3

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update file and is a binary (no ELF, PE,...). I am stuck with the next step. IDA Pro disassembles some functions but (I guess) it needs further information about the ROM start address, loading address, and offset to do it properly. Where can I find these information?

I have no RE experience and I am doing this for fun/education. Any hints about further reading or next steps would be great.

Improve this question

2 Answers 2

Reset to default
4

As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try 0x80400000 as the start address.

Although I don't know a simple and exact method to calculate the start address I try to explain a little bit more how can you found this anyway.

You can try the following techniques:

  • Identify function starts and pointers to the functions and try to match them. If you disassemble the whole binary, the function start addresses can be determined very accurately. So, you can collect the relative start addresses. In most of the binaries and bootloaders, after the code section you will find various data items such as pointers to functions. If you can identify some of these pointers, you can try to find the corresponding relative address.
  • You can find hints from the code itself. Although the bootloader uses relative branches, the data items are accessed with absolute addresses. In the figure, you can find the absoulte addresses as 0x804B7F10 and so on.
    enter image description here
    Based on this address and the length of the code area (0x9B6A4) you may have intelligent guesses, such as 0x80400000 or 0x80408000 or similar.

    • Improve this answer
    2
    • Thanks for your advice. I had the same idea but the address spread in my disassembly is too big. However, it seems as if my disassembly is wrong. IDA disassembles the area around 0xCC as a bunch of qwords altough the shown addresses, e.g., 0x804B7EF0 appear in my dump at the appropriate place.
      – user3422070
      Oct 15, 2015 at 7:41
    • May be some reference pointed around 0xCC in later code, which confused IDA. In this case I disassembled only some function at the start of the binary to see the absolute address references.
      – ebux
      Oct 15, 2015 at 8:01
    2

    From http://www.nulltrace.org/2013/04/mips-bootstrapping.html:

    MIPS Bootstrapping

    Bootstrapping is the process of taking a CPU just out of reset, fetching and executing instructions serially, to a more complex running environment. The program that does that is called a "Boot loader" or "Boot strap code" or simply "Boot code".

    First Instruction Fetch

    When power is applied to a processor and it comes out of reset, it fetches its first instruction from an address that is hardwired. This address is known as the "Boot Vector" or the "Reset Vector". The MIPS processors' boot vector is located at physical address 0x1FC00000. The MIPS processors have MMU enabled as soon as they are powered on. The MIPS core thus presents a virtual address of 0xBFC00000. The MMU translates this address to physical address of 0x1FC00000, the boot vector. This translation again is hardwired. Typically, a boot device is present at this address and responds to the read request of the processor.

    Improve this answer
    4
    • This pages explains the MIPS bootstrap process and which memory address is executed first. However, it does not answer how this relates to the boot loader binary blob as I do not know where the binary is stored in the ROM and which instruction of the binary blob is executed first.
      – user3422070
      Oct 13, 2015 at 13:11
    • "it needs further information about the ROM start address, loading address, and offset to do it properly. Where can I find these information?" - My understanding is that the bootloader ROM is loaded at the address described above.
      – Jason Geffner
      Oct 13, 2015 at 13:30
    • 1
      Stefan explains and solves in his blog post a very similar problem. I think, I am looking for the required ROM start address to set the correct addresses inside IDA. Jason's post is the next step as it indicates the first executed instruction from the binary.
      – user3422070
      Oct 13, 2015 at 13:44
    • @user3422070 Did you try dumping the memory at this address when the OS is already running? In many cases the OS does not use bootloader addresses, and you can dump it from memory. Once you do, you can locate the same binary sequence in your file, and get the loading address from that.
      – tmr232
      Oct 14, 2015 at 6:01

    Your Answer

    By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

    Not the answer you're looking for? Browse other questions tagged or ask your own question.