I extracted Samsung Galaxy S6 kernel image from its stock boot.img. The result is a raw code kernel image. I load into IDA 6.8 (64-bit) using ROM Start: 0xffffffc000205000 size:0x18C020000, load address:0xffffffc000205000 size:0x18C020000 which is the address of _text/_stext inside it's kallsyms, it does not disassemble correctly and recognise nearly everything as data. On the other hand, using the _text/stext function for a 32-bit ARM Note 4 kernel image at 0xC0008000 works perfectly. Does any one have any idea how to disassemble ARM64 android image correctly? Any advice is appreciated. Thanks.
It may be a mix of 64 and 32 bit code, to disassemble the 32bit segments, change the segment bitness to 32 ( via Alt-S )
then you can disassemble those sections as either arm32, or thumb code.
A problem will arise when you want to be able to decompile both the 32 and 64 bit code. IDA will only be able to decompile the 64 bit code.
I needed to set the segment bitness to 64-bit. It then disassembled correctly.
-
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – perror Sep 4 '15 at 11:43
-
