Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
327
questions
3
votes
1
answer
93
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 41
3
votes
0
answers
96
views
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
- 219
1
vote
0
answers
49
views
Understanding pointer indirection for accessing static variables in Cortex M0 firmware
I'm reverse engineering some firmware from a device running an ARM Cortex M0 (specifically, Nordic nrf51802). For reference, the pertinent part of the memory map looks like this:
I'm trying to add ...
- 111
0
votes
0
answers
26
views
Using Hopper to flip branching instruction
Is it possible to flip branch instruction such as tbz to tbnz and b.ne to b.eq, I tried the hopper it gives syntax error
Is it possible to set a NOP on a bl or equivalent instruction using Hopper so ...
- 111
1
vote
1
answer
56
views
Reversing C++ Classes in ARM
I have unstripped linux arm binary,
The code calls functions in class object reference like so:
LDR R3, [R6]
MOV R1, R7
MOV R0, R6
LDR R3, [R3,#0xC] ; (...
- 11
3
votes
2
answers
125
views
IDAPython set name of function using string passed to debug logging subfunction
IDA Pro 7.6
Static disassembly of ARM executable.
This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc.
However, 90% of these functions have a call to a debug ...
- 73
2
votes
1
answer
61
views
armv7 disassemble thumb instructions from raw binary snippet
I have a portion of a raw binary file that contains ARM instructions, specifically in Thumb mode (and I've manually disassembled a few instructions using the Architecture Manual, and they seemed ...
- 121
0
votes
1
answer
77
views
How to get hexadecimal of instruction and distinct value(token) of opcode by ghidra script?
From disassembled code, I want to extract the hexadecimal of instruction, as boxed in the figure below
plus, I want to get distinct value of each opcode and its operand,
which means sort of
mov => ...
- 13
3
votes
0
answers
103
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 139
1
vote
0
answers
91
views
ghidra assigns local variable to register
im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from
this is ...
- 41
3
votes
0
answers
32
views
How can I quickly tell which ARM Thumb version a particular piece of code is using?
I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this:
arm-none-...
1
vote
0
answers
76
views
How to Decompile HP LaserJet Pro M12w firmware in Ghidra
I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra,
after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
- 11
2
votes
1
answer
247
views
U-boot base address on Ghidra
I'm trying to do some REing on a vendored U-Boot bootloader image.
For context, the U-Boot image was extracted from the full firmware image with:
dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
- 163
1
vote
2
answers
335
views
ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file
I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
- 163
1
vote
0
answers
44
views
Ghidra: Ignoring partial resolution of indirect
The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile:
uint ...
- 11
1
vote
0
answers
19
views
Cutter cannot parse AUTDA instruction
I work on reverse engineering of an iOS software using Cutter, and receive several opcodes as "invalid". For example:
<addr> 301ac1da invalid
Looking up the hex ...
- 111
2
votes
1
answer
249
views
Trying to reverse a bin file
I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file.
he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
- 131
2
votes
1
answer
96
views
Can an OpenWrt FIT kernel be virtualized in qemu?
I have a router I'd like to virtualize in order to do some dynamic analysis.
I could virtualize individual binaries with qemu, but I'd like to have the whole ecosystem up and running.
I'll start here:
...
2
votes
1
answer
71
views
Is there any way to understand if a raw binary firmware is Cortex-M or not?
I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares?
I have some ideas like Interrupt vector Table (...
- 21
0
votes
1
answer
135
views
Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header
I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum.
file output:
libTheArmKing.so: ELF ...
- 219
6
votes
4
answers
3k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
3
votes
1
answer
394
views
STM32 - Disable Voltage Check
I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to
disable the Voltage check (allow alternative power source)...
- 131
1
vote
1
answer
60
views
Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary
Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected?
Here is the Win64 version, that works
UPX0:...
- 11
1
vote
1
answer
71
views
Gdb hardware watchpoint error on android
After failing to find a solution to this I have started using Gdb and have encountered another error.
Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
- 154
2
votes
1
answer
539
views
LLDB debugging on android?
I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
- 154
5
votes
1
answer
931
views
What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?
Background
Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page:
MRE (MAUI Runtime Environment) is a ...
- 219
0
votes
0
answers
93
views
not called functions
trying to reverse a Cortex-M0 bin file using Ghidra.
There are functions that are Never Called any where in the code! (but actually should be called somewhere !)
What could be the reasons?
Tnx
1
vote
2
answers
123
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 219
1
vote
1
answer
412
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
1
vote
1
answer
163
views
Need help identifying this SoC
Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means.
“SAV500D” seems to be the model, the ...
- 25
2
votes
0
answers
205
views
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following ...
1
vote
1
answer
96
views
ARM/THUMB assembly mismatch between binaries causes crash
I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC.
I made sure ...
- 11
2
votes
1
answer
432
views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
0
votes
1
answer
134
views
ADDS(operations with S suffix) -Arm
This question was asked before here but in the answers I did get what i was looking for.
Consider this:
ADDS R0 RO R1
As far as I know to update the cpsr flags a subtraction has to be made. So after ...
- 154
0
votes
1
answer
492
views
android index.android.bundle file
I downloaded an app from Raccoon.
I got these files:
com.company.name-3423.apk
config.ar-3423.apk
config.armeabi_v7a-3423.apk
config.en-3423.apk
config.iw-3423.apk
config.ru-3423.apk
config.xhdpi-3423....
- 101
2
votes
0
answers
127
views
Hopper Disassembler AArch64 assemble instruction syntax error
As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error".
At this moment I can only change it by editing the instruction encoding in hex view as a ...
- 121
1
vote
1
answer
229
views
Change iOS app binary file
I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
2
votes
1
answer
465
views
Arm custom u-boot reversing
I'm trying to reverse a custom u-boot that implements cryptography for the Kernel at runtime (the Kernel at rest is encrypted also in a flash). I can probably ask the IoT vendor to provide the ...
- 163
0
votes
1
answer
211
views
Reading from buffer and printing output to a text file
00001f10 2846 mov r0, r5
00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0}
00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"}
...
- 154
3
votes
1
answer
212
views
Code caves in arm assembly
In a disassembled elf binary i found these arm thumb instructions:
function0
0x002cc3a8 8079 ldrb r0, [r0, #6]
0x002cc3aa 7047 bx lr
In the codecave these were the initial hex ...
- 154
0
votes
1
answer
71
views
Branching in arm assembly
This is an example assembly code:
function0()
0x0.mov r0, #1
0x8.mov r1, #20
0x10.mov r2, #6
0x18.cmp r1, #16
0x20.b function1
function1()
0x28.cmp r0, #1
0x30.b functionX
functionX(...
- 154
1
vote
1
answer
103
views
How to insert arm instructions into a function in a native library?
I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction.
addres hex arm instruction ...
- 154
2
votes
1
answer
104
views
When would a program normally transfer data between memory and coprocessor?
In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators.
Would it be common for ...
- 123
0
votes
1
answer
183
views
ARM floating point register S0 used without initialization
The following code snippet is the first few assembly instructions of a function.
The code runs on armv8a.
SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
- 101
0
votes
1
answer
667
views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
- 1
0
votes
2
answers
100
views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
1
answer
247
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
0
votes
1
answer
296
views
Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?
I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.
I want to check some logic in `xx. ...
- 1
0
votes
1
answer
767
views
Where stack canary is located?
Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr
so I can't change any registers (while the ...
- 1
2
votes
0
answers
149
views
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
- 121