I'm trying to do some REing on a vendored U-Boot bootloader image.

For context, the U-Boot image was extracted from the full firmware image with:

dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 skip=8 count=512 seek=0

Then I ran binwalk on the image:

$ binwalk uboot_sdcard.bin 

16908         0x420C          CRC32 polynomial table, little endian
32768         0x8000          uImage header, header size: 64 bytes, header CRC: 0x1701FCC6, created: 2022-11-10 01:20:36, image size: 407733 bytes, Data Address: 0x4A000000, Entry Point: 0x0, data CRC: 0x68F80364, OS: Firmware, CPU: ARM, image type: Firmware Image, compression type: none, image name: "U-Boot 2017.11 for sunxi board"
100384        0x18820         uImage header, header size: 64 bytes, header CRC: 0x207047, created: 1994-05-30 14:08:13, image size: 71753208 bytes, Data Address: 0x28809B46, Entry Point: 0xDDF82CA0, data CRC: 0x230D46, image name: ""
259212        0x3F48C         CRC32 polynomial table, little endian
269762        0x41DC2         Android bootimg, kernel size: 1684947200 bytes, kernel addr: 0x64696F72, ramdisk size: 1763734311 bytes, ramdisk addr: 0x6567616D, product name: "ddr 0x%08x size %u KiB"
417648        0x65F70         Flattened device tree, size: 22917 bytes, version: 17

My question now is, when I load this uboot_sdcard.bin on Ghidra, what should be the Base address? I tried the typical 0x4A000000 but some disassembly ends up with lots of warnings about not being able to resolve switch branches.

I've had similar issues when dealing with raw binaries, and it's almost always down to sectioning the file right, or setting the base address right.

So, I think I'm missing something here. Any pointers?

The device uses an Allwinner SoC, which has an ARM V7 processor.


1 Answer 1


So, a friend figured it out for me.

So, according to the binwalk in the OP, one can see that U-Boot is at offset 0x8000 on the file. But this contains a header, pushing actual U-Boot to 0x8040.

Now, one only needs to load this file on Ghidra with offset 0x8040 and with the usual base address of 0x4A00'0000:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.