I want to access the firmware of the ZASTONE D9000 app to examine the Bluetooth protocol or determine if I can modify the transmission frequency to match the Japanese range (otherwise, the JARD testing and approval process would be more complicated).
The result was the Qualcomm CSR, specifically the CSR8670. The ISA (which is called XAP and has an internal virtual machine, BlueCore VM) had no manual or specifications at all.
The most dangerous aspect is that various documents and the ADK require CSR service permissions to download, otherwise, you can only find leaked files from various forums, but none of them contain the necessary information for reverse engineering. While scripts online can be used to extract OTAU and DFU files, further extraction of vm.app is impossible, and the executable file format cannot be found at all. Although two implementations of disassemblers (only radare2 actually works) were found, but when loaded, they either fail to load or produce incorrect instructions, leading us to suspect that there may be a difference in ISA versions.
The only code in ADK that might have been released to comply with the GPL is GCC, but it doesn't include a linker. Furthermore, analyzing hundreds of KB of GCC code and writing disassembly instructions would be too time-consuming, and starting from scratch to reverse engineer the format of the executable file would be even more impractical.
Also, if you want to use DFU/OTAU, it requires signature verification with both public and private keys. However, I don't know whether the D9000 app stack actually performs this verification, but regardless, even modifying vm.app is currently impossible, so bypassing the check or directly flashing via SPI is out of the question.
However, are reverse engineering apps on Android still relatively straightforward?
闽ICP备2021006864号-7
闽公网安备35020602002794号
互联网举报中心