Disassembling with GNU/GPL tools
The gnu/gpl tools are not made for analysing alien binary dumps because we usually have the source code if we need to debug. This is not really an replacement for IDA but for me it's was sufficient.
Installing software is not explained in this tutorials.
Prerequisites:
- U have a raw binary firmware dump to look at. I'll use here "dump.bin"
- U have set up arm-gcc/binutils toolchain.
In this toybox we have:
arm-elf-objcopy | arm-linux-gnu-objcopy arm-elf-objdump | arm-linux-gnu-objdump
Here we go:
strings -t x dump.bin > dump.strings hexdump -C dump.bin > dump.hex arm-linux-gnu-objdump -m arm -b binary -D dump.bin > dump.dis
However, theres a problem: all files start with an offset of 0x00. Here comes my renumber.pl script:
strings -t x dump.bin | ./renumber.pl 0xff810000 > dump.strings hexdump -C dump.bin |./renumber.pl 0xff810000 > dump.hex
Before we disassemble the dump, we pack it into elf format. This meat is good for feeding gdb and the IDA demo version ;)
arm-linux-gnu-objcopy --change-addresses=0xff810000 -I binary -O elf32-littlearm -B arm dump.bin dump.elf arm-linux-gnu-objcopy --set-section-flags .data=code dump.elf
Verify the elf file:
arm-linux-gnu-objdump -x dump.elf
Disassemble:
arm-linux-gnu-objdump -d dump.elf > dump.dis
So finally we have 3 ascii files to stare at:
- dump.dis
- dump.strings
- dump.hex
and
- dump.elf for gdb and qemu
Putting all together
Meanwhile I wrote a perl script, which does all the jobs. Also it lookup references and add this to the disassemble output.
e.g.:
ff936a40: e59f12e8 ldr r1, [pc, #744] ; ff936d30: (ff81d88c) ff936a44: e28f0fba add r0, pc, #744 ; ff936d34: (63727473) *"strcpy"
Next lesson: run the dump in Qemu