I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler).
The values I try to figure out are the ones shown here:
From what I know, the processor is a STM32F100C8, ARM Cortex-M3, 64Kbytes Flash, 8Kbytes RAM. The BOOT0 pin is tied low, so I know it's booting from main flash memory:
Boot from main Flash memory: the main Flash memory is aliased in the boot memory space (0x0000 0000), but still accessible from its original memory space (0x800 0000). In other words, the Flash memory contents can be accessed starting from address 0x0000 0000 or 0x800 0000.
The startup sequence is as follows:
The CPU fetches the top-of-stack value from address 0x0000 0000, then starts code execution from the boot memory starting from 0x0000 0004
I converted the .hex file to a .bin file using arm-none-eabi-objcopy and found:
0x0000 0000 | 10050020 (Stack pointer)
0x0000 0004 | 05A90008 (ResetHandler)
What I don't understand are the memory addresses.
The stack pointer is too large to be a relative offset (only 8K RAM) and too small to point into SRAM (starting at 0x2000 0000).
The reset handler is also too large to be a relative offset (only 64k flash) and too small to point to main flash memory (starting at 0x800 0000).
How do I figure out the proper base address and entry point?
PS: The schematics and firmware for the DIY project can be found here
