1

I dumped a ROM recently.

I tried to disassembled the machine code* for many architectures, but I always got assembly which, at best, looked like garbage.

Note: I can perfectly read the strings the the ROM dump.

*I have no proof this is really machine code.

Here is the beginning of the two write-protected sections:

    [000000] 00 40 02 0d 16 ef c3 60 01 d3 92 00 22 02 0d db  .@.....`...."...
    [000010] 8f 96 22 00 00 02 0e b1 90 3e 57 12 08 91 e4 ff  .."......>W.....
    [000020] fe fd fc 90 3e 5b 12 08 91 c0 96 75 96 03 e4 ff  ....>[.....u....
    [000030] 7e c0 fd fc 90 3e 57 12 08 27 c3 12 07 84 50 03  ~....>W..'....P.
    [000040] 02 00 a1 e4 fc fd fe 90 40 00 e4 f8 f9 fa e4 93  ........@.......
    [000050] 28 f8 e4 39 f9 a3 da f6 e8 2c fc e9 3d fd e4 3e  (..9.....,..=..>
    [000060] fe e5 83 70 e5 90 3e 5e e0 2c f0 90 3e 5d e0 3d  ...p..>^.,..>].=
    [000070] f0 90 3e 5c e0 3e f0 90 3e 5b e0 34 00 f0 e5 96  ..>\.>..>[.4....
    [000080] 04 f5 96 90 3e 57 12 08 0b c3 ef 94 00 ff ee 94  ....>W..........
    [000090] c0 fe ed 94 00 fd ec 94 00 fc 90 3e 57 12 08 91  ...........>W...
    [0000a0] 02 00 2c 90 3e 59 e0 f9 a3 e0 f8 90 3e 5b e0 ff  ..,.>Y......>[..
    [0000b0] a3 e0 fe a3 e0 fd a3 e0 fc 90 40 00 e8 49 60 15  ..........@..I`.
    [0000c0] 18 b8 ff 01 19 e4 93 2c fc e4 3d fd e4 3e fe e4  .......,..=..>..
    [0000d0] 3f ff a3 80 e7 90 3e 5b ef f0 a3 ee f0 a3 ed f0  ?.....>[........
    [0000e0] a3 ec f0 d0 96 90 3e 5b 12 08 0b 22 10 11 0b 12  ......>[..."....
    [0000f0] 0f 04 bf 0d 02 7f 0a 02 01 69 90 49 da e0 ff 22  ........i.I..."

    [040000] 90 3c db 12 24 2d 90 3c df 12 24 7c e4 7f 01 fe  .<..$-.<..$|...
    [040010] fd fc 12 23 9c e4 ff fe fd fc 90 3c db 12 23 d3  ...#.......<..#.
    [040020] d3 12 23 40 40 3f 90 3c df 12 24 45 c0 03 c0 02  ..#@@?.<..$E....
    [040030] c0 01 12 23 77 e4 7b 02 fa f9 f8 12 21 cb d0 01  ...#w.{.....!...
    [040040] d0 02 d0 03 12 23 9c 90 3c db 12 23 c7 ef 24 ff  .....#..<..#..$.
    [040050] ff ee 34 ff fe ed 34 ff fd ec 34 ff fc 90 3c db  ..4...4...4...<.
    [040060] 12 24 2d 80 b0 22 ef f4 60 05 7e 09 7f 01 22 90  .$-.."..`.~..".
    [040070] 37 55 e0 fd c3 94 80 40 05 7e 09 7f 03 22 af 05  7U.....@.~.."..
    [040080] e4 fc fd fe 12 17 51 ef 4e 60 01 22 e4 fe ff 22  ......Q.N`."..."
    [040090] 90 37 6d ef f0 c3 94 02 40 05 7e 09 7f 01 22 e4  .7m.....@.~..".
    [0400a0] 7f ff fe fd fc 90 37 6e 12 23 d3 d3 12 23 40 40  .....7n.#...#@@
    [0400b0] 02 80 61 90 37 6d e0 25 e0 25 e0 ff 74 0f 7e 00  ..a.7m.%.%..t.~.
    [0400c0] a8 07 08 80 05 c3 33 ce 33 ce d8 f9 ff ee 33 95  ......3.3.....3.
    [0400d0] e0 fd fc 90 37 6e 12 23 d3 12 22 f5 c0 04 c0 05  ....7n.#..".....
    [0400e0] c0 06 c0 07 90 37 6d e0 25 e0 25 e0 ff 74 0f 7e  .....7m.%.%..t.~
    [0400f0] 00 a8 07 08 80 05 c3 33 ce 33 ce d8 f9 fb aa 06  .......3.3......

Can you identify which architecture/endianess I should give to the disassembler?

Thanks;

  • Is it possible the ROM is interleaved? (In which case the odd bytes are in one ROM and the even bytes in another.) – usr2564301 Nov 17 '15 at 22:48
  • @Jongware There is only one visible ROM. I cannot get the reference number of the main chip as the heat-sink is well-glued on it. I'll add in the question that strings are perfectly readable in the ROM dump. – rvkolp Nov 17 '15 at 22:53
  • 1
    Would you please upload somewhere the whole section files ? – w s Nov 18 '15 at 6:25
  • Do you have FCC label on this device ? Once it was possible to find hardware specifications on FCC site if it is FCC approved. – w s Nov 18 '15 at 11:02
  • And what about second section ? It looks much more promising. – w s Nov 18 '15 at 11:06
4

Here's what I found and how I found it.

Finding strings

First, I examined the strings within the file to determine the type and model of equipment. I did that visually, with a text editor (vim) after I had converted the file back to plain binary using xxd.

Learning more about the device

Once I did that, I looked for images which show the inside of this product. I found a few, which seemed to show that it's not much different than the usual 5-port unmanaged hub, with what appears to be a single Ethernet switch controller IC. Unfortunately, the heatsink was still attached to the top of the chip of interest in the photos I found, so I tried a different approach.

Process of elimination

There are maybe a dozen or so different vendors of Ethernet switch controllers, so I started searching for the prefixes of some of them within the binary image. Jackpot! I found the following strings: RTL8376B and RTL8367N. Looking up the latter, the manufacturer's web site confirms that it is indeed a 5-port controller and that it contains an "Integrated 8051 microprocessor."

Sample dump

Starting at offset 0x29200 which in your file, (chosen because it looked like it might be code and not data) I used d52 to disassemble. An extract of the result is here:

    org 0
;
    mov r5,#0c2h
    mov dptr,#X3744
    lcall   X2445
    lcall   X2007
    xrl a,#1
    jz  X0012
    ljmp    X547d
;
X0012:  clr c
    mov r1,24h
    ajmp    X00c3
;
    cjne    r1,#0c3h,Xffbe
    addc    a,r2
    clr c
    cjne    r2,#12h,X003f
    inc @r1
    clr c
    cjne    r7,#0c3h,Xffa8
    rrc a
    rrc a
    anl a,#3
    jb  0c0h.3,Xffcb
    rr  a
    ljmp    X547d
;
    clr c
X0030:  mov r7,54h
    addc    a,r7
    clr c
    cjne    r7,#64h,X0039
    jz  X0041
X0039:  clr c
    mov r7,64h
    ajmp    X0060

For those familiar with 8051 programming, this is very plausible looking code, so it is indeed an 8051 derivative. Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.