Questions tagged [arm]
A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...
252
questions
1
vote
1answer
39 views
Confusion between different ARM architectures
I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
2
votes
1answer
37 views
ARM multiply compiler optimization
I need help interpreting this compiler optimization:
;R12 = 0x88888889;
UMULL LR, R2, R12, R3 ; R3 * 0x88888889;
MOV R2, R2,LSR#3 ; ((R3 * 0x88888889 << 32) >&...
1
vote
1answer
19 views
JTAG TCK on Intel X Scale (ArmV5) PXA270
Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270?
I'm probing signals on pads around the CPU and got a waveform like:
But I don't know whether any of this data is JTAG, or ...
-2
votes
0answers
27 views
print instructions app executes using frida android
i connected my android device over tcp and now i want my device to print all instructions as the app executes when it loads this module but print instructions from current thread not those present in ...
1
vote
0answers
42 views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
36 views
ARM7 32-bit Branch Offset Calculator
I need to patch an arm7 program by replacing this fopen function by another function.
.text:00018D68 52 D7 FF EB BL fopen
...
.plt:0000EAB8 ; FILE *fopen(const ...
1
vote
0answers
46 views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
1
vote
0answers
47 views
Immediate offset LDR in presumed malloc function looks wrong in static analysis
I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
0
votes
1answer
94 views
Having hard time analyzing stripped code
This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
1
vote
0answers
25 views
ARM 20-pin JTAG header?
I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header:
but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
1
vote
1answer
60 views
I have a two pin debug interface, confused on how to use it
I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it ...
1
vote
1answer
65 views
Is Ghidra's decompilation of ARMv7 strb.w instruction broken?
I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones):
void memset(byte *addr,byte value,int count)
...
5
votes
1answer
354 views
ARM bx instruction branches to address not specified as argument
I'm debugging an ARM cortex M4 (STM32F4) running FreeRTOS.
Inside the assembly FreeRTOS function vPortSVCHandler, there's a branch instruction
bx r14
using GDB, I step through instruction by ...
1
vote
1answer
57 views
Issue understanding simple ARM ASM function
I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
1
vote
0answers
24 views
ARMv7 Word Patch (CBZ)
I'm disassembling an iPhone app
I'm trying to batch the instruction CBZ -> CBNZ
Instruction Code: D9 09 00 34
As per my understanding, CBZ will jump to the address if value of register is 0
I have ...
1
vote
0answers
42 views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
8
votes
1answer
95 views
Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)
I have a static library archive which I try to understand.
First I use 'ar' to extract the object files.
The object files ar "ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped"
...
1
vote
1answer
37 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
0answers
19 views
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
1
vote
1answer
63 views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
2answers
142 views
What does this decompiled line mean?
__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1));
memcpy(__dest,param_2,numBytes + 1);
Can someone please explain what the first line does step by step? I get that ...
0
votes
1answer
48 views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
0
votes
0answers
15 views
Using Gdb-Server with Ida 7.4 failed
I have gdb-server to arm , downloded from https://github.com/therealsaumil/static-arm-bins/blob/master/gdbserver-armel-static-8.0.1.
When I use Ida 6.6 to connect remotly to this gdb-server that work ...
0
votes
0answers
67 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
1answer
60 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
39 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
0
votes
0answers
35 views
Find common functions in arm static binary
According to Detecting libc function with IDA
I have static binary for arm and I want to find common function like fread sleep printf ioctl etc.
When I looking for string in this binary I found glibc ...
0
votes
1answer
88 views
Reverse engineering MCU with “poor” datasheet
I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck.
This is what i've done:
I got ...
0
votes
0answers
174 views
a.out: Invalid ELF image for this architecture
I am trying to run arm executable using qemu and I am getting this following error
a.out: Invalid ELF image for this architecture.
My assemble code hello.s
.text
.global _start
_start:
mov r0, #1
...
0
votes
0answers
50 views
Loading garmin Foretrex 601 firmware into IDA Pro
I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin)
But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch.
The GCD file can be ...
0
votes
2answers
211 views
IDA Freeware 7.0 disassemble ARM .so file
I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error:
The processor type 'arm' is not included in the installed version of IDA.
IDA Version: Freeware ...
0
votes
3answers
212 views
Reverse engineer .so file from android app with radare2
I have a .so file from an android app, and I know how to list all functions in IDA Pro.
How can I do this with radare2?
-1
votes
2answers
142 views
How to see assembly of main function?
How can I dump the assembly of main function of binary(not striped) in ubuntu?
I want to see the assembly command and the hex value of this command
There are 1 binary for arm and 1 binary for x86
5
votes
3answers
1k views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
2
votes
0answers
242 views
How to proceed after running binwalk on this firmware?
I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP
So far I've used binwalk and gotten the following output:
...
0
votes
1answer
80 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
1
vote
1answer
226 views
LDR specifier combination UXTW
Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:
LDR W0, [X30,W0,UXTW#2]
ADD X30, X30, W0,UXTW
I have readed ...
0
votes
1answer
88 views
Patch Arm binary with Ida
In Ida I can patch binary that run on x86 , but not binary that run on Arm.
How can I simply patch binary , change assembly(not only hex) and save to new binary file
2
votes
1answer
132 views
reverse engineering hi3516ev200
I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
1
vote
0answers
56 views
Bin patching Arm7tdmi CRC32?
Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin ...
1
vote
1answer
43 views
IDA - ObjC - Meaning of _BYTE and dword_0?
This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
0
votes
1answer
118 views
How to Modify CBZ Branch in ARM64?
If I want after running the CBZ W0, loc_C5C8 command
Run to the ADRP X8,#selRef_curent_version@PAGE command
regardless of the condition (in picture), what should I do?
2
votes
0answers
120 views
Reversing a firmware update for an LG HTS
I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall.
This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
3
votes
3answers
247 views
Strange vtable setup in constructor disassembly
In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code:
ctor_1:
ldr r1, =vtable_base
str r1, [r0] ;r0 always contains ...
0
votes
0answers
26 views
Building firmware.bin from mtd partitions
Working on reversing current router firmware here and I can't find any sources from the manufacturer for their firmware and toolchain.
I wanted to do this approach.
firmware.bin is loaded and ...
1
vote
0answers
60 views
Strange behaviour debugging Android ARM binary with gdbserver
I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
0
votes
0answers
68 views
Why is U-Boot changing this bit marked as “DO NOT CHANGE”?
While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
1
vote
1answer
40 views
Mach-O ARM64 using literal values instead of a frame pointer (BP) register
I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
3
votes
1answer
76 views
What binary value does Thread and Process ID Register contains in Android ARM?
I have following instructions in Android shared library:
MRC p15, 0, R3,c13,c0, 3
LDR R3, [R3,#4]
MOV R0, #0
STR R0, [R3,#0xC]
According to ARM documentation:
Reading or writing the Thread and ...
-1
votes
1answer
192 views
What is the following assembly code doing? [closed]
str fp,[sp, -4]!
add fp, sp, #0
sub sp, sp, #12
str r0, [fp, #-8]
str r1 [fp, #-12]
L5:
ldr r3, [fp, #-8]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [fp, #-12]
ldrb r3, [r3]
cmp r3, #0
beq .L2
ldr r3, [...
