MediaTek md1img Loader for Ghidra

Ghidra loader for the MediaTek md1img modem firmware image format. Currently, only nanoMIPS-based firmware is supported, but basic features may still work if you manually choose a different architecture (e.g., MIPS) when loading an image.

Setup

For nanoMIPS-based modems, install the nanoMIPS ISA Ghidra plugin along with this loader before attempting to load the firmware image.

Usage

In Ghidra, simply import an md1img format file into the project. The loader will extract the modem firmware and apply any debug symbols.

After initially loading the firmware and identifying the INT_InitRegions_C, memcpy, and memset functions, run the MtkInitRegions.java and emulate_custom_mk_ram_info.py scripts from the Script Manager (in that order) to automatically define further memory regions.

Development

Ensure the GHIDRA_INSTALL_DIR environment variable or project property is defined in order for Gradle to work properly in Eclipse. See https://docs.gradle.org/current/userguide/build_environment.html#sec:gradle_configuration_properties for where to place the gradle.properties file containing this property definition.

If modifying this project in tandem with the nanoMIPS ISA plugin, add the nanoMIPS plugin project directory to the loader's Eclipse project build path.

Build

Use your local Gradle install or in the included Gradle wrapper to build the project from source. Make sure to specify the correct Ghidra install directory in the GHIDRA_INSTALL_DIR property.

$ ./gradlew -PGHIDRA_INSTALL_DIR=<ghidra_path>