Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
302
questions
0
votes
0
answers
13
views
(Inquiring individual conditioned by an intellectually impoverished Southern heritage) Can I extract activity data remotely from unaware ios undetecd?
Inquiring individual conditioned by an intellectually impoverished Southern heritage:Can I extract activity data remotely from unaware ios undetected?
That’s all… thank you
0
votes
1
answer
30
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 101
1
vote
1
answer
74
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
1
vote
1
answer
104
views
Need help identifying this SoC
Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means.
“SAV500D” seems to be the model, the ...
- 13
2
votes
0
answers
49
views
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following ...
1
vote
1
answer
49
views
ARM/THUMB assembly mismatch between binaries causes crash
I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC.
I made sure ...
- 11
0
votes
0
answers
89
views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
0
votes
1
answer
83
views
ADDS(operations with S suffix) -Arm
This question was asked before here but in the answers I did get what i was looking for.
Consider this:
ADDS R0 RO R1
As far as I know to update the cpsr flags a subtraction has to be made. So after ...
- 62
0
votes
1
answer
207
views
android index.android.bundle file
I downloaded an app from Raccoon.
I got these files:
com.company.name-3423.apk
config.ar-3423.apk
config.armeabi_v7a-3423.apk
config.en-3423.apk
config.iw-3423.apk
config.ru-3423.apk
config.xhdpi-3423....
- 101
1
vote
0
answers
43
views
Hopper Disassembler AArch64 assemble instruction syntax error
As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error".
At this moment I can only change it by editing the instruction encoding in hex view as a ...
- 111
1
vote
1
answer
82
views
Change iOS app binary file
I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
2
votes
1
answer
236
views
Arm custom u-boot reversing
I'm trying to reverse a custom u-boot that implements cryptography for the Kernel at runtime (the Kernel at rest is encrypted also in a flash). I can probably ask the IoT vendor to provide the ...
- 153
0
votes
1
answer
66
views
Reading from buffer and printing output to a text file
00001f10 2846 mov r0, r5
00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0}
00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"}
...
- 62
2
votes
1
answer
122
views
Code caves in arm assembly
In a disassembled elf binary i found these arm thumb instructions:
function0
0x002cc3a8 8079 ldrb r0, [r0, #6]
0x002cc3aa 7047 bx lr
In the codecave these were the initial hex ...
- 62
0
votes
1
answer
44
views
Branching in arm assembly
This is an example assembly code:
function0()
0x0.mov r0, #1
0x8.mov r1, #20
0x10.mov r2, #6
0x18.cmp r1, #16
0x20.b function1
function1()
0x28.cmp r0, #1
0x30.b functionX
functionX(...
- 62
1
vote
1
answer
70
views
How to insert arm instructions into a function in a native library?
I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction.
addres hex arm instruction ...
- 62
2
votes
1
answer
75
views
When would a program normally transfer data between memory and coprocessor?
In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators.
Would it be common for ...
- 123
0
votes
1
answer
72
views
ARM floating point register S0 used without initialization
The following code snippet is the first few assembly instructions of a function.
The code runs on armv8a.
SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
- 101
0
votes
1
answer
230
views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
- 1
0
votes
2
answers
64
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
0
answers
54
views
How can I identify JTAG in this case and utilize it?
I'm developer and I somehow tried today to reverse engineer and take apart a hardware, just after learning that some devices have hardware debugging. First thing to try to know in my understanding of ...
- 179
0
votes
1
answer
186
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
0
votes
1
answer
155
views
Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?
I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.
I want to check some logic in `xx. ...
- 1
0
votes
1
answer
196
views
Where stack canary is located?
Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr
so I can't change any registers (while the ...
- 1
2
votes
0
answers
70
views
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
- 121
2
votes
1
answer
74
views
How to know when a subroutine starts when reversing an ARM64 file?
I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
- 23
2
votes
1
answer
578
views
Disassembling ARM based Camera Firmware
I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file.
Binwalk is unable to extract the known zip files.
binwalk -e digicap.dav
DECIMAL ...
- 121
1
vote
1
answer
85
views
Debug bFLT in qemu-arm-static
I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static .
I want to debug that binary dynamically with GDB.
I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
1
answer
77
views
Ghidra showing pointer being given as size argument of calloc
I'm attempting to figure out the structure of a "God object".
I found where it's being initialized, but I've never seen calloc used like this before:
god = (God *)calloc(1,(size_t)&...
- 113
2
votes
0
answers
79
views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
- 73
1
vote
0
answers
177
views
ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)
As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
- 56
2
votes
1
answer
65
views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
- 41
3
votes
2
answers
251
views
Find the entry point in Interrupt Vector Table ARM9
I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings.
I've disassembled the firmware using ida pro, but I couldn't find the entry ...
- 31
3
votes
2
answers
230
views
What does this ARM assembly code do?
I'm trying to figure out the password that is used to access the U-Boot shell, as mentoined in my previous question.
I'm having trouble understanding how exactly the code works.
Here is an image of ...
- 31
0
votes
0
answers
177
views
Loading a U-Boot ARM flash image into IDA Pro
I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
- 31
1
vote
1
answer
102
views
IDApython - Turning a modified operand into a string reference
I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table.
The core of the script is working fine, but I have some issue when it comes ...
- 619
2
votes
1
answer
59
views
Reverse Engineering Classes in ARM
I came across this part in the book Reverse Engineering For Beginners book by Denis Yurichev. It writes about reverse engineering Classes in C++, but it doesn't provide any examples in ARM.
Page 546
...
- 723
1
vote
1
answer
69
views
What could a firmware image be, if not embedded linux?
I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
- 113
2
votes
1
answer
698
views
How to extract the kernel assembly code from a zImage?
here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
- 21
1
vote
1
answer
43
views
Help understanding ARM Cortex-M4 SBC instruction
Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
- 35
2
votes
1
answer
168
views
Help with LDR, LDRD and STR instructions
The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
- 35
2
votes
0
answers
89
views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
- 21
1
vote
1
answer
177
views
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
- 13
3
votes
2
answers
233
views
How can I find out what type of processor an Intel Hex file belongs to?
I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below:
:03:8000:00:028100FA
:02:8003:00:XXXXXX
:02:800B:00:XXXXXX
:02:8013:00:XXXXXX
:01:801B:00:...
- 187
1
vote
1
answer
185
views
What does the "=>" sign means in ARM assembly LDR?
what does this arm instruction means?
LDRB param_1,[r12,r5]=>local_b0
In particular I don't understand the "=>local_b0" part.
Ghidra decompiles it to
local_b0._0_1_ = *(byte *)((int)&...
- 23
2
votes
0
answers
173
views
How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?
I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them.
I have dumped and decoded the bios and got some useful datas,
according to datas we can see u-...
- 21
0
votes
1
answer
37
views
Why would just two bits of the SP be used here?
This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7.
; Registers used:
; - r3 : unsigned long argp
0000005c mov r1, ...
- 137
3
votes
1
answer
84
views
Understanding ARMv7 seemingly overly verbose disassembly
I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention:
00009086 movw r3, #...
- 137
0
votes
1
answer
50
views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
1
vote
1
answer
216
views
Change function call to another function call in arm using IDA
Is it possible to patch arm lib in a way that changes branch instruction calling one function to another function call?
I have instruction
B function_a
and want change it to:
B function_b
