Questions tagged [aarch64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
37 views

Disassembly of raw binary of AARCH64 using Ghidra not complete

I am trying to disassemble a raw binary with AARCH64:LE:64:v8A​:default (as per below mentioned specs). Architecture: aarch64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-...
user avatar
1 vote
2 answers
34 views

How Does ARM64 EOR with Shift Work?

I'm reverse engineering an ARM64 binary and I came across the following instruction 48 05 48 4A eor w8, w10, w8, lsr #1 I looked up the definition of ARM64's eor instruction here: https://...
user avatar
  • 201
1 vote
0 answers
49 views

failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64

I have implemented packer of x86_64 shared library. Briefly, a loader is injected to a shared library, and the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
user avatar
  • 71
1 vote
0 answers
48 views

Hopper Disassembler AArch64 assemble instruction syntax error

As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error". At this moment I can only change it by editing the instruction encoding in hex view as a ...
user avatar
2 votes
1 answer
682 views

Read and write to register with Frida

I have an instruction that looks like this in Ghidra: 100168ff0 e9 13 00 32 orr w9,wzr,#0x1f Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
user avatar
  • 107
1 vote
1 answer
351 views

What do the following AARCH64 LDR and STR instructions do exactly?

The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
user avatar
  • 257
1 vote
0 answers
107 views

What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?

Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
user avatar
  • 257
0 votes
0 answers
470 views

Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container

My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using sudo docker ...
user avatar
  • 257
2 votes
0 answers
202 views

Reverse engineering a command line argument using angr for an aarch64 binary

I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
user avatar
2 votes
0 answers
546 views

Reverse engineering a aarch64 elf in Ghidra

I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
user avatar
0 votes
1 answer
60 views

reversing enrichment routine

I want to know where a specific std::string comes from, find the enrichment routine in the C++ application I'm reversing. The variable I'm looking for it at @ [X21,#8], I don't fully understand the ...
user avatar