I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit different.

So I have tried to load file and test with 2 possible targets, ARCompact and ARCTangent, and loading address I tested with 0x0 and 0x400000, because I see some offsets in binary (L.E) like:


So I guess loading must be close to that offset but no successful, only got garbage fucntions. The first 0xB0 data from file is like this:


And these flags are before gzip header:

    2E 6B65726E656C -> kernel
    004B5F40 -*
    004B5F40 -* Offset where kernel is decompressed?
    00400600 -> ?
    1F8B0800 -> gzip

Hope someone could help me in someway.

Many thanks in advance.


Seems to be ARCompact code:

CODE:00000000                 mov     r1, 0
CODE:00000004                 mov     r2, 0
CODE:00000008                 mov     r3, 0
CODE:0000000C                 mov     r4, 0
CODE:00000010                 mov     r5, 0
CODE:00000014                 mov     r6, 0
CODE:00000018                 mov     r7, 0
CODE:0000001C                 mov     r8, 0
CODE:00000020                 mov     r9, 0
CODE:00000024                 mov     r10, 0
CODE:00000028                 mov     r11, 0
CODE:0000002C                 mov     r12, 0
CODE:00000030                 mov     r13, 0
CODE:00000034                 mov     r14, 0
CODE:00000038                 mov     r15, 0
CODE:0000003C                 mov     r16, 0
CODE:00000040                 mov     r17, 0
CODE:00000044                 mov     r18, 0
CODE:00000048                 mov     r19, 0
CODE:0000004C                 mov     r20, 0
CODE:00000050                 mov     r21, 0
CODE:00000054                 mov     r22, 0
CODE:00000058                 mov     r23, 0
CODE:0000005C                 mov     r24, 0
CODE:00000060                 mov     r25, 0
CODE:00000064                 mov     r0, 0
CODE:00000068                 jl      0x40230980
CODE:00000070                 mov     sp, 0x402BB848
CODE:00000078                 mov     gp, 0x402B5960
CODE:00000080                 mov.f   r2, 0
CODE:00000088                 jlne    [r2]
CODE:0000008C                 mov     fp, 0
CODE:00000090                 jl      0x40229EDC
CODE:00000098                 b       loc_A0

The load base could be 40000000 or 40200000, but might be something else too.

  • Thanks for answer, I have tried those base addresses and after press 'c' I get same result, but does not appear all functions, then I select all file and press 'c' again and functions seems to be garbage again. The offset I check for confirm the functions are ok is 0x00104968 in plain file, this offset is a 0x70 key that must be xored. Here is the file file.town/download/vwy508j3uyljbgybp3vtx8gqo – numind Jan 5 '18 at 13:03
  • I found xor key offset, 0x00104968 ^ 0x00106170, at least it makes xor with this offset, need to find out entry point for check more coincidences... – numind Jan 5 '18 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.