Crusoe Exposed: Transmeta TM5xxx Architecture 1

Pages: 1 2 3 4 5

Reverse Engineering Methodology

Now, for the proof. The reverse engineering effort started with a static analysis of a CMS 4.4.03 binary image ([5] in references). The only other resources used include published articles and technical reports, as well as the author’s own personal experience in designing VLIW processors at a major university research lab.

Surprisingly, no actual Crusoe hardware was necessary for most of the initial static analysis; only isolated details required analyzing a CMS memory image at runtime. To present some idea of the nature of Crusoe native code, the end of this report includes disassembled and commented listings of a few key CMS functions. Each instruction is given in both binary and symbolic form, along with comments to demonstrate understanding of the actual high level meaning the corresponding source code expressed.

CMS appears to have been compiled from C source using a hacked version of gcc, with many key parts hand-scheduled in VLIW assembler. Note that the instruction mnemonics and register names may not exactly match what Transmeta developers use internally, since the author did not have access to that information. Hence, most symbolic names have been based on those used in published papers or were derived from debug strings in the CMS image.

Anyone from Transmeta should be able to verify that this is indeed genuine TM5800 code with the given meaning; they are invited to confirm the legitimacy of the reverse engineered code (assuming their employer will let them!)

Pages: « Prev   1 2 3 4 5   Next »

Be the first to discuss this article!