I'm trying to reverse a V850E binary (it was extracted from an official update), however, IDA doesn't recognize anything at all.

In order to do that, I select a V850 or V850E1 processor type and leave disassembly memory organization as is by default. IDA gives a message "IDA can not identify the entry point automatically as there is no standard of binaries. Please move to what you think is an entry point..". I click OK and all I see is one unexplored piece. enter image description here I came across several examples for V850 when there was no initial information on the entry point location as well, but IDA in their case was able to recognize pieces of code like this: enter image description here I tried another binary for V850 from completely another firmware and I got the same result - nothing is identified!

Some observations:
- I tried using radare2 software and it was able to recognize the majority of the code
- I tried using another processor type in IDA (e.g. MetaPC) for the same binary and IDA was able to recognize a lot.
- First 17FF lines of the binary are zeros. I don't know if it's a placeholder for the bootloader or something else and it imposes any problems on IDA.

Any thoughts?


Try this:

    for i in Functions():
        print "function start = " + hex(GetFunctionAttr(i, FUNCATTR_START))
        print "function end = " + hex(GetFunctionAttr(i, FUNCATTR_END)) 
        GetManyBytes(GetFunctionAttr(i, FUNCATTR_START), GetFunctionAttr(i, FUNCATTR_END) - GetFunctionAttr(i, FUNCATTR_START), 0)

I have found this python script some time ago somewhere on the net. I will find all functions for you. Verify it!

  • This code will only list functions that are already recognized by IDA. It will not, as OP intends, recognize new functions. – NirIzr Feb 11 at 14:54
  • OK good to know. I am new to RE and learning very much at the moment. – crypted Feb 11 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.