Reverse engineering a firmware - what's up with every fourth byte?

Question

So I decided to grab my tools and analyze a router firmware. It went pretty okay up to the point where I had to find segments manually. I wouldn't bother you with it and i really don't want to ask about hacking anything or to do a favor for me. There is a pattern I'm sure someone could explain to me. Looking at the hexdump, all i see is this:

There are strings that break the pattern but it goes all the way down almost to the end of the file.
what on earth can cause this pattern?
(if anyone's willing to help but needs more info: VxWorks 5.5.1 / probably ARM-9E CPU)

Enact

To get the assembler, you can use objdump on the binary. A command like, objdump --disassemble-all -b binary -m arm memory.bin, where memory.bin is your file. You can do this on Ubuntu with the multi-arch binutils or you can find an arm specific version. Unfortunately, you posted a picture. Using strings on the file can also quickly tell you a lot; often the vxWork's front-end is a compressor and the main code maybe compressed. Sounds like this is not your case. The code may execute directly from NOR flash? – Cold

elephant in the room, arm instructions are little endian! – Lightproof

also see binwalk.org – Lightproof

Answer 1

it is an arm, go look at the arm documentation you will see that for the 32 bit (non-thumb) arm instructions the first four bits are the condition code. The code 0b1110 is "ALWAYS" most of the time you dont do conditional execution so most arm instructions start with 0xE. makes it very easy to pick out an arm binary. the 16 bit thumb instructions also have a similar pattern but for different reasons, then if you add in thumb2 it changes that some...

Furtek

Answer 2

Thats just due to how ARMs op codes are mapped and is actually helps me "eyeball" a dump to see if its ARM code.

I would suggest you go through part of the ARM Architecture Manual to see how op codes are generated. particularly conditionals. the E is created when you always want something to happen

Grimbal