ghidra-create-esp8266-rom-markers.py

import struct


rom = dict()
rom["Cache_Read_Disable"] = 0x400047f0 
rom["Cache_Read_Enable"] = 0x40004678 
rom["FilePacketSendReqMsgProc"] = 0x400035a0 
rom["FlashDwnLdParamCfgMsgProc"] = 0x4000368c 
rom["FlashDwnLdStartMsgProc"] = 0x40003538 
rom["FlashDwnLdStopReqMsgProc"] = 0x40003658 
rom["GetUartDevice"] = 0x40003f4c 
rom["MD5Final"] = 0x40009900 
rom["MD5Init"] = 0x40009818 
rom["MD5Update"] = 0x40009834 
rom["MemDwnLdStartMsgProc"] = 0x400036c4 
rom["MemDwnLdStopReqMsgProc"] = 0x4000377c 
rom["MemPacketSendReqMsgProc"] = 0x400036f0 
rom["RcvMsg"] = 0x40003eac 
rom["SHA1Final"] = 0x4000b648 
rom["SHA1Init"] = 0x4000b584 
rom["SHA1Transform"] = 0x4000a364 
rom["SHA1Update"] = 0x4000b5a8 
rom["SPI_read_status"] = 0x400043c8 
rom["SPI_write_status"] = 0x40004400 
rom["SPI_write_enable"] = 0x4000443c 
rom["Wait_SPI_Idle"] = 0x4000448c 
rom["SPIEraseArea"] = 0x40004b44 
rom["SPIEraseBlock"] = 0x400049b4 
rom["SPIEraseChip"] = 0x40004984 
rom["SPIEraseSector"] = 0x40004a00 
rom["SPILock"] = 0x400048a8 
rom["SPIParamCfg"] = 0x40004c2c 
rom["SPIRead"] = 0x40004b1c 
rom["SPIReadModeCnfig"] = 0x400048ec 
rom["SPIUnlock"] = 0x40004878 
rom["SPIWrite"] = 0x40004a4c 
rom["SelectSpiFunction"] = 0x40003f58 
rom["SendMsg"] = 0x40003cf4 
rom["UartConnCheck"] = 0x40003230 
rom["UartConnectProc"] = 0x400037a0 
rom["UartDwnLdProc"] = 0x40003368 
rom["UartGetCmdLn"] = 0x40003ef4 
rom["UartRegReadProc"] = 0x4000381c 
rom["UartRegWriteProc"] = 0x400037ac 
rom["UartRxString"] = 0x40003c30 
rom["Uart_Init"] = 0x40003a14 
rom["_DebugExceptionVector"] = 0x40000010 
rom["_DoubleExceptionVector"] = 0x40000070 
rom["_KernelExceptionVector"] = 0x40000030 
rom["_NMIExceptionVector"] = 0x40000020 
rom["_ResetHandler"] = 0x400000a4 
rom["_ResetVector"] = 0x40000080 
rom["_UserExceptionVector"] = 0x40000050 
rom["__adddf3"] = 0x4000c538 
rom["__addsf3"] = 0x4000c180 
rom["__divdf3"] = 0x4000cb94 
rom["__divdi3"] = 0x4000ce60 
rom["__divsi3"] = 0x4000dc88 
rom["__extendsfdf2"] = 0x4000cdfc 
rom["__fixdfsi"] = 0x4000ccb8 
rom["__fixunsdfsi"] = 0x4000cd00 
rom["__fixunssfsi"] = 0x4000c4c4 
rom["__floatsidf"] = 0x4000e2f0 
rom["__floatsisf"] = 0x4000e2ac 
rom["__floatunsidf"] = 0x4000e2e8 
rom["__floatunsisf"] = 0x4000e2a4 
rom["__muldf3"] = 0x4000c8f0 
rom["__muldi3"] = 0x40000650 
rom["__mulsf3"] = 0x4000c3dc 
rom["__subdf3"] = 0x4000c688 
rom["__subsf3"] = 0x4000c268 
rom["__truncdfsf2"] = 0x4000cd5c 
rom["__udivdi3"] = 0x4000d310 
rom["__udivsi3"] = 0x4000e21c 
rom["__umoddi3"] = 0x4000d770 
rom["__umodsi3"] = 0x4000e268 
rom["__umulsidi3"] = 0x4000dcf0 
rom["_rom_store"] = 0x4000e388 
rom["_rom_store_table"] = 0x4000e328 
rom["_start"] = 0x4000042c 
