0

I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step.

First of all this is the current uncompressed image: https://www.dropbox.com/s/7oq4m2zryid3ugv/FW_ZERO_DES.bin?dl=0

Acording with what I have found the image contains an hybrid between Windows CE and Itron RTOS called Windows Aceleration Tool:

http://www.ertl.jp/ITRON/DOC/iim99/Elmic.pdf

Here are some references to it:

000941e0  75 69 74 72 6f 6e 2e 63  79 67 77 69 6e 5f 69 6e  |uitron.cygwin_in|
00094290  6e 74 39 36 36 35 30 2e  75 69 74 72 6f 6e 2e 63  |nt96650.uitron.c|
000a0be0  36 35 30 2e 75 69 74 72  6f 6e 2e 63 79 67 77 69  |650.uitron.cygwi|
000a2b50  75 69 74 72 6f 6e 2e 63  79 67 77 69 6e 5f 69 6e  |uitron.cygwin_in|

Here you can see Itron references with cygwin and below the Windows CE references:

DECIMAL         HEX             DESCRIPTION
    -------------------------------------------------------------------------------------------------------------------
[...]
4592396         0x46130C        Windows CE RTOS
4592400         0x461310        Windows CE RTOS
4592404         0x461314        Windows CE RTOS
4592408         0x461318        Windows CE RTOS
4592412         0x46131C        Windows CE RTOS
4592416         0x461320        Windows CE RTOS
[...]

Also I found some syscalls related ti Windows Aceleration Tool like cre_tsk().

Checking the hexdump I found some Windows CE magic number references ( B0 00 FF ) accordin to this documentation http://forum.xda-developers.com/showthread.php?t=801167 :

struct BIN_HEADER {
char[7] Signature;      // B000FF\n signature   
DWORD ImageStart;    // Image Start
DWORD ImageLength; // Image Length
};

My problem now is that I don't see the correct byte structure for Image Start and Image Length. I want to separate all the pieces on this image but I'm stuck here.

Am I in the good way or Am I completely out of focus? How can I continue?

3

Actually, from the strings, it looks to me like it's using eCos, not Windows CE:

