3

I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below:

:03:8000:00:028100FA
:02:8003:00:XXXXXX
:02:800B:00:XXXXXX
:02:8013:00:XXXXXX
:01:801B:00:XXXX
:01:8023:00:XXXX
:10:802B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
:10:803B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
:10:804B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
:10:805B:00:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

How can I find out what type of processor (Intel/ARM/PIC/...) this file belongs to? And how can I disassemble it?

Frequency of bytes:

ebra@him:~$ cat single-byte-per-line | sort | uniq -c | sort -n
      1 
      3 59
      5 4C
      6 49
      6 57
      6 5D
      8 47
      8 48
      8 4A
      8 4E
      8 52
     10 C6
     11 7E
     11 8F
     11 9B
     12 51
     12 8E
     12 95
     12 9C
     12 9D
     12 B7
     12 CE
     13 CF
     14 27
     14 55
     14 56
     14 58
     14 5C
     14 7F
     15 73
     15 8D
     15 9E
     15 C7
     15 D6
     16 5F
     16 D7
     17 1B
     17 A5
     17 C8
     17 CB
     18 AF
     18 B1
     19 46
     19 5A
     19 8B
     19 C1
     20 D9
     20 ED
     21 72
     21 94
     21 A6
     22 43
     22 4F
     22 71
     22 AC
     22 B9
     22 C9
     23 9F
     23 A3
     23 BE
     24 42
     24 AD
     24 BD
     24 BF
     24 E9
     25 4D
     25 CC
     26 87
     26 A1
     26 B8
     26 E8
     27 69
     27 6F
     27 88
     28 F1
     29 53
     29 5E
     29 61
     29 77
     29 BC
     30 45
     30 AB
     31 1A
     32 86
     33 1E
     33 4B
     34 1C
     35 1F
     35 67
     36 BB
     36 EA
     37 98
     37 99
     37 DD
     37 F4
     37 FD
     38 2C
     38 B2
     40 3B
     40 EE
     41 25
     41 97
     41 E7
     42 2D
     42 D4
     42 EF
     43 1D
     43 8C
     44 5B
     44 96
     44 DC
     46 28
     46 3A
     46 D5
     46 DF
     46 F7
     46 FE
     47 76
     47 7D
     48 C5
     48 FC
     49 D8
     50 35
     53 0E
     53 B5
     57 BA
     57 E6
     58 A7
     58 C4
     58 CA
     59 19
     59 21
     59 AA
     62 3D
     62 A8
     63 93
     63 A9
     65 34
     65 8A
     65 B0
     65 F6
     67 AE
     67 D1
     68 31
     69 EC
     70 26
     70 41
     71 14
     71 81
     72 23
     72 3E
     72 65
     72 B6
     74 F8
     75 44
     75 6B
     76 64
     76 7C
     76 92
     77 FF
     78 37
     78 91
     78 B3
     79 2F
     80 A0
     82 38
     84 A2
     85 DA
     87 0D
     90 24
     91 6D
     91 A4
     93 18
     95 62
     95 CD
     96 0B
     96 3C
     99 68
     99 E4
    101 6C
    103 50
    106 63
    109 39
    109 3F
    109 DE
    111 6E
    112 6A
    115 E1
    116 36
    117 70
    117 89
    118 D3
    128 17
    131 FB
    134 D0
    137 54
    146 FA
    149 0C
    151 0A
    154 F9
    164 60
    173 C3
    174 2A
    183 DB
    184 C0
    185 29
    185 E3
    189 16
    191 83
    200 2E
    203 9A
    204 66
    207 F3
    212 15
    212 20
    220 0F
    221 7B
    226 7A
    240 33
    241 E2
    242 F5
    244 EB
    247 30
    247 32
    255 2B
    256 06
    261 10
    275 13
    284 07
    286 40
    288 E0
    309 84
    311 85
    313 03
    321 04
    325 22
    326 C2
    327 F2
    333 01
    333 79
    344 82
    353 90
    357 11
    362 F0
    376 80
    414 05
    422 78
    436 09
    467 74
    489 D2
    570 08
    656 E5
    889 B4
   1301 12
   1369 02
   1717 00
   2081 75

