Reverse Engineer STM32L151's Firmware

Question

I have the STM32L151's firmware that I extracted via JTAG, but I cannot find a start point in IDA. I have tried two methods:

1) I start IDA, drag the binary into the workspace, select ARM Little-endian for the processor type, click ok, the disassembly memory organization window appears, entered in relevant information found here on page 48, click ok, windows pops up saying "IDA can not identify the entry point...", in the workspace I see "RAM:08000000 DCB [some hex number]"

2) Converted the binary to elf using my arm toolchain's objcopy, used "readelf -h [my binary file]" to find the entry point, got this output where the entry point is 0xff810000, dragged the elf into IDA's workspace, selected ARM Little-endian processor under processor type, clicked ok, and the workspace shows lines that look like ".data:0000002C [several hex values separated by commas]"

If I try to jump to the entry point address (0xff810000 from readelf) I get an JumpAsk fail. How do I find my start point so I can start reading the disassembled ARM assembly code?

Answer 1

From the PDF to which you linked:

3.3.4 Boot modes

At startup, boot pins are used to select one of three boot options:

• Boot from Flash memory
• Boot from System Memory
• Boot from embedded RAM

The boot loader is located in System Memory. It is used to reprogram the Flash memory by using USART1 or USART2. See STM32™ microcontroller system memory boot mode AN2606 for details.

If we Google for AN2606, we find the documentation for the STM32 microcontroller system memory boot mode, which suggests in the table below that the bootloader begins at memory location 0x1FF00FFE.

Additionally, the bootloader configuration table for each chip specifies the address of the bootloader firmware. For example, for STM32L01xxx/02xxx chips, page 174 specifies that the the bootloader's firmware is a 4 KB chunk that begins at address 0x1FF00000.

Answer 2

Get 4 bytes data from address 0x08000004 (at 0x08000000 is stack pointer address), there should be address to your reset handler. Even if internal bootloader will start, at the end it jumps to reset handler at that address.