Questions tagged [arm64]
The arm64 tag has no usage guidance.
37
questions
0
votes
0
answers
30
views
can I teach ghidra ARM's MSRs?
I have this instruction in the code:
00 cc 38 d5 mrs x0,sreg(0x3, 0x0, c0xc, c0xc, 0x0)
putting the bytecode into disassmbler, I get: mrs x0, icc_iar1_el1
so ghidra does not recognize this ...
- 273
0
votes
1
answer
66
views
ARM64 RE Questions
I have a chunk of ARM code which I am trying to make sense of. I'm new to ARM, so would appreciate some help figuring this piece out. I have added some comments to show my progress so far.
My ...
- 3
2
votes
1
answer
82
views
WinDbg command to retrieve TTBR registers for Aarch64?
Aarch64 architecture has the following registers, that contain physical base addresses for the virtual-to-physical translation tables for different exception levels:
TTBR0_EL1, TTBR1_EL1, TTBR0_EL2, ...
- 1,751
0
votes
1
answer
101
views
Function calls to unmapped memory
I'm examining an iOS framework (extracted from a dyld shared cache) and there are a lot of branch-link instructions to functions which don't exist. For example,
bl #-0x50e7e04
Performing the ...
0
votes
0
answers
59
views
Debug Linux Kernel ARM64
I need to extract Initramfs from the kernel.
The initramfs archive itself is encrypted and located inside the kernel.
I couldn't extract the key.
I thought to run the kernel in Qemu, connect with the ...
- 1
0
votes
1
answer
89
views
IDA Pro could not disassemble native function properly
Looks like some obfuscation technique was applied to this piece of code (none of start opcodes were identified properly):
Is it possible to produce manually more readable assembly?
- 161
1
vote
1
answer
200
views
ARM64 Stack Layout - Why 100x'A' Doesn't Crash?
I'm trying to exploit a buffer overflow vulnerability in an ARM64 program from this blog.
When I give as input 100*'A', and I compile the program for ARM 32 bit (without canaries), the program crashes ...
- 113
1
vote
1
answer
69
views
Objective-C stub functions on AARCH64
I'm analyzing some functions I see in Machos binaries and I see that whenever there's bl instruction to an objective-c stub function that resides in the __objc_stubs section and in that function there'...
- 185
2
votes
0
answers
253
views
Booting a Linux kernel ARM64 boot executable Image
I am self learning reverse engineering and working on reversing a firmware image for an unknown ioT device that's running on Zephyr. I have the firmware image (.img file), which returns 'Linux kernel ...
- 21
4
votes
0
answers
565
views
How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?
I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail.
I'm originally a Windows programmer, ...
- 1,751
2
votes
1
answer
103
views
Stuck decompiling ARM64 function
I am trying to figure out how this function squashes quaternion (double[4], dvar5..6 in the disassembly) data into the 2 int outputs vertexX and vertexY.
As far as I can tell, it reads the raw sensor ...
- 21
2
votes
1
answer
374
views
Deobfuscating IOS dll file (I think arm64)
I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.
I have ...
5
votes
0
answers
301
views
Cannot find references to functions in vtables
First time doing RE work and I am working on a rather large C++ binary.
In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
- 151
1
vote
0
answers
558
views
Reinterpreting local function strings in Ghidra (ARM)
The program I'm working with has stuff like this all over:
strbuf = 0x20746567;
local_824 = (undefined *)0x6863616d;
local_820 = (undefined *)0x20656e69;
local_81c = (undefined ...
- 31
1
vote
1
answer
456
views
Visual Arm64 Emulator
I have an arm64 binary that I've been reversing and I've reached a point where it would be immensely useful to visually emulate / debug a section of code. I have the full binary and I can also find a ...
- 223
1
vote
0
answers
49
views
View v0, d0 registers in Cutter (ARM64)
When reversing an ARM64 binary in Cutter 2.1, I wanted to emulate certain instructions and view the values that were computed. Cutter's emulation showed the x0-x31 registers but how do I view the v0....
- 193
3
votes
1
answer
272
views
IOS ASLR address calculation with delta offset (ARM64)
I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver.
Screenshot of start connect to remote process:
Sections of my process(image dump sections hidenseek):
...
- 71
2
votes
0
answers
215
views
how to find address in memory using ADRP and ADD (ARM64) instructions?
