Difference between revisions of "Working with binaries"
(→GNU ARM toolchain) |
(→IDA Pro demo) |
||
| Line 17: | Line 17: | ||
</pre> | </pre> | ||
| − | ==IDA Pro | + | ==IDA Pro== |
| − | ===IDA Pro 5.7 paid=== | + | ===Distributions=== |
| + | ====IDA Pro 5.7 paid==== | ||
This is the best version if you can pay. One of the main advantages over its demo version is that you can save project files. | This is the best version if you can pay. One of the main advantages over its demo version is that you can save project files. | ||
| − | ===IDA Pro 5.7 demo=== | + | ====IDA Pro 5.7 demo==== |
This is the best version if you don't want to pay. It can't save or open binary files, but there is a workaround to opening binaries. | This is the best version if you don't want to pay. It can't save or open binary files, but there is a workaround to opening binaries. | ||
| Line 28: | Line 29: | ||
arm-elf-objcopy --set-section-flags .data=code dump.elf | arm-elf-objcopy --set-section-flags .data=code dump.elf | ||
</pre> | </pre> | ||
| − | ===IDA Pro 4.9 freeware=== | + | ====IDA Pro 4.9 freeware==== |
This version is tempting to download but useless since it doesn't support ARM. | This version is tempting to download but useless since it doesn't support ARM. | ||
| + | ===Usage=== | ||
| + | #To create a new disassembly database, go to File->New... | ||
| + | #Select "Binary/Raw File" under the "Various files" tab | ||
| + | #Select the binary file you want to examine | ||
| + | #Click next. You don't need the analysis options | ||
| + | #The processor you should select is "ARM processors: ARM". Click next | ||
| + | #Click finish. Now you are asked about memory mapping. Fill out the info and press OK. | ||
| + | #IDA will now create the project file. Sometimes it freezes but if it does just try these steps again. There should be two popups concerning thumb mode and your program's entry point. Press OK for both of them. | ||
| + | #Go to 0x02000000 and press 'C'. This tells IDA that this is code. All the other code should appear now. | ||
| + | #You are good to go. Happy analyzing! | ||
==Helpful pages== | ==Helpful pages== | ||
Revision as of 20:32, 2 August 2010
Contents
GNU ARM toolchain
Working with the ARM platform requires a special toolchain. The GNU ARM toolchain has all the basic tools needed to build and examine software on the iPod.
Obtaining
The GNU ARM toolchain can be downloaded from http://www.gnuarm.com/. You can either download source or binaries. Put the binaries in your system path.
Assembling
arm-elf-as -o test.o test.asm arm-elf-ld -e 0 -Ttext=0 -o test.elf test.o arm-elf-objcopy -O binary test.elf test.bin
Disassembling
arm-elf-objdump -bbinary -marmv4 -D test.bin > test.asm
IDA Pro
Distributions
IDA Pro 5.7 paid
This is the best version if you can pay. One of the main advantages over its demo version is that you can save project files.
IDA Pro 5.7 demo
This is the best version if you don't want to pay. It can't save or open binary files, but there is a workaround to opening binaries.
The IDA Pro demo can't open raw ARM files but it can open ELF files. We need to convert the raw binaries to ELF binaries as a workaround. Assuming the input file is called "dump.bin" and the output will be called "dump.elf", run these commands:
arm-elf-objcopy --change-addresses=0xff810000 -I binary -O elf32-littlearm -B arm dump.bin dump.elf arm-elf-objcopy --set-section-flags .data=code dump.elf
IDA Pro 4.9 freeware
This version is tempting to download but useless since it doesn't support ARM.
Usage
- To create a new disassembly database, go to File->New...
- Select "Binary/Raw File" under the "Various files" tab
- Select the binary file you want to examine
- Click next. You don't need the analysis options
- The processor you should select is "ARM processors: ARM". Click next
- Click finish. Now you are asked about memory mapping. Fill out the info and press OK.
- IDA will now create the project file. Sometimes it freezes but if it does just try these steps again. There should be two popups concerning thumb mode and your program's entry point. Press OK for both of them.
- Go to 0x02000000 and press 'C'. This tells IDA that this is code. All the other code should appear now.
- You are good to go. Happy analyzing!
