0

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a learning exercise.

It was explained that in both File1.bin and File2.bin there was both ARM926EJ-S code and Blackfin DSP code combined. I'm interested in looking at the ARM code, but am not clear on how to separate one from another. Using binja and Ghidra at the moment...

How can the ARM code get isolated, and what's the best way to decompile down to seeing functions like RegisterATCmdHook() and RegisterPendingATCmdHook()?

Paper is available here: https://uploadfiles.io/2l0f9ulc

Improve this question

1 Answer 1

Reset to default
0

Once I solved the opposite problem: to collect Blackfin code as memory dump and load it into IDA. To solve your issue you can just consider DSP code as a data using memory chunk description from here

Improve this answer
4
  • Yes, I have been looking at this paper, but having trouble with this portion: "After removing the header, two resulting binary files can be ARM-disassembled by setting the correct base address, which can be deduced from the respective headers" How the heck do they expect that to be done?
    – Walter Christie
    Apr 16, 2019 at 3:01
  • I can't publish screenshot in my comment. Try to open File1.bin in IDA using "ARM Little-endian" CPU , "ROM start address = 0x04C00000", "Loading address = 0x04C00000" and "File offset=0x50" settings.
    – Igor Matyuh
    Apr 16, 2019 at 15:54
  • @IgorMatyuh just put the screenshot in your post
    – julian ♦
    Apr 18, 2019 at 10:03
  • @IgorMatyuh: Now i'm getting somewhere, your last got me seeing the right stuff. So basically, the Blackfin firmware is 0x08000000 -> 0x05040000, with the ARM firmware being 0x04C00000 -> 0x04000000. This matches what the Groundworks paper had. The question then is - how did they figure out this memory map? Are there ASCII strings that indicate this?
    – Walter Christie
    Apr 20, 2019 at 3:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.