Open the attached binaries and Binja

Oct 13, 2025 by magicalceylontours.com 34 views

Unsupported PE File Machine Type for Certain ARM Bootloaders

In the world of reverse engineering and binary analysis, the ability to accurately identify the platform of a given binary is crucial. However, Binja, a popular binary analysis tool, has been found to incorrectly identify the platform for certain ARM bootloaders that are artifacts of the GNU toolchain. This issue arises from the fact that the machine type is not part of any specification and was "made up" by binutils. In this article, we will delve into the details of this issue, explore the steps to reproduce it, and discuss the expected behavior.

The bug in question revolves around the machine type of certain ARM bootloaders that are generated by the GNU toolchain. These bootloaders are created using the objcopy command, which is a part of the binutils package. The machine type of these bootloaders is not recognized by Binja, leading to incorrect identification of the platform.

The machine type in question is 0xa00, which is not part of any specification. This value was "made up" by binutils, and as a result, Binja is unable to recognize it. The code snippet from the binutils-gdb repository on GitHub highlights this issue:

https://github.com/bminor/binutils-gdb/blob/master/include/coff/arm.h#L78

The objcopy command used to generate these bootloaders is as follows:

objcopy --output-target=pei-arm-wince-big --subsystem=wince foo.elf foo.pe

This command takes an ARM big-endian ELF file as input and generates a PE file with the specified machine type.

To reproduce this issue, follow these steps:

Open the attached binaries and Binja: Download the attached binary, which contains an example PE header, and open it in Binja.
Observe it incorrectly identify the platform: Binja should incorrectly identify the platform of the binary.

The expected behavior is that Binja should auto-recognize the platform as armv7eb.

A screenshot of the issue is provided below:

If applicable, please provide us with the binary to help us work with the issue faster. The binary is available for download as a zip file:

bootloader-header.pe.zip

One aspect that is not yet clear is how to detect whether the image is big-endian or little-endian ARM. The 0xa00 machine ID is used for both, which makes it challenging to determine the correct platform. This will require a closer look at the objcopy source code.

In conclusion, the issue of unsupported PE file machine type for certain ARM bootloaders is a complex one. Binja's inability to recognize the 0xa00 machine type leads to incorrect identification of the platform. To resolve this issue, a deeper understanding of the objcopy source code and the machine type is required. By working together, we can ensure that Binja accurately identifies the platform of all binaries, including those generated by the GNU toolchain.

To address this issue, the following steps can be taken:

Investigate the objcopy source code: A closer look at the objcopy source code is required to understand how the machine type is generated.
Develop a solution to detect big-endian or little-endian ARM: A solution is needed to determine whether the image is big-endian or little-endian ARM.
Implement the solution in Binja: The solution developed in the previous step should be implemented in Binja to ensure accurate identification of the platform.

By following these steps, we can ensure that Binja accurately identifies the platform of all binaries, including those generated by the GNU toolchain.
Unsupported PE File Machine Type for Certain ARM Bootloaders: Q&A

In our previous article, we discussed the issue of unsupported PE file machine type for certain ARM bootloaders. This issue arises from the fact that the machine type is not part of any specification and was "made up" by binutils. In this article, we will address some of the frequently asked questions related to this issue.

A: The machine type of the ARM bootloaders in question is 0xa00. This value was "made up" by binutils and is not part of any specification.

A: Binja is unable to recognize the machine type because it is not part of any specification. The 0xa00 machine type is not recognized by Binja, leading to incorrect identification of the platform.

A: The ARM bootloaders are generated using the objcopy command, which is a part of the binutils package. The objcopy command takes an ARM big-endian ELF file as input and generates a PE file with the specified machine type.

A: The objcopy command used to generate the ARM bootloaders is as follows:

objcopy --output-target=pei-arm-wince-big --subsystem=wince foo.elf foo.pe

A: Determining whether the image is big-endian or little-endian ARM is challenging because the 0xa00 machine ID is used for both. A closer look at the objcopy source code is required to understand how the machine type is generated.

A: The expected behavior of Binja is to auto-recognize the platform as armv7eb.

A: To reproduce the issue, follow these steps:

Open the attached binaries and Binja: Download the attached binary, which contains an example PE header, and open it in Binja.
Observe it incorrectly identify the platform: Binja should incorrectly identify the platform of the binary.

A: The binary is available for download as a zip file:

bootloader-header.pe.zip

A: The next step to resolve this issue is to investigate the objcopy source code and develop a solution to detect big-endian or little-endian ARM. The solution should then be implemented in Binja to ensure accurate identification of the platform.

In conclusion, the issue of unsupported PE file machine type for certain ARM bootloaders is a complex one. Binja's inability to recognize the 0xa00 machine type leads to incorrect identification of the platform. By addressing the frequently asked questions related to this issue, we can better understand the problem and work towards a solution.