Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
286
questions
0
votes
1answer
57 views
Running ELF file built for ARM arhitecture
My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
0
votes
2answers
50 views
How to calculate the value needed to branch two points in IDA pro?
I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0
votes
0answers
34 views
How can I identify JTAG in this case and utilize it?
I'm developer and I somehow tried today to reverse engineer and take apart a hardware, just after learning that some devices have hardware debugging. First thing to try to know in my understanding of ...
0
votes
1answer
140 views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
0
votes
1answer
104 views
Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?
I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a.
I want to check some logic in `xx. ...
0
votes
1answer
62 views
Where stack canary is located?
Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr
so I can't change any registers (while the ...
2
votes
0answers
35 views
Finding (or building) a kernel for Huawei EchoLife EG8145V5
I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
2
votes
1answer
61 views
How to know when a subroutine starts when reversing an ARM64 file?
I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
1
vote
1answer
150 views
Disassembling ARM based Camera Firmware
I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file.
Binwalk is unable to extract the known zip files.
binwalk -e digicap.dav
DECIMAL ...
1
vote
1answer
55 views
Debug bFLT in qemu-arm-static
I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static .
I want to debug that binary dynamically with GDB.
I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
1answer
51 views
Ghidra showing pointer being given as size argument of calloc
I'm attempting to figure out the structure of a "God object".
I found where it's being initialized, but I've never seen calloc used like this before:
god = (God *)calloc(1,(size_t)&...
2
votes
0answers
71 views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
1
vote
0answers
90 views
ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)
As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
0
votes
0answers
36 views
Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?
The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
2
votes
1answer
49 views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
3
votes
2answers
115 views
Find the entry point in Interrupt Vector Table ARM9
I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings.
I've disassembled the firmware using ida pro, but I couldn't find the entry ...
3
votes
2answers
188 views
What does this ARM assembly code do?
I'm trying to figure out the password that is used to access the U-Boot shell, as mentoined in my previous question.
I'm having trouble understanding how exactly the code works.
Here is an image of ...
0
votes
0answers
103 views
Loading a U-Boot ARM flash image into IDA Pro
I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
1
vote
1answer
58 views
IDApython - Turning a modified operand into a string reference
I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table.
The core of the script is working fine, but I have some issue when it comes ...
2
votes
1answer
49 views
Reverse Engineering Classes in ARM
I came across this part in the book Reverse Engineering For Beginners book by Denis Yurichev. It writes about reverse engineering Classes in C++, but it doesn't provide any examples in ARM.
Page 546
...
1
vote
1answer
51 views
What could a firmware image be, if not embedded linux?
I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
2
votes
1answer
250 views
How to extract the kernel assembly code from a zImage?
here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
1
vote
1answer
34 views
Help understanding ARM Cortex-M4 SBC instruction
Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
2
votes
1answer
132 views
Help with LDR, LDRD and STR instructions
The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
2
votes
0answers
81 views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
1
vote
1answer
87 views
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
3
votes
2answers
150 views
How can I find out what type of processor an Intel Hex file belongs to?
I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below:
:03:8000:00:028100FA
:02:8003:00:XXXXXX
:02:800B:00:XXXXXX
:02:8013:00:XXXXXX
:01:801B:00:...
1
vote
1answer
126 views
What does the "=>" sign means in ARM assembly LDR?
what does this arm instruction means?
LDRB param_1,[r12,r5]=>local_b0
In particular I don't understand the "=>local_b0" part.
Ghidra decompiles it to
local_b0._0_1_ = *(byte *)((int)&...
2
votes
0answers
97 views
How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?
I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them.
I have dumped and decoded the bios and got some useful datas,
according to datas we can see u-...
0
votes
1answer
36 views
Why would just two bits of the SP be used here?
This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7.
; Registers used:
; - r3 : unsigned long argp
0000005c mov r1, ...
3
votes
1answer
65 views
Understanding ARMv7 seemingly overly verbose disassembly
I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention:
00009086 movw r3, #...
0
votes
0answers
33 views
Function obfuscation with hundreds of LDR PC, what is it called and how is it generated?
I am working on some obfuscated code. To my understanding, here is how the obfuscation works:
Take the subroutine you want to obfuscate, like;
LDR R2, [R0,#8]
MOV R0, #0
CMP ...
0
votes
1answer
37 views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
1
vote
1answer
109 views
Change function call to another function call in arm using IDA
Is it possible to patch arm lib in a way that changes branch instruction calling one function to another function call?
I have instruction
B function_a
and want change it to:
B function_b
1
vote
1answer
72 views
Migrate x86 printer drivers to arm [Brother]
I have a Brother DCP 197C printer and I would like to print from my phone using a raspberry pi. To archieve it I need to install drivers, but brother only provide x86 and x64 drivers, any way to do it?...
0
votes
0answers
64 views
Reverse an encryption algorithem in APK .so file
I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
2
votes
1answer
1k views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
1
vote
1answer
444 views
What is the meaning of ARM LDAXR/STLXR instructions?
Often while disassembling ARM files, I see some code snippet with the following pattern:
loc_BB30:
.text:C0 FE 5F 88 LDAXR WZR, W0, [X22]
.text:00 04 00 51 SUB W0, W0, #1
.text:...
0
votes
1answer
97 views
Setting Breakpoints on Thumb Instructions in GDB
I'm practicing reversing a stripped arm binary, and found that when I set a breakpoint at say 0x010451, and run the program, gdb spins forever until I hit ctrl+c. When I do, the current pc is at the ...
0
votes
0answers
38 views
Emulator that emulates arm hardware
I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
1
vote
2answers
312 views
How to determine ARM architecture from the ELF file extracted from the firmware?
I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
1
vote
1answer
71 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
2
votes
1answer
77 views
ARM multiply compiler optimization
I need help interpreting this compiler optimization:
;R12 = 0x88888889;
UMULL LR, R2, R12, R3 ; R3 * 0x88888889;
MOV R2, R2,LSR#3 ; ((R3 * 0x88888889 << 32) >&...
1
vote
1answer
43 views
JTAG TCK on Intel X Scale (ArmV5) PXA270
Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270?
I'm probing signals on pads around the CPU and got a waveform like:
But I don't know whether any of this data is JTAG, or ...
1
vote
0answers
355 views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
60 views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
1
vote
0answers
72 views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
1
vote
0answers
61 views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
448 views
Having hard time analyzing stripped code
This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
0answers
58 views
ARM 20-pin JTAG header?
I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:
but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...