1

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-R, ARMv7-M, ARMv7-A) from the ELF file? It would be even better if I can figure out the ARM core type. I suppose I can look for some patterns or some specific instructions to make an informed guess, but I don't really have any idea.

The ELF file contained in the flash dump is compressed and somewhat non-standard, I actually decompressed it, did some modifications, and added the program header table by myself.

I know tools like readelf and binwalk -A, but what I want to know is not a very broad ARM32 or ARM64 categorization but the specific ARM architecture, or even better, the specific ARM core type. Because I am not even sure if the chip used on the printer is an ARM Cortex A/R or M series. I cannot find a Linux on the printer, so it's probably not a Cortex-A.

Improve this question

2 Answers 2

Reset to default
2

There's a few other options can help you narrow down the specific architecture / core / SoC.

  1. Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains.

  2. Look at disassembly to identify the offsets of key memory regions (code, data, flash etc)

  3. Similarly, SoCs tend to have memory mapped peripherals. Identifying what's being accessed here can help.

  4. Look at disassembly for MRS and MSR instructions - many special registers are core specific.

  5. Open the printer up and look at the PCB to visually ID the chip. (Or google image search for printer make/model PCB.)

Improve this answer
0

The ELF header should contain information about the target architecture. You can use the Unix utility file to possibly obtain some basic information about the file, and readelf -h should give you most everything that is there.

If for some reason that isn't helpful, I suppose you could try disassembling against different architectures until it produces something readable.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.