GPL Disassembling

Meanwhile I wrote a perl script, which does all the jobs. Also it lookup references and add this to the disassemble output.

Disassembling with GNU/GPL tools

The gnu/gpl tools are not made for analysing alien binary dumps because we usually have the source code if we need to debug. This is not really an replacement for IDA but for me it's was sufficient.

Installing software is not explained in this tutorials.

Prerequisites:

• U have a raw binary firmware dump to look at. I'll use here "dump.bin"

• U have set up arm-gcc/binutils toolchain. (Get it from GNUARM.org , download: http://www.gnuarm.com/bu-2.15_gcc-3.4.3-c-c++-java_nl-1.12.0_gi-6.1.tar.bz2 for example)

In this toybox we have:

arm-elf-objcopy | arm-linux-gnu-objcopy
arm-elf-objdump | arm-linux-gnu-objdump

Here we go:

strings -t x dump.bin > dump.strings
hexdump -C dump.bin > dump.hex

arm-linux-gnu-objdump -m arm -b binary -D dump.bin > dump.dis

However, theres a problem: all files start with an offset of 0x00. Here comes my renumber.pl script:

strings -t x dump.bin | ./renumber.pl 0xff810000 > dump.strings
hexdump -C dump.bin |./renumber.pl 0xff810000 > dump.hex

Before we disassemble the dump, we pack it into elf format. This meat is good for feeding gdb and the IDA demo version ;)

arm-linux-gnu-objcopy --change-addresses=0xff810000 -I binary -O elf32-littlearm -B arm dump.bin dump.elf
arm-linux-gnu-objcopy --set-section-flags .data=code dump.elf

Verify the elf file:

arm-linux-gnu-objdump -x dump.elf

Disassemble:

arm-linux-gnu-objdump -d dump.elf > dump.dis

So finally we have 3 ascii files to stare at:

• dump.dis
• dump.strings
• dump.hex

and

• dump.elf for gdb and qemu

Putting all together

Meanwhile I wrote GPL:disassemble.pl perl script, which does all the jobs. Also it lookup references and add this to the disassemble output.

disassemble.pl 0xff810000 dump.bin

e.g. output:

FUNC(ExitTask, 0xff81be48):
ff81be48: 	e51f0070 	ldr	r0, [pc, #-112]	; ff81bde0: (ff810214) 
ff81be4c: 	e92d4010 	stmdb	sp!, {r4, lr}
ff81be50: 	e5900000 	ldr	r0, [r0]
ff81be54: 	e5900000 	ldr	r0, [r0]
ff81be58: 	e3500000 	cmp	r0, #0	; 0x0
ff81be5c: 	c59f1028 	ldrgt	r1, [pc, #40]	; ff81be8c: (00000219) 
ff81be60: 	c24f0084 	subgt	r0, pc, #132	; ff81bde4: (5472654b)  *"KerTask.c"
ff81be64: 	cb000089 	blgt	ff81c090 <DebugAssert +556>

using gcc/gas

Another way to create an elf file with symbols from chdk's stub files: forum However, the disassemble scipt makes a better format but this one is very good for gdb+qemu ;)

Next lesson: run the dump in Qemu