hobune Channels Contact About Donate

Bare-metal ARM firmware reverse engineering with Ghidra and SVD-Loader

Back to video page | Download comments jsonl

Comments (archived 2022-07-02 15:29; 85 top, 125 total comments)

Thanassis Tsiodras 2020-02-27 18:31:16

The signal-to-noise ratio of your channel is off the charts! Congrats - keep it up.

179 likes
Seamas Clerkin 2020-02-27 21:55:54

Great video! Would love to see some more embedded FW reverse engineering like this :D

35 likes
teslaTrooper 2020-02-27 18:31:18

As a mostly embedded programmer this is great, much easier to follow when there's no complicated OS to worry about.

80 likes
Replies (12)
Asaf Cohen 2020-02-27 19:11:56

also an embedded programmer here just wanted to say c is unreplaceable

9 likes
BRUHItsABunny 2020-02-28 04:09:00

@Asaf Cohen i have no idea and 0 experience in C nor embedded programming however I am interested as to why C is irreplaceable when it comes to embedded programming

0 likes
A A 2020-02-28 04:09:06

As a beginner in coding this really helps me understand what I’m learning so much better.

0 likes
Asaf Cohen 2020-02-28 17:48:09

@BRUHItsABunny c is basically the only option if you want to do effective embedded programming

0 likes
Adri 2020-02-29 19:36:21

@Asaf Cohen Id say rust is another great rising option too right now.

6 likes
Jedzia Dex 2020-03-05 04:22:29 (edited 2020-03-05 04:24:55 )

@Adri Depends on the project you work on. Maybe for hobby in this state of Rust and this kind of MCU. If you're doing a consumer product you will have your setup with your toolchain and exactly defined framework conditions about your libraries, years of knowledge about the hardware and hopefully deep insight. If you don't get memory safety by yourself with C, Rust won't be a magic bullet one might expect. Features such as package management that e.g. cargo provides is rather counterproductive and more a pollution. Don't get me wrong, this is great for other cases ... let's say on a MIPS based approach with a Linux-Kernel, where you use OpenSSL, Server-implementations, etc.
But on such small platforms you want to have (and can have) full hardware control.
The interested one can have a sneak peak at https://github.com/rust-embedded/awesome-embedded-rust

3 likes
Gianluca Recchia 2020-03-17 19:22:29

@Jedzia Dex I've been into Rust only for a few weeks but I'd be interest to know why, in your opinion, C gives you more control over the hardware compared to Rust. They both seems on-par as to the level of abstraction they work at. Rust with no-std (rust without the standard library that is) becomes extremely low-level, while still having all the safety guarantees it normally provides. Rust is going to become C 2.0, basically. The only reason you wouldn't use Rust for new code is because you have so much legacy code to worry about; and even then, Rust seamlessly talks to C code, with no performance loss whatsoever.

1 like
Jedzia Dex 2020-03-17 23:18:53 (edited 2020-03-17 23:45:47 )

@Gianluca Recchia So you use the great interfacing capability of Rust and use C. That is because of simplicity. Sometimes this forces you nearer to the Hardware and away from the abstraction. BTW I don't say you have to choose C. Pick the appropriate tool or one that you are familiar with the most.
For example, designing a very simple switch application with a resulting binary of 100 bytes using a Rust tool-chain of several Gb may be overkill. Or you are bound to industry standards required by your client. Maybe there is no need for the rat tail of a dependency system. Or you need just some "ldr r0, [pc, #208]" here and some "movs r1, #1" there, because it is simpler to "((volatile unsigned short *)(PORTBASE + 208)) = 1;". For Rust see https://doc.rust-lang.org/core/intrinsics/ and core::ptr::write_volatile alike.
Another case can be if a mature system is needed which you can rely on and here, C is the quasi standard in the industry. Also good luck finding a 8051 toolchain for Rust or for similar exotic/legacy(I love C= :-)) processors.

But no programming language or tool-chain frees you from knowing your hardware, e.g. reading data-sheets, knowing specs. etc. Usually AFTER you know the basics and theory behind an area you can begin with abstraction. The only time this works the other way around is if you are curious about something and start to learn the stuff behind.

