Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
266
questions
1
vote
1answer
29 views
How to extract the kernel assembly code from a zImage?
here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
1
vote
1answer
25 views
Help understanding ARM Cortex-M4 SBC instruction
Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
-1
votes
0answers
21 views
Getting an offline peephole camera feed to wireless LAN
I have the following Yale peephole camera:
It has no built-in Wireless/Cloud support so the camera feed can only be viewed via the device itself and so as a RE project I wondered if I could get it ...
2
votes
1answer
107 views
Help with LDR, LDRD and STR instructions
The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
2
votes
0answers
76 views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
1
vote
1answer
49 views
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
3
votes
2answers
109 views
How can I find out what type of processor an Intel Hex file belongs to?
I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below:
:03:8000:00:028100FA
:02:8003:00:XXXXXX
:02:800B:00:XXXXXX
:02:8013:00:XXXXXX
:01:801B:00:...
1
vote
1answer
94 views
What does the “=>” sign means in ARM assembly LDR?
what does this arm instruction means?
LDRB param_1,[r12,r5]=>local_b0
In particular I don't understand the "=>local_b0" part.
Ghidra decompiles it to
local_b0._0_1_ = *(byte *)((int)&...
2
votes
0answers
59 views
How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?
I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them.
I have dumped and decoded the bios and got some useful datas,
according to datas we can see u-...
0
votes
1answer
30 views
Why would just two bits of the SP be used here?
This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7.
; Registers used:
; - r3 : unsigned long argp
0000005c mov r1, ...
3
votes
1answer
60 views
Understanding ARMv7 seemingly overly verbose disassembly
I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention:
00009086 movw r3, #...
0
votes
0answers
22 views
Function obfuscation with hundreds of LDR PC, what is it called and how is it generated?
I am working on some obfuscated code. To my understanding, here is how the obfuscation works:
Take the subroutine you want to obfuscate, like;
LDR R2, [R0,#8]
MOV R0, #0
CMP ...
0
votes
1answer
35 views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
0
votes
1answer
55 views
Change function call to another function call in arm using IDA
Is it possible to patch arm lib in a way that changes branch instruction calling one function to another function call?
I have instruction
B function_a
and want change it to:
B function_b
1
vote
1answer
50 views
Migrate x86 printer drivers to arm [Brother]
I have a Brother DCP 197C printer and I would like to print from my phone using a raspberry pi. To archieve it I need to install drivers, but brother only provide x86 and x64 drivers, any way to do it?...
0
votes
0answers
57 views
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
1
vote
1answer
726 views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
0
votes
1answer
249 views
What is the meaning of ARM LDAXR/STLXR instructions?
Often while disassembling ARM files, I see some code snippet with the following pattern:
loc_BB30:
.text:C0 FE 5F 88 LDAXR WZR, W0, [X22]
.text:00 04 00 51 SUB W0, W0, #1
.text:...
0
votes
1answer
61 views
Setting Breakpoints on Thumb Instructions in GDB
I'm practicing reversing a stripped arm binary, and found that when I set a breakpoint at say 0x010451, and run the program, gdb spins forever until I hit ctrl+c. When I do, the current pc is at the ...
0
votes
0answers
31 views
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
1
vote
2answers
184 views
How to determine ARM architecture from the ELF file extracted from the firmware?
I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
1
vote
1answer
65 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
2
votes
1answer
65 views
ARM multiply compiler optimization
I need help interpreting this compiler optimization:
;R12 = 0x88888889;
UMULL LR, R2, R12, R3 ; R3 * 0x88888889;
MOV R2, R2,LSR#3 ; ((R3 * 0x88888889 << 32) >&...
1
vote
1answer
35 views
JTAG TCK on Intel X Scale (ArmV5) PXA270
Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270?
I'm probing signals on pads around the CPU and got a waveform like:
But I don't know whether any of this data is JTAG, or ...
1
vote
0answers
264 views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
51 views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
1
vote
0answers
63 views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
1
vote
0answers
60 views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
306 views
Having hard time analyzing stripped code
This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
0answers
46 views
ARM 20-pin JTAG header?
I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:
but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
1
vote
1answer
65 views
I have a two pin debug interface, confused on how to use it
I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it ...
1
vote
1answer
108 views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
5
votes
1answer
419 views
ARM bx instruction branches to address not specified as argument
I'm debugging an ARM cortex M4 (STM32F4) running FreeRTOS.
Inside the assembly FreeRTOS function vPortSVCHandler, there's a branch instruction
bx r14
using GDB, I step through instruction by ...
1
vote
1answer
81 views
Issue understanding simple ARM ASM function
I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
1
vote
0answers
30 views
ARMv7 Word Patch (CBZ)
I'm disassembling an iPhone app
I'm trying to batch the instruction CBZ -> CBNZ
Instruction Code: D9 09 00 34
As per my understanding, CBZ will jump to the address if value of register is 0
I have ...
1
vote
0answers
56 views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
8
votes
1answer
107 views
Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)
I have a static library archive which I try to understand.
First I use 'ar' to extract the object files.
The object files ar "ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped"
...
2
votes
1answer
214 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
0answers
31 views
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
1
vote
1answer
181 views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
2answers
330 views
What does this decompiled line mean?
__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1));
memcpy(__dest,param_2,numBytes + 1);
Can someone please explain what the first line does step by step? I get that ...
0
votes
1answer
82 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
1
vote
0answers
81 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
1
vote
1answer
174 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
2answers
147 views
Reverse engineering MCU with “poor” datasheet
I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck.
This is what i've done:
I got ...
0
votes
2answers
1k views
IDA Freeware 7.0 disassemble ARM .so file
I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error:
The processor type 'arm' is not included in the installed version of IDA.
IDA Version: Freeware ...
0
votes
3answers
604 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
-1
votes
2answers
505 views
How to see assembly of main function?
How can I dump the assembly of main function of binary(not striped) in ubuntu?
I want to see the assembly command and the hex value of this command
There are 1 binary for arm and 1 binary for x86
8
votes
3answers
3k views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
2
votes
0answers
798 views
How to proceed after running binwalk on this firmware?
I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP
So far I've used binwalk and gotten the following output:
...
