13:54 <CodeEstate> On an unknown embedded target, is there a way to loop through memory addresses to find ones that are dumpable? For example, on my unknown target I can read from 0x0 for a length of 0x400, but past that I get "memory read caused data abort." I know some of the other valid regions, but I can't be certain I got them all.

14:34 <sys64738> id imagine you now have some code, right? eg. if its an arm, id try inserting some code snippet that dumps the mpu state (and maybe the processor version/revision numbers) & running that & reading out its output

14:34 <sys64738> (if it has an mpu, that is, but a cortex-m0+ has one, so most things will i think? except if its an arm7tdmi)

16:07 <CodeEstate> I do have some code, but I don't know what code I could insert that would get me more information on the memory mapping. I've manually found info at 0xffff0000 and around 0x00178000, and I have an idea where some peripherals are (saw a timer being loaded from an address in one function I was reversing).

16:07 <CodeEstate> I believe the chip is based on ARMv5

16:13 <PaulFertser> CodeEstate: you can script OpenOCD in Tcl internally or use RPC with any other language you prefer.

16:22 <sys64738> 0xffff0000 is where the vectors are, feels rom-y. 0x00178000 sounds like a possible ram address. armv5 means youll have to go through cp15 to get the mpu state, see http://problemkaputt.de/gbatek.htm#armcp15systemcontrolcoprocessor (yeah i use this one because it is easier to look stuff up in than arm pdfs imo)