I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit different.
So I have tried to load file and test with 2 possible targets, ARCompact and ARCTangent, and loading address I tested with 0x0 and 0x400000, because I see some offsets in binary (L.E) like:
So I guess loading must be close to that offset but no successful, only got garbage fucntions. The first 0xB0 data from file is like this:
4A2100004A2200004A2300004A240000 4A2500004A2600004A2700004A200010 4A2100104A2200104A2300104A240010 4A2500104A2600104A2700104A200020 4A2100204A2200204A2300204A240020 4A2500204A2600204A2700204A200030 4A2100304A2000002220800F23408009 0A24803F2B4048B80A22803F2B406059 0A22808F00000000E22082004A230030 2220800F2240DC9E090000006CD41640 692040004A2600704A2600704A260070
And these flags are before gzip header:
48B82B40 48B82B40 00200300 2E 6B65726E656C -> kernel 0000000000 004B5F40 -* 004B5F40 -* Offset where kernel is decompressed? 00400600 -> ? 1F8B0800 -> gzip
Hope someone could help me in someway.
Many thanks in advance.