2

I have been advised to analyze an ARM binary image from an Cortex M3 (STM32) for training. It has been directly extracted from flash beforehand and passed to me. However it's unknown whether this image is in big or little Endian byte order. Running a strings command on the bin, does not return any meaningful strings. Before proceeding with analyzing utilizing Ghidra, I wanted to learn how to verify that the Endianess is correct.

user@XOP:~$ xxd -b binary.bin
00000000: 00100000 00000000 00010001 01100000 00001000 00000000   ..`..
00000006: 00111111 11001001 00001000 00000000 00111111 11100101  ?...?.
..
0000001e: 00000000 00000000 00000000 00000000 00000000 00000000  ......
00000024: 00000000 00000000 00000000 00000000 00000000 00000000  ......
..
00000036: 00000000 00000000 00001000 00000000 01000000 00000001  ....@.
0000003c: 00001000 00000000 01000000 00000101 00001000 00000000  ..@...
00000042: 01000000 00001001 00001000 00000000 01000000 00001101  @...@.
..
0000005a: 01000000 00100001 00001000 00000000 01000000 00100101  @!..@%

user@XOP:~$ strings binary.bin
xhph
"@A\
@CpC
2
  • 1
    You could employ AI analysis tools such as isadetect (there's also a research paper on it)
    – mimak
    Jul 14, 2023 at 20:57
  • objdump -d <filename> should help with that. If it says bigarm, it is big endian arm.
    – melsk
    Jul 18, 2023 at 22:23

2 Answers 2

3

Cortex M is always little endian. In my experience, big endian ARM is exceedingly rare, I think it was used mostly in some network processors (e.g. the old Intel IXP series).

1

MCU usually have vector table starting at address 0 (STM32 certainly does, I am not 100% for others). This should help you a lot when combined with memory map to check if addresses in vector table are valid.

Even easier method is to check datasheets for specific target in this case programming manual: https://www.st.com/resource/en/programming_manual/pm0056-stm32f10xxx20xxx21xxxl1xxxx-cortexm3-programming-manual-stmicroelectronics.pdf

Where it explicitly say it is little endian.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.