[Android Software/Hacking General [Developers Only]] Cobaltikus:
Latest Version 0.5.1 (beta)

What is CobaltDebugger? An ARM Processor Simulator/Emulator/Debugger. At its current state, it reads Android bootloader files, and runs them in a simulator, giving you control over which instructions execute and when. For optimal experience, use this in conjunction with IDA Pro.

Hint: Try setting the PC Register to an interesting address found in IDA.

https://youtu.be/cwvz8Cj70Ac <- newer but still old

https://youtu.be/L5NDob2rCmI <- even older

Unzip contents

Run CobaltDebugger.exe

Load up your aboot.mbn or sbl1.mbn

If you want to display referenced strings, open your binary in IDA, go to View > Subviews > Strings, then copy and paste the contents of the strings window into a new text file, then load that text file into CobaltDebugger.

Memory file will grow to 4GB

Click "Load Binary"

Then click "Step Into" or "Run"

You can

- Set breakpoints by address: use >, and < to define break-ranges

- Alter register values, condition flags, psr modes, instruction sets (ARM and Thumb)

Memory edits are not yet implemented but will most likely come as time permits

Page Up, Page Down, Up, and Down keys can be used to navigate the memory viewer - or you can type an address and click "Go" to go there - There's a bug in here somewhere - I'll get to it

The output from the bottom right window is saved as output.xxxxxx.txt, although the file may not get flushed until you click "Unload" or close the application.

All ARM and Thumb instructions were implemented in C# by hand by me. There may be bugs here and there as this is a work in progress and beta. Not all instructions have been implemented so you may encounter a message that states such and such instruction not implemented. If you see that, let me know which instruction and I will implement it as time permits, or you can wait until the next release. I plan on continuing this project until all instructions are implemented.

Originally built with the binaries from the AT&T Samsung Galaxy Note 3 (NC2) in mind, but focus switched to the Verizon Samsung Galaxy S4 (NK1), then back to Note 3 (OC1). This should work with other similar binaries as well.

I'm hoping this will help us discover new ways to unlock bootloaders. But at the very least it's fun to watch the files run.

Change Log 0.5.1

Added image verification steps thanks to Tal Aloni

Bug fixes

More instructions implemented

Slight redesign

Change Log 0.5

Bug fixes, UI improvements, a few more instructions implemented

Now the "Next" instruction is actually the Next instruction as opposed to the most recently executed instruction, so you can see the instruction highlighted BEFORE it executes.

Change Log 0.4.1

Fixed some bugs

Implemented some more instructions

AT&T Note 3 NC2 aboot runs to completion again, although you may find some instructions I've missed if you start jumping around editing the PC value.

Change Log 0.4

Complete refactor

Verizon S4 NK1 aboot runs to completion, although you may find some instructions I've missed if you start jumping around editing the PC value.

Broke some things with the Note 3 aboot instructions

Change Log v0.3:

set default breakpoint for Verizon S4 aboot - Either it's actually *supposed* to start executing code at 0x880C7000 after an MCR and BX instruction, or I may have mis-coded something, but it seems odd, so a breakpoint is set to 0x88E0E4BC until I can figure that one out.

Output to file - C:\temp\output.HHmmss.asm - Now you can review the log after the program has run.