
15 1 IN 68 h 316.1.0
15 1 IN 00 . 317.1.0
15 1 IN 08 . 318.1.0
15 5 IN 02 54 00 c6 16 .T... 319.1.0
15 77 OUT 46 b9 6a 00 4b 04 00 00 F.j.K... 320.1.0
5a a5 ff ff ff 00 ff ff Z....... 320.1.8
00 ff ff ff ff ff ff ff ........ 320.1.16
ff ff ff ff ff ff ff ff ........ 320.1.24
00 00 ff a8 ff a8 ff 90 ........ 320.1.32
ff fd 03 ff ff ff ff ff ........ 320.1.40
ff ff ff ff ff ff ff ff ........ 320.1.48
ff ff ff ff ff ff ff ff ........ 320.1.56
ff ec ff ff ff 6a bf f7 .....j.. 320.1.64
ba 9f 39 cc 16 ..9.. 320.1.72
15 1 IN 46 F 321.1.0
15 1 IN b9 . 322.1.0
15 1 IN 68 h 323.1.0
15 1 IN 00 . 324.1.0
15 1 IN 08 . 325.1.0
15 5 IN 04 54 00 c8 16 .T... 326.1.0
根據網路上的分析，封包的傳輸流程，可以分成如下幾個步驟：
(PC Out) > Pulse
(7f)
(PC In) > Infomation packet
(46 b9 68 00 34 50 91 11 6a 8a f7 ba 9f 00 a8 ee e0 fd 26 03 03 81 72 54 00 f5 14 04 06 70 8a 02 29 2b 2f 30 2c 00 14 10 04 e7 ec 6b bf ff ff 15 08 25 01 12 0c 16)
(PC Out) > Frequency challenges round 1
(46 b9 6a 00 20 00 0b 00 c0 80 c0 ff c0 00 80 80 80 ff 80 00 40 80 40 ff 40 00 00 80 00 00 00 0a 12 16 fe)
(PC In) > Frequency responses
(46 b9 68 00 20 00 0b 0d 58 13 07 18 c0 1a 82 25 ae 30 da 36 1b 4c 55 61 db 54 c5 76 08 00 00 08 28 16)
(PC Out) > Frequency challenges round 2
(46 b9 6a 00 20 00 0c 69 80 6a 80 6b 80 6c 80 6d 80 6e 80 64 40 65 40 66 40 67 40 68 40 69 40 0a 02 16 fe)
(PC In) > Frequency responses
(46 b9 68 00 20 00 0c 23 dd 23 fb 24 0f 24 32 24 4b 24 64 47 ff 48 2c 48 63 48 90 48 81 48 a4 09 24 16)
(PC Out) > Baudrate switch
(46 b9 6a 00 0e 01 64 40 ff d0 80 6b 81 04 58 16)
(PC In) > Ack
(46 b9 68 00 07 01 00 70 16)
(PC Out) > Prepare
(46 b9 6a 00 0b 05 00 00 5a a5 01 79 16)
(PC In) > Ack
(46 b9 68 00 07 05 00 74 16)
(PC Out) > Erase
(46 b9 6a 00 0b 03 00 00 5a a5 01 77 16)
(PC In) > Ack + UID
(46 b9 68 00 0e 03 f5 14 00 d6 05 aa 28 03 2f 16)
(PC Out) > Write block 1
(46 b9 6a 00 8b 22 00 00 5a a5 02 00 11 75 80 ff 75 90 ff 75 a0 ff e4 f5 b0 80 fe 78 7f e4 f6 d8 fd 75 81 07 02 00 03 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 74 81 16)
(PC In) > Ack
(46 b9 68 00 08 02 54 00 c6 16)
(PC Out) > Write block 2
(46 b9 6a 00 8b 02 00 80 5a a5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 81 f6 16)
(PC In) > Ack
(46 b9 68 00 08 02 54 00 c6 16)
(PC Out) > Write block 3
(46 b9 6a 00 8b 02 01 00 5a a5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 81 77 16)
(PC In) > Ack
(46 b9 68 00 08 02 54 00 c6 16)
(PC Out) > Write block 4
(46 b9 6a 00 8b 02 01 80 5a a5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 81 f7 16)
(PC In) > Ack
(46 b9 68 00 08 02 54 00 c6 16)
(PC Out) > Option packet
(46 b9 6a 00 4b 04 00 00 5a a5 ff ff ff 00 ff ff 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 ff a8 ff a8 ff 90 ff fd 03 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ec ff ff ff 6a bf f7 ba 9f 39 cc 16)
(PC In) > Ack
(46 b9 68 00 08 04 54 00 c8 16)