Which architecture is this machine code?

Question

I dumped a ROM recently.

I tried to disassembled the machine code* for many architectures, but I always got assembly which, at best, looked like garbage.

Note: I can perfectly read the strings the the ROM dump.

*I have no proof this is really machine code.

Here is the beginning of the two write-protected sections:

    [000000] 00 40 02 0d 16 ef c3 60 01 d3 92 00 22 02 0d db  .@.....`...."...
    [000010] 8f 96 22 00 00 02 0e b1 90 3e 57 12 08 91 e4 ff  .."......>W.....
    [000020] fe fd fc 90 3e 5b 12 08 91 c0 96 75 96 03 e4 ff  ....>[.....u....
    [000030] 7e c0 fd fc 90 3e 57 12 08 27 c3 12 07 84 50 03  ~....>W..'....P.
    [000040] 02 00 a1 e4 fc fd fe 90 40 00 e4 f8 f9 fa e4 93  ........@.......
    [000050] 28 f8 e4 39 f9 a3 da f6 e8 2c fc e9 3d fd e4 3e  (..9.....,..=..>
    [000060] fe e5 83 70 e5 90 3e 5e e0 2c f0 90 3e 5d e0 3d  ...p..>^.,..>].=
    [000070] f0 90 3e 5c e0 3e f0 90 3e 5b e0 34 00 f0 e5 96  ..>\.>..>[.4....
    [000080] 04 f5 96 90 3e 57 12 08 0b c3 ef 94 00 ff ee 94  ....>W..........
    [000090] c0 fe ed 94 00 fd ec 94 00 fc 90 3e 57 12 08 91  ...........>W...
    [0000a0] 02 00 2c 90 3e 59 e0 f9 a3 e0 f8 90 3e 5b e0 ff  ..,.>Y......>[..
    [0000b0] a3 e0 fe a3 e0 fd a3 e0 fc 90 40 00 e8 49 60 15  [email protected]`.
    [0000c0] 18 b8 ff 01 19 e4 93 2c fc e4 3d fd e4 3e fe e4  .......,..=..>..
    [0000d0] 3f ff a3 80 e7 90 3e 5b ef f0 a3 ee f0 a3 ed f0  ?.....>[........
    [0000e0] a3 ec f0 d0 96 90 3e 5b 12 08 0b 22 10 11 0b 12  ......>[..."....
    [0000f0] 0f 04 bf 0d 02 7f 0a 02 01 69 90 49 da e0 ff 22  ........i.I..."

    [040000] 90 3c db 12 24 2d 90 3c df 12 24 7c e4 7f 01 fe  .<..$-.<..$|...
    [040010] fd fc 12 23 9c e4 ff fe fd fc 90 3c db 12 23 d3  ...#.......<..#.
    [040020] d3 12 23 40 40 3f 90 3c df 12 24 45 c0 03 c0 02  ..#@@?.<..$E....
    [040030] c0 01 12 23 77 e4 7b 02 fa f9 f8 12 21 cb d0 01  ...#w.{.....!...
    [040040] d0 02 d0 03 12 23 9c 90 3c db 12 23 c7 ef 24 ff  .....#..<..#..$.
    [040050] ff ee 34 ff fe ed 34 ff fd ec 34 ff fc 90 3c db  ..4...4...4...<.
    [040060] 12 24 2d 80 b0 22 ef f4 60 05 7e 09 7f 01 22 90  .$-.."..`.~..".
    [040070] 37 55 e0 fd c3 94 80 40 05 7e 09 7f 03 22 af 05  7U.....@.~.."..
    [040080] e4 fc fd fe 12 17 51 ef 4e 60 01 22 e4 fe ff 22  ......Q.N`."..."
    [040090] 90 37 6d ef f0 c3 94 02 40 05 7e 09 7f 01 22 e4  .7m.....@.~..".
    [0400a0] 7f ff fe fd fc 90 37 6e 12 23 d3 d3 12 23 40 40  .....7n.#...#@@
    [0400b0] 02 80 61 90 37 6d e0 25 e0 25 e0 ff 74 0f 7e 00  ..a.7m.%.%..t.~.
    [0400c0] a8 07 08 80 05 c3 33 ce 33 ce d8 f9 ff ee 33 95  ......3.3.....3.
    [0400d0] e0 fd fc 90 37 6e 12 23 d3 12 22 f5 c0 04 c0 05  ....7n.#..".....
    [0400e0] c0 06 c0 07 90 37 6d e0 25 e0 25 e0 ff 74 0f 7e  .....7m.%.%..t.~
    [0400f0] 00 a8 07 08 80 05 c3 33 ce 33 ce d8 f9 fb aa 06  .......3.3......

Can you identify which architecture/endianess I should give to the disassembler?

Thanks;

Answer 1

Here's what I found and how I found it.

Finding strings

First, I examined the strings within the file to determine the type and model of equipment. I did that visually, with a text editor (vim) after I had converted the file back to plain binary using xxd.

Learning more about the device

Once I did that, I looked for images which show the inside of this product. I found a few, which seemed to show that it's not much different than the usual 5-port unmanaged hub, with what appears to be a single Ethernet switch controller IC. Unfortunately, the heatsink was still attached to the top of the chip of interest in the photos I found, so I tried a different approach.

Process of elimination

There are maybe a dozen or so different vendors of Ethernet switch controllers, so I started searching for the prefixes of some of them within the binary image. Jackpot! I found the following strings: RTL8376B and RTL8367N. Looking up the latter, the manufacturer's web site confirms that it is indeed a 5-port controller and that it contains an "Integrated 8051 microprocessor."

Sample dump

Starting at offset 0x29200 which in your file, (chosen because it looked like it might be code and not data) I used d52 to disassemble. An extract of the result is here:

    org 0
;
    mov r5,#0c2h
    mov dptr,#X3744
    lcall   X2445
    lcall   X2007
    xrl a,#1
    jz  X0012
    ljmp    X547d
;
X0012:  clr c
    mov r1,24h
    ajmp    X00c3
;
    cjne    r1,#0c3h,Xffbe
    addc    a,r2
    clr c
    cjne    r2,#12h,X003f
    inc @r1
    clr c
    cjne    r7,#0c3h,Xffa8
    rrc a
    rrc a
    anl a,#3
    jb  0c0h.3,Xffcb
    rr  a
    ljmp    X547d
;
    clr c
X0030:  mov r7,54h
    addc    a,r7
    clr c
    cjne    r7,#64h,X0039
    jz  X0041
X0039:  clr c
    mov r7,64h
    ajmp    X0060

For those familiar with 8051 programming, this is very plausible looking code, so it is indeed an 8051 derivative. Good luck!