Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
232
questions
0
votes
0answers
6 views
Creating a toast in .so file? (Android Apk)
I know its a dumb question but can we create a toast (android pop up message) in an already existing .so file of a decompiled apk using ARM?
Thanks.
0
votes
1answer
32 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
0
votes
0answers
12 views
Using Gdb-Server with Ida 7.4 failed
I have gdb-server to arm , downloded from https://github.com/therealsaumil/static-arm-bins/blob/master/gdbserver-armel-static-8.0.1.
When I use Ida 6.6 to connect remotly to this gdb-server that work ...
0
votes
0answers
50 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
1answer
29 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
28 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
0
votes
0answers
35 views
Find common functions in arm static binary
According to Detecting libc function with IDA
I have static binary for arm and I want to find common function like fread sleep printf ioctl etc.
When I looking for string in this binary I found glibc ...
0
votes
1answer
69 views
Reverse engineering MCU with “poor” datasheet
I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck.
This is what i've done:
I got ...
0
votes
0answers
72 views
a.out: Invalid ELF image for this architecture
I am trying to run arm executable using qemu and I am getting this following error
a.out: Invalid ELF image for this architecture.
My assemble code hello.s
.text
.global _start
_start:
mov r0, #1
...
0
votes
0answers
31 views
Loading garmin Foretrex 601 firmware into IDA Pro
I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin)
But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch.
The GCD file can be ...
0
votes
2answers
74 views
IDA Freeware 7.0 disassemble ARM .so file
I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error:
The processor type 'arm' is not included in the installed version of IDA.
IDA Version: Freeware ...
0
votes
3answers
98 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
-1
votes
2answers
89 views
How to see assembly of main function?
How can I dump the assembly of main function of binary(not striped) in ubuntu?
I want to see the assembly command and the hex value of this command
There are 1 binary for arm and 1 binary for x86
5
votes
3answers
499 views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
2
votes
0answers
101 views
How to proceed after running binwalk on this firmware?
I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP
So far I've used binwalk and gotten the following output:
...
0
votes
1answer
67 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
0
votes
1answer
99 views
LDR specifier combination UXTW
Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:
LDR W0, [X30,W0,UXTW#2]
ADD X30, X30, W0,UXTW
I have readed ...
0
votes
1answer
53 views
Patch Arm binary with Ida
In Ida I can patch binary that run on x86 , but not binary that run on Arm.
How can I simply patch binary , change assembly(not only hex) and save to new binary file
1
vote
1answer
70 views
reverse engineering hi3516ev200
I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
1
vote
0answers
55 views
Bin patching Arm7tdmi CRC32?
Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin ...
1
vote
1answer
37 views
IDA - ObjC - Meaning of _BYTE and dword_0?
This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
0
votes
1answer
77 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
2
votes
0answers
103 views
Reversing a firmware update for an LG HTS
I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall.
This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
3
votes
3answers
214 views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
ctor_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
0
votes
0answers
17 views
Building firmware.bin from mtd partitions
Working on reversing current router firmware here and I can't find any sources from the manufacturer for their firmware and toolchain.
I wanted to do this approach.
firmware.bin is loaded and ...
1
vote
0answers
44 views
Strange behaviour debugging Android ARM binary with gdbserver
I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
0
votes
0answers
65 views
Why is U-Boot changing this bit marked as “DO NOT CHANGE”?
While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
1
vote
1answer
35 views
Mach-O ARM64 using literal values instead of a frame pointer (BP) register
I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
3
votes
1answer
64 views
What binary value does Thread and Process ID Register contains in Android ARM?
I have following instructions in Android shared library:
MRC p15, 0, R3,c13,c0, 3
LDR R3, [R3,#4]
MOV R0, #0
STR R0, [R3,#0xC]
According to ARM documentation:
Reading or writing the Thread and ...
-1
votes
1answer
186 views
What is the following assembly code doing? [closed]
str fp,[sp, -4]!
add fp, sp, #0
sub sp, sp, #12
str r0, [fp, #-8]
str r1 [fp, #-12]
L5:
ldr r3, [fp, #-8]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [fp, #-12]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [...
2
votes
0answers
73 views
When virtual table is not the first element of structure?
Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
2
votes
0answers
318 views
Extracting firmware image from binary
I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts?
I used Binwalk to extract content, ...
0
votes
1answer
52 views
How is `va_list` implemented in Assembler level on ARMv7 Android?
I need to extract all arguments from CallStaticObjectMethodV JNI call on ARMv7 Android at Assembler level.
Can anyone advice how is va_list implemented on low level in ARMv7 Android?
3
votes
2answers
97 views
Get certain instruction count for multi-architecture binaries
I need to get an ELF binary's total count of
Function call instruction
conditional jump (branch) instruction
The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc.
It ...
3
votes
0answers
175 views
Reverse Engineering Firmware Aether Cone
I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
0
votes
1answer
52 views
Why does this command crash IDA Android native debugger?
In Android shared library that heavily protected against debugging, I found following code:
CODE32
ldr pc, [pc, #-4]
For me, this instruction looks like NOP; it just jumps to next instruction in ARM ...
1
vote
0answers
94 views
Debugging arbitrary ARM binary image using IDA and QEMU
i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
2
votes
0answers
765 views
Extracting ARM Boot zImage
I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
0
votes
0answers
43 views
LLDB Cannot calculate virtual address from ASLR slide
I am trying to set a breakpoint at an Objective-C method in an iOS app (armv7). I create a toy app, dumped the sections to find the loaded address of the __text section, and calculated the mapped ...
0
votes
1answer
138 views
Understand what Ioctl do
I looking in ida on arm linux binary . I can see there that there is ioctl call
ioctl(fd,req,num).
fd is fd to /dev/module. ,req is some 4bytes and num is some number.
How can I understand what ...
0
votes
0answers
94 views
Why decrement a hex value in assembly code?
I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange.
EntryPoint:
00001000 db 0x00 ; '.'
00001001 db 0xff ; '.'
00001002 ...
1
vote
1answer
125 views
How to inject some code to ARM .so files permanently?
I am trying to figure out how to solve the following. I have two ARM .SO libraries (32 bit and 64 bit) with the same functions. There is a method which returns const char* , it looks like this in ...
0
votes
0answers
434 views
Disassembling ARM binary
I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys.
My current state is that I ...
1
vote
0answers
155 views
Can you change the architecture in Ghidra after importing?
I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
1
vote
1answer
74 views
MEMORY macro in IDA Pro pseudocode
I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example:
int S_u8init_flag = 0; // ...
1
vote
0answers
201 views
Simplify two 32 bit expressions into one 64 bit expression in decompilation
I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like:
gTime._0_4_ = (undefined4)(time1 >>...
4
votes
1answer
1k views
In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM
In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it.
The context is I have some functions pointed to by a data ...
0
votes
1answer
211 views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
117 views
Finding function at offset loaded with ADRP/ADD
I have this assembly:
ADRP X8, #off_FFFFFFF006F1E960@PAGE
ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF
LDR X0, [X8] ; qword_FFFFFFF0077F08A8
LDR X8, [X0]
...
5
votes
1answer
182 views
Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)
Reposted from StackOverflow as is.
I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
