Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1 vote
1 answer
65 views

Reverse engineering AES128 Key Derrivation from MAC Address

Using Ghidra I have acquired the following Psuedo-code decompilation output from an ELF 32-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped. From this decompilation I ...
Seb's user avatar
  • 11
0 votes
0 answers
44 views

Address arithmetic in Ida Pro

Can someone tell more about address arithmetic in Ida? I were looking for assembly instructions and saw this LDR R0, =(byte_255914C - 0xC63D50) I understood right that in r0 will be an address which ...
switch_case's user avatar
0 votes
1 answer
98 views

Cracking cryptographic function with radare2

I want to reverse engineer an android game, found a method public static byte[] MNNOPKMJMFP(byte[] AFFEPNLBIIC, byte[] OENOGNMAMPO, byte[] GLLEHJKGIBK) { } Names are obfuscated, i know that this is a ...
Gold Moon's user avatar
1 vote
1 answer
62 views

Objective-C stub functions on AARCH64

I'm analyzing some functions I see in Machos binaries and I see that whenever there's bl instruction to an objective-c stub function that resides in the __objc_stubs section and in that function there'...
Jorayen's user avatar
  • 185
0 votes
0 answers
56 views

What are some open source encoder-decoder libraries/binaries for ARM v8 and above?

A basic search yielded me results for Capstone disassembler for ARM v8, can I get details on some open source encoders and decoders for ARM v8 and above?
SV_one's user avatar
  • 1
0 votes
1 answer
212 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
1 vote
1 answer
112 views

Why I can't decompile this ARM function?

I have an ARM (thumb) function from Nokia's firmware: ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p ROM:10A5409C ROM:10A5409C var_18 = -0x18 ROM:...
raspiduino's user avatar
2 votes
2 answers
126 views

Determine Endianess of some ARM binary image?

I have been advised to analyze an ARM binary image from an Cortex M3 (STM32) for training. It has been directly extracted from flash beforehand and passed to me. However it's unknown whether this ...
Tomblarom's user avatar
  • 121
1 vote
0 answers
66 views

How to debug armel and armhf binaries on x86-64 Ubuntu simultaneously?

I'm working on the challenges on ROP Emporium. For the ARMv5 version of the callme challenge, we are given two binaries and two shared libraries: callme_armv5 with libcallme_armv5.so and callme_armv5-...
jinscoe123's user avatar
1 vote
0 answers
45 views

JEB pro is not showing xrefs for native code (arm)

i have this problem when analyzing arm shared object. when working with IDA pro, it finds all xrefs but in jeb, most of xrefs are missing. when JEB finfishes, the final analysis lacks most of xrefs. I ...
shetal's user avatar
  • 51
3 votes
0 answers
127 views

IDA Pro debugging an ARM binary on windows with QEMU

I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
IRP_HANDLER's user avatar
3 votes
0 answers
182 views

What is the best emulator/environment for android debugging?

I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want. There are fast emulators but they don't provide ...
shetal's user avatar
  • 51
2 votes
1 answer
145 views

Identify mod operation in ARM firmware with IDA

I have the firmware in which mod operation must be done. I want to find this part of instructions. Assume the following logic exist in the firmware: res = var % 17 I have tried to make search by % ...
ALEX's user avatar
  • 21
4 votes
0 answers
258 views

How to trace with Frida some specific functions in ARM ending with BX LR

I'am trying to trace down with Frida v16.0.11 (frida-trace) all calls to exported functions from "libssl.so" (Android, 32bit). But turns out that Frida is unable to hook some functions. One ...
Cyb's user avatar
  • 41
2 votes
1 answer
100 views

Stuck decompiling ARM64 function

I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY. As far as I can tell, it reads the raw sensor ...
duckblaster's user avatar
5 votes
2 answers
630 views

How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?

Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines? MOV R1, #100 -> MOV R1, #(5 * 20) LDR R8, =var | ...
E.A's user avatar
  • 171
4 votes
1 answer
139 views

💻 This code does not crash on ARM (qemu). Why?

I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7. I'm able to emulate the userspace process ...
Attila Szász's user avatar
3 votes
0 answers
942 views

Problem getting root shell on Ezviz camera

I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
raspiduino's user avatar
2 votes
1 answer
196 views

Understanding pointer indirection for accessing static variables in Cortex M0 firmware

I'm reverse engineering some firmware from a device running an ARM Cortex M0 (specifically, Nordic nrf51802). For reference, the pertinent part of the memory map looks like this: I'm trying to add ...
Chris Laplante's user avatar
1 vote
0 answers
42 views

Using Hopper to flip branching instruction

Is it possible to flip branch instruction such as tbz to tbnz and b.ne to b.eq, I tried the hopper it gives syntax error Is it possible to set a NOP on a bl or equivalent instruction using Hopper so ...
A O's user avatar
  • 161
2 votes
1 answer
178 views

Reversing C++ Classes in ARM

I have unstripped linux arm binary, The code calls functions in class object reference like so: LDR R3, [R6] MOV R1, R7 MOV R0, R6 LDR R3, [R3,#0xC] ; (...
Dinamo's user avatar
  • 21
4 votes
2 answers
577 views

IDAPython set name of function using string passed to debug logging subfunction

IDA Pro 7.6 Static disassembly of ARM executable. This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc. However, 90% of these functions have a call to a debug ...
Tis Me's user avatar
  • 83
2 votes
1 answer
387 views

armv7 disassemble thumb instructions from raw binary snippet

I have a portion of a raw binary file that contains ARM instructions, specifically in Thumb mode (and I've manually disassembled a few instructions using the Architecture Manual, and they seemed ...
Sittin Hawk's user avatar
2 votes
1 answer
542 views

How to get hexadecimal of instruction and distinct value(token) of opcode by ghidra script?

