I am in trouble with GearFit bootloader. I can not find the load address when disassembled into IDA pro.....

Here is the link to download it.


You might want to look at this excellent explanation of the ARM boot process by Igor Skochinsky. Loading the boot loader at address 0, Architecture ARM, results in the first few lines

ROM:00000000 dword_0         DCD 0x20002DE0
ROM:00000004                 DCD 0x20016AAD
ROM:00000008                 DCD 0x2000E241
ROM:0000000C                 DCD 0x2000E245
ROM:00000010                 DCD 0x2000E2B5
ROM:00000014                 DCD 0x2000E32D
ROM:00000018                 DCD 0x2000E3A5
ROM:0000001C                 DCD 0
ROM:00000020                 DCD 0

So, 0x20002DE0 is the initial stack pointer, and 0x20016AAD is the entry point.

That entry point does not seem to be contained in the boot loader itself (which has 64 K + 256 bytes), but in the on-Chip ROM. From the answer:

Note that in the modern complex chips such as OMAP3 or Apple's A4 the first piece of code which is executed is usually not user code but the on-chip Boot ROM. It might check various conditions to determine where to load the user code from and whether to load it at all (e.g. it could require a valid digital signature). In such cases, the user code might have to conform to different start-up conventions.

So unless you can somehow dump the memory at 0x20016AAD, you won't be able to find out what the ROM does, and where within the ROM it jumps.

From a brief glance at the code, i'd assume the entry point to be a 0xBA40, or maybe 0xBAC0 which calls 0xBA40, because this calls 0x0960. The first few instructions there (especially at 0x097a)

ROM:00000960                 PUSH.W          {R4-R11,LR}
ROM:00000964                 SUB             SP, SP, #0x6C
ROM:00000966                 ADD             R0, SP, #0x90+var_88
ROM:00000968                 MOVS            R1, #0x34 ; '4'
ROM:0000096A                 BL              sub_1A58
ROM:0000096E                 BL              sub_8A8
ROM:00000972                 BL              sub_266
ROM:00000976                 BL              sub_1D8
ROM:0000097A                 ADR.W           R0, aStartBootloade ; "\n\n\nstart bootloader\n"
ROM:0000097E                 BL              sub_1E94
ROM:00000982                 MOVS            R1, #1
ROM:00000984                 LDR.W           R0, =0x40020000
ROM:00000988                 BL              sub_193E

seem to be an indication that the bootloader starts there, and sub_1E94 is a generic string output function (it gets called lots of times, every time with a string address in R0).

| improve this answer | |
  • more likely the firmware is mapped at 0x2000000 or possibly 0x20010000 – Igor Skochinsky Nov 2 '16 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.