Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Console ReEngineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 05-04-2011, 04:07 AM
chrgu000 chrgu000 is offline
Junior Member
 
Join Date: May 2011
Posts: 2
Cool Is possible to reverse an embedded ARM linux u-Image?

All,

I am reversing an emdedded device, which is based on ARM Linux. I have dumped full flash image from the device, and extracted the files from it's file system. Now I found some encryption alg. of this device is compiled as static driver mode, e.g. these algs are in the uImage file. As you now, uImage is not in ELF format, I can use Hex editor to find some useful strings in the uImage file, so my question is : is it possible to disassemble the uImage with IDA or some other tools? If it is not possible, how can I reverse it?
P.S. Is there some useful links for this topic? I have Googled for a long time, but nothing seems help to me.

Thanks very much.
Reply With Quote
  #2  
Old 05-04-2011, 05:07 AM
kao kao is offline
Senior Member
 
Join Date: Sep 2007
Posts: 184
Default

Hmm, standard tools and tutorials wouldn't work?
http://buffalo.nas-central.org/wiki/...ract_an_uImage
http://beaversource.oregonstate.edu/...wto.txt?rev=32
Reply With Quote
  #3  
Old 05-04-2011, 09:28 PM
chrgu000 chrgu000 is offline
Junior Member
 
Join Date: May 2011
Posts: 2
Default

Quote:
Originally Posted by kao View Post
Kao,

Thanks for your reply, I have successfully extract the uImage to a piggy file. Following is the procedure:
1. Use the script (http://buffalo.nas-central.org/wiki/...act_an_uImage), which will extract uImage to zImage;
2. Use following command:arm_v5t_le-objdump -EL -b binary -D -m armv5t zImage | grep 8b1f, this will find the offset of real kernel code in zImage, e.g. skip the self decompress code.
3. Use dd if=zImage of=piggy.gz bs=1 skip="offset found in setp 2" | gunzip piggy.gz. After this command, we will get a piggy file, which contains pure kernel code, but this is only a binary format, not a ELF format, so IDA can not diassemble it.
=============================

So, my question is: when I get this piggy file, how can I diassemble it, and find the "interesting code " in this file?

Any suggestion?

Thanks
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.