And if I extract all 2-byte sequences which starts with 75, I have:

ebra@him:~$ cat sequence-starts-with-75 | grep -o .... | sort | uniq -c | sort -n
      1 7505
      1 750D
      1 750E
      1 7514
      1 7519
      1 751F
      1 7521
      1 7522
      1 7526
      1 7527
      1 752D
      1 7530
      1 7545
      1 7547
      1 7548
      1 754D
      1 754F
      1 7557
      1 755F
      1 7560
      1 756F
      1 7570
      1 7571
      1 7572
      1 7573
      1 7581
      1 7587
      1 758B
      1 7594
      1 75A8
      1 75B8
      1 75C8
      1 75CA
      1 75CB
      1 75CC
      1 75CD
      1 75E5
      1 75F2
      2 7501
      2 7510
      2 751D
      2 7525
      2 7534
      2 7536
      2 753C
      2 753D
      2 7566
      2 758D
      2 7598
      2 7599
      2 75B4
      2 75D0
      2 75D4
      3 7523
      3 752F
      3 757A
      3 758C
      4 752E
      4 753A
      6 7535
      6 7537
      6 753B
      6 753F
      6 7567
      6 7569
      7 7500
      7 7540
      7 757B
      7 758A
      8 757C
      8 75A0
     10 7524
     11 7563
     11 7574
     11 7576
     11 7577
     11 7579
     12 7518
     13 7575
     14 752C
     16 7565
     16 7578
     17 7517
     17 75F0
     18 7528
     18 7564
     19 7539
     19 753E
     27 7562
     37 7515
     37 7583
     38 7516
     45 7533
     49 756A
     49 756B
     50 756C
     52 756E
     53 756D
     58 7532
     68 7512
     73 7568
    141 752B
    143 7529
    144 752A
    169 7582
    204 7513
    248 7511

For 3-bytes sequences which starts with 75:

    ebra@him:~$ cat sequence-starts-with-75 | grep -o ...... | sort | uniq -c | sort -n
  .. [Truncated] ...
  6 750075
  6 752B03
  6 752B08
  6 753269
  6 753F00
  6 756BA4
  6 757500
  6 757800
  6 758204
  6 758205
  6 75820B
  6 75F000
  7 75120A
  7 752801
  7 752B05
  7 756E08
  8 751101
  8 752910
  8 756BC0
  8 756D0C
  8 757400
  8 75A000
  9 751104
  9 752803
  9 758200
  9 758203
 10 752901
 10 752C80
 10 756BB2
 11 751864
 11 753200
 11 756ABC
 11 758208
 12 753290
 13 751210
 14 752B01
 14 752B10
 14 753910
 14 756C01
 14 75820F
 15 752B06
 16 753E00
 16 756BB0
 17 7517FF
 17 75326A
 17 753300
 18 752906
 19 756811
 19 756E00
 19 758209
 20 758201
 21 752904
 21 752B04
 22 756D00
 23 756C00
 24 75820A
 30 756A00
 34 758202
 35 752902
 36 758301
 37 752905
 46 752B02
 46 756810
 65 751103
 77 751102
 79 751100
142 752A00
3

This sounds analogous to given a document, infer the language.

I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for known processor types.

Effectively a unigram model. If you source the files in a common format I can give you a hand.

7
  • Awesome idea, I have updated the question. Would you please take a look? – Ebrahim Ghasemi Dec 25 '20 at 9:17
  • Can you point me to some index hex format files for various chips? – pythonpython Dec 25 '20 at 16:18
  • Unfortunately I have no clue. I'll share it if I could find any. – Ebrahim Ghasemi Dec 25 '20 at 18:44
  • I'll see what I can find for Intel/ARM/PIC. – pythonpython Dec 25 '20 at 18:50
  • 1
    Well, I opened the body of the device. lol. – Ebrahim Ghasemi Dec 26 '20 at 19:15
2

You can't - the Intel hex format doesn't hold this kind of data. You need to manually look for the correct architecture. You can use IDA or Ghidra for that and open in the following for each architecture it might be.

IDA

Then you need to disassemble the whole file and look if it makes sense. (Control flow, number of functions, xrefs,...)

Or of course, use some scripting for that.

2
  • Isn't there any processor/architecture-specific Instructions/Prolog in this file? As far as I know the instruction sets are different. Right? – Ebrahim Ghasemi Dec 24 '20 at 17:21
  • Yes, but hex format only maps values of bytes to address space. You can think of it as a big map that says which binary value supposed to be at which address. The hex format itself doesn't care about the architecture. – macro_controller Dec 24 '20 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.