2

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment.

Here's what file shows: ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped

I've tried running it on Linux using qemu and the process immediately terminates with the message "Killed". Running strace ./executable returns this:

execve("./executable", ["./executable"], [/*13 vars */] <unfinished ...> +++ killed by SIGKILL +++ Killed

I'm using the Debian Wheezy image from here: https://people.debian.org/~aurel32/qemu/armel/

Any ideas why this is happening?

  • 1
    file doesn't always give the correct output. Try running readelf -A to know specifically the version of ARM. – 0xec Jan 28 at 8:17
3

The process may send itself (or it's child processes) the SIGTERM signal as part of an anti-debugging trick. Hunting for that will require you to search for signal-sending APIs like kill and how/when they're being used by the application.

A more simple solution, that is not necessarily RE related, could be that the process is killed by the OOM killer.

To test that, you can run mesg | egrep -i “killed process” inside the emulated machine.

If that's the case, you can easily disable it (add vm.oom-kill = 0 in /etc/sysctl.conf).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.