I'm reverse engineering a firmware used on an STM32 microcontroler. With the datasheet and some help I managed to find the entry point (Reset vector):
MasterStackPointer 00000000 00 00 03 20 addr DAT_20030000 = ?? Reset XREF: Entry Point (*) 00000004 d5 2b 03 08 addr LAB_08032bd4+1
Notice how it says the entry point is at
I go to that address:
LAB_08032bd4+1 XREF[0,2]: 00000004 (*) , 08000004 (*) 08032bd4 00 00 movs r0,r0 08032bd6 80 3f subs r7,#0x80 08032bd8 2f 51 str r7,[r5,r4]
And right out of the bat, a thing strike me as surprising:
Why and how is the entry point in the middle of an instruction?
And the second, and most pressing issue is that Ghidra thinks this block of code is part of a function that:
- Starts at
0x08032c8a. I doubt this is possible. The
Resetpointer should be the beginning of a function, no?
- Said function has a comment above it saying
/* WARNING: Control flow encountered bad instruction data */. And a
/* WARNING: Bad instruction - Truncating control flow here */ halt_baddata();couple lines into the function.
The latter corresponds to the following disassemble:
08032c70 c9 16 asrs r1,r1,#0x1b 08032c72 7d 3f subs r7,#0x7d 08032c74 c9 ?? C9h ? -> 3b56f7c9 08032c75 f7 ?? F7h 08032c76 56 3b subs r3,#0x56 08032c78 00 00 movs r0,r0
Which is clearly missing something.
Is this lack of support for the Thumb instruction set on Ghidra, or what am I missing?