3

I'm looking for the CPU/Instruction-Set of a closed embedded system.

Code snippet:

E6 F2 F3 15  E6 F3 0A EF  E6 F8 9B 7F  E6 F9 5B D5  0D 32 49 94 EA 30 60 71

What I know:

  1. E6 Fx is "LDR 16-Bit-Word immediate" or "XOR 16-Bit-Word immediate".
  2. 16-Bit-Word behind E6 Fx is in little endian format.

New insights. I'll think this is the start of the boot loaader. The data was read with upload command "Read address=0xC00000 length=256" from the embedded system; 0xC00000 is the lowest address which is accepted.

FA C0 9E 27 10 C7 01 00 03 00 01 00 80 41 01 00
27 C6 01 00 02 00 01 00 D8 41 01 00 11 C7 01 00
01 00 01 00 02 42 07 00 2E 86 02 00 01 00 02 00
12 42 01 00 31 C6 03 00 03 00 03 00 98 41 01 00
34 B6 02 00 00 00 00 00 00 00 09 00 36 B6 02 00
00 00 00 00 00 00 0A 00 37 A6 00 00 00 00 00 00
00 00 0B 00 3E C7 01 00 01 00 01 00 0A 42 0C 00
22 97 02 00 00 00 00 00 00 00 0D 00 34 44 C0 00
E4 44 C0 00 80 37 C0 00 56 41 C0 00 18 34 C0 00
24 30 C0 00 B2 2B C0 00 40 43 C0 00 E8 1F C0 00
86 11 C0 00 50 19 C0 00 F0 31 C0 00 BA 44 C0 00
5C 44 C0 00 86 36 C0 00 EC 21 C0 00 54 44 C0 00
00 00 00 00 64 10 B7 1D C8 20 6E 3B AC 30 D9 26
90 41 DC 76 F4 51 6B 6B 58 61 B2 4D 3C 71 05 50
20 83 B8 ED 44 93 0F F0 E8 A3 D6 D6 8C B3 61 CB
B0 C2 64 9B D4 D2 D3 86 78 E2 0A A0 1C F2 BD BD
09 08 01 00 86 2C C0 00 5A 24 C0 00 E4 44 C0 00
  • 1
    If the instruction set is not known, how can you be sure that the snippet provided is indeed code and not data? If the binary file the above sample originates from cannot be shared, please provide more exemplars. – julian Jun 12 '18 at 21:43
  • 2
    where did you get the info about XOR instruction? What else is known? – Igor Skochinsky Jun 12 '18 at 22:06
  • Could it be MIPS 32 Big Endian if by any chance the assumption about xor is incorrect ? – w s Jun 13 '18 at 8:19
  • This are XOR Masked used in a routine to calculate keys. – Holger Jun 13 '18 at 21:26
  • 1
    Any more information you can provide about the embedded system itself? Also I am unsure about your statement. Do you mean the bytes you show above are obfuscated with simple xor? – 0xC0000022L Jun 17 '18 at 20:26
1

Check this out: https://en.wikipedia.org/wiki/StrongARM (your chip might be one of those).

The LDR encoding on the SA1110 is quite similar (E5 9x):

     LDR R0,[R1,#0x38] 38 00 91 E5
     LDR R0,[R5]       00 00 95 E5
     LDR R2,[R3]       00 20 93 E5
     LDR R1,[R6]       00 10 96 E5

Definitely an ARM chip.

Intel doc

StrongARM SA1110 Opcodes

Hotchips SA1500 presentation

ARM Arch. ref. manual of that era (1995) It contains the instruction encoding which might lead you to something.

I'll dig deeper and edit later on if I find something more conclusive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.