$ binwalk FW_ZERO_DES.bin
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
28494         0x6F4E          eCos RTOS string reference: "eCos Thread[%.2ld, %s]"
29723         0x741B          eCos RTOS string reference: "eCos Thread ========================="
512758        0x7D2F6         eCos RTOS string reference: "eCos> is not exist!"
512793        0x7D319         eCos RTOS string reference: "eCos> console."
597136        0x91C90         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx"
597141        0x91C95         eCos RTOS string reference: "ecos-2.0.6/packages/infra/v2_0_60/src/tcdiag.cxx"
598072        0x92038         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx"
598077        0x9203D         eCos RTOS string reference: "ecos-2.0.6/packages/infra/v2_0_60/src/pure.cxx"
600072        0x92808         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx"
600077        0x9280D         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/clock.cxx"
606656        0x941C0         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/smp.hxx"
606661        0x941C5         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/smp.hxx"
606840        0x94278         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/thread.inl"
606845        0x9427D         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/thread.inl"
607004        0x9431C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx"
607009        0x94321         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/kapi.cxx"
611740        0x9559C         eCos RTOS string reference: "eCos on NT96650A! <<<<"
611788        0x955CC         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx"
611793        0x955D1         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/thread.cxx"
619372        0x9736C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx"
619377        0x97371         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/common/except.cxx"
620228        0x976C4         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx"
620233        0x976C9         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/intr/intr.cxx"
623552        0x983C0         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx"
623557        0x983C5         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sched/mlqueue.cxx"
627044        0x99164         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx"
627049        0x99169         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sched/sched.cxx"
632140        0x9A54C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx"
632145        0x9A551         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sync/cnt_sem.cxx"
632512        0x9A6C0         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx"
632517        0x9A6C5         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sync/flag.cxx"
636124        0x9B4DC         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl"
636129        0x9B4E1         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl"
639396        0x9C1A4         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx"
639401        0x9C1A9         eCos RTOS string reference: "ecos-2.0.6/packages/kernel/v2_0_60/src/sync/mutex.cxx"
644816        0x9D6D0         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx"
644821        0x9D6D5         eCos RTOS string reference: "ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/dlmalloc.cxx"
652748        0x9F5CC         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl"
652753        0x9F5D1         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl"
658372        0xA0BC4         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl"
658377        0xA0BC9         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl"
663684        0xA2084         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx"
663689        0xA2089         eCos RTOS string reference: "ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/kapi.cxx"
664672        0xA2460         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx"
664677        0xA2465         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/_exit.cxx"
664916        0xA2554         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx"
664921        0xA2559         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/abort.cxx"
665128        0xA2628         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx"
665133        0xA262D         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/atexit.cxx"
665820        0xA28DC         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx"
665825        0xA28E1         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/invokemain.cxx"
666092        0xA29EC         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx"
666097        0xA29F1         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/startup/v2_0_60/src/main.cxx"
666416        0xA2B30         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl"
666421        0xA2B35         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl"
666584        0xA2BD8         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl"
666589        0xA2BDD         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl"
670072        0xA3978         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl"
670077        0xA397D         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl"
670252        0xA3A2C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx"
670257        0xA3A31         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/stdio/v2_0_60/src/common/stream.cxx"
697416        0xAA448         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx"
697421        0xAA44D         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/getenv.cxx"
698080        0xAA6E0         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx"
698085        0xAA6E5         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/stdlib/v2_0_60/src/qsort.cxx"
708812        0xAD0CC         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx"
708817        0xAD0D1         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/string/v2_0_60/src/strtok.cxx"
710856        0xAD8C8         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx"
710861        0xAD8CD         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/strftime.cxx"
714740        0xAE7F4         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx"
714745        0xAE7F9         eCos RTOS string reference: "ecos-2.0.6/packages/language/c/libc/time/v2_0_60/src/timeutil.cxx"
714860        0xAE86C         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl"
714865        0xAE871         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl"
736748        0xB3DEC         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx"
736753        0xB3DF1         eCos RTOS string reference: "ecos-2.0.6/packages/compat/posix/v2_0_60/src/pthread.cxx"
741144        0xB4F18         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx"
741149        0xB4F1D         eCos RTOS string reference: "ecos-2.0.6/packages/compat/posix/v2_0_60/src/time.cxx"
744468        0xB5C14         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx"
744473        0xB5C19         eCos RTOS string reference: "ecos-2.0.6/packages/compat/posix/v2_0_60/src/signal.cxx"
748556        0xB6C0C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx"
748561        0xB6C11         eCos RTOS string reference: "ecos-2.0.6/packages/io/fileio/v2_0_60/src/file.cxx"
753884        0xB80DC         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx"
753889        0xB80E1         eCos RTOS string reference: "ecos-2.0.6/packages/io/fileio/v2_0_60/src/dir.cxx"
760592        0xB9B10         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c"
760597        0xB9B15         eCos RTOS string reference: "ecos-2.0.6/packages/io/eth/v2_0_60/src/net/eth_drv.c"
773604        0xBCDE4         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c"
773609        0xBCDE9         eCos RTOS string reference: "ecos-2.0.6/packages/net/common/v2_0_60/src/dhcp_prot.c"
793380        0xC1B24         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/net/common/v2_0_60/src/tftp_server.c"
793385        0xC1B29         eCos RTOS string reference: "ecos-2.0.6/packages/net/common/v2_0_60/src/tftp_server.c"
799368        0xC3288         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c"
799373        0xC328D         eCos RTOS string reference: "ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/support.c"
799419        0xC32BB         eCos RTOS string reference: "ecos/support.c"
800200        0xC35C8         eCos RTOS string reference: "eCos_node"
806272        0xC4D80         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c"
806277        0xC4D85         eCos RTOS string reference: "ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/synch.c"
806323        0xC4DB3         eCos RTOS string reference: "ecos/synch.c"
810080        0xC5C60         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c"
810085        0xC5C65         eCos RTOS string reference: "ecos-2.0.6/packages/net/bsd_tcpip/v2_0_60/src/ecos/timeout.c"
810131        0xC5C93         eCos RTOS string reference: "ecos/timeout.c"
986656        0xF0E20         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx"
986661        0xF0E25         eCos RTOS string reference: "ecos-2.0.6/packages/compat/uitron/v2_0_60/src/uit_ifnc.cxx"
996908        0xF362C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c"
996913        0xF3631         eCos RTOS string reference: "ecos-2.0.6/packages/net/ns/dns/v2_0_60/src/dns.c"
1025792       0xFA700         eCos RTOS string reference: "ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl"
1025797       0xFA705         eCos RTOS string reference: "ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl"
1025944       0xFA798         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx"
1025949       0xFA79D         eCos RTOS string reference: "ecos-2.0.6/packages/services/memalloc/common/v2_0_60/src/malloc.cxx"
1026892       0xFAB4C         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx"
1026897       0xFAB51         eCos RTOS string reference: "ecos-2.0.6/packages/io/fileio/v2_0_60/src/misc.cxx"
1027064       0xFABF8         eCos RTOS string reference: "ecos/ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c"
1027069       0xFABFD         eCos RTOS string reference: "ecos-2.0.6/packages/io/disk/v2_0_60/src/disk.c"
1085556       0x109074        Unix home path string: "/home/michael.lo/project-ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h"
1085581       0x10908D        eCos RTOS string reference: "ecos/ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h"
1085586       0x109092        eCos RTOS string reference: "ecos-rtl8189es/install/include/cyg/io/eth/rltk/819x/wrapper/skbuff.h"
1704183       0x1A00F7        eCos RTOS string reference: "eCos world!"
1705708       0x1A06EC        Standard base64 index table
1730270       0x1A66DE        eCos RTOS string reference: "eCos/include/cyg/libc/time/time.inl"
1827038       0x1BE0DE        Copyright string: "Copyright (c) 2012 Novatek Microelectronic Corp."
1916391       0x1D3DE7        eCos RTOS string reference: "ECOS#1.00.008_Nov 12 2013, 11:18:57"
1916434       0x1D3E12        eCos RTOS string reference: "ECOS#1.00.007_Nov 12 2013, 11:18:59"
4200028       0x40165C        XML document, version: "1.0"
4200788       0x401954        XML document, version: "1.0"
4404038       0x433346        MySQL MISAM compressed data file Version 3
5170192       0x4EE410        eCos RTOS string reference: "eCos does not support daemon option"
5173078       0x4EEF56        eCos RTOS string reference: "ecos threads"
5181448       0x4F1008        HTML document header
5182475       0x4F140B        HTML document footer
5182516       0x4F1434        eCos RTOS string reference: "eCos/1.0"
5184064       0x4F1A40        HTML document header
5184167       0x4F1AA7        HTML document footer
5184176       0x4F1AB0        HTML document header
5184261       0x4F1B05        HTML document footer
5184312       0x4F1B38        HTML document header
5184421       0x4F1BA5        HTML document footer
5184432       0x4F1BB0        HTML document header
5184552       0x4F1C28        HTML document footer
5471876       0x537E84        HTML document header
5471996       0x537EFC        HTML document footer