rom["_xtos_alloca_handler"] = 0x4000dbe0 
rom["_xtos_c_wrapper_handler"] = 0x40000598 
rom["_xtos_cause3_handler"] = 0x40000590 
rom["_xtos_ints_off"] = 0x4000bda4 
rom["_xtos_ints_on"] = 0x4000bd84 
rom["_xtos_l1int_handler"] = 0x4000048c 
rom["_xtos_p_none"] = 0x4000dbf8 
rom["_xtos_restore_intlevel"] = 0x4000056c 
rom["_xtos_return_from_exc"] = 0x4000dc54 
rom["_xtos_set_exception_handler"] = 0x40000454 
rom["_xtos_set_interrupt_handler"] = 0x4000bd70 
rom["_xtos_set_interrupt_handler_arg"] = 0x4000bd28 
rom["_xtos_set_intlevel"] = 0x4000dbfc 
rom["_xtos_set_min_intlevel"] = 0x4000dc18 
rom["_xtos_set_vpri"] = 0x40000574 
rom["_xtos_syscall_handler"] = 0x4000dbe4 
rom["_xtos_unhandled_exception"] = 0x4000dc44 
rom["_xtos_unhandled_interrupt"] = 0x4000dc3c 
rom["aes_decrypt"] = 0x400092d4 
rom["aes_decrypt_deinit"] = 0x400092e4 
rom["aes_decrypt_init"] = 0x40008ea4 
rom["aes_unwrap"] = 0x40009410 
rom["base64_decode"] = 0x40009648 
rom["base64_encode"] = 0x400094fc 
rom["bzero"] = 0x4000de84 
rom["cmd_parse"] = 0x40000814 
rom["conv_str_decimal"] = 0x40000b24 
rom["conv_str_hex"] = 0x40000cb8 
rom["convert_para_str"] = 0x40000a60 
rom["dtm_get_intr_mask"] = 0x400026d0 
rom["dtm_params_init"] = 0x4000269c 
rom["dtm_set_intr_mask"] = 0x400026c8 
rom["dtm_set_params"] = 0x400026dc 
rom["eprintf"] = 0x40001d14 
rom["eprintf_init_buf"] = 0x40001cb8 
rom["eprintf_to_host"] = 0x40001d48 
rom["est_get_printf_buf_remain_len"] = 0x40002494 
rom["est_reset_printf_buf_len"] = 0x4000249c 
rom["ets_bzero"] = 0x40002ae8 
rom["ets_char2xdigit"] = 0x40002b74 
rom["ets_delay_us"] = 0x40002ecc 
rom["ets_enter_sleep"] = 0x400027b8 
rom["ets_external_printf"] = 0x40002578 
rom["ets_get_cpu_frequency"] = 0x40002f0c 
rom["ets_getc"] = 0x40002bcc 
rom["ets_install_external_printf"] = 0x40002450 
rom["ets_install_putc1"] = 0x4000242c 
rom["ets_install_putc2"] = 0x4000248c 
rom["ets_install_uart_printf"] = 0x40002438 
rom["ets_intr_lock"] = 0x40000f74 
rom["ets_intr_unlock"] = 0x40000f80 
rom["ets_isr_attach"] = 0x40000f88 
rom["ets_isr_mask"] = 0x40000f98 
rom["ets_isr_unmask"] = 0x40000fa8 
rom["ets_memcmp"] = 0x400018d4 
rom["ets_memcpy"] = 0x400018b4 
rom["ets_memmove"] = 0x400018c4 
rom["ets_memset"] = 0x400018a4 
rom["ets_post"] = 0x40000e24 
rom["ets_printf"] = 0x400024cc 
rom["ets_putc"] = 0x40002be8 
rom["ets_rtc_int_register"] = 0x40002a40 
rom["ets_run"] = 0x40000e04 
rom["ets_set_idle_cb"] = 0x40000dc0 
rom["ets_set_user_start"] = 0x40000fbc 
rom["ets_str2macaddr"] = 0x40002af8 
rom["ets_strcmp"] = 0x40002aa8 
rom["ets_strcpy"] = 0x40002a88 
rom["ets_strlen"] = 0x40002ac8 
rom["ets_strncmp"] = 0x40002ab8 
rom["ets_strncpy"] = 0x40002a98 
rom["ets_strstr"] = 0x40002ad8 
