Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

0
votes
0answers
25 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
0
votes
0answers
36 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
1
vote
1answer
69 views

How to inject some code to ARM .so files permanently?

I am trying to figure out how to solve the following. I have two ARM .SO libraries (32 bit and 64 bit) with the same functions. There is a method which returns const char* , it looks like this in ...
0
votes
0answers
38 views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
1
vote
0answers
44 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
1
vote
1answer
40 views

MEMORY macro in IDA Pro pseudocode

I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example: int S_u8init_flag = 0; // ...
1
vote
0answers
54 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
3
votes
1answer
137 views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
0
votes
1answer
89 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
51 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
4
votes
1answer
127 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
1
vote
1answer
49 views

How is thumb branch calculated

I have the instruction which is: 5ff1aed4 bl sub_5ff171d0 which assembles to: FCF77CF9 This appears to mean that the program is branching backwards, However I can't seem to find ...
0
votes
0answers
50 views

Dumping flash from a running Cortex-M

I have a working device with a STM32F405ZGT6 in it. I want to dump the software it runs. As far as I can tell, there's no external flash on the device, so it must be running off of the internal flash....
0
votes
1answer
139 views

Firmware reverse engineering

this question is a follow-up from this previous post: Flash dump binwalk blank, low entropy I need to reverse engineer a firmware from a very secure device. I was able to reverse engineer the PCB ...
2
votes
1answer
69 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
1
vote
0answers
66 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
-1
votes
1answer
493 views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
0
votes
1answer
111 views

Confused about a firmware binary

I'm trying to reverse engineer an ARM Thumb2 firmware binary, and I've come across a few oddities. Parts of the file when treated as RGB binary data form perfect images, which seems unusual for a ...
2
votes
1answer
313 views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" via the Java Native Interface. My Problem is: The ...
2
votes
1answer
55 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
5
votes
1answer
281 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
1
vote
1answer
86 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
2
votes
0answers
66 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
2
votes
1answer
84 views

How are ARMv7 assembly opcodes and operands stored in bytes?

I've been trying to analyze an ARM binary but cannot figure out how the operators and operands are stored in the bytes of a program. For example, by looking at the disassembly listing of an ARMv7 ...
3
votes
1answer
233 views

Need help understanding XOR cipher

I am trying to modify a save file for a game. I think it is using an XOR cipher to encrypt it. Looking though the disassembly I think I found the function that decrypts it. I ran the assembly ...
2
votes
1answer
253 views

ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)

I used readelf to read the information of the ELF file. I found the address of .got section in the section header is different from the GOT entry point address read from the dynamic section. Is the ...
1
vote
2answers
165 views

Reverse engineer a ARM-v7a function

Currently I am trying to reverse engineer the following armeabi-v7a function: I already wrote the following Java code: static double getFunc(double param0, double param1, double param2, double ...
4
votes
2answers
123 views

Disassemble ELF - PC is set to 0?

I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems that the PC, program counter register, is set to 0. Did I miss something ...
1
vote
1answer
353 views

Finding RegisterNatives function calls in JNI_OnLoad's assembly code

My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with AAAAAAAA <JNI_OnLoad@@...
0
votes
1answer
381 views

How to Modify this Branch in ARM64?

I try to modify the branch of this disassembly in a binary: SUB SP, SP, #0x60 STP X26, X25, [SP,#0x50+var_40] STP X24, X23, [SP,#0x50+var_30] STP X22, ...
1
vote
1answer
104 views

Could someone explain how this ARM instructions works compared to the actual Objective-C code?

I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction: var_8= -8 var_4= -4 SUB SP, SP, #8 MOVS R2, #1 STR ...
1
vote
0answers
306 views

Patching an ipa (iPhone app) using Hopper Disassembler

I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
-1
votes
1answer
74 views

Which ARM command is influencing the SP position?

I do static analysis of ARM assembly code (I can't debug it). When I look on argument that in SP+0x<SomeOffset> I can find what I'm looking for, but if I look a few lines further down I see ...
1
vote
1answer
59 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
2
votes
2answers
677 views

How can I make sense of an Android NDK library?

So I'm currently trying to understand how an Android app interprets the data sent from a Bluetooth-enabled scale. Understanding the Java code was relatively easy. The code was obfuscated but I found ...
8
votes
1answer
2k views

Why is this ARM binary throwing an 'Illegal instruction' error and quitting?

Issue I'm hoping someone can help me determine why this binary won't execute. It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to ...
3
votes
2answers
92 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
10
votes
1answer
509 views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
0
votes
1answer
251 views

how to understand branch arm instruction

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? . When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
6
votes
2answers
377 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
0
votes
1answer
47 views

Ldr arm thumb2 must be multiple of 4?

I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4. I run on arm thumb 2 and want run this instruction ldr r0, ...
-1
votes
2answers
388 views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
1
vote
1answer
372 views

Determining endianness of PE files (Windows on ARM?)

For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
0
votes
1answer
139 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
-1
votes
2answers
42 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
0
votes
1answer
313 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
3
votes
2answers
239 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
0
votes
1answer
322 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
0
votes
2answers
279 views

explain c compile code

I compile c code to arm with this site https://godbolt.org/ int F(int a, int b) { int c=0; for(int i=0;i<=10;i++) { c+=a+b; } return c; } the result was F(int, ...
0
votes
1answer
111 views

Newbie here: hidden values in assembly? [closed]

So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...