It's full of little endian MIPS code:

$ binwalk -A FW_ZERO_DES.bin
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
9744          0x2610          MIPSEL instructions, function epilogue
9812          0x2654          MIPSEL instructions, function epilogue
10260         0x2814          MIPSEL instructions, function epilogue
10484         0x28F4          MIPSEL instructions, function epilogue
10784         0x2A20          MIPSEL instructions, function epilogue
11492         0x2CE4          MIPSEL instructions, function epilogue
11644         0x2D7C          MIPSEL instructions, function epilogue
11828         0x2E34          MIPSEL instructions, function epilogue
11856         0x2E50          MIPSEL instructions, function epilogue
12212         0x2FB4          MIPSEL instructions, function epilogue
12396         0x306C          MIPSEL instructions, function epilogue
12676         0x3184          MIPSEL instructions, function epilogue
12864         0x3240          MIPSEL instructions, function epilogue
13036         0x32EC          MIPSEL instructions, function epilogue
13280         0x33E0          MIPSEL instructions, function epilogue
13484         0x34AC          MIPSEL instructions, function epilogue
13552         0x34F0          MIPSEL instructions, function epilogue
14092         0x370C          MIPSEL instructions, function epilogue
14304         0x37E0          MIPSEL instructions, function epilogue

There is a standard eCos exception handler at offset 0x180:

ROM:00000180  # =============== S U B R O U T I N E =======================================
ROM:00000180
ROM:00000180
ROM:00000180 sub_180:
ROM:00000180                 mfc0    $k0, Cause       # Cause of last exception
ROM:00000184                 andi    $k0, 0x7F
ROM:00000188                 li      $k1, 0x800FB174
ROM:00000190                 add     $k1, $k0
ROM:00000194                 lw      $k1, 0($k1)
ROM:00000198                 jr      $k1
ROM:0000019C                 nop
ROM:0000019C  # End of function sub_180