rom["ets_task"] = 0x40000dd0 
rom["ets_timer_arm"] = 0x40002cc4 
rom["ets_timer_disarm"] = 0x40002d40 
rom["ets_timer_done"] = 0x40002d80 
rom["ets_timer_handler_isr"] = 0x40002da8 
rom["ets_timer_init"] = 0x40002e68 
rom["ets_timer_setfn"] = 0x40002c48 
rom["ets_uart_printf"] = 0x40002544 
rom["ets_update_cpu_frequency"] = 0x40002f04 
rom["ets_vprintf"] = 0x40001f00 
rom["ets_wdt_disable"] = 0x400030f0 
rom["ets_wdt_enable"] = 0x40002fa0 
rom["ets_wdt_get_mode"] = 0x40002f34 
rom["ets_wdt_init"] = 0x40003170 
rom["ets_wdt_restore"] = 0x40003158 
rom["ets_write_char"] = 0x40001da0 
rom["get_first_seg"] = 0x4000091c 
rom["gpio_init"] = 0x40004c50 
rom["gpio_input_get"] = 0x40004cf0 
rom["gpio_intr_ack"] = 0x40004dcc 
rom["gpio_intr_handler_register"] = 0x40004e28 
rom["gpio_intr_pending"] = 0x40004d88 
rom["gpio_intr_test"] = 0x40004efc 
rom["gpio_output_set"] = 0x40004cd0 
rom["gpio_pin_intr_state_set"] = 0x40004d90 
rom["gpio_pin_wakeup_disable"] = 0x40004ed4 
rom["gpio_pin_wakeup_enable"] = 0x40004e90 
rom["gpio_register_get"] = 0x40004d5c 
rom["gpio_register_set"] = 0x40004d04 
rom["hmac_md5"] = 0x4000a2cc 
rom["hmac_md5_vector"] = 0x4000a160 
rom["hmac_sha1"] = 0x4000ba28 
rom["hmac_sha1_vector"] = 0x4000b8b4 
rom["lldesc_build_chain"] = 0x40004f40 
rom["lldesc_num2link"] = 0x40005050 
rom["lldesc_set_owner"] = 0x4000507c 
rom["main"] = 0x40000fec 
rom["md5_vector"] = 0x400097ac 
rom["mem_calloc"] = 0x40001c2c 
rom["mem_free"] = 0x400019e0 
rom["mem_init"] = 0x40001998 
rom["mem_malloc"] = 0x40001b40 
rom["mem_realloc"] = 0x40001c6c 
rom["mem_trim"] = 0x40001a14 
rom["mem_zalloc"] = 0x40001c58 
rom["memcmp"] = 0x4000dea8 
rom["memcpy"] = 0x4000df48 
rom["memmove"] = 0x4000e04c 
rom["memset"] = 0x4000e190 
rom["multofup"] = 0x400031c0 
rom["pbkdf2_sha1"] = 0x4000b840 
rom["phy_get_romfuncs"] = 0x40006b08 
rom["rand"] = 0x40000600 
rom["rc4_skip"] = 0x4000dd68 
rom["recv_packet"] = 0x40003d08 
rom["remove_head_space"] = 0x40000a04 
rom["rijndaelKeySetupDec"] = 0x40008dd0 
rom["rijndaelKeySetupEnc"] = 0x40009300 
rom["rom_abs_temp"] = 0x400060c0 
rom["rom_ana_inf_gating_en"] = 0x40006b10 
rom["rom_cal_tos_v50"] = 0x40007a28 
rom["rom_chip_50_set_channel"] = 0x40006f84 
rom["rom_chip_v5_disable_cca"] = 0x400060d0 
rom["rom_chip_v5_enable_cca"] = 0x400060ec 
rom["rom_chip_v5_rx_init"] = 0x4000711c 
rom["rom_chip_v5_sense_backoff"] = 0x4000610c 
rom["rom_chip_v5_tx_init"] = 0x4000718c 
rom["rom_dc_iq_est"] = 0x4000615c 
rom["rom_en_pwdet"] = 0x400061b8 
rom["rom_get_bb_atten"] = 0x40006238 
rom["rom_get_corr_power"] = 0x40006260 
rom["rom_get_fm_sar_dout"] = 0x400062dc 
rom["rom_get_noisefloor"] = 0x40006394 
rom["rom_get_power_db"] = 0x400063b0 
rom["rom_i2c_readReg"] = 0x40007268 
rom["rom_i2c_readReg_Mask"] = 0x4000729c 
rom["rom_i2c_writeReg"] = 0x400072d8 
rom["rom_i2c_writeReg_Mask"] = 0x4000730c 
rom["rom_iq_est_disable"] = 0x40006400 
rom["rom_iq_est_enable"] = 0x40006430 
rom["rom_linear_to_db"] = 0x40006484 
rom["rom_mhz2ieee"] = 0x400065a4 
rom["rom_pbus_dco___SA2"] = 0x40007bf0 
rom["rom_pbus_debugmode"] = 0x4000737c 
rom["rom_pbus_enter_debugmode"] = 0x40007410 
rom["rom_pbus_exit_debugmode"] = 0x40007448 
rom["rom_pbus_force_test"] = 0x4000747c 
rom["rom_pbus_rd"] = 0x400074d8 
rom["rom_pbus_set_rxgain"] = 0x4000754c 
rom["rom_pbus_set_txgain"] = 0x40007610 
rom["rom_pbus_workmode"] = 0x40007648 
rom["rom_pbus_xpd_rx_off"] = 0x40007688 
rom["rom_pbus_xpd_rx_on"] = 0x400076cc 
rom["rom_pbus_xpd_tx_off"] = 0x400076fc 
rom["rom_pbus_xpd_tx_on"] = 0x40007740 
rom["rom_pbus_xpd_tx_on__low_gain"] = 0x400077a0 
rom["rom_phy_reset_req"] = 0x40007804 
rom["rom_restart_cal"] = 0x4000781c 
rom["rom_rfcal_pwrctrl"] = 0x40007eb4 
rom["rom_rfcal_rxiq"] = 0x4000804c 
rom["rom_rfcal_rxiq_set_reg"] = 0x40008264 
rom["rom_rfcal_txcap"] = 0x40008388 
rom["rom_rfcal_txiq"] = 0x40008610 
rom["rom_rfcal_txiq_cover"] = 0x400088b8 
rom["rom_rfcal_txiq_set_reg"] = 0x40008a70 
rom["rom_rfpll_reset"] = 0x40007868 
rom["rom_rfpll_set_freq"] = 0x40007968 
rom["rom_rxiq_cover_mg_mp"] = 0x40008b6c 
rom["rom_rxiq_get_mis"] = 0x40006628 
rom["rom_sar_init"] = 0x40006738 
rom["rom_set_ana_inf_tx_scale"] = 0x4000678c 
rom["rom_set_channel_freq"] = 0x40006c50 
rom["rom_set_loopback_gain"] = 0x400067c8 
rom["rom_set_noise_floor"] = 0x40006830 
rom["rom_set_rxclk_en"] = 0x40006550 
rom["rom_set_txbb_atten"] = 0x40008c6c 
rom["rom_set_txclk_en"] = 0x4000650c 
rom["rom_set_txiq_cal"] = 0x40008d34 
rom["rom_start_noisefloor"] = 0x40006874 
rom["rom_start_tx_tone"] = 0x400068b4 
rom["rom_stop_tx_tone"] = 0x4000698c 
rom["rom_tx_mac_disable"] = 0x40006a98 
rom["rom_tx_mac_enable"] = 0x40006ad4 
rom["rom_txtone_linear_pwr"] = 0x40006a1c 
rom["rom_write_rfpll_sdm"] = 0x400078dc 
rom["roundup2"] = 0x400031b4 
rom["rtc_enter_sleep"] = 0x40002870 
rom["rtc_get_reset_reason"] = 0x400025e0 
rom["rtc_intr_handler"] = 0x400029ec 
rom["rtc_set_sleep_mode"] = 0x40002668 
rom["save_rxbcn_mactime"] = 0x400027a4 
rom["save_tsf_us"] = 0x400027ac 
rom["send_packet"] = 0x40003c80 
rom["sha1_prf"] = 0x4000ba48 
rom["sha1_vector"] = 0x4000a2ec 
rom["sip_alloc_to_host_evt"] = 0x40005180 
rom["sip_get_ptr"] = 0x400058a8 
rom["sip_get_state"] = 0x40005668 
rom["sip_init_attach"] = 0x4000567c 
rom["sip_install_rx_ctrl_cb"] = 0x4000544c 
rom["sip_install_rx_data_cb"] = 0x4000545c 
rom["sip_post"] = 0x400050fc 
rom["sip_post_init"] = 0x400056c4 
rom["sip_reclaim_from_host_cmd"] = 0x4000534c 
rom["sip_reclaim_tx_data_pkt"] = 0x400052c0 
rom["sip_send"] = 0x40005808 
rom["sip_to_host_chain_append"] = 0x40005864 
rom["sip_to_host_evt_send_done"] = 0x40005234 
rom["slc_add_credits"] = 0x400060ac 
rom["slc_enable"] = 0x40005d90 
rom["slc_from_host_chain_fetch"] = 0x40005f24 
rom["slc_from_host_chain_recycle"] = 0x40005e94 
rom["slc_init_attach"] = 0x40005c50 
rom["slc_init_credit"] = 0x4000608c 
rom["slc_pause_from_host"] = 0x40006014 
rom["slc_reattach"] = 0x40005c1c 
rom["slc_resume_from_host"] = 0x4000603c 
rom["slc_select_tohost_gpio"] = 0x40005dc0 
rom["slc_select_tohost_gpio_mode"] = 0x40005db8 
rom["slc_send_to_host_chain"] = 0x40005de4 
rom["slc_set_host_io_max_window"] = 0x40006068 
rom["slc_to_host_chain_recycle"] = 0x40005f10 
rom["software_reset"] = 0x4000264c 
rom["spi_flash_attach"] = 0x40004644 
rom["srand"] = 0x400005f0 
rom["strcmp"] = 0x4000bdc8 
rom["strcpy"] = 0x4000bec8 
rom["strlen"] = 0x4000bf4c 
rom["strncmp"] = 0x4000bfa8 
rom["strncpy"] = 0x4000c0a0 
rom["strstr"] = 0x4000e1e0 
rom["timer_insert"] = 0x40002c64 
rom["uartAttach"] = 0x4000383c 
rom["uart_baudrate_detect"] = 0x40003924 
rom["uart_buff_switch"] = 0x400038a4 
rom["uart_div_modify"] = 0x400039d8 
rom["uart_rx_intr_handler"] = 0x40003bbc 
rom["uart_rx_one_char"] = 0x40003b8c 
rom["uart_rx_one_char_block"] = 0x40003b64 
rom["uart_rx_readbuff"] = 0x40003ec8 
rom["uart_tx_one_char"] = 0x40003b30 
rom["wepkey_128"] = 0x4000bc40 
rom["wepkey_64"] = 0x4000bb3c 
rom["xthal_bcopy"] = 0x40000688 
rom["xthal_copy123"] = 0x4000074c 
rom["xthal_get_ccompare"] = 0x4000dd4c 
rom["xthal_get_ccount"] = 0x4000dd38 
rom["xthal_get_interrupt"] = 0x4000dd58 
rom["xthal_get_intread"] = 0x4000dd58 
rom["xthal_memcpy"] = 0x400006c4 
rom["xthal_set_ccompare"] = 0x4000dd40 
rom["xthal_set_intclear"] = 0x4000dd60 
rom["xthal_spill_registers_into_stack_nw"] = 0x4000e320 
rom["xthal_window_spill"] = 0x4000e324 
rom["xthal_window_spill_nw"] = 0x4000e320 
rom["Te0"] = 0x3fffccf0 
rom["Td0"] = 0x3fffd100 
rom["Td4s"] = 0x3fffd500
rom["rcons"] = 0x3fffd0f0
rom["UartDev"] = 0x3fffde10 
rom["flashchip"] = 0x3fffc714

createMemoryBlock​("rom", toAddr(0x40000000), "\0"*0x10000, False)

# map function where they are
for fn in rom:
    createLabel(toAddr(rom[fn]), fn, True)

# map pointers to this functions, can corrupt functions maybe
for i in range(0x40100000, 0x40100000+0x8000, 4):
    try:
        bytes_at_addr = getBytes(toAddr(i), 4)
    except:
        pass
    u32 = struct.unpack("<I", bytes_at_addr)[0]
    for fn in rom:
        if rom[fn] == u32:
            ptr_name = fn + "_ptr"
            print(ptr_name + " at " + hex(i))
            createLabel(toAddr(i), ptr_name, True)
            break