I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a learning exercise.

It was explained that in both File1.bin and File2.bin there was both ARM926EJ-S code and Blackfin DSP code combined. I'm interested in looking at the ARM code, but am not clear on how to separate one from another. Using binja and Ghidra at the moment...

How can the ARM code get isolated, and what's the best way to decompile down to seeing functions like RegisterATCmdHook() and RegisterPendingATCmdHook()?

Paper is available here: https://uploadfiles.io/2l0f9ulc


Once I solved the opposite problem: to collect Blackfin code as memory dump and load it into IDA. To solve your issue you can just consider DSP code as a data using memory chunk description from here

  • Yes, I have been looking at this paper, but having trouble with this portion: "After removing the header, two resulting binary ﬁles can be ARM-disassembled by setting the correct base address, which can be deduced from the respective headers" How the heck do they expect that to be done? – Walter Christie Apr 16 at 3:01
  • I can't publish screenshot in my comment. Try to open File1.bin in IDA using "ARM Little-endian" CPU , "ROM start address = 0x04C00000", "Loading address = 0x04C00000" and "File offset=0x50" settings. – Igor Matyuh Apr 16 at 15:54
  • @IgorMatyuh just put the screenshot in your post – julian Apr 18 at 10:03
  • @IgorMatyuh: Now i'm getting somewhere, your last got me seeing the right stuff. So basically, the Blackfin firmware is 0x08000000 -> 0x05040000, with the ARM firmware being 0x04C00000 -> 0x04000000. This matches what the Groundworks paper had. The question then is - how did they figure out this memory map? Are there ASCII strings that indicate this? – Walter Christie Apr 20 at 3:38

Your Answer

