Questions tagged [aarch64]
The aarch64 tag has no usage guidance.
12
questions
0
votes
1
answer
82
views
IDA Pro could not disassemble native function properly
Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly):
Is it possible to produce manually more readable assembly?
- 161
3
votes
0
answers
652
views
Disassembly of raw binary of AARCH64 using Ghidra not complete
I am trying to disassemble a raw binary with AARCH64:LE:64:v8A:default (as per below mentioned specs).
Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 8
On-...
- 31
1
vote
2
answers
518
views
How Does ARM64 EOR with Shift Work?
I'm reverse engineering an ARM64 binary and I came across the following instruction
48 05 48 4A eor w8, w10, w8, lsr #1
I looked up the definition of ARM64's eor instruction here: https://...
- 223
1
vote
0
answers
71
views
failed to trigger packer's loader by overwritting the entry of rela.dyn on aarch64
I have implemented packer of x86_64 shared library.
Briefly, a loader is injected to a shared library, and
the rela.dyn entry is modified such that it points to the address of the loader. Once the ...
- 81
2
votes
0
answers
210
views
Hopper Disassembler AArch64 assemble instruction syntax error
As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error".
At this moment I can only change it by editing the instruction encoding in hex view as a ...
- 121
2
votes
1
answer
3k
views
Read and write to register with Frida
I have an instruction that looks like this in Ghidra:
100168ff0 e9 13 00 32 orr w9,wzr,#0x1f
Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
- 177
1
vote
1
answer
3k
views
What do the following AARCH64 LDR and STR instructions do exactly?
The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
- 277
2
votes
0
answers
154
views
What do you think is the optimum environment for reverse engineering dynamically-linked aarch64 Golang binaries developed in Alpine Linux?
Direct quote from Golang's website: "GDB does not understand Go programs well. The stack management, threading, and runtime contain aspects that differ enough from the execution model GDB expects ...
- 277
0
votes
0
answers
891
views
Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container
My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using
sudo docker ...
- 277
2
votes
0
answers
405
views
Reverse engineering a command line argument using angr for an aarch64 binary
I am trying to reverse engineer a aarch64 binary using angr to find the required command line argument to get a desired result. From the binary I am able to extract the required length of the argument....
- 21
2
votes
0
answers
842
views
Reverse engineering a aarch64 elf in Ghidra
I am trying to reverse engineer a aarch64 binary to find a password from it. I am able to modify certain functions in Ghidra but got stuck with the attached code snippet. The marked areas in the ...
0
votes
1
answer
66
views
reversing enrichment routine
I want to know where a specific std::string comes from, find the enrichment routine in the C++ application I'm reversing.
The variable I'm looking for it at @ [X21,#8], I don't fully understand the ...
- 283