I'm trying to reverse a custom u-boot that implements cryptography for the Kernel at runtime (the Kernel at rest is encrypted also in a flash). I can probably ask the IoT vendor to provide the modified code of u-boot, but I want to learn something from this experience.
Some info I gathered:
- SOC Data Sheet (with memory layouts)
- Ram start at 0x8000_0000 (2 GB)
- BOOTROM at 0x0400_0000 (64K)
- BOOTRAM at 0x0401_0000 (64K)
- Remapable area from 0x0000_0000 to 0x03FF_FFFF (64 Mb)
- Strings on the u-boot.bin file return:
bootcmd=kload 0x82000000; bootm 0x82000000
- The CPU is Arm Cortex A7 (the SOC have also an A17 but is not the "default" one)
Steps I'm doing to load the binary in IDA:
IDA asked me for the disassembly memory organizations; I tried a couple of things without success. I think this is the part where I messed up something, and later I can find proper addresses when I try to rebuild the Interrupt Vector Table to start defining functions later.
Which address I should choose in this case based on the information I have?
An example, if I chose to use 0x8000_0000
as a loading address and redefine some variables to double word (any Interrupt vector table entry is a double word), this is what I get:
I get something unusable (I can't jump at those addresses); I need to understand how to set up IDA in the early stages.
Any help, especially with some theory, is appreciated :)