Initial triage wiki
This commit is contained in:
MrARM
139
next-analysis-targets.md
Normal file
139
next-analysis-targets.md
Normal file
@@ -0,0 +1,139 @@
|
||||
# Next Analysis Targets
|
||||
|
||||
## Priority 1: Main Game Binary
|
||||
|
||||
Status: first-pass static strings, dependency review, targeted Ghidra decompilation, topper serial-key recovery, and a MicroPython emulator artifact are complete; see `main-game-behavior.md` and `topper-serial-key-emulator.md`.
|
||||
|
||||
Target:
|
||||
|
||||
- `/games/pokemon_pro/game`
|
||||
|
||||
Why:
|
||||
|
||||
- It is the real machine application started by `game_monitor`.
|
||||
- It interprets hardware state, controls gameplay, and likely talks to SPIKE node hardware.
|
||||
- Exit codes are meaningful and documented in `game_monitor`.
|
||||
|
||||
Suggested first passes:
|
||||
|
||||
- Extract strings with offsets. Done: `analysis/static-triage/game.strings`.
|
||||
- Identify linked libraries with an AArch64-aware ELF parser. Done with `objdump -p`; see `analysis/static-triage/game.objdump-p.txt`.
|
||||
- Load into Ghidra/IDA/rizin as AArch64 PIE. Done for targeted paths.
|
||||
- Search for paths from the init scripts: `/connectivity`, `/data`, `/games`, `/dev`, `UPDATE_REQUESTED`, `UPDATE_COMPLETED`, and node firmware filenames.
|
||||
- Search for exit-code constants matching the monitor script: `0` through `6`, plus signal paths.
|
||||
|
||||
Follow-up passes:
|
||||
|
||||
- Validate `analysis/topper-emulator/topper_emulator.py` on live hardware or a nodebus capture.
|
||||
- Recover the exact Magikarp topper `IDENTITY_BOARD_PART_ID` expected by command `0xfe`.
|
||||
- Confirm physical UART pins, baud, voltage level, and any netbridge timing/break behavior required for a MicroPython node.
|
||||
|
||||
## Priority 2: `image.bin` / Radium Runtime Image
|
||||
|
||||
Status: first-pass static comparison and whole-rootfs audio search complete; see `package-image-firmware.md` and `audio-asset-search.md`.
|
||||
|
||||
Targets:
|
||||
|
||||
- `/games/pokemon_pro/image.bin`
|
||||
- `/games/pokemon_pro/spike3/spike_menu/image.bin`
|
||||
|
||||
Why:
|
||||
|
||||
- `image.bin` is larger than the executable and is probably a resource pack, filesystem image, or application asset bundle used by the game.
|
||||
- The SPIKE menu explicitly copies its `image.bin` to tmpfs because updates may overwrite it while mmap-ed.
|
||||
- `main.pck` has already been extracted into workspace-local `assets/`; see `godot-and-radium-assets.md`.
|
||||
|
||||
Suggested first passes:
|
||||
|
||||
- Run `file`, `binwalk`, entropy analysis, and magic-number scans. `file`, `binwalk`, header dump, and first strings completed.
|
||||
- Search for embedded filenames, JSON, SQLite, compression headers, and Godot pack headers. First strings show Stern EULA text; no standard archive signature found by `binwalk`.
|
||||
- Compare structure between game `image.bin` and spike-menu `image.bin`. First 0xb0-byte header shape and early EULA structure are similar, with different size/table values.
|
||||
- Reverse the Radium/cereal mmap image table used by `/games/pokemon_pro/game` strings such as `Flash memory init mmap failed`, `/lcd/demand_loaded`, and `/lcd/auto_loaded`.
|
||||
- Trace the native sound lookup path from strings such as `Radium::Sound`, `PLAYING SOUND #%d`, `MUSIC: MAINPLAY`, and `SPEECH: 'SQUIRTLE'`; broad static searching found no ordinary loose Ogg/WAV/MP3 gameplay audio files.
|
||||
|
||||
## Priority 3: `conagent`
|
||||
|
||||
Status: first-pass reverse engineering complete in `conagent-re.md`; non-compilable C-like flow export is in `conagent-pseudocode.c`.
