thefloweringash/chicken-aten-ikvm — pull request #1 by erik-smit (2014-06-09 18:09:17+00:00)
Title: Update lens.rb

By means of IDA-ing the ikvmserver I was able to fill in some of the blanks.

I'm unsure whether or not to add the respective disassembly output for these findings.

Pro:
* Improves audit-ability
* Authoritive source instead of 'because erik-smit said so'

Con:
* Aten/Supermicro might frown upon disassemblies being posted of their software
* Could clutter/decrease readability of documentation

Examples:

Server-init:
```
EXPORT RFBProtocol::ProcServerInit(void)
RFBProtocol::ProcServerInit(void)	; CODE XREF: RFBProtocol::ProcServerInit(void)+8j
; DATA XREF: .got:_ZN11RFBProtocol14ProcServerInitEv_ptro

var_68	= -0x68

STMFD	SP!, {R4-R6,LR}
SUB	SP, SP,	#0x6C
MOV	R5, R0
BL	GetCurrentThread(void)
STR	R0, [SP,#0x7C+var_68]
LDR	R0, [R5,#8]
BL	NtwStream::StreamWriteStart(void)
MOV	R1, #0x1E0
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite16(ushort)
MOV	R1, #0x280
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite16(ushort)
MOV	R1, #0x20
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
MOV	R1, #0x18
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
MOV	R1, #0
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
MOV	R1, #1
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
MOV	R1, #0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite16(ushort)
MOV	R1, #0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite16(ushort)
MOV	R1, #0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite16(ushort)
MOV	R1, #0x10
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
LDR	R4, =aAtenIkvmServer ; "ATEN iKVM Server"
MOV	R1, #8
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
MOV	R1, #0
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
MOV	R6, R4
MOV	R1, #3
LDR	R0, [R5,#8]
BL	NtwStream::StreamWriteSkip(uint)
LDMIA	R6!, {R0-R3}
MOV	R12, SP
STMIA	R12!, {R0-R3}
LDR	LR, [R4,#(aAtenIkvmServer+0x10 - 0x17C94)]
MOV	R0, SP	; s
STRB	LR, [R12]
BL	strlen
MOV	R4, R0
MOV	R1, R0
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite32(uint)
MOV	R2, R4
MOV	R1, SP
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite(uchar *,uint)
MOV	R1, #4
LDR	R0, [R5,#8]
BL	NtwStream::StreamWriteSkip(uint)
LDR	R1, [SP,#0x7C+var_68]
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite32(uint)
LDR	R3, [R5,#0x10]
MOV	R6, SP
LDR	R0, [R3,#0x4C]
BL	j_CheckIKVMVideoEnable
AND	R1, R0,	#0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
LDR	R3, [R5,#0x10]
LDR	R0, [R3,#0x4C]
BL	j_CheckIKVMKMEnable
AND	R1, R0,	#0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
LDR	R3, [R5,#0x10]
LDR	R0, [R3,#0x4C]
BL	_j_CheckIKVMKickEnable
AND	R1, R0,	#0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
LDR	R3, [R5,#0x10]
LDR	R0, [R3,#0x4C]
BL	j_CheckVUSBEnable
AND	R1, R0,	#0xFF
LDR	R0, [R5,#8]
BL	NtwStream::StreamWrite8(uchar)
LDR	R0, [R5,#8]
BL	NtwStream::StreamWriteFlush(void)
MOV	R0, #1
ADD	SP, SP,	#0x6C
LDMFD	SP!, {R4-R6,PC}
; End of function RFBProtocol::ProcServerInit(void)
```

Keep-alive (0x22):
```
.text:00010FF8 EXPORT RFBProtocol::KeepAliveEvent(void)
.text:00010FF8 RFBProtocol::KeepAliveEvent(void) ; CODE XREF: RFBProtocol::KeepAliveEvent(void)+8j
.text:00010FF8 ; DATA XREF: .got:_ZN11RFBProtocol14KeepAliveEventEv_ptro
.text:00010FF8 STMFD SP!, {R4,R5,LR}
.text:00010FFC MOV R5, R0
.text:00011000 LDR R0, [R0,#8]
.text:00011004 BL NtwStream::StreamRead8(void)
.text:00011008 MOV R4, R0
.text:0001100C LDR R0, [R5,#8]
.text:00011010 BL NtwStream::StreamWriteStart(void)
.text:00011014 AND R4, R4, #0xFF
.text:00011018 MOV R1, __#0x16__
.text:0001101C LDR R0, [R5,#8]
.text:00011020 BL NtwStream::StreamWrite8(uchar)
.text:00011024 MOV R1, R4
.text:00011028 LDR R0, [R5,#8]
.text:0001102C BL NtwStream::StreamWrite8(uchar)
.text:00011030 LDR R0, [R5,#8]
.text:00011034 BL NtwStream::StreamWriteFlush(void)
.text:00011038 MOV R0, #1
.text:0001103C LDMFD SP!, {R4,R5,PC}
.text:0001103C ; End of function RFBProtocol::KeepAliveEvent(void)
```