Main code starts a bit later at 0x400, and the load address is almost certianly 0x80000000:

ROM:00000400 sub_400:
ROM:00000400                 mtc0    $zero, Count     # Timer Count
ROM:00000404                 li      $t2, 0xFFFFFFFF
ROM:00000408                 mtc0    $t2, Compare     # Timer Compare
ROM:0000040C                 mtc0    $zero, WatchLo   # Memory reference trap address low bits
ROM:00000410                 mtc0    $zero, WatchHi   # Memory reference trap address high bits
ROM:00000414                 li      $t1, 0x800FB170
ROM:0000041C                 lw      $a1, 0($t1)
ROM:00000420                 bnez    $a1, loc_440
...
ROM:00000490                 mtc0    $t2, Config      # Configuration register
ROM:00000494                 mfc0    $t4, Config, 7   # Configuration register
ROM:00000498                 ori     $t4, 0x100
ROM:0000049C                 mtc0    $t4, Config, 7   # Configuration register
ROM:000004A0                 li      $v0, 0x800004B0  # <--- This suggests the load address is 0x80000000
ROM:000004A8                 jr      $v0
ROM:000004AC                 nop
ROM:000004AC  # End of function sub_400
ROM:000004AC
ROM:000004B0
ROM:000004B0  # =============== S U B R O U T I N E =======================================
ROM:000004B0
ROM:000004B0
ROM:000004B0 sub_4B0:
ROM:000004B0                 li      $gp, 0x805433A0
ROM:000004B8                 li      $a0, 0x80588360
ROM:000004C0                 move    $sp, $a0
ROM:000004C4                 jal     unk_FB934
ROM:000004C8                 nop
ROM:000004CC                 jal     unk_B335C
ROM:000004D0                 nop

UPDATE:

There are references to cygwin and itron, but note that these are just directories under the developer's build path:

$ strings FW_ZERO_DES.bin | grep cygwin
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/smp.hxx
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/thread.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/kernel/mboxt2.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mfiximpl.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mvarimpl.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stdiofiles.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/stream.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdio/streambuf.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/libc/stdlib/div.inl
/cygdrive/c/project-ecos/ecos-2.0.6/configs/nt96650.uitron.cygwin_install/include/cyg/memalloc/mempolt2.inl

This makes sense, since ITRON appears to be an API standard for RTOS's (I'm not familiar with it myself), and the ITRON Wikipedia page explicitly states (emphasis added):

Supported CPUs are numerous. ARM, MIPS, x86, FR-V and many others including CPUs supported by open source RTOS eCos and RTEMS, both of which include the support for µITRON compatible APIs.

Loading this in IDA is pretty straight forward. It's a binary blob, so you'll have to explicitly tell IDA to use the mipsl processor module. When IDA then prompts you for the Disassembly memory organization, set both the ROM start address and Input file Loading address to 0x80000000 (the base address of the file, which we've already identified from previous disassembly above).

I'm using IDA 6.6, and I just let IDA's auto-analysis take it from there, which did a really good job (lots of string and data xrefs):

loc_8000D5A8:            # "^RERR:%s() DMA clk not match!\r\n"
addiu   $a0, (aRerrSDmaClkNot - 0x80010000)
jal     sub_8007CCC4
addiu   $a1, (aDxsys_dumpandv - 0x80010000)  # "DxSys_DumpAndVerifyClk"
jal     loc_800A25B4
nop

IIRC, older versions of IDA weren't quite as agressive in their auto-analysis, so if you have an older IDA, you might need to manually create some code (the c keyboard shortcut) at offsets 0x180 and 0x400 to give it a little kick-start.

| improve this answer | |
  • That seems to be true. But I saw references to cygwin, itron and other stuff inside the image. Also I tried t load in IDA but I got a weird output. Can you point me to the steps to load it and how to extract the files. – Nucklear Nov 19 '14 at 13:37
  • Updated the answer accordingly. There doesn't appear (to me) to be any files left to be extracted, unless you had something specific you were referencing? – devttys0 Nov 19 '14 at 14:28
  • That's it. Thank you so much for your help. Awesome explanations as always. – Nucklear Nov 19 '14 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.