|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "IDA Pro Setup"
Caique2001 (talk | contribs) m (→some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )) |
Caique2001 (talk | contribs) m (→some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )) |
||
| Line 26: | Line 26: | ||
== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )== |
== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )== |
||
| − | The autoanalysis didn't very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this: |
+ | The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this: |
Most code is 'embraced' by 'embracing' code: |
Most code is 'embraced' by 'embracing' code: |
||
| Line 32: | Line 32: | ||
- STMFD / LDMFD for arm mode |
- STMFD / LDMFD for arm mode |
||
| − | Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?! |
+ | Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?! |
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1). |
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1). |
||
| − | After all, you can hex browse a little bit and press |
+ | After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text. |
Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) ! |
Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) ! |
||
Revision as of 21:21, 19 August 2008
How to set up IDA pro to reverse the 3G baseband
The X-Gold 608 has a memory map, as seen in it's page.
The Secpack 2.0 takes up the first 0xCF8 of the .fls file.
So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)
For real noobs:
1. Drag the fls file into IDA 2. Select ARM 3. Change ROM start address to 0x20040000 4. Change Loading address to 0x20040000 5. Change File offset to 0xCF8 6. Copy Loading size into ROM size 7. Press OK 8. The entry point is the address at 0x20040408
9. Go to 20100004 and Press "C" to start. ~Deco 10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco
This might also be a decent starting point (pw: caique2001).
some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )
The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:
Most code is 'embraced' by 'embracing' code: - push / pop for thumb mod - STMFD / LDMFD for arm mode
Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?! The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1). After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text.
Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !
