2

I have a file called bios.bin which is the firmware of an ATM machine and I have found out it is x86 code 16-bit. But I don't understand how I'm supposed to set the base address in IDA Pro for an x86 processor.

  • reverseengineering.stackexchange.com/questions/19885/… says to load at F000:0000 – sudhackar Nov 28 '18 at 7:52
  • Does IDA recognize this as BIOS image? If it does, it should pick the appropriate loader and it will do the job for you. It may be valuable information which IDA version you're actually using, by the way (free, pro) ... – 0xC0000022L Nov 28 '18 at 9:27
  • 1
    @sudhackar I guess the issue isn't where to load it but rather how to accomplish this in IDA. – 0xC0000022L Nov 28 '18 at 9:32
3

You may use BOCHS x86 to emulate the 16 bit image and debug it using IDA pro. enter image description here

This is an example of bootloader of PETYA ransomware.

enter image description here

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.