Author Topic: Need help disassembling this binary  (Read 921 times)

0 Members and 1 Guest are viewing this topic.

Offline VooDustTopic starter

  • Regular Contributor
  • *
  • Posts: 70
  • Country: ch
Need help disassembling this binary
« on: November 27, 2023, 07:58:32 pm »
I am analyzing the firmware for my heat pump.

The main controller software binary is a standard ELF file, I was able to successfully load it into IDA Disassembler as ARM little-endian (thumb), patch some constant to change the heat pump's behavior, and retrieve the master password which was hardcoded into the binary. The firmware for the controller runs on a MCU that I could identify as ATSAMD21G18.

However, there is another file from the complete firmware package, and that is simply a generic .LIN file. I believe this file to contain code that runs on another controller board that communicates with the main controller software. However I was not yet able to identify what MCU it runs on.

Here is the .LIN file, I was hoping some expert here could jumpstart a noob like me and tell me what kind of binary / CPU architecture that is. I can only see garbage trying to disassemble it as ARM bytecode.
 

Offline bingo600

  • Super Contributor
  • ***
  • Posts: 1989
  • Country: dk
Re: Need help disassembling this binary
« Reply #1 on: November 27, 2023, 08:48:40 pm »
If looking at the "Strings in the binary"



They seem to match here (google search)

Ie: FreeRun forbidden in sleep mode   (Line 880)
https://android.googlesource.com/platform/external/arduino-ide/+/refs/heads/master/hardware/arduino/sam/system/libsam/source/adc.c

That might indicate it's for another sam processor

/Bingo
« Last Edit: November 27, 2023, 08:50:57 pm by bingo600 »
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 824
  • Country: es
Re: Need help disassembling this binary
« Reply #2 on: November 27, 2023, 08:56:14 pm »
The .LIN file is for Cortex-M MCU too, it is a raw binary with load address 0x401800.
A quick look shows ADC address 0x40038000, UART address 0x40024000 - this arrangement matches ATSAM4S.
 
The following users thanked this post: bingo600

Offline VooDustTopic starter

  • Regular Contributor
  • *
  • Posts: 70
  • Country: ch
Re: Need help disassembling this binary
« Reply #3 on: November 28, 2023, 10:30:54 am »
Thank you, I'll try to disassemble it again.
 

Offline AVI-crak

  • Regular Contributor
  • *
  • Posts: 125
  • Country: ru
    • Rtos
Re: Need help disassembling this binary
« Reply #4 on: November 28, 2023, 02:19:20 pm »
Ghidra can break any arm code. It's my favorite tool.
 

Offline coppice

  • Super Contributor
  • ***
  • Posts: 8651
  • Country: gb
Re: Need help disassembling this binary
« Reply #5 on: November 28, 2023, 02:22:43 pm »
Ghidra can break any arm code. It's my favorite tool.
Ghidra is the best tool I know for pulling apart any binary for an instruction set it supports. It will frequently get you to moderately readable C source code.
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 824
  • Country: es
Re: Need help disassembling this binary
« Reply #6 on: November 28, 2023, 03:28:39 pm »
arm-none-objdump can break any ARM code too  >:D
 

Offline DavidAlfa

  • Super Contributor
  • ***
  • Posts: 5912
  • Country: es
Re: Need help disassembling this binary
« Reply #7 on: November 28, 2023, 11:12:25 pm »
Ghidra + svd viewer plugin.
Hantek DSO2x1x            Drive        FAQ          DON'T BUY HANTEK! (Aka HALF-MADE)
Stm32 Soldering FW      Forum      Github      Donate
 

Offline abyrvalg

  • Frequent Contributor
  • **
  • Posts: 824
  • Country: es
Re: Need help disassembling this binary
« Reply #8 on: November 29, 2023, 02:37:41 am »
IMO, no point switching to Ghidra from IDA (OP have mentioned some prior success with it).
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf