2

I have a file called bios.bin which is the firmware of an ATM machine and I have found out it is x86 code 16-bit. But I don't understand how I'm supposed to set the base address in IDA Pro for an x86 processor.

  • reverseengineering.stackexchange.com/questions/19885/… says to load at F000:0000 – sudhackar Nov 28 '18 at 7:52
  • Does IDA recognize this as BIOS image? If it does, it should pick the appropriate loader and it will do the job for you. It may be valuable information which IDA version you're actually using, by the way (free, pro) ... – 0xC0000022L Nov 28 '18 at 9:27
  • 1
    @sudhackar I guess the issue isn't where to load it but rather how to accomplish this in IDA. – 0xC0000022L Nov 28 '18 at 9:32
3

You may use BOCHS x86 to emulate the 16 bit image and debug it using IDA pro. enter image description here

This is an example of bootloader of PETYA ransomware.

enter image description here

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.