1

I'm reversing a firmware, that comes in one big binary chunk(.bin file).

After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original segment into those two segments.

For example:

Original file segments:

Name   start   end
ROM    0x0     0x21bd

One big segment containing all the code and data.

Desired result segments:

 Name  start   end
.text  0x0     0x11bd 
.data  0xc000  0xd000

I want to split the one big segment into two nonadjusted segments, like this. the .data section should hold the bytes from the original ROM section. In other words, 0x11bd - 0x21bd from the original ROM section should be copied to 0xc000 - 0xd000 of the new data section.

Any ideas how can I achieve this?

1

Open the segments window in IDA. Go to edit that one big segment you have. Change the name to .text and edit the permissions as applicable. Uncheck "Move adjacent segments" and "Disable addresses", this step is very important, it's what prevents the actual segment data from being deleted. Change the end address to be the end of the .text segment. Click ok and confirm the edit. Right click, and select "Add segment", set the name to .data and fill in the start and end addresses as the addresses it was previously loaded at. Then go to Edit -> Segments -> Move current segment to select the correct start address.

  • will this copy what is at 0x11be to 0xc000 as asked ? – blabb Jul 17 at 20:26
  • @blabb I edited it, it will now. – Avery3R Jul 18 at 2:19
  • thanks good to know so that I can do it without 0x00 filler bytes inbetween – blabb Jul 18 at 4:55
  • I followed your instructions, but I keep getting .data: not enough free room at the target address. It seems that I get it only when I copy it to the address that I actually need, but if I copy it to other locations it works fine. Any ideas why? – macr0controller Jul 18 at 8:06
  • @Train What step do you get that error message during? When you move the segment or when you create it? – Avery3R Jul 18 at 21:14
1

i've always found it easier to split and join the file outside of ida to what is needed and just create segments using edit ->segment->createSegment with proper start and end address rather that dealing with move_segment headache which will keep on saying no room blah blah , bad base blah blah etc etc ..

may be someone with better ida experience would give a proper ida way to do what you ask

here is a simple splitter for your case

forig = open('f://somrom.bin' , 'rb')
part1 = forig.read(0x11be)
forig.seek(0x11be,0)
part2 = forig.read(0x1000)
arr = bytearray(0xc000-0x11be)

ffinal = open('f:\\somromfinal.bin','wb')
ffinal.write(part1)
ffinal.write(arr)
ffinal.write(part2)
ffinal.close()
forig.close()

you can check to see if it is split properly

xxd.exe -g 1 -l 16 -s 0x11b0 somrom.bin
000011b0: 8c 08 31 2d 09 8a c1 7d 19 39 2b 83 e5 e3 57 ed  ..1-...}.9+...W.

xxd.exe -g 1 -l 16 -s 0x11b0 somromfinal.bin
000011b0: 8c 08 31 2d 09 8a c1 7d 19 39 2b 83 e5 e3 00 00  ..1-...}.9+..... 

<<<<<<<<0x11be bf =00

xxd.exe -g 1 -l 16 -s 0xc000 somromfinal.bin
0000c000: 57 ed 37 31 e2 31 2d 98 18 6f 53 36 59 4e ad 92  W.71.1-..oS6YN..
<<<<< 0xc000 start with 0x57 ed

you can load this file in ida
and just create three segments
0000 to 11bd
11be to bfff
c000 to d000

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.