Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

53 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
3k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
user avatar
3 votes
0 answers
342 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
user avatar
2 votes
0 answers
57 views

Is it possible to dump firmware of a device via USB port?

I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port. lsusb command says that this device has following ...
user avatar
2 votes
0 answers
74 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
user avatar
  • 121
2 votes
0 answers
79 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
user avatar
  • 73
2 votes
0 answers
89 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
user avatar
  • 21
2 votes
0 answers
194 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
user avatar
  • 21
2 votes
0 answers
2k views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
user avatar
  • 1,625
2 votes
0 answers
218 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
user avatar
  • 21
2 votes
0 answers
88 views

When virtual table is not the first element of structure?

Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
user avatar
2 votes
0 answers
925 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
user avatar
  • 215
2 votes
0 answers
133 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
user avatar
  • 49
2 votes
0 answers
1k views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
user avatar
  • 43
2 votes
0 answers
247 views

Help identify missing component for jtag connection

I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector. (See here) I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU When I follow the wires, TCK, ...
user avatar
2 votes
0 answers
479 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
user avatar
  • 181
1 vote
0 answers
43 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
user avatar
  • 111
1 vote
0 answers
44 views

Hopper Disassembler AArch64 assemble instruction syntax error

As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error". At this moment I can only change it by editing the instruction encoding in hex view as a ...
user avatar
1 vote
0 answers
194 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
user avatar
  • 56
1 vote
0 answers
552 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
user avatar
  • 73
1 vote
0 answers
109 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
user avatar
  • 73
1 vote
0 answers
63 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
user avatar
1 vote
0 answers
82 views

ARM 20-pin JTAG header?

I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header: but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
user avatar
1 vote
0 answers
51 views

ARMv7 Word Patch (CBZ)

I'm disassembling an iPhone app I'm trying to batch the instruction CBZ -> CBNZ Instruction Code: D9 09 00 34 As per my understanding, CBZ will jump to the address if value of register is 0 I have ...
user avatar
  • 11
1 vote
0 answers
127 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
user avatar
  • 11
1 vote
0 answers
60 views

finding specific string in ios dyld_shared_cache

Im trying to find the library inside a dyld cache that contains a specific string. I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
user avatar
1 vote
0 answers
111 views

Find vulnerabilities in ARM IoT device

I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro. I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
user avatar
1 vote
0 answers
71 views

Bin patching Arm7tdmi CRC32?

Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin ...
user avatar
  • 21
1 vote
0 answers
187 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
user avatar
1 vote
0 answers
170 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
user avatar
1 vote
0 answers
464 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
user avatar
  • 111
1 vote
0 answers
95 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
user avatar
  • 11
1 vote
1 answer
275 views

Breakpoint on memory access in ARM debugging

I'm using IDA Pro for ARM native debugging (with androidserver). I'd like to check when a memory address is read by code (what instruction and where). Hardware breakpoint is not possible. How can I do ...
user avatar
1 vote
0 answers
603 views

Patching an ipa (iPhone app) using Hopper Disassembler

I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
user avatar
1 vote
0 answers
178 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
user avatar
  • 231
1 vote
0 answers
562 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
user avatar
1 vote
0 answers
269 views

Calculating branch in arm64

I stumbled across this question here Offset calculation for branch instruction in ARM After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?
user avatar
  • 25
1 vote
0 answers
284 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
user avatar
1 vote
0 answers
656 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
user avatar
  • 139
1 vote
0 answers
505 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
user avatar
1 vote
0 answers
637 views

crackme binary crashing on Raspberry pi

I was trying out a basic ARM crackme here. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is ...
user avatar
0 votes
0 answers
17 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
user avatar
0 votes
0 answers
42 views

not called functions

trying to reverse a Cortex-M0 bin file using Ghidra. There are functions that are Never Called any where in the code! (but actually should be called somewhere !) What could be the reasons? Tnx
user avatar
0 votes
0 answers
124 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
user avatar
0 votes
0 answers
57 views

How can I identify JTAG in this case and utilize it?

I'm developer and I somehow tried today to reverse engineer and take apart a hardware, just after learning that some devices have hardware debugging. First thing to try to know in my understanding of ...
user avatar
  • 179
0 votes
0 answers
185 views

Loading a U-Boot ARM flash image into IDA Pro

I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
user avatar
  • 31
0 votes
0 answers
75 views

Reverse an encryption algorithem in APK .so file

I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
user avatar
0 votes
0 answers
61 views

Emulator that emulates arm hardware

I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
user avatar
  • 73
0 votes
1 answer
599 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
user avatar
0 votes
0 answers
76 views

Why is U-Boot changing this bit marked as "DO NOT CHANGE"?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
user avatar
0 votes
0 answers
149 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
user avatar
  • 159