I have been sorting through disassembled code for a couple of days and I have a few questions.
Note: This is my first reverse engineering side project and I apologize if these are rather newbie questions...
1) I wrote a simple program that blinks an LED on a STM32F4 board (this is not the board I am rev eng), compiled the code, and looked at the hex file in IDA. When in hex view, I saw some clear text like so:
..Q..<...8pG../s
ystem/src/stm32f
4-hal/stm32f4xx_
hal_cortex.c....
../system/src/st
m32f4-hal/stm32f
4xx_hal_gpio.c..
................
../system/src/st
m32f4-hal/stm32f
When I look at my disassembled binary from the STM32L151 board in IDA's hex view, I do not seen any trace of readable characters. Does this mean the firmware was obfuscated (the programmed board sells for $60 so I wouldn't be surprised if it is)?
2) IDA cannot recognize an entry point, so I am sifting though the disassembled file looking for anything interesting (like functions). I have programmed in assembly before, but the first line of the firmware does not make any sense to me. It consists of consecutive STR operations... what is it storing? It pretty much did the same operation 50 times!? Additionally, it has the EQ condition but I don't see what it's comparing. The starting code that I linked is not unique to the board, the STM32F4 hex file started in a similar fashion.
3) When I am looking over the disassembled firmware in "IDA View-A", I am hitting the down arrow follow by the "C" key to see the assembly code but some of the code stays as a DCB operation. Why is that? Example here.
4) Are there any guides dedicated to finding an entry point? I am getting overwhelmed by the sheer amount of assembly code.
dcb
's are there because not every single random sequence of bytes forms valid code. By the way, the code that does appear around them doesn't look much like valid code either. So yeah, it's packed, encrypted or not actually code at all.