TLDR; Use what you are familiar with and have fun:)
P.S: C 2.0 ? You forgot C++ and D as heritage. Then Rust is C 4.0 :)

2 likes
Макс Ф. 2020-04-10 09:09:46

Embedded applications can be with an OS. Many STM32 (and other) devices uses FreeRTOS or another real-time operation system.

1 like
Tunahan Karatay 2021-04-22 06:47:49

@BRUHItsABunny What's the alternative, Javascript? Embedded means closer to bare metal, and the closest you can get to bare metal is by using C and Assembly. There are so many cases in which you just need raw memory access. Rust is probably going to replace it in the future, because it is really well structured. This is related to the second reason why embedded programmers use C. It's so efficient and straightforward. In applications that run on a normal PC, it makes sense to use thinks like Go, Python, etc. But in embedded, you need perfectly deterministic software. C is a perfectly predictable language, there is no chance of some random delay caused by the garbage collector etc. Rust has the same design philosophy, but it doesn't allow most memory bugs.

0 likes
BRUHItsABunny 2021-04-22 22:41:00

@Tunahan Karatay this was an insightful answer, thank you

0 likes
Bruh 2022-06-19 20:48:46

@BRUHItsABunny

-Fast

-plenty of libraries

-Has the best syntax ever created by mankind

0 likes
Asaf Cohen 2020-02-27 19:10:24

great editing its cool that you dont pass on the technical aspects and not just the theoretical concepts

17 likes
António Postiga 2020-07-22 23:42:59

Thank you sir. As a beginner in reverse engineering that's starting with a bare metal firmware, this video is very helpful. Please do more

0 likes
Ennar 2021-05-17 01:56:13

Coming from the Bare-Metal world, I often wonder how OSes actually do their thing on microcontrollers, and how to develop for them.

1 like
Jarryd Took 2020-02-28 22:35:47

I don't have this device nor do RE for a living. But damn this is getting me close to trying this out. Always found integrated boards and chipsets fascinating

8 likes
Replies (1)
Jedzia Dex 2020-03-05 03:58:26

16 Bucks, Amazon or else where. Search for "NUCLEO stm32f446re". Use Ghidra Ninja's links in the description to ST-Microelectronics to get an overview for this bugger or discover many more different types. These are great to begin with. What are you waiting for? :))

0 likes
GMManBZFlag 2020-12-13 18:26:16

One thing I'd suggest with regards to memory mapping is to clear the write flag in the flash regions. That way Ghidra automatically dereferences constants and show strings as quoted strings rather than a pointer to a string. Do keep in mind it also removes what it considers to be extraneous reads and writes and unreachable code based on constants, so if there's some configurable options in the firmware, it may remove code from the decompilation for other options that it sees as unreachable.

1 like
Baggers 2021-02-04 01:43:13

These videos are an absolute goldmine. Incredible work

0 likes
Scott Williams 2021-12-06 05:42:01

Outstanding! Thanks for continuing to share your dedicated work

0 likes
Jason Hirsch 2020-05-08 03:29:03

I am really impressed and grateful. This was the most useful jump start I've gotten.

4 likes
Simon Mathiasen 2021-11-20 18:55:57

I've legit been looking for so long for content creators who just explain such things in detail without all the bs

3 likes
Replies (2)
stacksmashing 2021-11-20 19:00:50

Thanks :)

0 likes
Simon Mathiasen 2022-01-16 16:54:18

@stacksmashing though it did take off very fast at the middle ahaha

0 likes
TheBrick2 2020-02-28 19:46:11 (edited 2020-02-28 19:46:54 )

Excellent thanks for writing the SVD loader script. This video popped into my feed and ironically I am just waiting on some details of cortex M3 project which may require some reversing (although hopefully not from a work POV).

3 likes
Dexter Dormain 2021-06-15 17:58:39

Very good information. This is the exact microcontroller we used in our embedded systems courses in university!

0 likes
sweetlilmre 2021-05-29 19:21:43

Please do more of this, it's fantastic!

