|
2 years ago | |
---|---|---|
LICENSE | 2 years ago | |
README.md | 2 years ago | |
brom | 2 years ago | |
brom.s | 2 years ago |
This repository contains the Allwinner V3s Boot ROM Reverse Engineering work.
The Allwinner V3s SoC starts by executing a piece of code stored in masked ROM known as «BROM» (for Boot ROM).
It is located at address 0xffff0000 and its size is 32KB (0x8000).
In order to dump its contents, you need first to clone the sunxi-tools repository using:
git clone https://github.com/linux-sunxi/sunxi-tools.git
Then follow the building instructions, basically:
cd sunxi-tools
make
(We don’t need to target tools).
In order to turn the dump into something readable, you will need linux machine and download an ARM cross-toolchain, such as the one contained in the FunKey SDK from:
In order to install it, type:
sudo tar zxvf FunKey-sdk-2.0.0.tar.gz -C /opt
In order to dump the ROM, type:
sudo ./sunxi-fel read 0xffff0000 0x8000 path_to_your/brom
In order to disassemble the ROM into readable ARM instructions, type:
/opt/FunKey-sdk-2.0.0/bin/arm-funkey-linux-musleabihf-objdump -D -bbinary -marm --adjust-vma=0xffff0000 path_to_your/brom >path_to_your/brom.s