0

While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters.

For example in IDA i have things like :

MSR             #4, c6, c0, #4, X0

or

MSR             #5, #0

Could someone explain how to parse these instructions and point me to the right documentation ?

Maybe there is a script or plugin to automate the process ?

  • Which processor are you working with ? – w s Feb 11 '17 at 10:00
  • Sometimes IDA has problems disassembling raw ARM images due to switches to THUMB mode. Is THUMB mode relevant to you ARM version? – Eli K Feb 11 '17 at 18:14
2

The presence of X0 and the use of MSR to access a system register tells me that you are on 64-bit ARM / ARMv8.

The reference manual for this architecture can be found here

Section C6 describes the instructions. You can find MSR (register) at C6.2.131 and MSR (immediate) at C6.2.130. These both access system control registers.

Section D7 describes the generic ARMv8 system control registers. In D7.2.34 you can find the information that your MSR instruction is accessing the HPFAR_EL2 register which contains the "Hypervisor IPA Fault Address." (see the table at the bottom of the section that shows the values of op0/op1/CRn/Cm/op2 that correspond to this register.)

The two instructions you show above are therefore -

MSR HPFAR_EL2, X0

MSR PSTATEField_SP, #0

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.