can't analysis the ELF files

[shmuelfomberg]

I'm trying to open a similar file, from Asus ROG 8. but I see different things than you did. can you give me a hint?

it seen that they moved xbl_ramdump.img and xbl_config.img outside from the main file to files of their own. (I don't know what these files are, but you mentioned them in the repository)

it seen that the file have three parts. one some kind of header (size 0x904 bytes), second is unknown, and third is an elf file that I opened mostly successfully. (still have unreferenced things that annoy me, starting from offset 0x2F574)

About that second file, It looks like a normal ELF file, with entropy for code (about 6, even if suspiciously uniform) and an area for strings and data in the end. but it won't disassemble to anything, no matter what I do.

The third ELF contains strings about DDR training, for I guess it is the xbl_core file. so the second should be the xbl_sec.mbn file.

I tried disassemble in 64 bit mode, and 32 bit. thumb. little and big endian. ARM7. nothing. (the device is ARM64 LE)

below is a binwalk and readelf of this xbl.img file.
any hint?

thank you.

binwalk xbl.img

DECIMAL HEXADECIMAL DESCRIPTION

0 0x0 ELF, 32-bit LSB executable, version 1 (SYSV)
2308 0x904 ELF, 32-bit LSB executable, version 1 MathCoPro/FPU/MAU Required (SYSV)
169732 0x29704 YAFFS filesystem, little endian
183724 0x2CDAC Certificate in DER format (x509 v3), header length: 4, sequence length: 624
184352 0x2D020 Certificate in DER format (x509 v3), header length: 4, sequence length: 684
185040 0x2D2D0 Certificate in DER format (x509 v3), header length: 4, sequence length: 629
187188 0x2DB34 Certificate in DER format (x509 v3), header length: 4, sequence length: 566
187758 0x2DD6E Certificate in DER format (x509 v3), header length: 4, sequence length: 692
188454 0x2E026 Certificate in DER format (x509 v3), header length: 4, sequence length: 728
193908 0x2F574 ELF, 64-bit LSB executable, version 1 (SYSV)
741818 0xB51BA Unix path: /dev/icbcfg/boot
757748 0xB8FF4 SHA256 hash constants, little endian
772240 0xBC890 CRC32 polynomial table, little endian
775392 0xBD4E0 CRC32 polynomial table, little endian
1083788 0x10898C Certificate in DER format (x509 v3), header length: 4, sequence length: 624
1084416 0x108C00 Certificate in DER format (x509 v3), header length: 4, sequence length: 684
1085104 0x108EB0 Certificate in DER format (x509 v3), header length: 4, sequence length: 629
1087252 0x109714 Certificate in DER format (x509 v3), header length: 4, sequence length: 564
1087820 0x10994C Certificate in DER format (x509 v3), header length: 4, sequence length: 692
1088516 0x109C04 Certificate in DER format (x509 v3), header length: 4, sequence length: 728

readelf -a xbl.img
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: RISC-V
Version: 0x1
Entry point address: 0x22126000
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x5, RVC, double-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 2
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0

There are no sections in this file.

There are no section groups in this file.

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000084 0x22126000 0x22126000 0x00600 0x00600 RWE 0x1
LOAD 0x000684 0x22126600 0x22126600 0x00280 0x00280 RWE 0x1

There is no dynamic section in this file.

There are no relocations in this file.

The decoding of unwind sections for machine type RISC-V is not currently supported.

Dynamic symbol information is not available for displaying symbols.

No version information found in this file.