Setup IDA Pro to disassemble preFL Convers+ Firmware 7M2T-14C026-AG
Posted: 02 Nov 2021, 12:07
In this topic i'd like to show how i setup my reverse engineering environment to disassemble the IPC firmware of release 7M2T-14C026-AG.
To answer this question let's take a look at the memory layout of the MAC7116: The important parts we need are:
| Start address | End address | Size | Content | Comment |
|---|---|---|---|---|
| 0x0000_0000 | 0x0000_001F | 0x0000_0020 | Reset Vector table | Used for the MAC to know where to jump under certain conditions (e.g. Reset, Interrupt, ...) |
| 0x0000_1000 | 0x0000_3FFFF | 0x0000_4000 | Primary Bootloader (PBL) | This code is needed to bring the MAC and it's periphals up and running, like the BIOS of a PC |
| 0x0000_5000 | 0x00FB_4FFF | 0x00FB_0000 | MAIN Firmware | 1 MB of Firmware code, placed into internal Flash of MAC |
| 0x3000_0000 | 0x3001F_FFFF | 0x0020_0000 | FLASH Firmware | 2 MB of Firmware code/data, placed into the external Flash attached to the MAC |
| 0x4000_0000 | 0x4000_BFFF | 0x0000_C000 | SRAM | 48 KB internal SRAM of the MAC |
| 0xFC00_0000 | 0xFC0F_FFFF | 0x0010_0000 | Control Register Space | 1 MB address space to access periphals of the MAC |
Part 2) Gathering the needed data (binary images)
For the firmware itself, those VBF files are needed:
- 7M2T-14C026-AG.vbf -> MAIN
- 7M2T-14C026-BC.vbf -> FLASH
Now we also need the PBL code and the Reset-Vectors.Those are not available as VBF files, since they are programmed by the manufacturer. One way to get them is to download it from an working device having the same(!) firmware applied. I did it using JTAG, my Segger J-Link and J-Mem, a tool to read out memory locations through JTAG.
To do so, connect the J-Link probe to the IPC board, attach a 12V source to it (no IGN simulation needed), open "J-Link Commander" shell and issue these commands to connect to the device:
Code: Select all
selectinterface 0
speed 750
jtagconf -1,-1
device MAC7116
BE
connect
Code: Select all
savebin c:\temp\bootvectors.bin, 0x0, 0x20
savebin c:\temp\pbl.bin, 0x1000, 0x4000
Part 3) Putting it all together
For a quick startup, i've added a ZIP containing all the files needed.
1.) Startup IDA Pro and choose "New" 2.) Start with the bootvectors file "7M2T-14C026_VECTORS_0x00000000-0x0000001F.bin" file using "File" -> "Open...".
3.) Choose "ARM Big-endian [ARMB]" processor type (this can't change this afterwards!) 4.) Just accept the following dialog: 5.) Go to "View" -> "Open subviews..." -> "Segments" (or just press "Shift-F7") to open the "Program Segmentation" view. There, right-click and "Edit segment" (or just press "Ctrl+E") on the newly created "ROM" segment. Change segment name to "VECT" and check the "Execute" and "Read" permissions. 6.) Load the PBL file "7M2T-14C026_PBL_0x00001000_0x00004FFF.bin" with "File" -> "Load file" -> "Additional binary file...". Set "Loading segment" to "0x0" and "Loading offset" to "0x1000" ("Create segments" and "Code segment" should be checked): After loading, edit the newly created segment (usually called "seg...") and change it's name to "PBL" and also check the "Execute" and "Read" boxes. 7.) Do the very same (load additional file) with the Main-Firmware file called "7M2T-14C026-AG_MAIN_0x00005000-0x000FFFFF.bin". Set "Loading segment" to "0x0" and "Loading offset" to "0x5000". Edit the segment and change name to "MAIN" and check "Execute", "Read".
8.) Now load the external Flash file "7M2T-14C026-BC_FLASH_0x30000000-0x30200000.bin" in either the same way. Set "Loading segment" to "0x0" and "Loading offset" to "0x30000000", but this time uncheck the "Code segment" box as this file only contains data. Edit the new segment and change it's name to "FLASH", segment class to "DATA" and only check the "Read" box. 9.) The last file to add is the RAM file "7M2T-14C026_RAM-SNAP-NOIGN_0x40000000-0x4000C000.bin". This is only a J-Mem snapshot of a booted Convers+ having this firmware (no ignition, no other signals attached) and it should only aid us as a hint to have reasonable values in there instead of 0x00
. Load it as any other file before, set "Loading segment" to "0x0" and "Loading offset" to 0x40000000. Again enshure "Code segment" is unchecked. Change segment name to "RAM", segment class to "RAM" also (just enter it, if it's not there) and only check "Read", "Write" boxes.10.) In the end your segmentation should look like this: And now it's time to save your work! So go to "File" -> "Save as..." (use a filename and directory you like)
11.) The very last thing to prepare is to do a inital analyzing of the code, where IDA try to detect the code out of the bytes in the segments flagged als executeable. Therefore double-click the "VECT" segment in the segmentation view, which leads you to the "IDA-View A" window: Now choose "Edit" -> "Select all", which will select the whole bytes of all segments, and hit "C" to auto-analyze all data: Answer "Yes" to this question: Now, it takes a while to analyze the code: You got functions detected on the left pane and see how IDA has changed from simply showing bytes to an Assembler view of commands: IDA gave you an impression of the memory layout in the top bar: What you find here is, where IDA could automatically detect code during analysis (blue) and where not (grey).
Now you are ready to go!
And beware: IDA Pro HAS NO UNDO (CTRL-Z) so "save early - save often".
