- Python 100%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
22921e04c2
A Python processor module for the Toshiba MeP core (PS Vita F00D security processor, little-endian). TeamMolecule toshiba-mep-idp is C++ for IDA 7.7 only; this is a ground-up Python rewrite that loads on IDA 9.x with no compilation, like IDA shipped procs/msp430.py. ISA/semantics from xyzz ghidra-mep (mep.sinc). - Processor name "mepf00d"; reads instruction halfwords little-endian regardless of DB endianness; F00D conventions (jmp $1/$11 = return, swi = Vita syscall) - Core MeP ISA: moves, arith/logic, 3-operand forms, shifts, loads/stores (reg/sp/tp/disp16/abs24), ldc/stc + ldcb/stcb, mul/div, slt3/sltu3, ext*, all branches/calls/jumps, ei/di/reti/sleep/syncm/swi - Validated on a Vita F00D secure_kernel: 100% clean decode (2336 insns) and confirmed to load + disassemble in headless IDA 9.4 (idat.exe -A -pmepf00d -B) - Companion decompiler: github.com/zecoxao/f00ddec Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
| .gitignore | ||
| LICENSE | ||
| mep.py | ||
| README.md | ||
| test_decode.py | ||
mep-ida — Toshiba MeP (F00D) processor module for IDA 9.x
A Python processor module for the Toshiba MeP core, targeting the PlayStation Vita's F00D security processor (a little-endian MeP).
TeamMolecule's toshiba-mep-idp
is a C++ module that only builds for IDA 7.7. This is a ground-up rewrite in
Python, so it loads on IDA 9.x with no compilation (like IDA's shipped
procs/msp430.py / spu.py). The instruction set and semantics follow xyzz's
Ghidra SLEIGH (ghidra-mep).
Install
Copy mep.py into your IDA user procs directory (no admin needed):
%APPDATA%\Hex-Rays\IDA Pro\procs\mep.py
(or the IDA install's own procs/ directory).
Use
-
File → Open → your F00D dump → choose the Binary file loader.
-
Processor type:
mepf00d— Toshiba MeP (F00D, little-endian). -
Set the load/base address, then jump to the entry (press C to force code):
dump base entry secure_kernel.bin0x8000000x800100second_loader.bin0x400000x40200(Or load at 0 then Edit → Segments → Rebase program to the base — the reset
jmpthen points at the entry.)
The module reads instruction halfwords little-endian regardless of the database
endianness, and applies the F00D conventions: jmp $1/jmp $11 are returns, and
swi is the Vita syscall.
Coverage
Core MeP ISA (main map + all 16/32-bit forms): moves, arithmetic/logic, 3-operand
forms, shifts, loads/stores (register / sp- / tp-relative / disp16 / abs24),
control-register (ldc/stc) and control-bus (ldcb/stcb) access,
multiply/divide, slt3/sltu3, sign/zero extends, all branches/calls/jumps, and
system instructions (ei/di/reti/sleep/syncm/swi). Coprocessor / VLIW
(IVC2 etc.) is not included — F00D uses the core ISA.
Validated against a PS Vita syscon-era F00D secure_kernel dump: 100% clean
recursive-descent decode (2336 instructions), and confirmed to load and
disassemble in headless IDA 9.4 (idat.exe -A -pmepf00d -B).
test_decode.py runs the module's decoder headlessly (stubs the ida_* modules)
over a dump for regression testing.
Companion
f00ddec is a decompiler that produces
pseudo-C on top of this module.
Credits
MeP reverse-engineering by TeamMolecule (toshiba-mep-idp), xyzz (ghidra-mep)
and the CGEN MeP description. MIT licensed. No firmware is included.