0 likes
Tom Storey 2021-02-10 11:43:04

Would just like to say, your videos inspired me to have a go at reverse engineering something, so I grabbed a Cisco 2501 router off ebay (because its got a Motorola 68030 in it), and used Ghidra to explore the boot ROMs (was amazed that it supported the m68k architecture!), figured out the memory map, and managed to get FreeRTOS running on it after creating a m68k port for it. :-)

Love your channel!

2 likes
Replies (2)
stacksmashing 2021-02-10 11:43:40

That’s awesome to hear! And sounds like a super interesting project - you should do a write up! :)

1 like
Tom Storey 2021-02-10 12:11:42

​@stacksmashing Ive put notes of what I have found so far up on github, including my FreeRTOS port. I dont know if I can post links here (sometimes works, sometimes doesnt), but you can find it by searching users for my name as one word (the one that doesnt end in sn).

Theres more I would like to find out about it, including a couple more registers within two proprietary chips, but its a monumental task!

1 like
Ron DLH 2021-06-04 20:38:05

Very impressive and educational, thanks!

0 likes
guilhem rioux 2021-10-22 13:11:15

Hi thanks for this awesome video, do you know any other device on which we can improve our knowledges, like a device where you need to extract the firmware with jtag ?
Really enjoy your videos :D

0 likes
Knee Snap 2020-03-06 05:16:03

Nice explanation, I'm surprised at how fast you were able to go through that in Ghidra, it still takes me quite a while to create names and clean up decompiled output. Seems like a good goal.

1 like
Mika Beckerich 2020-03-01 21:31:53

This is the best tutorial of reverse engineering embedded systems with ghidra I've seen so far. Some days ago I wanted to RE an STM board but didn't know how to proceed. Could you please do something like this with the nRF51 or nRF52 processors?

1 like
Replies (2)
Kotesu 2021-05-20 01:36:31 (edited 2021-05-20 01:37:03 )

Unfortunately, most Nordic nRF-series micros are built on top of their Softdevice middleware, which, while technically not an OS, is pretty close to being one. It's also notoriously bad and can obfuscate alot of behaviours. The whole experience can be summarized as one colleague put it: "you don't own the chip, you rent it". I think it would be a huge challenge to reverse-engineer. I've done 15 years of bare metal development and that chip was one of the biggest pain-in-the-ass I ever experienced.

0 likes
Mika Beckerich 2021-05-20 02:24:51

@Kotesu   Yeah I somewhat got it to work and managed to seperate the parts of the firmware (softdevice, app, etc.), but ghidra still has some control flow detection issues on arm, which makes everything complicated. It really is a PITA

0 likes
Elay Dahan 2020-02-27 21:35:37

Quality content, as always.

1 like
zardoz jones 2020-11-22 22:20:07

Love this channel - thanks for you all your vids. Bare metal/Embedded/IOT/Soc adventures are like "crack" for coders - I need help :P

1 like
Matisec 2021-05-14 16:26:29

Now I ask myself why I didn't know this channel before. Great work!

6 likes
Jedzia Dex 2020-03-05 03:34:16 (edited 2020-03-05 03:49:11 )

Nice Video, thanks:)
Be careful with the 5V. Not all pins are tolerant. See "FT" specification in data-sheet, Table 9 for this MCU (Depends on the series). To avoid this: There is 3.3V right next to the 5V supply pin on the NUCLEO. Up to 112 5 V-tolerant I/Os on max 114 I/O for the LQFP144 part. So the chances are good to not release the magic smoke:)
Yours is a LQFP64, so better look that up folks. At all, don't rely on chance. It's a 3.3V part and best practice is to treat it like one. While experimenting, only use the 5V-tolerance functionality if absolutely necessary. This protects against nasty surprises

1 like
Replies (2)
stacksmashing 2020-03-08 12:55:23

If you watch closely you'll see that I used the pin NEXT to the 5V pin, which is 3.3V 😉

0 likes
Jedzia Dex 2020-03-08 16:30:05

@stacksmashing Good boy;)

0 likes
Racim Boussa 2020-02-27 18:01:52

Thank you mate your videos are the greatest in this field.

