RK3588 DDR init blob reverse engineering

- Ghidra decompilation of v1.02-v1.19 blobs (118 functions) - 53 functions renamed, 79 MMIO registers mapped to TRM - 45 timeout-less poll loops identified and patched - Production patcher (patch_prod.py) and QEMU emulator - Comprehensive analysis, frequency tables, community research Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 13:06:47 +02:00
commit 816848a474
23 changed files with 84690 additions and 0 deletions
@@ -0,0 +1,43 @@
+//Exports decompiled C for all functions
+//@category Export
+import ghidra.app.script.GhidraScript;
+import ghidra.app.decompiler.*;
+import ghidra.program.model.listing.*;
+import java.io.*;
+
+public class ExportDecompiled extends GhidraScript {
+    @Override
+    public void run() throws Exception {
+        String[] args = getScriptArgs();
+        String outPath = args.length > 0 ? args[0] : "/opt/work/ddr_decompiled.c";
+        
+        DecompInterface decompiler = new DecompInterface();
+        decompiler.openProgram(currentProgram);
+        
+        PrintWriter pw = new PrintWriter(new File(outPath));
+        pw.println("// RK3588 DDR Init Blob - Decompiled by Ghidra");
+        pw.println("// Source: " + currentProgram.getName());
+        pw.println("// Processor: ARM Cortex LE 32-bit");
+        pw.println();
+        
+        FunctionManager fm = currentProgram.getFunctionManager();
+        FunctionIterator fi = fm.getFunctions(true);
+        int count = 0;
+        
+        while (fi.hasNext()) {
+            Function func = fi.next();
+            DecompileResults results = decompiler.decompileFunction(func, 30, monitor);
+            DecompiledFunction decomp = results.getDecompiledFunction();
+            if (decomp != null) {
+                pw.println("// " + func.getName() + " @ " + func.getEntryPoint());
+                pw.println(decomp.getC());
+                pw.println();
+                count++;
+            }
+        }
+        
+        pw.close();
+        decompiler.dispose();
+        println("Exported " + count + " functions to " + outPath);
+    }
+}