I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open in IDA Pro and continue working on.
However, I am having a much more difficult time doing this with the RTOS side of the firmware. In my target firmware image, I was able to identify that the RTOS sits above the Linux filesystems in memory address, by performing some string searches for common RTOS-related things. The code is definitely ARM, likely 32 bit, little-endian. This is a Cortex-A7. I saw artifacts which indiciate that it is also likely an ITRON RTOS or perhaps FreeRTOS. But essentially, binwalk extracted 3-4 chunks of "data" files which contain all of this. So I am able to get some useful info from looking at string offsets in these chunks. Seeing as most of the data appear to be strings and ARM instructions, I've opened them in IDA Pro. IDA Takes A LONG TIME to parse, but once they're parsed, everything is just data and needs to be manually turned into code. This is where I'm hung-up. I have 2 main questions:
- Does an RTOS system like this have a proper "file system" that I could "mount" to view the binaries like I did with the Linux ext and squashfs ones? All filesystems I've ever worked with using binwalk have been Linux ones. What are common RTOS file systems if this is the case?
- If not, how can I go about viewing the ARM disassembly of these chunks in a legible way using IDA Pro?