A dedicated IDA processor module for KIRK firmware
KIRK v1.0.0 is an IDA Pro processor module for analyzing the internal mask-ROM firmware of the PSP KIRK cryptographic coprocessor. It identifies the processor as “Star Trek PSP Processors: KIRK big endian” and supports IDA Pro 8.x and 9.x with 64-bit databases.
The emulated processor is not the PSP’s main CPU. KIRK uses a custom big-endian, registerless micro-sequencer with memory-to-memory operations, separate code and data address spaces, and memory-mapped hardware units. The module gives IDA a processor definition that represents those features instead of treating the firmware as a generic instruction stream.
Instruction decoding covers the documented KIRK instruction set
The module decodes 42 hardware-valid opcodes, including arithmetic, logical, movement, shifting, bit manipulation, branching, calls, returns and accelerator synchronization. It supports 32-bit word operations as well as 128-bit block transfers through the mov128 instruction.
Addressing modes are rendered directly in the disassembly. Direct and indirect memory references distinguish ordinary locations from pointer dereferences, while immediate word-index values can be converted into symbolic data references. The decoder also validates five-bit shift and bit-operation immediates, helping avoid false instruction interpretations when examining raw firmware data.
The reset vector’s documented one-bit decap shift is handled by resolving the reset entry at 0x0000 toward _start. Branch and call targets use KIRK’s 12-bit word-address format, while calls and returns are modeled with the processor’s internal hardware return-address stack.
Hardware symbols make accelerator activity easier to follow
The included kirk.cfg configuration describes KIRK’s memory map, entry points, MMIO registers and named bitfields. When an existing IDA database is opened, the module can load this port and bit metadata without replacing user-defined symbols.
Wait-for-event instructions receive names for their accelerator event masks, including DMA, HOST, ECC, SHA1, AES, PRNG, TRNG and MATH. Bit tests and bit updates can likewise show hardware field names, such as ECC validity or AES initialization controls, alongside the instruction operands.
The configuration covers the ECC, SHA-1, AES, PRNG, true-random-number, modular-math, DMA and host interfaces. It also identifies the key vault, SRAM workspace, boot and FIPS status areas, giving analysts recognizable labels for regions used by KIRK firmware.
IDA analysis gains control-flow and data cross-references
The emulation layer creates typed data items for 32-bit values and 16-byte mov128 transfers. It also adds read, write and offset references, including pointer-read references for indirect operands, so data movement through MMIO and scratchpad memory is visible in the database.
Calls, conditional branches, unconditional jumps, fallthrough edges and terminating instructions are represented with appropriate cross-references. This gives IDA’s navigation and graph views information about how KIRK routines move through firmware and interact with memory-mapped hardware.
Availability and documented setup
KIRK v1.0.0 was published on October 29, 2026, and was built against the IDA SDK 9.5.0 release. The release provides separate packages for Windows x64, macOS arm64 and Linux x64 hosts. These are host-platform packages for use with IDA Pro, not firmware or PSP-console builds.
The documented setup requires copying the package’s procs contents into the IDA Pro procs directory and cfg/kirk.cfg into the corresponding cfg directory. In IDA Pro, open a raw KIRK mask-ROM binary, select the KIRK big-endian processor type, keep the load address at 0x0000 and accept the KIRK I/O configuration when prompted. The documented configuration creates the ROM and RAM segments and populates the processor’s hardware symbols.
