3

I have a probably executable file for Motorola/Freescale/NXP PowerQUICC MPC860 and cannot disassemble it with IDA Pro since I cannot find the correct processor type in IDA?!

IDA list MPC860 as supported see: HEX Rays Supported Processors

But is not listed, Any help or suggestion which type should I choose for this file:

BIN FILE

Also there is another text file list some file addresses and says it is memory map? Can it help in reverse engineering? [MAP File][3]

Regards

Improve this question
1

1 Answer 1

Reset to default
3

It looks like that you should choose PowerPC big endian. After loading the binary the menu which contains "MPC860" will appear.

Please note that image probably should be rebased for the proper disassembling. I loaded modem.bin into Ida and I see some reasonable code.

  • Small addition #0: when I rebase this image to 0xFFC40130 I see some very consistent pointers to strings in the code, which means that probably this should be address to rebase the image to.
  • Small addition #1: I'm not sure that the map file is really related to this binary - some of the functions in it are not match to the function prologue addresses.
  • Small addition #2: I can confirm that the code is not packed, and that the loading address is correct.
  • Small addition #3: Just for completeness, r13 value is 0xD410 (Options --> General --> Analysis -->Processor specific analysis options -->SDA (r13) address) . As far as I can see setting this value is very much compatible with addresses of the strings used for printing.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.