Firmware map¶

Where the application image's code goes, and how much of it has been looked at. The Architecture page describes how the pieces talk. This page accounts for the whole image, one function at a time, and tracks which parts have been read closely.

All figures on this page come from tools/survey.py, run on the owner's own stock NAV SMEG5.43.A.R2 image and the symbol map SPYSTORE copies off the unit. Figures for the AUDIO_BT build will differ.

Scale¶

Reading every instruction by hand is not feasible, so the working unit is the function. Every function gets a row in the survey. Each subsystem that matters to a patch then gets a close reading, recorded in the coverage ledger below.

Where the code goes¶

About 35% of the instructions belong to families whose names identify a third-party library. That labelling is inferred from names (sqlite3_*, png_*, FT_*, Q*); no library version has been checked against its upstream source.

The layer that decides behaviour is small. C_MGR_SRC is 71 functions and ≈ 7 600 instructions out of eight million. Every AUX patch edits C_MGR_SRC, C_HMI_AUDIO_APP_BASE or C_HMI_MEDIA_APP_BASE.

Producing the inventory¶

tools/survey.py makes one pass over the image. For every code symbol it records:

• its family and size;
• its direct bl callers;
• its materialised references: lis+addi/ori pairs that build its address. This is how most of this firmware's calls are made (through mtctr/bctrl), and it is exactly what tools/callers.py cannot see. C_MGR_SRC::ExecuteAllocationFirstRound has 0 bl callers and 1 materialised reference, from ExecuteAllocation;
• pointers to it held in data (vtables, callback tables). C_HMI_MEDIA_APP_BASE::InitApp and C_MGR_SRC::StartUp are reached this way only;
• the strings whose address it builds, usually its trace text;
• the vtable slots it occupies. A vtable is the _ZTV symbol: two zero words (offset to top, and typeinfo, since there is no RTTI), then one function pointer per slot.

Besides the per-function table it writes three more:

• vtables.tsv: every slot of every vtable (class, slot offset, function). NAV 5.43.A.R2: 36 758 slots in 3 103 vtables.
• virtual_calls.tsv: call sites of the form lwz vptr,0(obj) → lwz rZ,off(vptr) → mtctr rZ → bctrl, with the slot offset each calls: 10 495 on NAV. The object's class is not inferred, so a site is not attributed to one function. StartUp and InitApp still show no direct callers for that reason.
• globals.tsv: each data symbol, including BSS past the end of the image, with the functions that read and write it through lis rX,hi + a load or store at lo(rX): 3 199 on NAV. C_MGR_SRC::m_Instance has 3 readers and 3 writers.

uv run tools/survey.py ~/Downloads/SMEG_PLUS_UPG/NAV/AppBin/f_BigQuick.bin \
    abs_symbols_base.txt.gz --out ~/smeg-survey

It takes f_BigQuick.bin or an inflated image, and abs_symbols_base.txt.gz from a SPYSTORE dump, gzipped or not. The run takes a few seconds. The output is derived from the vendor's symbol map, so it stays on your machine. Do not commit it; see AGENTS.md.

Coverage ledger¶

How closely each part has been examined, using the evidence tiers from Verification. Read means disassembled or decompiled and followed. Executed means run under the emulator or observed on the car.

When a subsystem is read closely, add a row here with its depth and the page it is written on. Keep the tier honest: a function that is named, or that has a caller, has not been read.