Reverse-engineering a toy based on an nRF52832

[Frank]

I have some questions that I hope some of you fine engineers can shed some light on. First, some story time is probably in order. Skyrocket Toys developed a line of IR tag toys called Recoil, then some BadThings and they had to abandon the line of toys. They agreed to opensource as much of the assets as they had left available unfortunately due to earlier said BadThings much of the documentation and code repositories were lost. (what is left is available on GitHub) Fortunately, the .pem signature file was recovered so we can sign new packages that the boot loader accepts and loads (this was tested by changing one bit that we know is used as an identifier to the game software and resigning the .bin to make one model of toy believe that it is the other model)

My goal is to reconstruct a source repository from a program .bin file if that is possible.

Which is question #1: Is it possible to decompile a program bin back into a semblance of human read/editable code?

And #2 Barring that possibility can the underlying SoftDevice be updated without having to modify the application? 

Thank you all for your time.

Frank

SoC: nRF52832-QFAB

SoftDevice: s132_nrf52_3.1.0

DFU Package: <FW_TX_01762_PD_14501_dfu.zip>:
|
|- Image count: 1
|
|- Image #0:
|- Type: application
|- Image file: FW_TX_01762_PD_14501.bin
|- Init packet file: FW_TX_01762_PD_14501.dat
|
|- op_code: INIT
|- signature_type: ECDSA_P256_SHA256
|- signature (little-endian): 48506229c7d75af2dd58d2ae77ff7c7f2fa993bf890d646c01a018b1213632ef1fda5f0386203575dc2c34a0fb5eed5e1d48ba81c7a2d34e3397ad692c5472b2
|
|- fw_version: 0x000038A5 (14501)
|- hw_version 0x00000001 (1)
|- sd_req: 0x91
|- type: APPLICATION
|- sd_size: 0
|- bl_size: 0
|- app_size: 58352
|
|- hash_type: SHA256
|- hash (little-endian): f18a745f4a42d0d3a87cf62a856200b2c1f417d064f0dffe8f5ad7ee5ae576ad
|
|- is_debug: False

[awneil]

Frank said:

#1: Is it possible to decompile a program bin back into a semblance of human read/editable code?

It is largely possible to disassemble binary code to assembler source, but you will have no meaningful names or labels for anything - variables, functions, etc.

For any non-trivial program, Getting back to useful, readable code at the 'C' level is pretty much a dead end.

It would probably be easier & more productive to just re-write from scratch.

Frank said:

can the underlying SoftDevice be updated without having to modify the application?

It should be possible via SWD - provided the chip is not locked.

Whether a bootloader would support that is another question.

Whether the app would work with any other SoftDevice is another question still.

[Frank]

The chips have protection 1 (readout) enabled but not 2 so they are still erasable/writeable, but we do not have a copy of the bootloader. Can the SoftDevice be bundled with the application replaced over BLE DFU, or is that in of itself a function of the soft device and as such be in use?  

The primary reason I am curious about replacing the SoftDevice is that there are several models of smartphones that fail to communicate with the toys and I was hoping to increase compatibility.