2

I'm trying to reverse a custom u-boot that implements cryptography for the Kernel at runtime (the Kernel at rest is encrypted also in a flash). I can probably ask the IoT vendor to provide the modified code of u-boot, but I want to learn something from this experience.

Some info I gathered:

  • SOC Data Sheet (with memory layouts)
  • Ram start at 0x8000_0000 (2 GB)
  • BOOTROM at 0x0400_0000 (64K)
  • BOOTRAM at 0x0401_0000 (64K)
  • Remapable area from 0x0000_0000 to 0x03FF_FFFF (64 Mb)
  • Strings on the u-boot.bin file return: bootcmd=kload 0x82000000; bootm 0x82000000
  • The CPU is Arm Cortex A7 (the SOC have also an A17 but is not the "default" one)

Steps I'm doing to load the binary in IDA: Step 1 IDA

IDA asked me for the disassembly memory organizations; I tried a couple of things without success. I think this is the part where I messed up something, and later I can find proper addresses when I try to rebuild the Interrupt Vector Table to start defining functions later.

Step 2 IDA

Which address I should choose in this case based on the information I have?

An example, if I chose to use 0x8000_0000 as a loading address and redefine some variables to double word (any Interrupt vector table entry is a double word), this is what I get:

IDA example

I get something unusable (I can't jump at those addresses); I need to understand how to set up IDA in the early stages.

Any help, especially with some theory, is appreciated :)

Improve this question

1 Answer 1

Reset to default
2

The reset vector location is the address right after 0xDEADBEEF (not shown in your snippet).

It is the function that the first instruction's relative branch is branching to.

Tell IDA to load the segment at that address (0x8080xxxx).

Improve this answer
1
  • I didn't update the post, but I found that 0x8080_0000 (looking at DATA ref after an auto analysis). I found a forum where someone analyzed the code, of the custom u-boot, under a developing point of view and 0x8080_0000 is referenced as the loading address, so I guess it's confirmed. A user on Reddit (blessthe28) suggested turning all the 0xEXXX into code since those are unconditional ARM codes, and effectively I got some LD to PC register in the order suggested by the user. actual IDA status
    – zi0Black
    Nov 2, 2021 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.