I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done:
I got access to the SWD interface (it's like jtag but arm specific) and i can debug stuff through gdb. I have begun by taking a look at the main CPU, the datasheet says '128MHz high cpu performance processor', so i can assume it's an ARM Cortex (maybe M3).
In memory i found the vector table (placed at 0) and the reset handler (0x4). By now i can start reading code from the entry point (reset handler). But the code is big and reading all of that through gdb is annoying, but most important i don't know where things are. Well, through the vector table i know where the stack and entry point are. I have the locations of some interrupts that are used in the chip but nothing more. The question is, can i figure out the memory map from this few information ? How your approach would be with this sort of "challenge" ? Thank you :)


If you have SWD you should be able to get at least the device ID or determine the device family. For example, most Cortex-M devices have a pretty uniform memory map. You can also probe memory reads (e.g. each 0x1000 bytes) to determine what addresses are valid.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.