1

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).

After the analysis I get only few codelines with a lot of similar messages:

                   /* WARNING: Bad instruction - Truncating control flow here */
    halt_baddata();
  }
                    /* WARNING: Could not recover jumptable at 0x00000008. Too many branches */
                    /* WARNING: Treating indirect jump as call */
  (*(code *)(unaff_r4 ^ unaff_r4 << 0xe))();

And the strings seems meaningless bunch of chars.

I have tried also ARM aggressive instruction finder without success.

I have also tried to set base address 0x08000000 that seems common for various STM32 with analogous bad results.

I have also tried to use bot arm v7 little and big endian as trial and error.

How should I proceed considering that I don't know the datasheet of microcontroller used?

Here The File

6
  • Do you have physical access to the microcontroller? Are there any serial numbers or other markings on it? Sep 28 at 14:29
  • @dingo_kinznerhook I cannot access it at the moment.
    – AndreaF
    Sep 28 at 14:36
  • If it is stm mcu then binary starts with isr vector table where second entry is reset handler. Did you try to disassemble as thumb instructions? Sep 29 at 6:31
  • @RokTavčar I'm not sure it is really an STM MCU. I haven't clear what do you mean, I tried to decompile a raw binary with the options ARM/thumb mode ARM v7. I have linked the file if someone here can give a look to suggest me the correct way to disassemble in such situation. It would be really appreciated.
    – AndreaF
    Sep 29 at 14:29
  • You can't simply throw binaries at Ghidra. You need to: 1) Read the uC manuals and get an extensive and complete understanding of its working (including the boot sequence and interrupts vectors); 2) inspect the binary to understand the format used, it is a blob of code? It's a firmware FS? It's proprietary? Where it's mapped and how? 3) Dissect code and data from metadata 4) disassemble the code. Without any of this, you can only make guesses. Sep 30 at 15:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy