3

I'm looking for the CPU/Instruction-Set of a closed embedded system.

Code snippet:

E6 F2 F3 15  E6 F3 0A EF  E6 F8 9B 7F  E6 F9 5B D5  0D 32 49 94 EA 30 60 71

What I know:

  1. E6 Fx is "LDR 16-Bit-Word immediate" or "XOR 16-Bit-Word immediate".
  2. 16-Bit-Word behind E6 Fx is in little endian format.

New insights. I'll think this is the start of the boot loaader. The data was read with upload command "Read address=0xC00000 length=256" from the embedded system; 0xC00000 is the lowest address which is accepted.

FA C0 9E 27 10 C7 01 00 03 00 01 00 80 41 01 00
27 C6 01 00 02 00 01 00 D8 41 01 00 11 C7 01 00
01 00 01 00 02 42 07 00 2E 86 02 00 01 00 02 00
12 42 01 00 31 C6 03 00 03 00 03 00 98 41 01 00
34 B6 02 00 00 00 00 00 00 00 09 00 36 B6 02 00
00 00 00 00 00 00 0A 00 37 A6 00 00 00 00 00 00
00 00 0B 00 3E C7 01 00 01 00 01 00 0A 42 0C 00
22 97 02 00 00 00 00 00 00 00 0D 00 34 44 C0 00
E4 44 C0 00 80 37 C0 00 56 41 C0 00 18 34 C0 00
24 30 C0 00 B2 2B C0 00 40 43 C0 00 E8 1F C0 00
86 11 C0 00 50 19 C0 00 F0 31 C0 00 BA 44 C0 00
5C 44 C0 00 86 36 C0 00 EC 21 C0 00 54 44 C0 00
00 00 00 00 64 10 B7 1D C8 20 6E 3B AC 30 D9 26
90 41 DC 76 F4 51 6B 6B 58 61 B2 4D 3C 71 05 50
20 83 B8 ED 44 93 0F F0 E8 A3 D6 D6 8C B3 61 CB
B0 C2 64 9B D4 D2 D3 86 78 E2 0A A0 1C F2 BD BD
09 08 01 00 86 2C C0 00 5A 24 C0 00 E4 44 C0 00
Improve this question
6
  • 1
    If the instruction set is not known, how can you be sure that the snippet provided is indeed code and not data? If the binary file the above sample originates from cannot be shared, please provide more exemplars.
    – julian ♦
    Jun 12, 2018 at 21:43
  • 2
    where did you get the info about XOR instruction? What else is known?
    – Igor Skochinsky ♦
    Jun 12, 2018 at 22:06
  • Could it be MIPS 32 Big Endian if by any chance the assumption about xor is incorrect ?
    – w s
    Jun 13, 2018 at 8:19
  • This are XOR Masked used in a routine to calculate keys.
    – Holger
    Jun 13, 2018 at 21:26
  • 1
    Any more information you can provide about the embedded system itself? Also I am unsure about your statement. Do you mean the bytes you show above are obfuscated with simple xor?
    – 0xC0000022L ♦
    Jun 17, 2018 at 20:26

1 Answer 1

Reset to default
1

Check this out: https://en.wikipedia.org/wiki/StrongARM (your chip might be one of those).

The LDR encoding on the SA1110 is quite similar (E5 9x):

     LDR R0,[R1,#0x38] 38 00 91 E5
     LDR R0,[R5]       00 00 95 E5
     LDR R2,[R3]       00 20 93 E5
     LDR R1,[R6]       00 10 96 E5

Definitely an ARM chip.

Intel doc

StrongARM SA1110 Opcodes

Hotchips SA1500 presentation

ARM Arch. ref. manual of that era (1995) It contains the instruction encoding which might lead you to something.

I'll dig deeper and edit later on if I find something more conclusive.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.