CS35L27-Covert-Channel-Analysis/report/findings.md

# CS35L27 8051 Firmware Forensic Findings

**Firmware analyzed:** Region 32 (8051, 4096 bytes)  
**Supporting files:** codecctl.txt; all runtime TraceV3 logs (see methods)  
**Analysis Date:** December 18–19, 2025

---

## Major Observed Findings

| # | Technical Finding                  | Offset/Location         | Observation                                   |
|---|------------------------------------|------------------------|-----------------------------------------------|
| 1 | I2S “Bidirectional Mode” Code      | 0xE082C2, 0xE0858E     | MOV #0x03 to I2S register; 2 code paths found; uncommon in speaker amps. |
| 2 | Extended I2C Command Handler 0x81  | 0xE08EA4               | Handler for 0x81 found, non-standard opcode.  |
| 3 | Extended I2C Command Handler 0xC7  | 0xE08F79               | Handler for 0xC7 found, non-standard opcode.  |
| 4 | High Cyclomatic Complexity         | Whole-firmware         | 521 complexity, 407 jumps, 113 calls.         |
| 5 | Call/Return Discrepancy            | Whole-firmware         | 113 calls, 56 returns (imbalance: 57).        |
| 6 | High entropy (DSP section)         | 0x0C00–0x0FFF          | 7.30 bits/byte; matches heavily optimized code.|
| 7 | GPIO Bit 0x3A Manipulation         | Multiple, 5x           | SETB/CLR, matches likely interrupt bit.        |
| 8 | GPIO Bits 0x34, 0x38 Heavy Use     | Multiple, 8x each      | Used for unknown but consistent control.       |
| 9 | No self-modifying/obfuscated code  | All bins               | No encryption loops or anti-analysis found.    |
|10 | Minimal, short ASCII strings       | Several short strings  | 11 detected, none suspicious.                  |

---

- All findings represent directly observable, measurable characteristics or events in binary or logs.
- No risk assignments, theoretical surmise, or narrative included.
- For cross-correlation with runtime, see runtime-trace-analysis.md.

---