Help in reverse engineering a boarding gate scanner's firmware

Question

I'm working on a custom Access Control system for my local airport that will validate passengers' boarding passes and I've been given two DESKO GRSK 502 scanners.

Unfortunately, there's absolutely no documentation available on them and the manufacturer is not willing to disclose any information on how the scanners operate even though they reached End of Service in 2020.

I managed to find a script that is used to update its firmware and it appears to contain what I've been looking for.

I am a complete newbie when it comes to reverse engineering, so the only things I've managed to get from the firmware are some random command strings. Unfortunately, however, the scanner always returns a 'Negative Acknowledge' response, so I'm guessing it expects some initialization command before accepting any others.

Here is the firmware itself: https://pastebin.com/UDgne3Q8 I used Hex2Bin to convert the firmware file to a .bin file and the loaded it up on IDA Pro. Upon Googling, I came across this blog post which mentions that IDA Pro should be provided with the processor's ROM start address in order to decompile it properly.

Here's the inside of the scanner:

I assumed that the processors is 'P80C5521BA', but there's no information on NXP's website on its ROM start address.

I would appreciate any help I can get in extracting any information from that firmware file. 🙏

Thank you!

Answer 1

The CPU in the P80C552 microcontroller is a 80C51. After reset, this begins execution at address 0x0000.

A quick inspection of your firmware hex file confirms this.

This is -

:03000000020403F4

=>
0000:  020403    LJMP $0403  // long jump to address `0x0403`

If we follow this -

:10040000320178C2AFC2977581AD90FFD043820FA1

=>

0403:  C2AF      CLR IE.7 // disable all interrupts
....

After disabling interrupts, the code continues as typical reset code, setting the stack pointer, data pointer etc.

This confirms that address 0000 is a plausible start address for your firmware.

However, to actually use it in IDA you need to be aware that the 8051 has a Harvard architecture. Please look at the related question & answer here for details.