How to dissassemble Motorola/Freescale/NXP PowerQUICC excutable

Question

I have a probably executable file for Motorola/Freescale/NXP PowerQUICC MPC860 and cannot disassemble it with IDA Pro since I cannot find the correct processor type in IDA?!

IDA list MPC860 as supported see: HEX Rays Supported Processors

But is not listed, Any help or suggestion which type should I choose for this file:

BIN FILE

Also there is another text file list some file addresses and says it is memory map? Can it help in reverse engineering? [MAP File][3]

Regards

Answer 1

It looks like that you should choose PowerPC big endian. After loading the binary the menu which contains "MPC860" will appear.

Please note that image probably should be rebased for the proper disassembling. I loaded modem.bin into Ida and I see some reasonable code.

• Small addition #0: when I rebase this image to 0xFFC40130 I see some very consistent pointers to strings in the code, which means that probably this should be address to rebase the image to.
• Small addition #1: I'm not sure that the map file is really related to this binary - some of the functions in it are not match to the function prologue addresses.
• Small addition #2: I can confirm that the code is not packed, and that the loading address is correct.
• Small addition #3: Just for completeness, r13 value is 0xD410 (Options --> General --> Analysis -->Processor specific analysis options -->SDA (r13) address) . As far as I can see setting this value is very much compatible with addresses of the strings used for printing.