1 like
Re Cecure 2020-02-27 17:29:04

IOT reversing from Ghidra Ninja? I absolutely love it!! 😍

13 likes
Andrea Vergani 2021-05-16 10:17:17

Great Channel man. You explain so well.
Good Job.

0 likes
Ihsan Topcu 2021-05-12 20:30:36

I swear. You give better lectures than all my CA teachers together!

5 likes
Nicky Lim 2020-11-19 09:58:11

Thanks for the video! Curious, but how did you get the baremetal firmware (example.bin)?

0 likes
Replies (1)
stacksmashing 2020-11-19 09:58:50

I wrote the firmware in C

1 like
Aveneid 2020-02-29 01:22:49

I just started to reverse some code for STM32F2 and you just make my life easier, ty <3

2 likes
Carl Friedrich Gauss 2020-03-01 22:52:46

Excellent upload timing, my STM32 blue pill arrived but a couple days ago. Keep up the good work!

2 likes
Saber LAADHARI 2020-04-13 16:53:08

top quality. i was wondering about custom ARM ASIC without datasheet. how to guess base adress ? Now days they are everywhere they enable to reduce PCB size & cost & make reverse-engenring harder. ARM ASIC includes custom IP modules inside the SOC.

0 likes
Kartik Vatsa 2021-06-10 00:57:16

i tried rev engg with atmega2560 last year, ghidra has support for it, I just had to import the bin/hex file, the thing is i already knew every reg, therefore it was easier for me to rev engg the source code when I look at ghidra's conversion

0 likes
Mike Jans 2021-05-21 07:31:43

This is an absolute amazing video!!!!

0 likes
Harold Fincher 2020-05-03 01:53:49

interesting topic and really well made video!

1 like
robinbuster 2020-03-01 07:38:06

Top quality explanation and skills

1 like
Rashid Zafar 2020-12-24 20:43:51

I watched a video and subscribed right away! Amazing content 😊

0 likes
milp 2021-11-28 13:05:19

The fact that STM calls their mode register MODER in their docs which loosely translates to mold in german, always cracks me up.

0 likes
Je suis suicidaire soyez sympa 2020-08-31 15:24:50

I've always thought that a computer was defined by both hardware AND an operating system. For a bare metal, does the application assume the role of operating system, how does the hardware "communicate" with the app ? Thanks

0 likes
Replies (1)
rowifi 2021-05-18 18:23:04

The app has to do everything an OS does, just that you don't write code for what you don't need. The app can do everything an os does, if you write it, but most bare metal code tends to be simpler.

0 likes
Malek Lamari 2020-02-28 00:03:51

Great video, keep them coming, thnx!

1 like
WG 2021-07-07 01:36:24

as a beginner in RE, where should I start if I want to learn? I have a cyber security background, just not an RE background

0 likes
Rixtronix LAB 2021-05-30 22:08:53

Nice info, thanks :)

0 likes
Fathan Akbar 2020-03-19 10:10:59

Love this explanation vid!

0 likes
Rebar 2021-05-20 22:48:40

Which DevOps Engineers also thought this would be a bare metal tutorial for Kubernetes 😆

0 likes
bagus prabangkoro 2021-02-03 15:25:52

Omg this video brings up memories, I used ARM to build a robot. And oh boy, it's mind consuming to read the datasheet -.-

1 like
Replies (1)
The Terrible Animator 2021-05-11 23:05:24

but you are a better programer for it.

1 like
deltaPath 2022-05-15 12:54:48

omg man.. please do tutorial series and teach us how to use Ghidra :)

0 likes
Munawwar Hussain Sheliya 2020-02-28 03:39:14

Great thanks for creating the video

1 like
nomen omen 2020-02-27 21:47:18

GREAT JOB!!!

1 like
Andy Shevchenko 2021-07-20 12:32:26

Thanks! Any hints from you how to reverse engineer BOSH BHI160 sensor firmware? https://www.bosch-sensortec.com/products/smart-sensors/bhi160-firmware/ I believe they may use Zephyr. In any case `binwalk` kept silent, Ghidra doesn't help much seems...

0 likes
Emiliano Quiroga 2021-05-28 02:43:47

And how do you get the binary from a flashed device?

