I have some problem with Galaxy S6 boot loader (sboot.bin).

From 0x3F000 of that file, I think that there exists the real boot loader.

So I tried to disassemble it with ida 6.8 pro (64bit)

But It does not disassemble it clearly. (in both thumb mode and arm mode)

IDA pro 6.8 can support the Galaxy S6 boot loader (sboot.bin)?

Is there anyone who succeed in disassembling the Galaxy S6 boot loader (sboot.bin)? (aka armv8, aarch64 architecture)

  • Why not use the latest IDA version? Maintenance ran out?
    – 0xC0000022L
    Commented Aug 30, 2017 at 21:27

2 Answers 2


Fernand Lone Sang from Quarkslab has had success disassembling the S6 bootloader (ARMv8, AArch64):

SBOOT's base address is identified to be 0x02102000 by executing this python script:

import sys
import string
import struct

RT_SVC_DESC_SIZE    = struct.calcsize(RT_SVC_DESC_FORMAT)
RT_SVC_DESC_ENTRIES = (0xcc10 - 0xcb50) / RT_SVC_DESC_SIZE

if len(sys.argv) != 2:
    print("usage: %s <sboot.bin>" % sys.argv[0])

sboot_file = open(sys.argv[1], "rb")
sboot_data = sboot_file.read()

rt_svc_desc = []
for idx in range(RT_SVC_DESC_ENTRIES):
    start = RT_SVC_DESC_OFFSET + (idx << 5)
    desc = struct.unpack(RT_SVC_DESC_FORMAT,

strlen = lambda x: 1 + strlen(x[1:]) if x and x[0] in string.printable else 0

for base_addr in range(0x2100000, 0x21fffff, 0x1000):
    names = []
    print("[+] testing base address %08x" % base_addr)
    for desc in rt_svc_desc:
        offset = desc[3] - base_addr
        if offset < 0:
        name_len = strlen(sboot_data[offset:])
        if not name_len:
    if len(names) == RT_SVC_DESC_ENTRIES:
        print("[!] w00t!!! base address is %08x" % base_addr)
        print("    found names: %s" % ", ".join(names))

it's an ARM64 binary. If we're looking at the same sboot.bin, it's actually starting at offset 10:

0x00000000      0x00000010      DCD 0x10        ; ^P
0x00000004      0xe99c208a      DCD 0xe99c208a  ; <8A> <9C><E9>
0x00000008      0x00000000      DCD 0x0 ; 
0x0000000c      0x00000000      DCD 0x0 ; 
0x00000010      0x14000002      B 0x18
0x00000014      0x14000000      B 0x14
0x00000018      0x58000a80      LDR X0, #336            ; 0x168
0x0000001c      0xb9400000      LDR W0, [X0, #0]
0x00000020      0xd2b00001      MOVZ X1, 0x8000, LSL #16

Try using disarm (http://newosxbook.com/tools/disarm.html) since IDA somehow has trouble with this file. (There are also apparently ARM32 bits towards its end)

  • 2
    Since ida6.9 there is ARM64 support. Use Alt-S to set your segment bitness to 64 to be able to use it. Commented Mar 25, 2017 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.