|
||||
|
||||
Target:
|
||||
|
||||
- `/games/pokemon_pro/conagent`
|
||||
|
||||
Why:
|
||||
|
||||
- It is separately supervised and restarted forever.
|
||||
- Name and `/connectivity` paths suggest Stern Insider Connected or connectivity agent behavior.
|
||||
|
||||
Suggested first passes:
|
||||
|
||||
- Strings and URL/domain extraction.
|
||||
- Network syscall/import review.
|
||||
- Trace references to `/connectivity/cache`, `/connectivity/files`, `/connectivity/update`, and hostname handling.
|
||||
|
||||
Follow-up passes:
|
||||
|
||||
- Force Ghidra function creation for the stripped text region and rerun decompilation.
|
||||
- Audit `ifup`/`ifdown` command construction and interface-name validation.
|
||||
- Audit direct Game-to-Server endpoint validation.
|
||||
- Audit file-transfer local path validation and update handoff.
|
||||
|
||||
## Priority 4: Netbridge Debug Path
|
||||
|
||||
Status: first-pass strings and ELF program-header review complete; see `package-image-firmware.md`.
|
||||
|
||||
Targets:
|
||||
|
||||
- `/games/pokemon_pro/spike3/netbridge/netbridge.elf`
|
||||
- `/games/pokemon_pro/spike3/netbridge/spike3-swd.cfg`
|
||||
- `/games/pokemon_pro/spike3/netbridge/rp2040.cfg`
|
||||
|
||||
Why:
|
||||
|
||||
- `netbridge.elf` is not stripped and has debug info.
|
||||
- OpenOCD config maps SWD onto Raspberry Pi GPIOs 10 and 11.
|
||||
- This may be the clearest path to understanding lower-level board communication and programming/debug pathways.
|
||||
|
||||
Findings:
|
||||
|
||||
- `netbridge.elf` is a 32-bit ARM static executable with code mapped at `0x10000000` and RAM at `0x20000000`/`0x20040000`.
|
||||
- Strings include `uart_node.c`, `NODEBUS_Poll`, `NODEUART_Write`, `UART_NodeRxIrq`, and `WS2812_NodeSetLED`.
|
||||
|
||||
## Priority 5: Node Firmware
|
||||
|
||||
Status: first-pass Intel HEX range parsing complete for top-level node firmware; see `package-image-firmware.md`.
|
||||
|
||||
Targets:
|
||||
|
||||
- All `*-LPC*.hex` files under `/games/pokemon_pro`.
|
||||
- `/games/pokemon_pro/spike3/powerdist/powerdist_ext.hex`.
|
||||
|
||||
Why:
|
||||
|
||||
- These likely define behavior for distributed playfield nodes: coils, LEDs, LCD, magnet sensors, HDMI, TMC drivers, power distribution.
|
||||
- Firmware names expose node families and MCU types.
|
||||
|
||||
Suggested first passes:
|
||||
|
||||
- Parse Intel HEX metadata and address ranges. Done for 17 top-level HEX files in `analysis/static-triage/node-firmware-ranges.md`.
|
||||
- Group by MCU family. Initial grouping by filename identifies LPC1112, LPC1113, LPC1124, LPC1313, and LPC812 families.
|
||||
- Disassemble with the correct Cortex-M profile per chip.
|
||||
- Correlate firmware names with harnesses, playfield devices, and game binary strings.
|
||||
|
||||
## Priority 6: Update Format
|
||||
|
||||
Status: first-pass `.sidx` strings/header review complete; see `package-image-firmware.md`.
|
||||
|
||||
Targets:
|
||||
|
||||
- `/games/spk/index/pokemon_pro-0_83_0.sidx`
|
||||
- Any available `.spk` update packages outside this rootfs.
|
||||
|
||||
Why:
|
||||
|
||||
- `/etc/init.d/update` and `update_monitor` make `.spk` the software update format.
|
||||
- The index file may describe package contents, hashes, versions, or install paths.
|
||||
|
||||
Suggested first passes:
|
||||
|
||||
- Inspect `.sidx` with `file`, strings, hexdump, and structured parsers. Done with `file`, `xxd`, and `strings`; 686 package paths were identified.
|
||||
- Compare with any `.spk` available from machine update media or connectivity cache.
|
||||
Reference in New Issue
Block a user