First Notes on Reverse Engineering Kenwood TH-D74 Firmware

These are my notes loading and decompiling the Kenwood TH-D74 firmware, which Hash (@BitBangingBytes) managed to dump the BGA Flash ROM of a damaged radio. With a little luck and some other volunteers, this might lead to something like md380tools or OpenGD77, allowing custom software to run within the TH-D74 for decoding new digital protocols, storing a repeater database on the SD Card, or other fancy things.

Let’s begin by exploring how the firmware needs to be loaded into memory, then cover a few handy tables in memory that can be used to identify which functions of code are responsible for implementing a feature.

I’ll keep things are agnostic of version number as possible, but all explicit pointer addresses refer to Version 1.10 of the firmware.

73 from Knoxville,

–Travis Goodspeed, KK4VCZ

UPDATE: If you’d like to play along, DD4CR has broken the firmware decryption, allowing you to extract the firmware yourself from an update rather than desolder the Flash chip.

Linking and Loading

The Flash memory dump is a single file, 32MB in size, with no formatting or wrapping beyond what the radio itself uses internally. This holds not just software, but also the user’s memory settings and the list of DSTAR repeaters.

Applications helpfully have ASCII labels, and the first program is the EX-4409 Boot Program V1.01.00.

dell% hd raw.bin | head -n 30
00000000  11 00 00 00 04 f0 1f e5  00 01 00 60 01 00 a0 e3  |...........`....|
00000010  1e ff 2f e1 1e ff 2f e1  ff ff ff ff ff ff ff ff  |../.../.........|
00000020  45 58 2d 34 34 30 39 20  42 6f 6f 74 20 50 72 6f  |EX-4409 Boot Pro|
00000030  67 72 61 6d 00 ff ff ff  ff ff ff ff ff ff ff ff  |gram............|
00000040  56 31 2e 30 31 2e 30 30  20 20 20 20 20 20 20 00  |V1.01.00       .|
00000050  f8 40 2d e9 00 60 a0 e1  03 00 a0 e3 a6 30 00 eb  |.@-..`.......0..|
00000060  00 40 a0 e1 01 50 a0 e1  03 00 a0 e3 a2 30 00 eb  |.@...P.......0..|
00000070  00 70 a0 e3 01 00 00 ea  03 00 a0 e3 9e 30 00 eb  |.p...........0..|
00000080  04 00 50 e0 05 10 c1 e0  07 00 51 e1 f9 ff ff 3a  |..P.......Q....:|
00000090  01 00 00 8a 06 00 50 e1  f6 ff ff 3a f1 80 bd e8  |......P....:....|
000000a0  10 b5 07 49 79 44 18 31  06 4c 7c 44 16 34 04 e0  |...IyD.1.L|D.4..|
000000b0  0a 68 08 1d 89 18 88 47  01 00 a1 42 f8 d1 10 bd  |.h.....G...B....|
000000c0  20 e4 00 00 2c e4 00 00  ff ff ff ff ff ff ff ff  | ...,...........|
000000d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000100  00 00 0f e1 1f 00 c0 e3  13 00 80 e3 00 f0 21 e1  |..............!.|
00000110  18 d0 9f e5 18 c0 9f e5  ff ff ff eb 1c ff 2f e1  |............../.|
00000120  10 0f 11 ee 04 00 c0 e3  10 0f 01 ee 1e ff 2f e1  |............../.|

A little later, we find the FldmLoader,

00020000  1c f0 9f e5 1c f0 9f e5  1c f0 9f e5 1c f0 9f e5  |................|
00020010  1c f0 9f e5 00 00 00 00  18 f0 9f e5 18 f0 9f e5  |................|
00020020  ff ff ff 00 50 1d 02 c0  5c 1f 02 c0 90 ad 00 c0  |....P...\.......|
00020030  84 1f 02 c0 ac 1f 02 c0  64 ae 00 c0 20 1f 02 c0  |........d... ...|
00020040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00020080  45 58 2d 34 34 32 30 20  46 6c 64 6d 4c 6f 61 64  |EX-4420 FldmLoad|
00020090  65 72 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |er..............|
000200a0  31 2e 30 30 2e 30 30 2e  32 33 20 20 20 20 20 00  |1.00.00.23     .|
000200b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000200c0  00 00 20 60 00 00 00 61  00 00 00 c0 00 00 30 00  |.. `...a......0.|
000200d0  00 00 30 00 00 00 00 00  00 00 00 00 00 00 00 00  |..0.............|
000200e0  00 00 20 60 00 00 60 60  00 00 00 c0 00 00 30 00  |.. `..``......0.|
000200f0  00 00 30 00 ff ff ff ff  ff ff ff ff 00 00 00 00  |..0.............|
00020100  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00020200  00 00 00 00 00 00 00 00  00 00 00 70 d8 d8 70 00  |...........p..p.|
00020210  3e 30 30 30 30 30 30 30  30 30 30 00 00 00 00 00  |>0000000000.....|

And what we’re really interested in is the third image, the EX-4409 Firmware V1.10.000 beginning at file address 0x0020.0000.

