Tons of error bookmark on Ghidra

Question

I'm new to Ghidra so go easy on me. Running it on Windows.

After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to read some of its original source code, even though I understand it won't be as clean as the original.

But, after analyzing the bin file, I get tons of error. Architecture used/tried to solve this issue was both the ARM Cortex LE 32 bit and the ARM v6 LE 32 bit. Looked for solutions on the internet and I did not find anyone with the same issue. All of the errors are Bad Instruction.

Here's pictures of two different analyze:

Without ARM Aggressive Instruction Finder (Prototype)

With ARM Aggressive Instruction Finder (Prototype)

The reason I posted two pictures of my code browser because those two different analysis gave me different amount of bookmark. I know it's because of the Instruction Finder but who knows this might help you to help me.

I have also tried adding a line into my ia.sinc file as suggested by a user named nsadeveloper789 on a GitHub issue but it did not solve my issue. I have also tried the No Return method from a PDF lesson (page 11) and no luck as well.

Did used SVD-Loader as well but still doesn't solve the issue as the SVD-Loader's script itself might have an issue and I've commented on this issue on GitHub (currently no specific solution). You can have a look at this issue here.

Does anyone knows how to solve this issue? I've been trying for a week or two now and even asked this in the unofficial Ghidra's Discord group but no answer yet.

Looking forward for your answers. Thanks in advance.

Here's a link to download the bin file: https://filebin.net/5abhimciwdfr5gfi

Answer 1

The firmware is incorrectly dumped. In your file all occurrences of the byte 0A have been replaced with 0D 0A. Looks like a line ending issue. May be the tool which you have used to dump the firmware have prepended a 0D to each 0A.

After replacing all instances of 0D 0A with 0A, it has an exact size of 256 KiB (262144 bytes) as it should be. Previously it had a size of 263788 bytes ~ 257.6 KiB.

For reference, I've uploaded the fixed firmware here

$ ./sfk196-linux-64.exe replace dump.bin  -binary /0d0a/0a/ -yes
[total hits/matching patterns/non-matching patterns]
[1644/1/0] dump.bin   -1644 bytes
1 files checked, 1 changed.

$ du -b dump.bin
262144  dump.bin

Further you can use nrf5x-tools on the fixed firmware to verify.

$ python3 ./nrfident.py bin ../dump.bin 2>/dev/null
############################ nRF5-tool ############################
#####                                                         #####
#####                Identifying nRF5x firmwares              #####
#####                                                         #####
###################################################################


Binary file provided ../dump.bin

Computing signature from binary
Signature:  26d6240e598f89b8aeabcecb96f3c5595b07bfc315b969a13aca34b2e61a7dc0
Searching for signature in nRF.db
=========================
SDK version:  8.1.0
SoftDevice version: s110
NRF: nrf51822
=========================
SDK version:  9.0.0
SoftDevice version: s110
NRF: nrf51822
=========================
SDK version:  10.0.0
SoftDevice version: s110
NRF: nrf51822
=========================
SDK version:  8.0.0
SoftDevice version: s110
NRF: nrf51822
                               ==================
nRF5x signature written to file nRF_ver in current directory
nRF_ver path must be provided when running nrfreverse.py from IDA

                                     *****
                                  Binary mapping
                                     *****

SoftDevice  :  s110
Card version :  xxaa
           *****
RAM address  :  0x20002000
RAM length   :  0x2000
ROM address  :  0x18000
ROM length   :  0x28000

                                     *****
                                  Binary mapping
                                     *****

SoftDevice  :  s110
Card version :  xxab
           *****
RAM address  :  0x20002000
RAM length   :  0x2000
ROM address  :  0x18000
ROM length   :  0x8000

                                     *****
                                  Binary mapping
                                     *****

SoftDevice  :  s110
Card version :  xxac
           *****
RAM address  :  0x20002000
RAM length   :  0x6000
ROM address  :  0x18000
ROM length   :  0x28000

Loading the binary in Ghidra using the language ARM-Cortex-32-little, the code is readable.

There are still some errors but those are because I have not created the memory segments. For more information look into the nRF51 Series Reference Manual, Section - 5.