What firmware did you use?
The procedure is the following: name the entry point as "fw_base" and the run smart_disasm(), it will calculate the disasm region bounds and call smart_disasm_region().
Calling smart_disasm_region for a small part of the firmware is a bad idea, as pointers may be very distant from the corresponding functions.
This script is better than the previous because it has a very small amount of false positives. And false positives frequently make IDA disassemble data, not code, and then the disasm looks awful. The old script is especially awful for nuvis 34xx, 24x5 (when the firmware uses Thumb2 instructions).
UPD
Yeah, it does miss functions, can't yet explain why.
I thought that any function is either called indirectly (and then its address is stored as integer), or it's called directly by some function and then we can proceed recursively with the caller. By this reasoning the new script should disassemble all functions.
I'm aware that this reasoning is false sometimes (the italic part), as some functions are first copied to another location and only after they are called, also there is infinite amount of perverted ways to call a function (but only small amount of them is used by the compiler). But I'm hoping that it's false for not too many functions.
So, in conclusion, the new script is better because the disasm is clearer (no images/other data is disassembled!), while almost all usable functions are found.
Bookmarks