2

I have unstripped linux arm binary, The code calls functions in class object reference like so:

LDR             R3, [R6]
MOV             R1, R7
MOV             R0, R6
LDR             R3, [R3,#0xC]  ; (Class *)(this + 0xC)
BLX             R3

I have the vtables in the binary

What is the best way to make this code readable, x86/x64 have plugins for this but i don't find those in ARM, should I do that manually? if so how?

Thanks.

1
  • while demanding in terms of time and effort, can be the preferred method for deciphering code in less commonly used architectures such as ARM. This approach entails a thorough analysis of the virtual table, followed by the RE of its associated functions, as previously outlined. Despite the challenges posed by manual RE, it often yields the most comprehensive understanding of the code in question.
    – raheel0x01
    Commented Feb 14, 2023 at 19:35

1 Answer 1

3

Step 1: Spot the function being called - The function being called is referenced in the virtual table and is executed via a BLX instruction:

BLX R3

Step 2: Analyze the virtual table - To find out what the functions in the virtual table do, use a disassembler or debugger to take a closer look at the virtual table and see what addresses the functions reference. This info will come in handy when you RE the functions.

Step 3: Then, RE the functions - With the addresses of the functions in hand, you can use a disassembler or debugger to examine each function and determine its purpose. This makes it easier to understand the code and work with it.

Step 4: Create a function map - Put everything together by creating a map of the virtual table and its functions, including what each function does.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.