reverse_engineering:ghidra:create_a_project
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
reverse_engineering:ghidra:create_a_project [2022/03/12 10:38] – kitor | reverse_engineering:ghidra:create_a_project [2022/04/01 17:46] (current) – [Initial analysis] kitor | ||
---|---|---|---|
Line 27: | Line 27: | ||
* Block name: as you wish, but something meaningful is recommended (eg ROM0, ROM1) | * Block name: as you wish, but something meaningful is recommended (eg ROM0, ROM1) | ||
* Base Address: | * Base Address: | ||
- | * Digic 6: ROM1 loads at 0xF0000000 | + | * Digic 6: ROM1 loads at '' |
- | * Digic 7,8,x: ROM0 loads at 0xE0000000 | + | * Digic 7,8,x: ROM0 loads at '' |
* Leave all other options as default. | * Leave all other options as default. | ||
Close by clicking OK on all dialogs, and then acknowledge the import result. File will appear in a project. | Close by clicking OK on all dialogs, and then acknowledge the import result. File will appear in a project. | ||
- | ===== Run disassembly | + | ===== Project preparation |
- | Jump to second level (DryOS) bootloader address (press ' | + | Click twice on newly imported file. It will bring up "Code Browser" |
- | * Digic 6: 0xF0 | + | |
- | * Digic 7,8: 0xE0040000 | + | |
- | * Digic X: 0xE0100000 | + | |
- | Press F12 to disassemble in Thumb mode. Wait for Ghidra to finish a task - it will discover a lot of functions so it will take some time. | + | Ghidra |
- | After it is done, we name that function `firmware_entry` | + | === Load 2nd ROM file (where applicable) === |
- | ===== Initial analysis ===== | + | Go to '' |
- | Click twice on newly imported file. It will bring up "Code Browser" | + | Open '' |
- | + | ||
- | Ghidra will ask if you want to perform auto analysis now - select **No**. | + | |
=== Fix memory map === | === Fix memory map === | ||
- | Navigate to Window -> Memory Map. In the only existing row (representing loaded ROM image) | + | Navigate to '' |
- | === Run auto analysis | + | === Add other memory regions |
- | Navigate to Analysis -> Auto analysis "< | + | This topic has a separate Wiki section: [[reverse_engineering: |
+ | |||
+ | == Result == | ||
+ | |||
+ | Complete memory map for EOS R 1.8.0 (internal 7.3.9) firmware: | ||
+ | |||
+ | {{ : | ||
+ | |||
+ | ===== Initial analysis ===== | ||
+ | |||
+ | Project is now ready to start disassembling. | ||
+ | |||
+ | === Configure auto analysis === | ||
+ | |||
+ | Navigate to '' | ||
There' | There' | ||
Line 64: | Line 73: | ||
* Disable " | * Disable " | ||
- | Run the analysis - it will take a long time. After it is done, you may want to run "one shot" analysis for Embedded media and for Create Address Tables - but YRMV. | + | Click '' |
+ | |||
+ | === Run disassembly === | ||
+ | |||
+ | Jump to second level (DryOS) bootloader address (press ' | ||
+ | |||
+ | ^ CPU ^ Address | ||
+ | | Digic 6 | '' | ||
+ | | Digic 7,8 | '' | ||
+ | | Digic X | '' | ||
+ | |||
+ | Press F12 to disassemble in Thumb mode. Wait for Ghidra to finish a task - it will discover a lot of functions so it will take some time. | ||
+ | |||
+ | After it is done, we name that function '' | ||
+ | |||
+ | === Run auto analysis === | ||
+ | |||
+ | Go back to '' | ||
+ | |||
+ | Run the analysis - it will take a long time. After it is done, you may want to run "one shot" analysis for Embedded media and for Create Address Tables - but YMMV. | ||
reverse_engineering/ghidra/create_a_project.1647077882.txt.gz · Last modified: 2022/03/12 10:38 by kitor