0

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).

Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and BlKernelExceptionHandler. The image below is two functions when I load bootaa64.efi to IDA.

ida

I'm not really good at ARM64 assembly but I recognized these functions are just forever loops.

The code stuck in that loop means somehow the function is called. But IDA just show two xref, one is the function call itself (loop) and the other is .pdata xref:

I want to know what called these functions. Thanks!

.pdata

1
  • Found this about .pdata section. It is exception handling section
    – raspiduino
    Apr 26 at 6:10

1 Answer 1

0

These functions look like exception handlers and are probably “called” by the processor when an exception or a fault happens. You need to inspect system registers to determine the cause of the exception and where it happened. See the ARM manuals for more information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.