Skip to main content
8 votes

Reverse Engineering 8051 firmware

I recently made a tool to make the early stuff in 8051 reverse engineering easier, called at51 and will shamelessly use this answer as a showcase. First off, you want the image to be properly aligned....
8051Enthusiast's user avatar
4 votes

Loading 8051 binary to IDA with ROM+External RAM configuration

The default dialog you’re seeing uses so-called “linear addresses” which are global for the whole program and can not intersect. It is mostly useful for processors with unified (Von Neumann) address ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

Disassemble CC2541 firmware (TI SensorTag)

This issue is now fixed and you should be able to load the firmware with the command line you tried. Also check out the recent addition to the r2 documentation for more details about 8051 support. ...
astuder's user avatar
  • 66
2 votes
Accepted

What 8051 instruction extensions are there?

The CPU actually turned out to be an AC1082 from JL: it's intended for the MP3 player market. It's an 8051 clone with (I think) 8 kB of RAM and a combined XDATA/CODE address space, allowing it to run ...
David Given's user avatar
2 votes

What 8051 instruction extensions are there?

Check out bunnie’s work on SD card controllers. One family they looked at (AX211) was actually using a5 for extended opcodes.
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Configuring Ghidra to use the Keil 8051 ABI for analysis

You need to use the mx51 variant of the 8051 processor when loading the binary. The file in the link uses the calling convention found in your link.
mumbel's user avatar
  • 441
2 votes

Reverse Engineering 8051 firmware

Yes, this looks like 8051 firmware. Reset entry point is 0x0000, which in this case jumps to 0x0788, which continues with valid 8051 code. There are many calls to addresses above 0x4000, so you ...
astuder's user avatar
  • 66
2 votes

Reverse Engineering 8051 firmware

radare2 supports 8051 if you think it is 8051 your link points to a directory there is no ee file there is an efw file i ran it in radare2 and it seems to be disassembling it radare2 -AA -a ...
blabb's user avatar
  • 16.4k

Only top scored, non community-wiki answers of a minimum length are eligible