Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
257
questions
0
votes
0answers
38 views
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
-1
votes
1answer
125 views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
0
votes
1answer
77 views
What is the meaning of ARM LDAXR/STLXR instructions?
Often while disassembling ARM files, I see some code snippet with the following pattern:
loc_BB30:
.text:C0 FE 5F 88 LDAXR WZR, W0, [X22]
.text:00 04 00 51 SUB W0, W0, #1
.text:...
0
votes
1answer
31 views
Setting Breakpoints on Thumb Instructions in GDB
I'm practicing reversing a stripped arm binary, and found that when I set a breakpoint at say 0x010451, and run the program, gdb spins forever until I hit ctrl+c. When I do, the current pc is at the ...
0
votes
0answers
24 views
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
1
vote
2answers
63 views
How to determine ARM architecture from the ELF file extracted from the firmware?
I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
1
vote
1answer
63 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
2
votes
1answer
49 views
ARM multiply compiler optimization
I need help interpreting this compiler optimization:
;R12 = 0x88888889;
UMULL LR, R2, R12, R3 ; R3 * 0x88888889;
MOV R2, R2,LSR#3 ; ((R3 * 0x88888889 << 32) >&...
1
vote
1answer
26 views
JTAG TCK on Intel X Scale (ArmV5) PXA270
Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270?
I'm probing signals on pads around the CPU and got a waveform like:
But I don't know whether any of this data is JTAG, or ...
1
vote
0answers
92 views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
40 views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
1
vote
0answers
50 views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
1
vote
0answers
51 views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
140 views
Having hard time analyzing stripped code
This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
0answers
28 views
ARM 20-pin JTAG header?
I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:
but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
1
vote
1answer
62 views
I have a two pin debug interface, confused on how to use it
I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it ...
1
vote
1answer
72 views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
5
votes
1answer
370 views
ARM bx instruction branches to address not specified as argument
I'm debugging an ARM cortex M4 (STM32F4) running FreeRTOS.
Inside the assembly FreeRTOS function vPortSVCHandler, there's a branch instruction
bx r14
using GDB, I step through instruction by ...
1
vote
1answer
63 views
Issue understanding simple ARM ASM function
I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
1
vote
0answers
25 views
ARMv7 Word Patch (CBZ)
I'm disassembling an iPhone app
I'm trying to batch the instruction CBZ -> CBNZ
Instruction Code: D9 09 00 34
As per my understanding, CBZ will jump to the address if value of register is 0
I have ...
1
vote
0answers
47 views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
8
votes
1answer
99 views
Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)
I have a static library archive which I try to understand.
First I use 'ar' to extract the object files.
The object files ar "ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped"
...
1
vote
1answer
66 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
0answers
21 views
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
1
vote
1answer
86 views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
2answers
194 views
What does this decompiled line mean?
__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1));
memcpy(__dest,param_2,numBytes + 1);
Can someone please explain what the first line does step by step? I get that ...
0
votes
1answer
54 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
0
votes
0answers
21 views
Using Gdb-Server with Ida 7.4 failed
I have gdb-server to arm , downloded from https://github.com/therealsaumil/static-arm-bins/blob/master/gdbserver-armel-static-8.0.1.
When I use Ida 6.6 to connect remotly to this gdb-server that work ...
0
votes
0answers
72 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
1answer
91 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
41 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
0
votes
0answers
36 views
Find common functions in arm static binary
According to Detecting libc function with IDA
I have static binary for arm and I want to find common function like fread sleep printf ioctl etc.
When I looking for string in this binary I found glibc ...
0
votes
1answer
110 views
Reverse engineering MCU with “poor” datasheet
I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck.
This is what i've done:
I got ...
0
votes
0answers
220 views
a.out: Invalid ELF image for this architecture
I am trying to run arm executable using qemu and I am getting this following error
a.out: Invalid ELF image for this architecture.
My assemble code hello.s
.text
.global _start
_start:
mov r0, #1
...
0
votes
0answers
64 views
Loading garmin Foretrex 601 firmware into IDA Pro
I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin)
But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch.
The GCD file can be ...
0
votes
2answers
448 views
IDA Freeware 7.0 disassemble ARM .so file
I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error:
The processor type 'arm' is not included in the installed version of IDA.
IDA Version: Freeware ...
0
votes
3answers
315 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
-1
votes
2answers
200 views
How to see assembly of main function?
How can I dump the assembly of main function of binary(not striped) in ubuntu?
I want to see the assembly command and the hex value of this command
There are 1 binary for arm and 1 binary for x86
5
votes
3answers
1k views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
2
votes
0answers
352 views
How to proceed after running binwalk on this firmware?
I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP
So far I've used binwalk and gotten the following output:
...
0
votes
1answer
93 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
1
vote
1answer
349 views
LDR specifier combination UXTW
Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:
LDR W0, [X30,W0,UXTW#2]
ADD X30, X30, W0,UXTW
I have readed ...
0
votes
1answer
116 views
Patch Arm binary with Ida
In Ida I can patch binary that run on x86 , but not binary that run on Arm.
How can I simply patch binary , change assembly(not only hex) and save to new binary file
2
votes
1answer
146 views
reverse engineering hi3516ev200
I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
1
vote
0answers
57 views
Bin patching Arm7tdmi CRC32?
Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin ...
1
vote
1answer
48 views
IDA - ObjC - Meaning of _BYTE and dword_0?
This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
0
votes
1answer
150 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
2
votes
0answers
135 views
Reversing a firmware update for an LG HTS
I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall.
This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
3
votes
3answers
262 views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
ctor_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
0
votes
0answers
29 views
Building firmware.bin from mtd partitions
Working on reversing current router firmware here and I can't find any sources from the manufacturer for their firmware and toolchain.
I wanted to do this approach.
firmware.bin is loaded and ...
