Figured I might as well start a thread on the topic. asi empezo su post sobre los bines

The cracked IDA Pro is about the only way I know of right now to do disassembly of the ARM code. There is a program called DSemu intended to emulate ARM code used on Nintendo devices--it is very similar to what we need and it would be good if someone looks into modding it for this use (would be nice to have emulation for ARM boxes to the same extent that STi5518 has emulation).

The easy way to use IDA is to search though the code for odd addresses that are word (32 bits) sized, word aligned (so fall on 0,4,8,c least significant nibble addresses) and are in the range of the code segment (basically that is between the two Conexant Copyright ascii strings as the are in RAM located code). I've built a small qbasic routine to do that and used the resultant addresses to generate IDC 'MakeCode' files for specific VS bins. You load the pgm files to 25eff6 if un-edited, or to 25f000 if you remove the ascii model number from the file start. Then you set the default mode to Thumb mode and run the IDC. The code will end up about 90-95% disassembled--close enough for our use.

Turns out the clone kill code is spread out a number of spots in the VS ultra bins--the flash erase code seems to be just past a pointer to ascii string "ProtectCheckTask", the flag to tell code to do kill is just before that ascii pointer and if you search for other uses of the flag location, you find a routine that calls a new jumptable routine near the start of the bin--that seems to be the kill trigger. Still have to find the code that does the code detect, but in the kill flag setting routine there are a number of compares that likely will lead to the kill detect.

Attached is some of the VS 070911 code that I think is kill oriented. Routine 1 is the jumptable code, Routine 2 is the flag branch to 1--I think a good spot to do a defeat, last routine is the one that I think has flash block values and addresses--likely is part of kill implimentation.

I'm also attaching odd address files for the VS ultra 070905 and 070911 pgms. They are the IDC files you would run under IDA to disassemble those pgm files. 
Attached Files