Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Is there any way to differentiate different microcontroller's hex files? I have a hex file and now I have forgotten of which micro-controller it belongs. Is there any available tool to tell this? or any tip or trick to know?
Edit: There is a similar question here, But this question specifically belongs to PIC family while I what if we have to differentiate from different families like AVR, 8051, PIC etc.
My first idea would be to perform a frequency analysis on aligned bytes. For most of the assembly languages, the most relevant bytes are aligned on the most significant bits.
So it might be quite easy to create a distinguer that can recognize the type of asm. But, suprisingly, after a few googling, I didn't find any tool or paper about this...
Maybe there is something to do here.
I don't know of tools designed for this. In practise, loading it into IDA (or any other disassembler) with different architectures until it looks right is probably the easiest way to do it. You might be able to write a script to automate this.
If you want to build your own tool, I suggest you look at Christopher Domas's talk "The future of RE Dynamic Binary Visualization". It discusses a number of techniques that can be used to analyse unknown data. The general idea graph the frequency of every group of two or three bytes in each file. The graphs are distinctly different between different architectures, and could be used to automatically identify data types. The actual tool, and the dataset you would need, is not publicly available, but this is the way I would go if I wanted to do automatic architecture detection.
A simpler approach would be to search for function prologue patterns in different architectures. Although the implementation is simpler, it would take more human-time to prepare the dataset (because identifying function prologues cannot be automated). Some processors may not be powerful enough to run C code, and if the code is not compiled it's possible to not have predictable function prologues. You may be able to find other common operations that you could search for.
Try to get an idea of what kinds of CPUs it could target. You can probably also guess the bit length of the CPU by looking at this file (file_size % 32 == 0? Probably 32 bit). Once you have a simple list, run the binary through some disassemblers and see if the code makes sense. Try running it in some emulated CPUs and see if it does anything.
Also, keep in mind that invalid instructions might not mean you've got the wrong CPU, it could just be data or something. It's actually probably worth checking out the file to see if you can't find any strings or anything, just to get a better sense of where things are.
