3

I am trying to become familiar with IDA by reversing a .bin file that I have compiled myself. The code is written in cpp and the open source code can be found here: https://github.com/openxc/vi-firmware

Taking a look at the Makefile and linker files (in vi-firmware/src and vi-firmware/src/platform/lpc17xx/), you can see the Flash and RAM locations are called out in the comments. The microcontroller uses an LPC17xx (http://vi.openxcplatform.com/electrical/design/microcontroller.html) with and ARM 7 architecture.

Therefore, when I load IDA, I select Binary file and set the Processor to ARM and Processor Options to ARM 7.

In the next menu I configure the RAM and ROM according to the comments in vi-firmware/src/platform/lpc17xx/LPC17xx-bootloader.ld and then, after pressing OK, get the dialogue box telling me to "Please move to what you think is an entry point".

I move 64KB (0x10000) into Flash (ROM) and hit 'C' to try to auto-analyse. Only a few lines translate to assembly.

Is there anything else I can do here? I've combed the datasheet for the uC but haven't been able to find anything of use.

Improve this question

1 Answer 1

Reset to default
2

(Disclaimer: I do not know ARM, this could be totally wrong)

I loaded vi-default-firmware-FORDBOARD-ctv7.2.0.bin (downloaded from the releases page) into IDA with these settings:

Settings for firmware

Then, after putting the cursor at 0x10000, you have to press C, then scroll to the undefined bytes, then press C again. Scroll to the top of the function and press P to make it a function, and have a nice graph view with Space:

How to fix the code

I don't have any experience with ARM, but this seems like a proper function graph to me:

ARM function graph

Improve this answer
2
  • 1
    Brilliant! Thanks so much. Why did you choose the ROM and Input File Loading size the way you did? And how did you get your graph to be so expansive? Do you move to every undefined byte and press C?
    – Kal
    Commented Dec 5, 2016 at 22:04
  • @Kal because the file you pointed us at said so. "Flash" memory apparently is RX, i.e. read and execute, so no write. ROM = read-only memory, so it makes sense that flash = ROM. As for the size: IDA barfs at you when you specify a wrong (default?) size, so I just tried the same value as the RAM and it worked. As for the graph - I really only did what you see in the GIF. Define unknown bytes with C, make a function with P, press Space, done. e.g.: 0x132E0
    – Martin
    Commented Dec 5, 2016 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.