1

I have some problem with galaxy s6 boot loader(sboot.bin).

From 0x3F000 of that file, I think that there exists the real boot loader.

So I tried to disassemble it with ida 6.8 pro (64bit)

But It does not disassemble it clearly. (in both thumb mode and arm mode)

IDA pro 6.8 can support the galaxy s6 boot loader(sboot.bin)?

Is there anyone who succeed in disassembling the galaxy s6 boot loader(sboot.bin)? (aka armv8, aarch64 architecture)

  • Why not use the latest IDA version? Maintenance ran out? – 0xC0000022L Aug 30 '17 at 21:27
1

Fernand Lone Sang from Quarkslab has had success disassembling the S6 bootloader (ARMv8, AArch64):

SBOOT's base address is identified to be 0x02102000 by executing this python script:

import sys
import string
import struct

RT_SVC_DESC_FORMAT  = "BBB5xQQQ"
RT_SVC_DESC_SIZE    = struct.calcsize(RT_SVC_DESC_FORMAT)
RT_SVC_DESC_OFFSET  = 0xcb50
RT_SVC_DESC_ENTRIES = (0xcc10 - 0xcb50) / RT_SVC_DESC_SIZE

if len(sys.argv) != 2:
    print("usage: %s <sboot.bin>" % sys.argv[0])
    sys.exit(1)

sboot_file = open(sys.argv[1], "rb")
sboot_data = sboot_file.read()

rt_svc_desc = []
for idx in range(RT_SVC_DESC_ENTRIES):
    start = RT_SVC_DESC_OFFSET + (idx << 5)
    desc = struct.unpack(RT_SVC_DESC_FORMAT,
                         sboot_data[start:start+RT_SVC_DESC_SIZE])
    rt_svc_desc.append(desc)

strlen = lambda x: 1 + strlen(x[1:]) if x and x[0] in string.printable else 0

for base_addr in range(0x2100000, 0x21fffff, 0x1000):
    names = []
    print("[+] testing base address %08x" % base_addr)
    for desc in rt_svc_desc:
        offset = desc[3] - base_addr
        if offset < 0:
            sys.exit(0)
        name_len = strlen(sboot_data[offset:])
        if not name_len:
            break
        names.append(sboot_data[offset:offset+name_len])
    if len(names) == RT_SVC_DESC_ENTRIES:
        print("[!] w00t!!! base address is %08x" % base_addr)
        print("    found names: %s" % ", ".join(names))
0

it's an ARM64 binary. If we're looking at the same sboot.bin, it's actually starting at offset 10:

0x00000000      0x00000010      DCD 0x10        ; ^P
0x00000004      0xe99c208a      DCD 0xe99c208a  ; <8A> <9C><E9>
0x00000008      0x00000000      DCD 0x0 ; 
0x0000000c      0x00000000      DCD 0x0 ; 
0x00000010      0x14000002      B 0x18
        -------------------------------
0x00000014      0x14000000      B 0x14
        -------------------------------
0x00000018      0x58000a80      LDR X0, #336            ; 0x168
0x0000001c      0xb9400000      LDR W0, [X0, #0]
0x00000020      0xd2b00001      MOVZ X1, 0x8000, LSL #16

Try using disarm (http://newosxbook.com/tools/disarm.html) since IDA somehow has trouble with this file. (There are also apparently ARM32 bits towards its end)

  • 2
    Since ida6.9 there is ARM64 support. Use Alt-S to set your segment bitness to 64 to be able to use it. – Willem Hengeveld Mar 25 '17 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.