IDA: NEC V850. Unable to identify anything

Question

I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all.

In order to do that, I select a V850 or V850E1 processor type and leave disassembly memory organization as is by default. IDA gives a message "IDA can not identify the entry point automatically as there is no standard of binaries. Please move to what you think is an entry point..". I click OK and all I see is one unexplored piece. I came across several examples for V850 when there was no initial information on the entry point location as well, but IDA in their case was able to recognize pieces of code like this: I tried another binary for V850 from completely another firmware and I got the same result - nothing is identified!

Some observations:
- I tried using radare2 software and it was able to recognize the majority of the code
- I tried using another processor type in IDA (e.g. MetaPC) for the same binary and IDA was able to recognize a lot.
- First 17FF lines of the binary are zeros. I don't know if it's a placeholder for the bootloader or something else and it imposes any problems on IDA.

Any thoughts?

Answer 1

When working with the architecture that you don't know, it's better to start with getting familiar with the assembler generated by the compiler for this architecture. If you google for "V850 compiler" you will find C Compiler and IDE for V850 Family at Renesas site. Most likely it's the compiler that was used by the firmware developers. Then you install the compiler and start to build helloworld-like examples to learn, how the code of the functions look like in disassembler, which bytes of the code are prolog and epilog. Thus you know what to look for in the firmware you try to disassemble, and know how to find the function start.

Answer 2

Try this:

    #!usr/bin/python
    for i in Functions():
        print "function start = " + hex(GetFunctionAttr(i, FUNCATTR_START))
        print "function end = " + hex(GetFunctionAttr(i, FUNCATTR_END)) 
        GetManyBytes(GetFunctionAttr(i, FUNCATTR_START), GetFunctionAttr(i, FUNCATTR_END) - GetFunctionAttr(i, FUNCATTR_START), 0)

I have found this python script some time ago somewhere on the net. I will find all functions for you. Verify it!