Problem with IDA pro 6.8 disassemble galaxy s6 sboot

Question

I have some problem with Galaxy S6 boot loader (sboot.bin).

From 0x3F000 of that file, I think that there exists the real boot loader.

So I tried to disassemble it with ida 6.8 pro (64bit)

But It does not disassemble it clearly. (in both thumb mode and arm mode)

IDA pro 6.8 can support the Galaxy S6 boot loader (sboot.bin)?

Is there anyone who succeed in disassembling the Galaxy S6 boot loader (sboot.bin)? (aka armv8, aarch64 architecture)

Answer 1

Fernand Lone Sang from Quarkslab has had success disassembling the S6 bootloader (ARMv8, AArch64):

• Reverse Engineering Samsung S6 SBOOT - Part I
• Reverse Engineering Samsung S6 SBOOT - Part II

SBOOT's base address is identified to be 0x02102000 by executing this python script:

import sys
import string
import struct

RT_SVC_DESC_FORMAT  = "BBB5xQQQ"
RT_SVC_DESC_SIZE    = struct.calcsize(RT_SVC_DESC_FORMAT)
RT_SVC_DESC_OFFSET  = 0xcb50
RT_SVC_DESC_ENTRIES = (0xcc10 - 0xcb50) / RT_SVC_DESC_SIZE

if len(sys.argv) != 2:
    print("usage: %s <sboot.bin>" % sys.argv[0])
    sys.exit(1)

sboot_file = open(sys.argv[1], "rb")
sboot_data = sboot_file.read()

rt_svc_desc = []
for idx in range(RT_SVC_DESC_ENTRIES):
    start = RT_SVC_DESC_OFFSET + (idx << 5)
    desc = struct.unpack(RT_SVC_DESC_FORMAT,
                         sboot_data[start:start+RT_SVC_DESC_SIZE])
    rt_svc_desc.append(desc)

strlen = lambda x: 1 + strlen(x[1:]) if x and x[0] in string.printable else 0

for base_addr in range(0x2100000, 0x21fffff, 0x1000):
    names = []
    print("[+] testing base address %08x" % base_addr)
    for desc in rt_svc_desc:
        offset = desc[3] - base_addr
        if offset < 0:
            sys.exit(0)
        name_len = strlen(sboot_data[offset:])
        if not name_len:
            break
        names.append(sboot_data[offset:offset+name_len])
    if len(names) == RT_SVC_DESC_ENTRIES:
        print("[!] w00t!!! base address is %08x" % base_addr)
        print("    found names: %s" % ", ".join(names))

Answer 2

it's an ARM64 binary. If we're looking at the same sboot.bin, it's actually starting at offset 10:

0x00000000      0x00000010      DCD 0x10        ; ^P
0x00000004      0xe99c208a      DCD 0xe99c208a  ; <8A> <9C><E9>
0x00000008      0x00000000      DCD 0x0 ; 
0x0000000c      0x00000000      DCD 0x0 ; 
0x00000010      0x14000002      B 0x18
        -------------------------------
0x00000014      0x14000000      B 0x14
        -------------------------------
0x00000018      0x58000a80      LDR X0, #336            ; 0x168
0x0000001c      0xb9400000      LDR W0, [X0, #0]
0x00000020      0xd2b00001      MOVZ X1, 0x8000, LSL #16

Try using disarm (http://newosxbook.com/tools/disarm.html) since IDA somehow has trouble with this file. (There are also apparently ARM32 bits towards its end)