0 likes
AMIT PARMAR 2020-04-29 05:24:33

Pls show how to include SVD scripts in ghidra environment I tried hard but can't find SVD scripts in script manager pls help

0 likes
ScriptIsle 2020-03-15 14:04:15

is it possible to flash a customized board firmware?

0 likes
Kaio Nayon 2020-03-04 04:03:57

Please keep sharing RE videos
Ill be back for this stuff..

0 likes
Potonicml 2020-05-07 00:59:49

Nice, I can't wait till chips are purpose built for this accessibility to clock cycles - C'mon people WORK ON YOUR AI BABY MODELS!

0 likes
Ciao Bello 2020-02-28 05:33:35

super video.. danke dir

2 likes
James.D 2021-05-30 12:27:14

Incredible!

0 likes
Minhaj SixByte 2021-05-20 03:16:12 (edited 2021-05-20 03:16:51 )

Can someone give me a list of prior knowledge do i need to do these things, roughly

0 likes
Mohamed Edrees 2020-11-17 22:47:56

Brilliant I have a challenge I know some brilliant mind like you Will solve it I need help with a Korean nintendo wii Locked on error 003 after update there is way to fix it but it's a painful and I can't find a modchip if there any way through software please and a lot of thanks to you for your time and work

0 likes
ECX0x100h 2021-10-27 20:11:42

Much more comfortable watching this at 0.75 speed lol

0 likes
evandrix none 2020-02-29 00:57:14

how did you get the display out that prints the crackme messages? the cable connected is a usb cable to power the microcontroller, right?

0 likes
Replies (1)
stacksmashing 2020-02-29 20:34:03

It's a serial terminal, the USB cable provides power and also a virtual serial port (and also access to the integrated ST-Link programmer)

0 likes
Diva Harsoor 2021-07-29 16:30:51

I'm having trouble finding the link to download example.bin. Can anyone help me out?

0 likes
MAT\x48 2020-02-27 22:37:55

Thank you :)

1 like
Junaid Saeed Uppal 2020-02-28 03:25:39

thank you!

1 like
Rena Kunisaki 2020-04-06 03:39:35

Tip: leave the address on the end of an unknown name. Eg usart_fn08000752. Then you don't have to worry about having a dozen different functions named usart_fn3 scattered around.

0 likes
Replies (1)
stacksmashing 2020-04-06 08:36:30

Good idea, I should try that

0 likes
BAZU 2021-04-01 14:58:38

The main reason why I clicked on this video was that I was hoping to learn how to export binary from mcu :(

0 likes
Devin Perez 2020-08-28 17:22:59

Would a reasonable way to be able to tell the endianness just be trial and error?

0 likes
Bunmi Lajide 2020-02-27 17:29:48

Please on your previous video on creating back door to a camera. I am having issue using the mkimage. It is not working for me. Is it not part of tools in Kali? Do I need to install it. I am not getting direct link on how to go about it. Can you help please?

0 likes
Replies (3)
stacksmashing 2020-02-27 17:31:37

I don't know if it's part of Kali, but on Ubuntu it's part of the "u-boot-tools" package

0 likes
Re Cecure 2020-02-27 17:34:53 (edited 2020-02-27 17:36:14 )

Just use firmware mod toolkit. It's easier that way. Btw. @GhidraNinja, you might wanna try firmware-mod-toolkit too. It's got sources for all versions of squash fs (even industrial versions).

Edit: I mean squash fs tools.

1 like
Bunmi Lajide 2020-02-27 18:51:08

@resync cyberwatch. Thank you
I will search for it and try it. Many thanks

0 likes
xxMrPHDxx 2020-03-03 01:28:57

I can't wait for next wannacry inverse engineering

1 like
ifohancroft 2021-05-17 10:49:29

I'm sorry but how did you figure out the SRAM lenght to that you put in the memory map? The SRAM blocks on the MCU I'm trying go from 0x20000000 to 0x40000000, also at the start of the Memory section in the datasheet says the chip has 256 kB RAM, so do I just put 0x40000 or could that be a different length since there are separate RAM and SRAM blocks and I see you are putting the SRAM's starting address

0 likes
Bhavith C 2021-05-12 13:51:24

Bro which IDE is that

0 likes
AMIT PARMAR 2020-04-30 15:03:37

yes i have refreshed but dont work

0 likes
Re Cecure 2020-02-27 17:30:21

So... Yikes... Looks like I'm too 👂ly here.

