-1

I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.

My goal is to know the specific way used by CC2650 to generate the LTK.

I'll appreciatte the answers.

  • What is the exact format of the CC2650 hex file - Intel hex? What is TI? What is LTK? Where can we obtain this file? – julian Oct 4 '18 at 16:51
  • Sorry for not being so specific: 1. ARM Cortex-M3 2. TI: Texas Instrument 3. LTK: Long Term Key 4. Hex file: ufile.io/lyxf2 – sfl0r3nz05 Oct 4 '18 at 17:03
1

First, convert the file from Hex to a raw binary using srec_cat or objcopy

Then take a look at an entropy plot, a hex dump, and the output of strings to check the state of the converted file. Here is a snippet of a hex dump of the converted file:

$ hexdump -C -n 256 sensor.bin 
00000000  00 37 00 20 c9 0b 00 00  d9 0b 00 00 db 0b 00 00  |.7. ............|
00000010  dd 0b 00 00 dd 0b 00 00  dd 0b 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 dd 0b 00 00  |................|
00000030  dd 0b 00 00 00 00 00 00  dd 0b 00 00 dd 0b 00 00  |................|
00000040  dd 0b 00 00 dd 0b 00 00  dd 0b 00 00 dd 0b 00 00  |................|
*
000000c0  dd 0b 00 00 dd 0b 00 00  df f8 e8 13 09 68 c1 f3  |.............h..|
000000d0  04 61 16 29 a8 bf 20 39  01 eb 20 71 49 1c 16 29  |.a.).. 9.. qI..)|
000000e0  a8 bf 15 21 04 da 6f f0  09 02 91 42 b8 bf 11 46  |...!..o....B...F|
000000f0  01 f0 1f 01 df f8 c0 23  41 f4 f8 51 11 80 df f8  |.......#A..Q....|
00000100

Next, check to see if you can find the entry point and attempt to begin disassembly there for the given architecture. Beginning disassembly at offset 0xC0 seems like a good guess. I used r2 to perform the disassembly (note that "sensor.bin" is the name I gave to the binary converted from the CC2650 Hex file):

$ r2 -a arm -b 16 sensor.bin       <-------  for ARM Thumb instruction set arch
 -- SHALL WE PLAY A GAME?
[0x00000000]> s 0xc0               <-------- seek to offset 0xC0
[0x000000c0]> pd                   <-------- print disassembly 
            0x000000c0      dd0b           lsrs r5, r3, 0xf
            0x000000c2      0000           movs r0, r0
            0x000000c4      dd0b           lsrs r5, r3, 0xf
            0x000000c6      0000           movs r0, r0
            0x000000c8      dff8e813       ldr.w r1, [0x000004b8]      ; [0x4b8:4]=0x4008626e
            0x000000cc      0968           ldr r1, [r1]
            0x000000ce      c1f30461       ubfx r1, r1, 0x18, 5
            0x000000d2      1629           cmp r1, 0x16
        ,=< 0x000000d4      a8bf           it ge
        `-> 0x000000d6      2039           subs r1, 0x20
            0x000000d8      01eb2071       add.w r1, r1, r0, asr 28
            0x000000dc      491c           adds r1, r1, 1
            0x000000de      1629           cmp r1, 0x16
        ,=< 0x000000e0      a8bf           it ge
        `-> 0x000000e2      1521           movs r1, 0x15
        ,=< 0x000000e4      04da           bge 0xf0
        |   0x000000e6      6ff00902       mvn r2, 9
        |   0x000000ea      9142           cmp r1, r2
       ,==< 0x000000ec      b8bf           it lt
       `--> 0x000000ee      1146           mov r1, r2
        `-> 0x000000f0      01f01f01       and r1, r1, 0x1f
            0x000000f4      dff8c023       ldr.w r2, [0x000004bc]      ; [0x4bc:4]=0x40090000
            0x000000f8      41f4f851       orr r1, r1, 0x1f00
            0x000000fc      1180           strh r1, [r2]
            0x000000fe      dff8bc13       ldr.w r1, [0x000004c2]      ; [0x4c0:4]=0x432a0494
            0x00000102      0968           ldr r1, [r1]
            0x00000104      8907           lsls r1, r1, 0x1e
        ,=< 0x00000106      4fbf           iteee mi
        `-> 0x00000108      40f04060       orr r0, r0, 0xc000000
            0x0000010c      0021           movs r1, 0
            0x0000010e      dff8b023       ldr.w r2, [0x000004c6]      ; [0x4c4:4]=0x43200000
            0x00000112      1160           str r1, [r2]
            0x00000114      dff8ac13       ldr.w r1, [0x000004c8]      ; [0x4c8:4]=0x400ca000
            0x00000118      c0f3c062       ubfx r2, r0, 0x1b, 1
            0x0000011c      82f00102       eor r2, r2, 1
            0x00000120      c0f38060       ubfx r0, r0, 0x1a, 1
            0x00000124      0a60           str r2, [r1]
            0x00000126      80f00100       eor r0, r0, 1
            0x0000012a      8860           str r0, [r1, 8]
            0x0000012c      7047           bx lr
            0x0000012e      70b5           push {r4, r5, r6, lr}
            0x00000130      0546           mov r5, r0
            0x00000132      82b0           sub sp, 8
            0x00000134      0846           mov r0, r1
            0x00000136      00f0eef8       bl 0x316
            0x0000013a      0246           mov r2, r0
            0x0000013c      dff88843       ldr.w r4, [0x000004cc]      ; [0x4cc:4]=0x50001370
            0x00000140      1821           movs r1, 0x18
            0x00000142      00f060f8       bl 0x206
            0x00000146      00f012f9       bl 0x36e
            0x0000014a      80b2           uxth r0, r0
            0x0000014c      0090           str r0, [sp]
            0x0000014e      0023           movs r3, 0
            0x00000150      40f2ff32       movw r2, 0x3ff
            0x00000154      2c21           movs r1, 0x2c               ; ','
            0x00000156      2046           mov r0, r4
            0x00000158      00f031fa       bl 0x5be
            0x0000015c      dff86c63       ldr.w r6, [0x000004d0]      ; [0x4d0:4]=0xfcffff
            0x00000160      f068           ldr r0, [r6, 0xc]
            0x00000162      c0f30d02       ubfx r2, r0, 0, 0xe
            0x00000166      1c21           movs r1, 0x1c
            0x00000168      00f04df8       bl 0x206
            0x0000016c      7068           ldr r0, [r6, 4]
            0x0000016e      00f0fc32       and r2, r0, 0xfcfcfcfc
.
.
<snip>

The disassembly seems OK. I am not familiar with ARM assembly variants, however. The absence of invalid disassembly is a good sign.

That should be enough information to get you started with your decompiler of choice.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.