Stepping through ARM firmware image

Question

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it.

I was able to obtain all the data from the memory of the device: the firmware, the option banks, the RAM which includes the data to be encrypted, etc.. and all in raw bytes.

I know the location of the encryption subroutine and want to start stepping through the program at that point. I've analyzed the firmware as far as possible in IDA PRO.

The device has an ARM Cortex-M3, which uses the ARMv7-M instruction set. Here is the
data sheet of the device.

What would be a good approach to do this?

Update 1 - sep 19 '16

I chose to emulate just the code snippet. However I'm slightly clueless what "configuration" to choose (configuring QEMU: step 5). The information that comes up when googling for the "Versatile" or the "Integrator" board doesn't make it more clear.

How can I determine what configuration to choose?

Answer 1

You can debug and even step the execution with the following ways:

• Emulating a code snippet. You can find the detailed steps of code snippet emulation with QEMU in hexblog. In this approach you have to set the memory and register values to the correct ones, which can be challenging in some times.
• Emulating the whole firmware. There is a very good blog post about firmware emulation with QEMU in the devttsy0 blog. Because you emulate the whole firmware in this case, you don't have to set any runtime values for debugging. However, you may have to emulate nvram and other hardware specific features.