#45839 - Vince - Wed Jun 15, 2005 6:07 pm
Hello to all of you,
I am one of the authors of if2a, the F2A/F2AUltra flashing software. I am in the process of going on with the reverse-engineering of the F2A Ultra features. To do that, I need to reverse-engineer the F2A Ultra loader (CIZ) as not much information can be obtained anymore from the memory dumps/sniffs.
Where I am:
+ I have an accurate disassembly of the binary using objdump as well as the reference datasheet for the ARM7 + GBATek excellent GBA spec. I have checked the disasm against VBA one and they both match so it seems correct to me.
+ I am using VBA (both Win32 normal and Linux SDL version) to understand what is being done under the hood. Unfortunately, the normal version (with the GUI) does not allow memory/register modification (I am running it through Wine so I may be wrong). The SDL version which embeds the debugger does not allow me to put breakpoints on addresses, only on symbols/lines/functions (whihc I don't have). Moreover, it seems impossible to launch the debugger before starting the emulation, something that annoys me. The VBA documentation is quite scarce on that matter and I would appreciate help here.
+ I have used objcopy to create an ELF file from the binary. I still need to change the section name as all goes into .data but this seems a viable approach to load it into an arm-built GDB and to connect to VBA. Once my GBA/VBA works, I can start building symbol tables by hand/using objcopy using information gathered from the reverse.
+ I am also thinking about scripting the objdump disasm in order to add function/jump detection. Is this a good approach?
What do you think about my method? I am sure there are more efficient ways to do that but I would like to use free tools (I don't want to buy IDAPro).
Thanks or your help on that matter, I've tried to gather as much info as I could but the forums is not full of information here (most people say they reverse engineer things but do not say how they did it...).
Vince
_________________
Reclaim control of your F2A/F2AU with if2a !!
I am one of the authors of if2a, the F2A/F2AUltra flashing software. I am in the process of going on with the reverse-engineering of the F2A Ultra features. To do that, I need to reverse-engineer the F2A Ultra loader (CIZ) as not much information can be obtained anymore from the memory dumps/sniffs.
Where I am:
+ I have an accurate disassembly of the binary using objdump as well as the reference datasheet for the ARM7 + GBATek excellent GBA spec. I have checked the disasm against VBA one and they both match so it seems correct to me.
+ I am using VBA (both Win32 normal and Linux SDL version) to understand what is being done under the hood. Unfortunately, the normal version (with the GUI) does not allow memory/register modification (I am running it through Wine so I may be wrong). The SDL version which embeds the debugger does not allow me to put breakpoints on addresses, only on symbols/lines/functions (whihc I don't have). Moreover, it seems impossible to launch the debugger before starting the emulation, something that annoys me. The VBA documentation is quite scarce on that matter and I would appreciate help here.
+ I have used objcopy to create an ELF file from the binary. I still need to change the section name as all goes into .data but this seems a viable approach to load it into an arm-built GDB and to connect to VBA. Once my GBA/VBA works, I can start building symbol tables by hand/using objcopy using information gathered from the reverse.
+ I am also thinking about scripting the objdump disasm in order to add function/jump detection. Is this a good approach?
What do you think about my method? I am sure there are more efficient ways to do that but I would like to use free tools (I don't want to buy IDAPro).
Thanks or your help on that matter, I've tried to gather as much info as I could but the forums is not full of information here (most people say they reverse engineer things but do not say how they did it...).
Vince
_________________
Reclaim control of your F2A/F2AU with if2a !!