0 likes
boB Gudgel 2020-04-08 20:55:23

Not sure where to find the ghidra python module ? Python reports that I am missing this. Any idea where to find that ?

0 likes
Replies (2)
stacksmashing 2020-04-08 20:57:06

You need to run the script from within Ghidra, then it should be fine

1 like
boB Gudgel 2020-04-08 22:20:52 (edited 2020-04-08 22:22:55 )

Thank you ! I didn't understand how it all went together at first. Found Ghidra at ghidra-sre.org and also downloaded the SDK from aws.amazon.com/corretto/ and things are up and running ! The biggie for me was understanding what ghidra itself was. I am using this same STM32F446 except for it being 100 pin so may be helpful to me ! Also fun to play with the other processors. Now if there is a .elf import too, I might be able to include source code comments ? Not sure if it does that or not

0 likes
Twobob Club 2021-05-23 23:40:13

nice. good talk.

0 likes
Gaston The Dank 'Tiel 2020-02-27 17:22:35

Im subscribed to this channel cz the dragon looks cool

4 likes
Saeed Mahmoodi 2020-02-28 22:49:31

brain.exe has stopped working

0 likes
astroboy tech ranger 2020-10-31 15:48:33

I didn't find decompiler for stm32f103c4 elf file to c code error

0 likes
Replies (4)
astroboy tech ranger 2020-10-31 15:48:55

With ghidra tool

0 likes
stacksmashing 2020-11-01 14:39:30

Not sure what you mean?

1 like
astroboy tech ranger 2020-11-01 14:56:42

@stacksmashing I used elf file of microcontroller STM 32f103c4 and I installed ghidra on Ubuntu 18 running of Jetson nano Nvidia board (GPU micro pc) and iam getting error as "decompiler missing__could not find decompiler excutable decompile"

1 like
astroboy tech ranger 2020-11-01 14:59:34

When I try to do analysis and c code is not generated 😭I tryed on virtual box with Ubuntu 20 now I got c code generated 😀👍✌️👌

0 likes
mikolaj kozakiewicz 2021-05-21 15:01:41

<3

0 likes
Iván0 2020-02-29 02:13:37

Please, do a similar video but now with the most popular MCU: atmega328 (Arduino UNO)

3 likes
Replies (1)
stacksmashing 2020-02-29 20:33:29

LiveOverflow did a couple on them: https://www.youtube.com/watch?v=D0VKuZuuvW8

3 likes
HelaFaye 2020-02-27 17:22:36

Notification squad. Lol, I'm a nerd.

1 like
Begga 2020-02-28 23:01:20

yeet

1 like
Perry Kivolowitz 2021-06-05 19:41:30

I'm sorry - I cannot get past you referring to 0x20000000 as hex two thousand etc. A hard pass on what could potentially have been an interesting video.

0 likes
Replies (1)
stacksmashing 2021-06-05 19:46:30

Okay :)

1 like
AMIT PARMAR 2020-04-29 05:27:08

Pls reply fast because I have a project to complete

0 likes
Replies (2)
stacksmashing 2020-04-29 08:20:47

You have to add the script folder to the paths Ghidra searches for scripts in

0 likes
AMIT PARMAR 2020-04-29 22:28:00

Add folder script folder to script directories in script manager but no effect and don't show in script list

0 likes
AMIT PARMAR 2020-04-30 04:27:01

Add script folder to script directories in script manager but dont show scripts in script list

0 likes
Replies (1)
stacksmashing 2020-04-30 07:43:12

Have you clicked the refresh button? Otherwise something else is wrong, the SVD-Loader.py script will get detected by Ghidra once it's in the search path.

0 likes
Can Billy 2021-02-08 06:43:53

Sorry, but way too much base and I can hardy make out what you are saying.

0 likes