The UF2 format is designed to be simple enough for a bootloader to parse and flash with as few as ~10 lines of C code. This straightforward structure is a double-edged sword: it makes for a reliable and simple flashing mechanism but also requires specialized tools to extract the embedded data.
A UF2 file consists of multiple 512-byte blocks. Each block contains:
Using lifter libraries (like remill or mcsema ), we can convert the ARM Thumb instructions into . Once in LLVM IR, we can run optimization passes to simplify the mess:
We are currently working on a v2 of the tool that feeds the raw binary into a local LLM (like CodeLlama) trained on ARM assembly. The prompt is: "Here is the disassembly of a UF2 file for a temperature sensor. Recover the I2C address and the conversion formula." uf2 decompiler
Extracting code from a device when the original source files are lost. Challenges in Decompilation
UF2 Decompiler: Understanding and Reversing USB Flashing Format Files
The official Microsoft UF2 repository includes Python scripts (like uf2conv.py ) that can convert UF2 files back into regular binaries. The UF2 format is designed to be simple
We will use , the open-source reverse engineering framework from the NSA. It’s free, powerful, and regularly updated.
Some UF2 files contain blocks for different memory regions (e.g., flash at 0x00000000 and a small patch to RAM at 0x20000000 ). Ghidra supports or you can split the binary into multiple files.
Once loaded, Ghidra will display a sea of unorganized hexadecimal bytes. Because raw binaries lack symbol tables, the decompiler does not know where functions begin or end. You must manually define the entry point using the microcontroller's Vector Table. Each block contains: Using lifter libraries (like remill
We can’t decompile garbage. The first function in our tool is a validator and reassembler. We scan for the magic start 0x0A324655 . If we find it, we know exactly where the payload sits.
This command removes the UF2 headers and extracts the executable payload, according to documentation on makerdiary/uf2utils. Step 3: Disassemble the Binary
Once you have the raw binary, the "decompilation" depends entirely on what language the original firmware was written in. USB Flashing Format (UF2) - Microsoft Open Source
Example: If bytes 0x00 0x20 0x00 0x20 appear at offset 0, that’s likely 0x20002000 – a typical SRAM base.
No standalone “UF2 to C” decompiler exists – and likely never will, due to architecture variability.