2

I am trying to reverse engineer / research a black box system, this is, a system for which there is no public information at all. Let's say the system is a modern handheld console.

I have already gathered the followed information and data:

  • The system uses ARM processors and I know their revision (ARM9, and ARM11 exactly)
  • The system has NX bit enabled (so it has a MMU I think). Aditionally, some critical applications run on the baremetal, while common user programs run on virtual memory
  • RAM contents are unencrypted. Using a hardware set-up, I have memory dumps.

So, I have the memory dumps. What would be an efficient approach?

First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?

Secondly. The dump is not encrypted. I can find strings, references to strings of programs that run in the system, etc... I guess I can also find code (like .text sections in PC but whatever are called in this system) which I should be able to reverse. Is this theory right? if so, how to put it in practice? how can I find pieces of code? I have tried entropy, which seems to be quite useful; code tends to have high entropy. Technically speaking, how would I load that code in IDA properly?

Everything is welcome

EDIT: Run binwalk over the ram dumps. Pretty interesting: https://gist.github.com/pedro-javierf/2476a1f4f0db72b785e414f77c273512

Improve this question

1 Answer 1

Reset to default
2

First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?

IDA directly handles raw image, all you have to do is specify the ARM little-endian [ARM] in the processor type. Once it's loaded, your first challenge is to identify the memory layout.

Secondly. The dump is not encrypted. I can find strings, references to programs that run in the system, etc... I guess I can also find code (like .text sections in PC but whatever are called in this system) which I should be able to reverse. Is this theory right? if so, how to put it in practice? how can I find pieces of code? I have tried entropy, which seems to be quite useful; code tends to have high entropy. Technically speaking, how would I load that code in IDA properly?

The information requires is to know what kind of dump do you have, if you dump memory from a vulnerability, or from a JTAG, or whatever. The layout might be different.

Few examples:

  • If this is a raw dump, I would suggest to start with the address 0x0 and look for the Arm exception vector.
  • If you dump it from a flash memory, you might find files embedded inside with binwalker.
  • If there's a MMU, you could retrieve the page tables and recreate the virtual layout.
  • You could look for strings which are used by open source software (e.g. u-Boot, linux, ...) and retrieve function pointers to start to reconstruct the image.
  • And so on.

Hopefully you can provide further information about the target, that's sound interesting. :)

Improve this answer
7
  • Firstly, thanks for replying! I have edited the question to add a few more details. I think there is a MMU, because the system is known to have NX bit / DEP protection. Also some apps or small apps (applets) run in virtualized memory, while important applications, like system settings, updates.. run in the baremetal. Concerning your answer, this thing you say about retrieving page tables sounds very interesting, how would that work? Btw, my dumps are raw physical dumps of the RAM chip (actually a FCRam chip). I also have FCRam dumps done via exploit by other person and they are the same thing.
    – 78dtat78da
    Jan 2, 2019 at 22:34
  • Also. I think that (obviously) the RAM dumps are not enough to have a 100% insight of the system, but sure a lot of information since most programs memory is there. Other devices (hmm for example the NAND memory, other flash memories, etc..) should be accessible through physical addresses, so obviously those contents are not in my dumps. This is pretty interesting!
    – 78dtat78da
    Jan 2, 2019 at 22:40
  • 1
    This is really tedious and I forget how it works exactly, but take a look on the Arm manual and the page table entry, you have some relation between different level and physical address. I can't provide a concrete example at the moment, sorry. Something easier: you could force to disassemble every words, trying with both Arm and Thumb. Arm instructions usually contain the 0xEX on the instruction, like: XXXXXXEX XXXXXXEX XXXXXXEX ...
    – wisk
    Jan 2, 2019 at 23:49
  • 1
    Well, on IDA I select all addresses (focus on the first address and type SHIFT+END), press c and you can try both analyze or force. The idea is just to see if there's code inside your dump. You will probably have to start from scratch and define code more precisely afterward. Regarding the image base, I'd suggest to find jump table (switch) and from the case code below and the jump table addresses you could figure the image base.
    – wisk
    Jan 5, 2019 at 0:04
  • 1
    @PedroJavierFernández Try running binwalk on it as suggested. It should be a standard package in your Linux distro of choice, so a simple yum install or apt-get install should do it. That might identify full binary files in your dump, which will be easier to analyze.
    – knowmalware
    Jan 5, 2019 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.