1

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).

Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and BlKernelExceptionHandler. The image below is two functions when I load bootaa64.efi to IDA.

ida

I'm not really good at ARM64 assembly but I recognized these functions are just forever loops.

The code stuck in that loop means somehow the function is called. But IDA just show two xref, one is the function call itself (loop) and the other is .pdata xref:

I want to know what called these functions. Thanks!

.pdata

1
  • Found this about .pdata section. It is exception handling section
    – raspiduino
    Apr 26, 2022 at 6:10

2 Answers 2

1

These functions look like exception handlers and are probably “called” by the processor when an exception or a fault happens. You need to inspect system registers to determine the cause of the exception and where it happened. See the ARM manuals for more information.

3
  • Can you provide me a link / hint for this? Thanks!
    – raspiduino
    Jun 10, 2022 at 2:51
  • 1
    @raspiduino maybe check ARM® Cortex™-A Series Programmer's Guide
    – Igor Skochinsky
    Jun 10, 2022 at 19:25
  • Found it: the register ELR_EL1 hold the address to return from exception. It was true in this case, when I replace the forever loop with ERET (see my answer below) it return to the exact same address!
    – raspiduino
    Jul 21, 2022 at 9:44
1

I don't know if it's true or not, but I patched the B BlKernelSp0SystemErrorHandler and B BlKernelExceptionHandler with ERET (aka exception return), and the EFI file jumps back and stop at the place of a BRK instruction (as a result of branching because a compare went wrong), which seems true for me since my KVM module didn't correctly implement that stubs yet.

Hope this helps for somebody.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.