mirror of
https://github.com/JGoyd/CS35L27-Covert-Channel-Analysis.git
synced 2026-08-17 04:20:21 +02:00
70 lines
2.1 KiB
Markdown
70 lines
2.1 KiB
Markdown
# CS35L27 Firmware and Trace Technical Details
|
||
|
||
---
|
||
|
||
## I2S Code Path Details
|
||
|
||
### Bidirectional Mode Write
|
||
|
||
- **First path (0xE082C2):**
|
||
`MOV A, #0x03; MOVX @DPTR, A`
|
||
Address: 0x0000
|
||
— Enables both transmit (TX) and receive (RX) in I2S control register.
|
||
- **Second path (0xE0858E):**
|
||
`MOV DPTR, #0x0003; MOV A, #0x03; MOVX @DPTR, A`
|
||
|
||
- **Note:**
|
||
Value `0x03` usage is uncommon in typical speaker amplifier firmware, which usually only requires TX. RX (microphone-like operation) is atypical unless for diagnostics or advanced features.
|
||
|
||
---
|
||
|
||
## Extended I2C Command Paths
|
||
|
||
- **Handler at 0xE08EA4:**
|
||
Triggered on `CJNE A, #0x81`. Non-standard command handling.
|
||
- **Handler at 0xE08F79:**
|
||
Triggered on `CJNE A, #0xC7`. Similarly not standard across typical CS35L27 implementations.
|
||
|
||
---
|
||
|
||
## Control Flow and Function Breakdown
|
||
|
||
- **Call Instructions:** 113 (68 LCALL, 45 ACALL)
|
||
- **Return Instructions:** 56 (Imbalance: 57)
|
||
- **Long jumps (LJMP):** 104
|
||
- **Short jumps (SJMP/AJMP):** 129
|
||
- **Switch/case-style indirect jumps (`JMP @A+DPTR`):** 3
|
||
|
||
- **Cyclomatic Complexity:** 521
|
||
— For 4KB code size, this is high but not unprecedented in event-driven embedded code.
|
||
|
||
---
|
||
|
||
## GPIO Operations
|
||
|
||
| Bit | Firmware Usage | Description/Notes |
|
||
|------|---------------|------------------------|
|
||
| 0x3A | 5 SETB/CLR | Matches probable INT |
|
||
| 0x34 | 8 SETB/CLR | Frequent general usage |
|
||
| 0x38 | 8 SETB/CLR | Frequent general usage |
|
||
|
||
*All toggles present in firmware, with detailed match to runtime evidence in TraceV3 logs.*
|
||
|
||
---
|
||
|
||
## Entropy and String Patterns
|
||
|
||
- DSP region (0x0C00–0x0FFF) shows highest entropy (7.30 bits/byte), matching expectations for optimized, dense DSP code.
|
||
- 11 minimal ASCII fragments (4–6 chars each), none corresponding to commands/phrases that indicate covert functions.
|
||
|
||
---
|
||
|
||
## Codecctl.txt Usage
|
||
|
||
- Register initialization patterns extracted and mapped to firmware behavior.
|
||
- Confirms settings and expected register defaults from boot/init phase.
|
||
|
||
---
|
||
|
||
All statements above are based on direct static or hex evidence, with reference to actual offsets and disassembly output only.
|