00200000  1c f0 9f e5 1c f0 9f e5  1c f0 9f e5 1c f0 9f e5  |................|
00200010  1c f0 9f e5 00 00 00 00  18 f0 9f e5 18 f0 9f e5  |................|
00200020  ff ff ff 00 74 39 15 c0  ac 3b 15 c0 68 5a 09 c0  |....t9...;..hZ..|
00200030  d4 3b 15 c0 fc 3b 15 c0  3c 5b 09 c0 70 3b 15 c0  |.;...;..<[..p;..|
00200040  5a 5a 7a 6f 2e 2e 28 2d  5f 2d 20 29 20 45 58 2d  |ZZzo..(-_- ) EX-|
00200050  34 34 32 30 20 32 30 31  33 2d 30 34 2d 30 31 00  |4420 2013-04-01.|
00200060  ff ff cd b6 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00200070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00200080  45 58 2d 34 34 30 39 20  46 69 72 6d 77 61 72 65  |EX-4409 Firmware|
00200090  00 ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
002000a0  56 31 2e 31 30 2e 30 30  30 20 20 20 20 20 20 00  |V1.10.000      .|
002000b0  00 ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
002000c0  00 00 20 60 00 00 00 61  00 00 00 c0 00 00 50 00  |.. `...a......P.|
002000d0  00 00 30 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..0.............|
002000e0  00 00 20 60 00 00 60 60  00 00 00 c0 00 00 50 00  |.. `..``......P.|
002000f0  00 00 30 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..0.............|
00200100  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00200200  38 b5 04 00 0d 00 0f f0  a7 fd 01 28 01 d1 01 20  |8..........(... |
00200210  00 e0 00 20 14 22 07 49  ab 00 5b 19 db 00 c9 18  |... .".I..[.....|
00200220  83 00 18 18 80 00 09 18  20 00 10 f0 d8 f9 31 bd  |........ .....1.|

So now we know the file locations of the three applications, and from AG5OW’s wiki we know that the code will be running in an OMAP L138 chip. In contrast to the ARM Cortex chip used by the MD380, this is a more powerful core that can run both 32-bit ARM instructions and the denser 16-bit Thumb2 instruction set.

While Cortex applications usually begin with an initial stack pointer followed by a list of odd (because Thumb2) interrupt handle addresses, full sized ARM firmware usually begins with executable instructions as interrupt handlers.

So let’s use Radare2 to disassemble these entry points in order to see where the code might run inside of the device. The instructions I’m looking for all have an ending byte of e3 or e5, the appear near the beginning and the branch to an absolute address by loading a value from a constant pool into the program counter.

dell% r2 -e asm.arch=arm -e asm.bits=32 raw.bin
 -- What about taking a break? Here, have this nice 0xCC.
[0x00000000]> pd 5 @0x0
 0x00000000      11000000       andeq r0, r0, r1, lsl r0
 0x00000004      04f01fe5       ldr pc, [0x00000008]        ; [0x8:4]=0x60000100
 0x00000008      00010060       andvs r0, r0, r0, lsl 2
 0x0000000c      0100a0e3       mov r0, 1
 0x00000010      1eff2fe1       bx lr
[0x00000000]>

Sure enough, the Boot Program branches to 0x600.00100 and from our earlier disassembly, we see that a gap of FF bytes ends at file address 0x100, so this program is probably just copied into memory at 0x6000.0000!

The FldmLoad program and the Firmware program both seem to run from the 0xc000.0000 region.

[0x00000000]> pd 5 @0x00020000
 0x00020000      1cf09fe5       ldr pc, [0x00020024]        ; [0x20024:4]=0xc0021d50
 0x00020004      1cf09fe5       ldr pc, [0x00020028]        ; [0x20028:4]=0xc0021f5c
 0x00020008      1cf09fe5       ldr pc, [0x0002002c]        ; [0x2002c:4]=0xc000ad90
 0x0002000c      1cf09fe5       ldr pc, [0x00020030]        ; [0x20030:4]=0xc0021f84
 0x00020010      1cf09fe5       ldr pc, [0x00020034]        ; [0x20034:4]=0xc0021fac
[0x00000000]> pd 5 @0x00200000
 0x00200000      1cf09fe5       ldr pc, [0x00200024]        ; [0x200024:4]=0xc0153974
 0x00200004      1cf09fe5       ldr pc, [0x00200028]        ; [0x200028:4]=0xc0153bac
 0x00200008      1cf09fe5       ldr pc, [0x0020002c]        ; [0x20002c:4]=0xc0095a68
 0x0020000c      1cf09fe5       ldr pc, [0x00200030]        ; [0x200030:4]=0xc0153bd4
 0x00200010      1cf09fe5       ldr pc, [0x00200034]        ; [0x200034:4]=0xc0153bfc

At this point, you can dice up the file and load it into Radare2 at the correct address, or into a competing program such as IDA Pro, Ghidra, or Binary Ninja simply by carving out the appropriate section and loading it at 0x6000.0000 or 0xc000.0000 with a bit more space tacked on the end for use as RAM.

When loading the image, you’ll find that although the entry point begins in 32-bit mode, most functions are written in Thumb2 instructions. Use alt+g in IDA Pro or ^R in Ghidra to set the T register to 1 in order to mark a region as Thumb2 instructions.

