Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
4
votes
1answer
43 views
How does API call work on Android (NDK)?
In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely.
...
0
votes
0answers
31 views
TIIF File format
In VSat modem like COBHAM Explorer 510, the company offers to upgrade software every one year. So I check the new software update. It contains a tiif file format that the user manual said to copy the ...
0
votes
0answers
22 views
Is it possible to change image base with `IDC` in IDA?
I use IDA ARM remote debugger with Android native libraries, and it detects wrong image base address always. I have to go to Segments => Rebase Program, and set Image base value to correct one on each ...
0
votes
0answers
38 views
Find usage of string in object file with radare2
I have some compiled code and would like to use Cutter (Radare2) to find the place where a certain static string is printed out. The code is an object file, compiled for ARM, and to be included with ...
0
votes
0answers
27 views
ARM runtime patch
Is it possible patch a memory location at runtime with an instruction located in a different memory segment? For example with str r0, [r1] when r1 points to a code memory location in a different ...
1
vote
1answer
56 views
Bp on memory access in arm deb
I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
2
votes
0answers
46 views
Understanding ESIL
I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
0
votes
0answers
51 views
Extract filesystem from flash dump
as a beginner project I'm trying to reverse engineer an old IP telephone just for fun. It has a Winbond 64MBit flash chip and I already dumped the content with flashrom. At my first try binwalk wasn't ...
2
votes
1answer
59 views
How are ARMv7 assembly opcodes and operands stored in bytes?
I've been trying to analyze an ARM binary but cannot figure out how the operators and operands are stored in the bytes of a program.
For example, by looking at the disassembly listing of an ARMv7 ...
0
votes
0answers
36 views
Making changes to a binary file that is a Intel hex file?
im trying to reverse the SMOK Alien firmware which can be found here. The file is a Intel HEX file. I then used srec_cat on it to create a binary file which i can actually open in an editor in order ...
3
votes
1answer
170 views
Need help understanding XOR cipher
I am trying to modify a save file for a game. I think it is using an XOR cipher to encrypt it. Looking though the disassembly I think I found the function that decrypts it. I ran the assembly ...
2
votes
1answer
93 views
ELF - The start address of .got section is different from the entry point address of the GOT(global offset table)
I used readelf to read the information of the ELF file. I found the address of .got section in the section header is different from the GOT entry point address read from the dynamic section. Is the ...
1
vote
2answers
126 views
Reverse engineer a ARM-v7a function
Currently I am trying to reverse engineer the following armeabi-v7a function:
I already wrote the following Java code:
static double getFunc(double param0, double param1, double param2, double ...
4
votes
2answers
91 views
Disassemble ELF - PC is set to 0?
I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems that the PC, program counter register, is set to 0. Did I miss something ...
1
vote
1answer
132 views
Finding RegisterNatives function calls in JNI_OnLoad's assembly code
My goal is to see what a native method m does. It doesn't have a direct counterpart in the so file, but I've found the JNI_OnLoad function's ARM assembly code. It starts with
AAAAAAAA <JNI_OnLoad@@...
0
votes
1answer
148 views
How to Modify this Branch in ARM64?
I try to modify the branch of this disassembly in a binary:
SUB SP, SP, #0x60
STP X26, X25, [SP,#0x50+var_40]
STP X24, X23, [SP,#0x50+var_30]
STP X22, ...
1
vote
1answer
64 views
Could someone explain how this ARM instructions works compared to the actual Objective-C code?
I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction:
var_8= -8
var_4= -4
SUB SP, SP, #8
MOVS R2, #1
STR ...
1
vote
0answers
145 views
Patching an ipa (iPhone app) using Hopper Disassembler
I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
-1
votes
1answer
50 views
Which ARM command is influencing the SP position?
I do static analysis of ARM assembly code (I can't debug it).
When I look on argument that in SP+0x<SomeOffset> I can find what I'm looking for, but if I look a few lines further down I see ...
1
vote
1answer
34 views
Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?
I have a .so from an Android JNI/NDK application. Here are two of its sections:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[10] .rel.plt REL ...
2
votes
2answers
299 views
How can I make sense of an Android NDK library?
So I'm currently trying to understand how an Android app interprets the data sent from a Bluetooth-enabled scale.
Understanding the Java code was relatively easy. The code was obfuscated but I found ...
6
votes
1answer
791 views
Why is this ARM binary throwing an 'Illegal instruction' error and quitting?
Issue
I'm hoping someone can help me determine why this binary won't execute.
It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to ...
3
votes
2answers
76 views
ARM Thumb2 register usage
I am reversing ARM Thumb2 code.
I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends.
By the way, if ...
