Reverse engineering MCU with "poor" datasheet

Question

I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done:
I got access to the SWD interface (it's like jtag but arm specific) and i can debug stuff through gdb. I have begun by taking a look at the main CPU, the datasheet says '128MHz high cpu performance processor', so i can assume it's an ARM Cortex (maybe M3).
In memory i found the vector table (placed at 0) and the reset handler (0x4). By now i can start reading code from the entry point (reset handler). But the code is big and reading all of that through gdb is annoying, but most important i don't know where things are. Well, through the vector table i know where the stack and entry point are. I have the locations of some interrupts that are used in the chip but nothing more. The question is, can i figure out the memory map from this few information ? How your approach would be with this sort of "challenge" ? Thank you :)

Answer 1

If you have SWD you should be able to get at least the device ID or determine the device family. For example, most Cortex-M devices have a pretty uniform memory map. You can also probe memory reads (e.g. each 0x1000 bytes) to determine what addresses are valid.

Answer 2

If you touched vector table, first entry is initial value for stack pointer. In the most cases it is set to highest possible RAM address. If it's for example 0x2000A000, then you know you have MCU with 40KB RAM. It make it easier later if your MCU is not custom chip but duplicate of some known MCU from ST, NXP or other vendor.

Maybe try some official tools from other vendors and you will catch your chip and it will make dumping flash memory much easier.

Anyway you can try reading from address 0x1FFFF7E0 where should be place size flash memory size (at least in ST MCUs). From the other hand as Igor said you can try to download chunks of flash and later built it together. Later when you will have full content, you can try to feed online disassembler with you code and with trial-error process find your core.