ARM Cortex-R4 Firmware Reverse Engineering – Find Function Addresses in Binary Files

Description:

I have several ARM Cortex-R4 firmware binary files (.bin, big endian) from embedded systems controllers.

In one of the firmware versions (reference version), I already have the following addresses identified:

• first_loop = 0x3142
• BL_EEPROM_READER = 0x1494
• BL_AFTER_CALL = 0x1498

These correspond to a specific execution loop entry point, a BL call to a SPI peripheral access function, and the return address after that call.

The job:
I have newer firmware versions from the same hardware platform where these functions exist but are located at different addresses. I need you to analyze the newer binaries and find the equivalent addresses using the reference version as a guide.

What I need delivered:
• The equivalent addresses (first_loop, BL call, return address) for each new firmware file provided (V3, V4 and V5). I've included V1 and V2 with the addresses already found, but with old firmware.
• A brief explanation of how you identified each one

What you will receive from me:

• The reference binary with the known addresses
• 2–3 newer firmware binaries to analyze

If you have experience with ARM binary analysis, disassembly, or reverse engineering of embedded firmware, I'd like to hear from you. Please mention in your proposal what tools you would use and your approach