mouse-get-info (0x37):

```
.text:00011A90 RFBProtocol::MouseGetInfo(void) ; CODE XREF: RFBProtocol::MouseGetInfo(void)+8j
.text:00011A90 ; DATA XREF: .got:_ZN11RFBProtocol12MouseGetInfoEv_ptro
.text:00011A90
.text:00011A90 var_1C = -0x1C
.text:00011A90 var_18 = -0x18
.text:00011A90 var_14 = -0x14
.text:00011A90 var_C = -0xC
.text:00011A90
.text:00011A90 STMFD SP!, {R4,R5,LR}
.text:00011A94 SUB SP, SP, #0x10
.text:00011A98 MOV R4, R0
.text:00011A9C BL j_GetDBPowerStatus
.text:00011AA0 MOV R5, R0
.text:00011AA4 AND R5, R5, #0xFF
.text:00011AA8 MOV R1, R5
.text:00011AAC LDR R0, =aPowerStatusD ; "Power Status == %d\n"
.text:00011AB0 BL printf
.text:00011AB4 LDR R2, [R4,#4]
.text:00011AB8 ADD R0, SP, #0x1C+var_14
.text:00011ABC LDR R3, [R2]
.text:00011AC0 MOV R1, R2
.text:00011AC4 MOV LR, PC
.text:00011AC8 LDR PC, [R3,#0x10]
.text:00011ACC ADD R2, SP, #0x1C+var_C
.text:00011AD0 LDMDB R2, {R1,R2}
.text:00011AD4 LDR R0, [R4,#8]
.text:00011AD8 STMEA SP, {R1,R2}
.text:00011ADC BL NtwStream::StreamWriteStart(void)
.text:00011AE0 MOV R1, #0x37
.text:00011AE4 LDR R0, [R4,#8]
.text:00011AE8 BL NtwStream::StreamWrite8(uchar)
.text:00011AEC LDRB R1, [SP,#0x1C+var_18]
.text:00011AF0 LDR R0, [R4,#8]
.text:00011AF4 BL NtwStream::StreamWrite8(uchar)
.text:00011AF8 LDRB R1, [SP,#0x1C+var_1C]
.text:00011AFC LDR R0, [R4,#8]
.text:00011B00 BL NtwStream::StreamWrite8(uchar)
.text:00011B04 MOV R1, R5
.text:00011B08 LDR R0, [R4,#8]
.text:00011B0C BL NtwStream::StreamWrite8(uchar)
.text:00011B10 LDR R0, [R4,#8]
.text:00011B14 BL NtwStream::StreamWriteFlush(void)
.text:00011B18 ADD SP, SP, #0x10
.text:00011B1C LDMFD SP!, {R4,R5,PC}
.text:00011B1C ; End of function RFBProtocol::MouseGetInfo(void)
```

get-viewer-lang (0x3c):

```
.text:00010F3C EXPORT RFBProtocol::GetViewerLang(void)
.text:00010F3C RFBProtocol::GetViewerLang(void) ; CODE XREF: RFBProtocol::GetViewerLang(void)+8j
.text:00010F3C ; DATA XREF: .got:_ZN11RFBProtocol13GetViewerLangEv_ptro
.text:00010F3C STMFD SP!, {R4,LR}
.text:00010F40 MOV R4, R0
.text:00010F44 LDR R0, [R0,#8]
.text:00010F48 BL NtwStream::StreamWriteStart(void)
.text:00010F4C MOV R1, #0x3C
.text:00010F50 LDR R0, [R4,#8]
.text:00010F54 BL NtwStream::StreamWrite8(uchar)
.text:00010F58 LDR R2, [R4,#0x10]
.text:00010F5C LDR R0, [R4,#8]
.text:00010F60 LDR R3, [R2,#0x4C]
.text:00010F64 LDR R1, [R3,#0x15C]
.text:00010F68 BL NtwStream::StreamWrite32(uint)
.text:00010F6C LDR R2, [R4,#0x10]
.text:00010F70 LDR R0, [R4,#8]
.text:00010F74 LDR R3, [R2,#0x4C]
.text:00010F78 LDR R1, [R3,#0x160]
.text:00010F7C BL NtwStream::StreamWrite32(uint)
.text:00010F80 LDR R0, [R4,#8]
.text:00010F84 LDMFD SP!, {R4,LR}
.text:00010F88 B NtwStream::StreamWriteFlush(void)
.text:00010F88 ; End of function RFBProtocol::GetViewerLang(void)
```

Thoughts?