2

I am trying to reverse engineer a raw binary image from an nrf24le1 SoC that (I think) has been compiled with the Keil toolchain. Specifically, I see that C functions in this image usually expect their arguments in r7/r5/r3 as described here and that the return value lives in r7. The behavior I'm seeing is:

  • Ghidra thinks that every function in this image takes 0 parameters, even if it's obvious that the function is immediately looking at r7 for its first argument
  • Ghidra thinks the return value lives in ACC

I have to manually override this for every function. I would like for Ghidra to automatically figure out when a function has arguments based on the Keil ABI.

By contrast, when I run Ghidra on a raw arm32 binary, it notices when a function looks for arguments in r0/r1/r2/... and it adjusts the function declaration accordingly. So Ghidra behaves correctly for arm32, but incorrectly for 8051.

Is there a way to fix this (or is there a better tool I should be using instead of Ghidra)?

Improve this question

1 Answer 1

Reset to default
2

You need to use the mx51 variant of the 8051 processor when loading the binary.

The file in the link uses the calling convention found in your link.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.