1

I'm reverse engineering a firmware used on an STM32 microcontroler. With the datasheet and some help I managed to find the entry point (Reset vector):

                             MasterStackPointer
        00000000 00  00  03  20    addr       DAT_20030000                                     = ??
                             Reset                                           XREF[1]:     Entry Point (*)   
        00000004 d5  2b  03  08    addr       LAB_08032bd4+1

Notice how it says the entry point is at 0x08032bd4+1, aka, 0x08032bd5. I go to that address:

                             LAB_08032bd4+1                                  XREF[0,2]:   00000004 (*) , 08000004 (*)   
        08032bd4 00  00           movs       r0,r0
        08032bd6 80  3f           subs       r7,#0x80
        08032bd8 2f  51           str        r7,[r5,r4]

And right out of the bat, a thing strike me as surprising:

Why and how is the entry point in the middle of an instruction?

And the second, and most pressing issue is that Ghidra thinks this block of code is part of a function that:

  1. Starts at 0x08032c8a. I doubt this is possible. The Reset pointer should be the beginning of a function, no?
  2. Said function has a comment above it saying /* WARNING: Control flow encountered bad instruction data */. And a /* WARNING: Bad instruction - Truncating control flow here */ halt_baddata(); couple lines into the function.

The latter corresponds to the following disassemble:

        08032c70 c9  16           asrs       r1,r1,#0x1b
        08032c72 7d  3f           subs       r7,#0x7d
        08032c74 c9              ??         C9h                                              ?  ->  3b56f7c9
        08032c75 f7              ??         F7h
        08032c76 56  3b           subs       r3,#0x56
        08032c78 00  00           movs       r0,r0

Which is clearly missing something.

Is this lack of support for the Thumb instruction set on Ghidra, or what am I missing?

Thanks.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.