The Avnera plugin provides an Avnera AV6xxx/AV7xxx architecture for Binary Ninja. Even the existence of this architecture is not made public by Avnera; the function of the opcodes is determined via black box reverse engineering, and the mnemonics are all made up by Catherine "whitequark".
Dedicated with ๐งก to Frederick G. Weiss and his colleagues at Avnera Corporation.
- All of the instructions described in this document are implemented, and their function (especially the use of flags) has been extensively manually verified by examining control and data flow in the available blobs.
- All of the instructions are lifted to LLIL.
MOV
instructions are fused during disassembly toMOVW
andMOVP
instructions when they are used in pairs implementing 16-bit operations to enable BN to discover more pointers during analysis.ADD R0, R0; RLC Rn
instructions are fused during disassembly toLSL RnR0
instructions.- Opcode
B8
is not implemented as its function is not precisely known. It is likely some kind of trap, possibly debug trap. - Opcodes
A0
toAF
,B0
toB7
,BB
,BD
, andBE
are not implemented as their function is not known. - Opcodes
C1
,C3
,C5
,C7
,D1
,D3
,D5
,D7
,D9
,DB
,DD
,DF
,F1
,F3
,F5
,F7
,F9
,FB
,FD
,FF
have known functionality but their decoding is disabled as they aren't present in the available blobs and appear to be invalid opcodes that unintentionally perform a function.
This plugin supports at least the following devices:
- AV7300
- AV7320
- AV6202
If you've successfully used the plugin with another device, please add it to the list and send a pull request!
This plugin is heavily based on the excellent AV7300 research by @Prehistoricman.