MBN Files¶
An MBN files is a container for executable code, data files, and SSL certificates. It uses a Qualcomm modified ELF header that contains the memory addresses of all the code and data, which may support multiple architectures.
MBN Format¶
Unlike an MDT file which uses multiple files, an MBN file is one large blob. It uses an ELF header to define the rest of the data. In some cases there is embedded ELF data contained in the standard ELF Program Headers field. When using the mdttool.py utility in this project to split the large file into it's separate components, these are extracted into standalone files for analysis.
File Splitting¶
Android and Linux on the same hardware device have the same blobs, with minor variations probably due to the software version. To support reverse engineering, or to duplicate the separate files used on Android, the MBN file can be split using the program headers. Each program header creates a standalone file. Only the first generated file will contain an ELF header, unless there are embedded ELF files. The rest will be just data.
Disassembling The Files¶
This distinction is important, as without an ELF header, none of the free reverse engineering tools can identify the architecture. At that point all you have is a hex dump. Using the radare2 program you can specify the required values for architecture and endianess and disassemble them. There are only a few possible values used for the Snapdragon, namely ARM, AARCH64, and RISCV32. ARM code may also be 16 bit Thumb code. All the variations can be tried until you get what looks like good disassembly.
You'll also see large sections of data only containing zeros. When disassembling, this will all appear as invalid instructions. This is the padding used to align the data within memory, so can be ignored.
SSL Certificates¶
On Linux, the SSL certificates aren't in a separate file, they're in one of the program headers. This program header can be identified as it uses a PT_NULL type and a zero file size, more details are (documented here](elf.md). There are always three certificates. There also appears to be unknown code in the data for the program header before the certificates. This is possibly code to load the certificates so the blob can be validated, or a data structure for some other purpose.