This part of the disassembler code takes the symbol "1" from memory to change i I need to know what address is assigned to the "x1" register, but the debugger does not work for me.
...
- 71
2
votes
0
answers
347
views
how to find a string in memory having ARM instructions ARDP and LDR?
hello, I disassembled the request sent to the game server, I need to change the symbol, but I don’t know its memory address. Help me understand the ADRP and LDR instructions, I need to understand what ...
- 71
1
vote
2
answers
586
views
How Does ARM64 EOR with Shift Work?
I'm reverse engineering an ARM64 binary and I came across the following instruction
48 05 48 4A eor w8, w10, w8, lsr #1
I looked up the definition of ARM64's eor instruction here: https://...
- 223
2
votes
1
answer
148
views
strange arm construct in objective-c application
I was reversing the objective-c application and stumbled upon an assembler construction that I don't understand:
This is call of some function with SP register (+ 0x18 offset) as parameter. (Picture1)....
- 21
1
vote
2
answers
209
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 249
3
votes
1
answer
2k
views
Ghidra not decompiling very simple ARM64 program
I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)
My Assembly code looks like this:
.global _start
_start:
...
- 43
0
votes
1
answer
1k
views
android index.android.bundle file
I downloaded an app from Raccoon.
I got these files:
com.company.name-3423.apk
config.ar-3423.apk
config.armeabi_v7a-3423.apk
config.en-3423.apk
config.iw-3423.apk
config.ru-3423.apk
config.xhdpi-3423....
- 101
1
vote
1
answer
444
views
Change iOS app binary file
I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
2
votes
1
answer
3k
views
Read and write to register with Frida
I have an instruction that looks like this in Ghidra:
100168ff0 e9 13 00 32 orr w9,wzr,#0x1f
Using lldb I can set a breakpoint on the instruction after this, read w9 to confirm what ...
- 177
2
votes
1
answer
2k
views
Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated
I'm performing my first reverse on a Mach-O file binary through Ghidra. My problem is that Ghidra doesn't create symbol files of the dylib/frameworks that are loaded in the project. It is really ...
- 21
1
vote
1
answer
3k
views
What do the following AARCH64 LDR and STR instructions do exactly?
The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
- 277
1
vote
1
answer
86
views
What to look for in the ARM64 assembly of a Golang binary to find the list of kill signals that affect the binary execution?
I'm reverse engineering an ARM64 Golang binary built with musl and I've already detected kill -10,12,15 pid as the signals which interact with it, where 10 and 12 represent user-defined signals. I ...
- 277
2
votes
1
answer
376
views
Format String Direct Parameter Behavior
I am investigating a format string vulnerability on arm64 (linked against musl libc), and am encountering some odd behavior while debugging the output.
From the decompilation, the program has a ...
- 609
0
votes
1
answer
66
views
reversing enrichment routine
I want to know where a specific std::string comes from, find the enrichment routine in the C++ application I'm reversing.
The variable I'm looking for it at @ [X21,#8], I don't fully understand the ...
- 283
2
votes
1
answer
277
views
Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff
I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it.
Pretext:
...
- 21
1
vote
0
answers
54
views
Theos Tweak compilation errors [closed]
While attempting to build a Theos tweak, even a templated one created by Theos, I will encounter the following error
bash: line 1: 4665 Done swift --version
4667 Broken pipe:...
- 193
1
vote
1
answer
253
views
empty .data section in AARCH64 elf binaries
My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF).
ghidra/JEB contradict me by showing that ...
- 13
12
votes
3
answers
15k
views
ARMv8 (AArch64, ARM64) opcodes list
I'm sorry for such as questions where answer would seem to be easily searched in google...
Some time ago I have seen table/list of ARMv8 instructions with opcodes and it was perfect, but I lost link. ...
- 355
3
votes
1
answer
3k
views
LDR specifier combination UXTW
Sorry, if this question seems stupid, but I am new in arm64 and next 2 assembly lines seriously damaged my brain:
LDR W0, [X30,W0,UXTW#2]
ADD X30, X30, W0,UXTW
I have readed ...
- 355
2
votes
1
answer
1k
views
indirect return value address
I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void.
I've noticed that every calle reads from x8/w8 afterwards, from wikipedia;
...
- 283