10
votes
1answer
320 views
How to write [sp+local_variable] in radare2
Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
0
votes
1answer
131 views
how to understand branch arm instruction
I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? .
When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
6
votes
2answers
234 views
Best Way to Identify Statically Linked Functions in Firmware
I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
0
votes
1answer
41 views
Ldr arm thumb2 must be multiple of 4?
I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4.
I run on arm thumb 2 and want run this instruction ldr r0, ...
-1
votes
2answers
211 views
translate arm instructions to hex
I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/.
Without linker , I want put 1 instruction , and want get the hex .
Do you know one please?
1
vote
1answer
191 views
Determining endianness of PE files (Windows on ARM?)
For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
0
votes
1answer
84 views
Arm function save registers r0 and r1
I see arm 32 bits assembly code.
Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them .
I see function that save push {r0,r1,r4-r9,lr} but ...
-1
votes
2answers
35 views
Edit arm thumb2 intelhex file
I have intelhex file to arm 32 bits thumb 2.
I want edit this file add/ change instructions.
Looking for easy and free tool (prefer gui windows tool ) to do it please.
0
votes
1answer
213 views
How ida choose arm Thumb/Thumb2
I load binary file to ida and choose arm cpu.
How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it?
Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
3
votes
2answers
154 views
Arm ldr diffrent between # and =
In ARM assembly, what is the difference between
ldr r4, =0x44454433
and
ldr r4, #0x44454433 ?
0
votes
1answer
197 views
Patching branch on assembly code
I compile this code
1. #include <stdio.h>
2. void F(int a, int b)
3. {
4. int c= a+b;
5. int d= a*b;
6. }
7. void printAll()
8. {
9. printf("test1");
10. printf("test2");
11. ...
0
votes
2answers
139 views
explain c compile code
I compile c code to arm with this site https://godbolt.org/
int F(int a, int b)
{
int c=0;
for(int i=0;i<=10;i++)
{
c+=a+b;
}
return c;
}
the result was
F(int, ...
0
votes
1answer
101 views
Newbie here: hidden values in assembly? [closed]
So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
0
votes
3answers
1k views
What is an immediate value?
I just read this post.
What does mean an "immediate value" ? Is there any string/ascii there?
How can I find this value on the binary file?
I have the same code and when I search on 0x28 address I ...
1
vote
2answers
958 views
How does the ldr instruction work on ARM?
ldr r0, #0x28
What does thw ldr instruction ? Does it load a string from some offset?
How can I find the string/value that is actually loaded ?
1
vote
1answer
154 views
Undefined instruction in Go binary compiled for ARM
I'm reverse engineering an ARM binary written in Go, and the following code sequence occurs fairly often (from runtime.cgoIsGoPointer):
BL runtime.panicindex
DCD 0xF7FABCFD
or, from runtime....
1
vote
1answer
258 views
Binary encryption
I'd like to ask your help to understand the algorithm used to encrypt these hex/bin firmware (for an ARM-Cortex M4 microcontroller).
In the tar file above you can find different firmware versions.
...
2
votes
0answers
452 views
Arm hex firmware reverse
it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters.
One of my goal was to understand how they bypassed (hacked) ...
1
vote
1answer
124 views
How to change a string in a arm 32bit lsb executable binary using radare2?
I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2.
I believe this will teach me the basics of RE and radare2.
Thank ...
0
votes
2answers
396 views
How can i start the RE process in radare2?(make changes to the registers) [closed]
I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
2
votes
1answer
207 views
Hex-Rays function signature does not match demangled name
From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
1
vote
1answer
80 views
ARM function start points look strange sometimes in IDA Pro
I am a little bit confused with this strange issue with ARM firmware. My original firmware file has no symbols, so I need to find them by myself trough the internet. But here I have a certain function ...
0
votes
0answers
198 views
ELF hook function by address
I used this to intercept (https://github.com/asLody/ElfHook). Everything is simple enough, but here's the question. Let's say I want to intercept a function, not by its name, by its address, as in the ...
3
votes
1answer
962 views
Entry point for STM32 firmware
I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware.
My question is how to initialize the disassembler properly (Hopper Disassembler).
The values I try to figure ...
2
votes
1answer
85 views
ARM system crashes after changing stack address
-- Edit with latest update on the problem, it is not solved yet :( --
While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module.
...
3
votes
2answers
898 views
ARM64 syscalls table
I wonder if there some syscall table for Linux ARM64 architecture?
I found syscall table for Linux ARM32 and many other architectures, but the problem still exists.
Does anyone know where can I find ...
2
votes
1answer
2k views
Inject code into JNI function (Android shared library)
An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash.
You can see the ...
