1

I extracted Samsung Galaxy S6 kernel image from its stock boot.img. The result is a raw code kernel image. I load into IDA 6.8 (64-bit) using ROM Start: 0xffffffc000205000 size:0x18C020000, load address:0xffffffc000205000 size:0x18C020000 which is the address of _text/_stext inside it's kallsyms, it does not disassemble correctly and recognise nearly everything as data. On the other hand, using the _text/stext function for a 32-bit ARM Note 4 kernel image at 0xC0008000 works perfectly. Does any one have any idea how to disassemble ARM64 android image correctly? Any advice is appreciated. Thanks.

Improve this question
1

It may be a mix of 64 and 32 bit code, to disassemble the 32bit segments, change the segment bitness to 32 ( via Alt-S )

then you can disassemble those sections as either arm32, or thumb code.

A problem will arise when you want to be able to decompile both the 32 and 64 bit code. IDA will only be able to decompile the 64 bit code.

Improve this answer
1

I needed to set the segment bitness to 64-bit. It then disassembled correctly.

Improve this answer
2
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post.
    – perror
    Sep 4 '15 at 11:43
  • Hi, @perror, he answered me on IDA forums :)
    – gigasai
    Sep 7 '15 at 1:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.