I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.
I have already gathered the followed information and data:
- The system uses ARM processors and I know their revision (ARM9, and ARM11 exactly)
- The system has NX bit enabled (so it has a MMU I think). Aditionally, some critical applications run on the baremetal, while common user programs run on virtual memory
- RAM contents are unencrypted. Using a hardware set-up, I have memory dumps.
So, I have the memory dumps. What would be an efficient approach?
First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?
Secondly. The dump is not encrypted. I can find strings, references to strings of programs that run in the system, etc... I guess I can also find code (like .text sections in PC but whatever are called in this system) which I should be able to reverse. Is this theory right? if so, how to put it in practice? how can I find pieces of code? I have tried entropy, which seems to be quite useful; code tends to have high entropy. Technically speaking, how would I load that code in IDA properly?
Everything is welcome
EDIT: Run binwalk over the ram dumps. Pretty interesting: https://gist.github.com/pedro-javierf/2476a1f4f0db72b785e414f77c273512