Images

The firmware uses LibPNG to parse images contained within Flash, including all the backgrounds and icons. You can carve these out with binwalk, or use Ghidra’s handy feature of displaying images inline in the disassembly listing.

LibPNG functions can be found and labeled, particularly those that call png_benign_error() with unique error messages. With a bit of work, it shouldn’t be too difficult to identify which code loads which icon.

Strings and Localization

The radio’s interface is available in both English and Japanese, with some form of indirection that chooses the locale from a table of twenty-byte strings in each language, with the English string first. Presumably because there is plenty of space in Flash, this table is not compressed.

The table begins at 0xc000.026c with spaces in each language, followed by TX/RX (送受信), Memory (ﾒﾓﾘｰ), Audio File (ｵｰﾃﾞｨｵﾌｧｲﾙ) and dozens of others.

Table lookups are performed by calling void localize_string(char *dst, int entry) at 0xc000.0238. This function loads an entry from the table and optionally adds twenty to the address in Japanese mode.

void localize_string(char *dst,int entry) {
  int j = localize_isjapanese();
  strncpy(dst,
          localize_table + (j==1)*0x14 + entry*0x28,
          0x14);
  return;
}

So whenever the radio wants to display TX/RX or 送受信, it will run something like this, where 1 is the magic constant.

char buf[0x14];
localize_string(buf, 1);
printf("The local word is: %s\n", buf);

Working backward, if we wanted a list of all functions that display TX/RX, we would want to find all function calls to localize_string() where the second parameter equals 1. Memory would be 2, and Audio File would be 3. It gets tedious to do this by hand, so let’s automate it.

/* This is a janky little C program to dump the string localization
   table from Kenwood TH-D74 firmware image.  It should self-adjust to
   any firmware version.
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

//Need this table from the real firmware.
char* localize_table=0;;
char fw[33554432];

void localize_string(char *dst,int entry) {
  int j = 0; //Not japanese.
  strncpy(dst,
          localize_table + (j==1)*0x14 + entry*0x28,
          0x14);
  return;
}


char* findtable(){
  char *maybetable;
  const char *spaces="                   \0                   \0";
  for(int i=0; i<33554432; i++){
    maybetable=fw+i;
    if(memcmp(spaces,maybetable,40)==0){
      printf("Found table at offset %x\n", i);
      return maybetable;
    }
  }
  printf("Error, table not found.\n");
  exit(1);
}

void loadfw(char *filename){
  FILE *fwfile=fopen(filename, "rb");
  size_t readbytes=fread(fw, 33554432, 1, fwfile);
  fclose(fwfile);  
}


int main(){
  char word[20];
  loadfw("raw.bin");
  localize_table=findtable();

  printf("| dec |  hex  |         word         |\n");
  printf("| --- | ----- | -------------------- |\n");
  for(int i=0; i<377; i++){
    localize_string(word, i);
    printf("| %03d | 0x%03x | %20s | \n", i, i, word);
  }
}

This produces the following table, abbreviated here but included in its entire bilingual glory at the end of the article.

Having this table, we can now begin to name all of the functions that render strings. So when localize_string(foo,0x6b);, we know that char foo[] is being populated with “My Position” or “自局位置”.

CAT Commands

Of particular interest to me is the CAT protocol of the TH-D74, as I’ve been writing a programming tool for Kenwood radios. There is a list by LA3QMA describing all of the standard commands for the radio, but there are extra commands in the 0G service mode which might be useful.

At memory address 0xc002.a828, there is a table of all commands in the standard mode, as first a 32-bit handler address and then a 4-byte character array of the name. A second table at 0xc006.4edc lists the service mode commands in the same format.

From LA3QMA’s docs, we know that the 0G command is called with the uppercase word KENWOOD as its only parameter to enter service mode. Now that we have the table, we can hunt its handler address and decompile the implementation. Sure enough, there’s a call to strncmp() to verify the parameter!

Service mode commands include 0E, 0G, 0M, 0R, 0S, 0W, 0Y, 1A, 1D, 1E, 1F, 1G, 1I, 1N, 1U, 1V, 1W, 2V, 9E, and 9R. I had hoped that there was a command for reading and writing memory names, as exists in other Kenwood radios, but I wasn’t able to find one.

What’s next?

As things stand, the TH-D74 firmware can be read and reverse engineered. With this documentation, you should be able to load the image into your favorite toolchain, name functions according to their localized strings, and begin to parse the implementations of any mystery CAT commands.

We’ll also need to understand more of the data structures in memory, such as the channel information and the repeater information. Wouldn’t it be nifty to store a database of all the world’s analog repeaters on the SD Card, to fetch the nearest ones by GPS position, as we can do for DSTAR repeaters in the stock firmware?

If our goal is to eventually patch this firmware with our own changes, we’ll need more than just a lot of symbol names for this image. We’ll need a way to dump memory from a running radio, without desoldering its Flash chip, and also to write changes back to RAM. JTAG debugging isn’t strictly necessary, but it would be nice.

The fun is just beginning.

Appendix: Complete String List