0

I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error: The processor type 'arm' is not included in the installed version of IDA.

IDA Version: Freeware 7.0
OS: Windows 10

Can the freeware 7.0 just not disassemble arm files? If not, what is a suitable alternative that actually works properly and displays a nice function table etc.? Thanks!

0

Radare2 can disassemble .so

:\>file libogg_opus_encoder.so
libogg_opus_encoder.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked, stripped

:\>radare2 libogg_opus_encoder.so
 -- Disable these messages with 'e cfg.fortunes = false' in your ~/.radare2rc
[0x00018d78]> aa
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
[0x00018d78]> pdf
            ;-- entry.fini1:
            ;-- section..text:
            ;-- pc:
            ;-- r15:
/ (fcn) entry0 12
|   entry0 ();
|           0x00018d78      04009fe5       ldr r0, [0x00018d84]        ; [0x18d84:4]=0x4835c ; [15] -r-x
|           0x00018d7c      00008fe0       add r0, pc, r0
\       ,=< 0x00018d80      3a0f01ea       b sym.imp.__cxa_atexit      ; sym.imp.__cxa_finalize+0xc

also ghidra should be able to disassemble .so

the link you posted in comments shows a functionlist and a graphical disassembly both are available in radare2 look for fs,f,pdf,VV commands

shown below is the same disassembly on the link youposted

:\>file libminecraftpe.so
libminecraftpe.so; ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked (uses shared libs), stripped

:\>radare2 -A libminecraftpe.so
[←[0m{ctrl+c} pressed.lags starting with sym. and entry0 (aa)
←[32m[x]←[0m Analyze all flags starting with sym. and entry0 (aa)
 -- git pull now
[0x002315d0]> f~Crafting~Held
0x003e2dd8 76 sym.CraftingInventoryScreenController::_handleHeldButton_int
0x003e2dd8 1 method.CraftingInventoryScreenController._handleHeldButton_int
[0x002315d0]> s 0x3e2dd8
[0x003e2dd8]> af
[0x003e2dd8]> pdf
            ;-- method.CraftingInventoryScreenController._handleHeldButton_int:
/ (fcn) sym.CraftingInventoryScreenController::_handleHeldButton_int 76
|   sym.CraftingInventoryScreenController::_handleHeldButton_int ();
|           0x003e2dd8      f8b5           push {r3, r4, r5, r6, r7, lr}
|           0x003e2dda      00f12c06       add.w r6, r0, 0x2c
|           0x003e2dde      0546           mov r5, r0
|           0x003e2de0      0f46           mov r7, r1
|           0x003e2de2      3046           mov r0, r6
|           0x003e2de4      5df01efb       bl sym.HeldButtonData::getCollectionIndex__const
|           0x003e2de8      b842           cmp r0, r7
|           0x003e2dea      0446           mov r4, r0
|       ,=< 0x003e2dec      01d0           beq 0x3e2df2
|       |   ; CODE XREF from sym.CraftingInventoryScreenController::_handleHeldButton_int (0x3e2e22)
|     ..--> 0x003e2dee      0120           movs r0, 1
|     ::|   0x003e2df0      f8bd           pop {r3, r4, r5, r6, r7, pc}
|     ::`-> 0x003e2df2      431c           adds r3, r0, 1
|     `===< 0x003e2df4      fbd0           beq 0x3e2dee
|      :    0x003e2df6      3046           mov r0, r6
|      :    0x003e2df8      5df0f6fa       bl sym.HeldButtonData::getButtonId__const
|      :    0x003e2dfc      b5f92630       ldrsh.w r3, [r5, 0x26]
|      :    0x003e2e00      8342           cmp r3, r0
|      :,=< 0x003e2e02      05d0           beq 0x3e2e10
|     .---> 0x003e2e04      2846           mov r0, r5
|     ::|   0x003e2e06      2146           mov r1, r4
|     ::|   0x003e2e08      5df012fb       bl sym.MinecraftScreenController::_handleHeldButton_int
|     ::|   0x003e2e0c      0120           movs r0, 1
|     ::|   0x003e2e0e      f8bd           pop {r3, r4, r5, r6, r7, pc}
|     ::`-> 0x003e2e10      3046           mov r0, r6
|     ::    0x003e2e12      5df0effa       bl sym.HeldButtonData::getItemLocation__const
|     ::    0x003e2e16      0328           cmp r0, 3
|     `===< 0x003e2e18      f4d1           bne 0x3e2e04
|      :    0x003e2e1a      2846           mov r0, r5
|      :    0x003e2e1c      2146           mov r1, r4
|      :    0x003e2e1e      fff7d7fe       bl sym.CraftingInventoryScreenController::_handleArmorTakePlace_int
\      `==< 0x003e2e22      e4e7           b 0x3e2dee
[0x003e2dd8]>

function list grepped for MainChunk

[0x003e2dd8]> f~MainChunk
0x00000000 1 class.MainChunkSource
0x00298f1c 4 sym.MainChunkSource::getStoredChunks__const
0x00298f1c 1 method.MainChunkSource.getStoredChunks__const
0x00298f20 4 sym.MainChunkSource::getStoredChunks
0x00298f20 1 method.MainChunkSource.getStoredChunks
0x0029e558 1 method.MainChunkSource._MainChunkSource
0x0029e5a8 18 sym.MainChunkSource::_MainChunkSource
0x0029e5bc 320 sym.MainChunkSource::releaseChunk_LevelChunk
0x0029e5bc 1 method.MainChunkSource.releaseChunk_LevelChunk
0x002a0afc 102 sym.MainChunkSource::getExistingChunk_ChunkPosconst
0x002a0afc 1 method.MainChunkSource.getExistingChunk_ChunkPosconst
0x002be794 112 sym.MainChunkSource::MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource
0x002be794 1 method.MainChunkSource.MainChunkSource_std::unique_ptr_ChunkSource_std::default_delete_ChunkSource
0x002d60d0 174 sym.MainChunkSource::requestChunk_ChunkPosconst__ChunkSource::LoadMode
0x002d60d0 1 method.MainChunkSource.requestChunk_ChunkPosconst__ChunkSource::LoadMode
0x002d6180 168 sym.MainChunkSource::acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk
0x002d6180 1 method.MainChunkSource.acquireDiscarded_std::unique_ptr_LevelChunk_std::default_delete_LevelChunk
0x005e3cb0 80 obj.vtableforMainChunkSource

the graph view

enter image description here

| improve this answer | |
  • I've tried that, but it doesn't return the same thing as IDA would (according to a tutorial I was following). You can see images of what it should return in the tutorial I'm viewing: github.com/byteandahalf/MCPE-NativeMods/wiki/4:-Setting-up-IDA – PG Cubing Feb 19 at 20:29
  • well both the things that are shown in the link are available in radare2 i edited the answer take a look – blabb Feb 19 at 21:33
  • Awesome! Exactly what I needed. Thank you so much! – PG Cubing Feb 20 at 5:19
  • Just one question: On what OS are you doing this? – PG Cubing Feb 20 at 5:53
  • Hmm. I don't seem to get the same output as you when I run this. For instance, f~Crafting~Held doesn't show any output at all. Am I doing something wrong? Also, the file command doesn't exist. – PG Cubing Feb 20 at 6:07
0

No, it doesn’t support ARM files.

From the description:

The freeware version of IDA v7.0 comes with the following limitations:

• no commercial use is allowed

• lacks all features introduced in IDA > v7.0

lacks support for many processors, file formats, etc…

• comes without technical support

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.