Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller: https://www.youtube.com/watch?v=_9ErnoLVxCA
Alex Ionescu: https://www.youtube.com/watch?v=nSqpinjjgmg&t=1164s
ANDREA BARISANI & DANIELE BIANCO: https://www.youtube.com/watch?v=4MBbMZ6M6Vw&list=PLPvhiAXwrC33Wv1zNC5uy1rrKO1JhlegM&index=6&t=2898s
At github you can find the original ".smc" firmware hex file and the extracted converted ".bin" file:
https://github.com/rajhlinux/smc
If you watch these interesting videos you can see that they all clearly and easily hacked into the Apple SMC Update file.
Alex Ionescu wrote a tool to extract the data from the Apple SMC update firmware file but he never made the tool available to the public, so I made my own tool that extracts the data from the "2012MBA13.smc" file. I basically extracted the hex data and converted it into Binary but IDA Pro just can't understand it.
So my first question is, did I extract the correct lines of data from the "2012MBA13.smc" firmware file?
Original "2012MBA13.smc" Firmware SMC file:
Data extracted from the "2012MBA13.smc" firmware file:
Extracted Hex Data converted to Binary:
So I hope I extracted the correct data lines, a total of 1920 64-Bytes data lines.
You can find all the details about the Apple Mid 2012 MacBook Air SMC's ARM Cortex M4F TI Stellaris LMFS 32Bit Microprocessor at the Github link above.
IDA Pro, starting at address 0x0004, "jump to operand" at address 0x0251, but The least-significant bit of each vector must be 1, indicating that the exception handler is Thumb code, so at address at 0x0250 I press "c" on IDA pro and I only got three functions:
So my Apple SMC firmware file is similar to Alex because I checked the strings and found the unlock password key.
What am I doing wrong which IDA pro is not able to disassemble the bin file? The "List of problems" which IDA pro is giving is the following:
Address Type Instruction ROM:0000024F NODISASM DCB 0
In IDA pro "NODISASM" means it can't disassemble the code.
However I did disassemble the entire binary file using the ARM GDB, but that doesn't help much. I need to use IDA.