How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Question

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:

Charlie Miller: https://www.youtube.com/watch?v=_9ErnoLVxCA

Alex Ionescu: https://www.youtube.com/watch?v=nSqpinjjgmg&t=1164s

ANDREA BARISANI & DANIELE BIANCO: https://www.youtube.com/watch?v=4MBbMZ6M6Vw&list=PLPvhiAXwrC33Wv1zNC5uy1rrKO1JhlegM&index=6&t=2898s

At github you can find the original ".smc" firmware hex file and the extracted converted ".bin" file:

https://github.com/rajhlinux/smc

If you watch these interesting videos you can see that they all clearly and easily hacked into the Apple SMC Update file.

Alex Ionescu wrote a tool to extract the data from the Apple SMC update firmware file but he never made the tool available to the public, so I made my own tool that extracts the data from the "2012MBA13.smc" file. I basically extracted the hex data and converted it into Binary but IDA Pro just can't understand it.

So my first question is, did I extract the correct lines of data from the "2012MBA13.smc" firmware file?

Original "2012MBA13.smc" Firmware SMC file:

Data extracted from the "2012MBA13.smc" firmware file:

Extracted Hex Data converted to Binary:

So I hope I extracted the correct data lines, a total of 1920 64-Bytes data lines.

You can find all the details about the Apple Mid 2012 MacBook Air SMC's ARM Cortex M4F TI Stellaris LMFS 32Bit Microprocessor at the Github link above.

IDA Pro, starting at address 0x0004, "jump to operand" at address 0x0251, but The least-significant bit of each vector must be 1, indicating that the exception handler is Thumb code, so at address at 0x0250 I press "c" on IDA pro and I only got three functions:

So my Apple SMC firmware file is similar to Alex because I checked the strings and found the unlock password key.

What am I doing wrong which IDA pro is not able to disassemble the bin file? The "List of problems" which IDA pro is giving is the following:

Address Type Instruction ROM:0000024F NODISASM DCB 0

In IDA pro "NODISASM" means it can't disassemble the code.

However I did disassemble the entire binary file using the ARM GDB, but that doesn't help much. I need to use IDA.

Answer 1

2012MBP13.smc is an incomplete firmware. If you look at the address ranges in your smc payload, it starts with 00000000 (vectors table) and then jumps to 00006800, meaning ranges 00000800 to 00006000 are missing. These ranges include the bootloader and updater. So when trying to analyze the code, it's likely missing portions. Systems from 2013 Retina to 2017 use the newer styled payloads containing 4 parts, from which an entire smc firmware can be assembled. The only way to acquire the firmware for your model is to patch the MACA function in the payload, recalculate the checksums and then flash your patched payload with SMCUtil.efi. Then set KPPW and use MACR to read out the entire SMC. Once you have a complete image, you can then begin reversing it.

Tools can be found here: https://github.com/sadponyguerillaboy/SMC-Toolkit

For your IDA setup, set processor type as Arm Little Endian, set processor options as Armv7-M, Create Ram section (check box during setup), Ram start address: 0x20000000, size: 0x8000, create ROM section (check box), start address 0x0, Rom size: 0x40000.

VirtuaSMC's git has some basic setup info you might find useful: https://github.com/acidanthera/VirtualSMC/blob/master/Docs/SMCBasics.txt