From disassembled code, I want to extract the hexadecimal of instruction, as boxed in the figure below plus, I want to get distinct value of each opcode and its operand, which means sort of mov => ...
rabbit's user avatar
  • 23
5 votes
0 answers
268 views

Cannot find references to functions in vtables

First time doing RE work and I am working on a rather large C++ binary. In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
micheal65536's user avatar
2 votes
0 answers
275 views

ghidra assigns local variable to register

im reversing a android native library and im trying to understand how a token is generated the toke n is passed to a callback java method and i traced where the method is getting called from this is ...
ahmed mani's user avatar
3 votes
0 answers
67 views

How can I quickly tell which ARM Thumb version a particular piece of code is using?

I'm working with an ARM processor: an STM32F407VGT6 board, which IIUC powers a 32-bit Arm® Cortex®-M4. I need to inspect the binary weight of some instruction, so I used objdump like this: arm-none-...
Alessandro Bertulli's user avatar
2 votes
0 answers
210 views

How to Decompile HP LaserJet Pro M12w firmware in Ghidra

I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra, after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
A.Motahari's user avatar
3 votes
1 answer
880 views

U-boot base address on Ghidra

I'm trying to do some REing on a vendored U-Boot bootloader image. For context, the U-Boot image was extracted from the full firmware image with: dd if=<firmware>.img of=uboot_sdcard.bin bs=1024 ...
Rui Oliveira's user avatar
2 votes
2 answers
1k views

ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file

I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
Rui Oliveira's user avatar
2 votes
0 answers
95 views

Ghidra: Ignoring partial resolution of indirect

The decompiled code for a function shows "Warning: Ignoring partial resolution of indirect" and I am not able to determine the values of variables local_18 in this decompile: uint ...
mattmunee's user avatar
2 votes
1 answer
67 views

Cutter cannot parse AUTDA instruction

I work on reverse engineering of an iOS software using Cutter, and receive several opcodes as "invalid". For example: <addr> 301ac1da invalid Looking up the hex ...
LeeNeverGup's user avatar
2 votes
1 answer
762 views

Trying to reverse a bin file

I'm trying to reverser a bin file with Ghidra, without success for the moment, I can't find any functions in the decompiled file. he bin file is for an ARM 32bits, I'm pretty sure this is an stm32, so ...
simon's user avatar
  • 131
2 votes
1 answer
185 views

Can an OpenWrt FIT kernel be virtualized in qemu?

I have a router I'd like to virtualize in order to do some dynamic analysis. I could virtualize individual binaries with qemu, but I'd like to have the whole ecosystem up and running. I'll start here: ...
Matthew Tingum's user avatar
2 votes
1 answer
96 views

Is there any way to understand if a raw binary firmware is Cortex-M or not?

I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares? I have some ideas like Interrupt vector Table (...
eftekhar's user avatar
0 votes
1 answer
370 views

Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header

I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum. file output: libTheArmKing.so: ELF ...
raspiduino's user avatar
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
Sirius Black's user avatar
3 votes
1 answer
993 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
vincent's user avatar
  • 131
1 vote
1 answer
73 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
captmicr0's user avatar
1 vote
1 answer
173 views

Gdb hardware watchpoint error on android

After failing to find a solution to this I have started using Gdb and have encountered another error. Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
Silent's user avatar
  • 164
2 votes
1 answer
1k views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
Silent's user avatar
  • 164
6 votes
1 answer
3k views

What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?

Background Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page: MRE (MAUI Runtime Environment) is a ...
raspiduino's user avatar
0 votes
0 answers
178 views

not called functions

trying to reverse a Cortex-M0 bin file using Ghidra. There are functions that are Never Called any where in the code! (but actually should be called somewhere !) What could be the reasons? Tnx
jonathan.'s user avatar
1 vote
2 answers
198 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
raspiduino's user avatar
1 vote
1 answer
940 views

ARM - Understanding a "base address" when reversing firmware

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
BeepBeepComputer's user avatar
1 vote
1 answer
261 views

Need help identifying this SoC

Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means. “SAV500D” seems to be the model, the ...
Alex4102's user avatar
3 votes
0 answers
401 views

Is it possible to dump firmware of a device via USB port?

I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port. lsusb command says that this device has following ...
Simon Rusinov's user avatar
1 vote
1 answer
147 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC. I made sure ...
BitFlow's user avatar
  • 11
3 votes
1 answer
802 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
RosterPantyhose's user avatar
0 votes
1 answer
286 views

ADDS(operations with S suffix) -Arm

This question was asked before here but in the answers I did get what i was looking for. Consider this: ADDS R0 RO R1 As far as I know to update the cpsr flags a subtraction has to be made. So after ...
Silent's user avatar
  • 164

1
2 3 4 5
7