I'm debugging the Windows ARM64 version's EFI (bootaa64.efi
).
Using QEMU and GDB I was able to find that bootaa64.efi
was stuck in one of the two functions BlKernelSp0SystemErrorHandler
and BlKernelExceptionHandler
. The image below is two functions when I load bootaa64.efi
to IDA.
I'm not really good at ARM64 assembly but I recognized these functions are just forever loops.
The code stuck in that loop means somehow the function is called. But IDA just show two xref, one is the function call itself (loop) and the other is .pdata
xref:
I want to know what called these functions. Thanks!
.pdata
section. It is exception handling section