Questions tagged [arm64]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
30 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
user avatar
1 vote
0 answers
102 views

Ghidra not decompiling very simple ARM64 program

I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64) My Assembly code looks like this: .global _start _start: ...
user avatar
0 votes
1 answer
207 views

android index.android.bundle file

I downloaded an app from Raccoon. I got these files: com.company.name-3423.apk config.ar-3423.apk config.armeabi_v7a-3423.apk config.en-3423.apk config.iw-3423.apk config.ru-3423.apk config.xhdpi-3423....
user avatar
1 vote
1 answer
82 views

Change iOS app binary file

I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
user avatar
0 votes
0 answers
189 views

Convert Arm64 Assembly Trace To C

I have an ARM64 instruction trace captured from a process I'm interested in. I'm wondering if there are any open source utilities for converting the textual assembly into a C-like format. I've already ...
user avatar
  • 101
2 votes
1 answer
501 views

Read and write to register with Frida

I have an instruction that looks like this in Ghidra: 100168ff0 e9 13 00 32 orr w9,wzr,#0x1f Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
user avatar
  • 95
0 votes
0 answers
27 views

CALC Branch to some address in ARM64

~STP X20, X19, [SP,#-0x10+var_10]! 0000000101BF9530 STP X29, X30, [SP,#0x10+var_s0] 0000000101BF9534 ADD X29, SP, #0x10 ...
user avatar
2 votes
1 answer
514 views

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
user avatar
  • 21
1 vote
1 answer
272 views

What do the following AARCH64 LDR and STR instructions do exactly?

The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
user avatar
  • 257
1 vote
1 answer
74 views

What to look for in the ARM64 assembly of a Golang binary to find the list of kill signals that affect the binary execution?

I'm reverse engineering an ARM64 Golang binary built with musl and I've already detected kill -10,12,15 pid as the signals which interact with it, where 10 and 12 represent user-defined signals. I ...
user avatar
  • 257
2 votes
1 answer
175 views

Format String Direct Parameter Behavior

I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output. From the decompilation, the program has a ...
user avatar
0 votes
1 answer
60 views

reversing enrichment routine

I want to know where a specific std::string comes from, find the enrichment routine in the C++ application I'm reversing. The variable I'm looking for it at @ [X21,#8], I don't fully understand the ...
user avatar
2 votes
1 answer
161 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
user avatar
1 vote
0 answers
44 views

Theos Tweak compilation errors [closed]

While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error bash: line 1: 4665 Done swift --version 4667 Broken pipe:...
user avatar
  • 153
1 vote
1 answer
175 views

empty .data section in AARCH64 elf binaries

My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF). ghidra/JEB contradict me by showing that ...
user avatar
10 votes
3 answers
7k views

ARMv8 (AArch64, ARM64) opcodes list

I'm sorry for such as questions where answer would seem to be easily searched in google... Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
user avatar
2 votes
1 answer
1k views

LDR specifier combination UXTW

Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain: LDR W0, [X30,W0,UXTW#2] ADD X30, X30, W0,UXTW I have readed ...
user avatar
1 vote
1 answer
432 views

indirect return value address

I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void. I've noticed that every calle reads from x8/w8 afterwards, from wikipedia; ...
user avatar