2

I got dump from ci module and after deflate compressed data, this time I can't find the data I am looking for without disassembly it, sometimes I can extract data manually, but this time file is a bit different.

So I have tried to load file and test with 2 possible targets, ARCompact and ARCTangent, and loading address I tested with 0x0 and 0x400000, because I see some offsets in binary (L.E) like:

207B2A40
347B2A40

So I guess loading must be close to that offset but no successful, only got garbage fucntions. The first 0xB0 data from file is like this:

4A2100004A2200004A2300004A240000
4A2500004A2600004A2700004A200010
4A2100104A2200104A2300104A240010
4A2500104A2600104A2700104A200020
4A2100204A2200204A2300204A240020
4A2500204A2600204A2700204A200030
4A2100304A2000002220800F23408009
0A24803F2B4048B80A22803F2B406059
0A22808F00000000E22082004A230030
2220800F2240DC9E090000006CD41640
692040004A2600704A2600704A260070

And these flags are before gzip header:

    48B82B40
    48B82B40
    00200300
    2E 6B65726E656C -> kernel
    0000000000
    004B5F40 -*
    004B5F40 -* Offset where kernel is decompressed?
    00400600 -> ?
    1F8B0800 -> gzip

Hope someone could help me in someway.

Many thanks in advance.

Improve this question

1 Answer 1

Reset to default
1

Seems to be ARCompact code:

CODE:00000000                 mov     r1, 0
CODE:00000004                 mov     r2, 0
CODE:00000008                 mov     r3, 0
CODE:0000000C                 mov     r4, 0
CODE:00000010                 mov     r5, 0
CODE:00000014                 mov     r6, 0
CODE:00000018                 mov     r7, 0
CODE:0000001C                 mov     r8, 0
CODE:00000020                 mov     r9, 0
CODE:00000024                 mov     r10, 0
CODE:00000028                 mov     r11, 0
CODE:0000002C                 mov     r12, 0
CODE:00000030                 mov     r13, 0
CODE:00000034                 mov     r14, 0
CODE:00000038                 mov     r15, 0
CODE:0000003C                 mov     r16, 0
CODE:00000040                 mov     r17, 0
CODE:00000044                 mov     r18, 0
CODE:00000048                 mov     r19, 0
CODE:0000004C                 mov     r20, 0
CODE:00000050                 mov     r21, 0
CODE:00000054                 mov     r22, 0
CODE:00000058                 mov     r23, 0
CODE:0000005C                 mov     r24, 0
CODE:00000060                 mov     r25, 0
CODE:00000064                 mov     r0, 0
CODE:00000068                 jl      0x40230980
CODE:00000070                 mov     sp, 0x402BB848
CODE:00000078                 mov     gp, 0x402B5960
CODE:00000080                 mov.f   r2, 0
CODE:00000088                 jlne    [r2]
CODE:0000008C                 mov     fp, 0
CODE:00000090                 jl      0x40229EDC
CODE:00000098                 b       loc_A0

The load base could be 40000000 or 40200000, but might be something else too.

Improve this answer
2
  • Thanks for answer, I have tried those base addresses and after press 'c' I get same result, but does not appear all functions, then I select all file and press 'c' again and functions seems to be garbage again. The offset I check for confirm the functions are ok is 0x00104968 in plain file, this offset is a 0x70 key that must be xored. Here is the file file.town/download/vwy508j3uyljbgybp3vtx8gqo
    – numind
    Jan 5, 2018 at 13:03
  • I found xor key offset, 0x00104968 ^ 0x00106170, at least it makes xor with this offset, need to find out entry point for check more coincidences...
    – numind
    Jan 5, 2018 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.