Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
2
votes
0answers
28 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
0
votes
1answer
49 views

Where stack canary is located?

Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr so I can't change any registers (while the ...
1
vote
2answers
2k views

Problem with IDA pro 6.8 disassemble galaxy s6 sboot

I have some problem with galaxy s6 boot loader(sboot.bin). From 0x3F000 of that file, I think that there exists the real boot loader. So I tried to disassemble it with ida 6.8 pro (64bit) But It ...
0
votes
1answer
410 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
2
votes
1answer
53 views

How to know when a subroutine starts when reversing an ARM64 file?

I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
1
vote
1answer
83 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
1
vote
1answer
49 views

Debug bFLT in qemu-arm-static

I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static . I want to debug that binary dynamically with GDB. I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
1answer
50 views

Ghidra showing pointer being given as size argument of calloc

I'm attempting to figure out the structure of a "God object". I found where it's being initialized, but I've never seen calloc used like this before: god = (God *)calloc(1,(size_t)&...
2
votes
1answer
166 views

How to extract the kernel assembly code from a zImage?

here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
2
votes
0answers
68 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
1
vote
0answers
70 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
0
votes
1answer
559 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...
0
votes
0answers
28 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
2
votes
1answer
46 views

Reversing uboot on an aarch64 Hi3559AV target problems

I am trying to reverse uboot for an ARM aarch64 Hi3559AV target. I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
5
votes
1answer
521 views

How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?

Context and Background Information Part 1: ARM firmware compared to firmware for other architectures I looked at the ARM firmware in these two questions: Running a binary identified as an ARM ...
3
votes
2answers
96 views

Find the entry point in Interrupt Vector Table ARM9

I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings. I've disassembled the firmware using ida pro, but I couldn't find the entry ...
2
votes
2answers
177 views

Reverse engineering MCU with “poor” datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
3
votes
2answers
183 views

What does this ARM assembly code do?

I'm trying to figure out the password that is used to access the U-Boot shell, as mentoined in my previous question. I'm having trouble understanding how exactly the code works. Here is an image of ...
1
vote
1answer
56 views

IDApython - Turning a modified operand into a string reference

I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table. The core of the script is working fine, but I have some issue when it comes ...
1
vote
1answer
204 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
2
votes
1answer
48 views

Reverse Engineering Classes in ARM

I came across this part in the book Reverse Engineering For Beginners book by Denis Yurichev. It writes about reverse engineering Classes in C++, but it doesn't provide any examples in ARM. Page 546 ...
0
votes
1answer
307 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
0
votes
0answers
86 views

Loading a U-Boot ARM flash image into IDA Pro

I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
1
vote
1answer
201 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
0
votes
2answers
94 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
1
vote
1answer
48 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
1
vote
1answer
87 views

Change function call to another function call in arm using IDA

Is it possible to patch arm lib in a way that changes branch instruction calling one function to another function call? I have instruction B function_a and want change it to: B function_b
4
votes
3answers
12k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What is the ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
3
votes
1answer
2k views

Division on ARM [duplicate]

When performing division on ARM, this is the code snippet that I encountered. 0x83d8 <main+12>: mov r3, #10 0x83dc <main+16>: str r3, [r11, #-8] 0x83e0 <main+20>: ...
1
vote
1answer
32 views

Help understanding ARM Cortex-M4 SBC instruction

Page 88 of the ARM Cortex-M4 Generic User Guide says "The SBC instruction subtracts the value of Operand2 from the value in Rn. If the carry flag is CLEAR, the result is reduced by one." Why ...
2
votes
1answer
125 views

Help with LDR, LDRD and STR instructions

The Cortex™-M3 Devices Generic User Guide explains the instruction LDRD R8, R9, [R3, #0x20] as "Load R8 from a word 8 bytes above the address in R3, and load R9 from a word 9 bytes above the ...
2
votes
1answer
277 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
1answer
787 views

[ARM]How does this checksum code works and how to revert it in C?

I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation. ...
2
votes
0answers
80 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
4
votes
2answers
543 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
1
vote
0answers
481 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
1
vote
1answer
74 views

Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
2
votes
0answers
89 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
3
votes
2answers
139 views

How can I find out what type of processor an Intel Hex file belongs to?

I have a text file and I know that it is a firmware of a device. This file have Intel Hex Format as below: :03:8000:00:028100FA :02:8003:00:XXXXXX :02:800B:00:XXXXXX :02:8013:00:XXXXXX :01:801B:00:...
4
votes
2answers
1k views

ARM “add” instruction with shift

I'm trying to understand how ARM add with shift is implemented e.g. sym.imp.__libc_start_main : ...
1
vote
1answer
122 views

What does the “=>” sign means in ARM assembly LDR?

what does this arm instruction means? LDRB param_1,[r12,r5]=>local_b0 In particular I don't understand the "=>local_b0" part. Ghidra decompiles it to local_b0._0_1_ = *(byte *)((int)&...
0
votes
1answer
36 views

Why would just two bits of the SP be used here?

This is the section of disassembled code in question. It’s from a Linux kernel module compiled for 4.4.16 on ARMv7. ; Registers used: ; - r3 : unsigned long argp 0000005c mov r1, ...
1
vote
1answer
246 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
3
votes
1answer
64 views

Understanding ARMv7 seemingly overly verbose disassembly

I’m working with a disassembled ARMv7 binary. There are several instances where groups of instructions seem sub-optimal, but this one really caught my attention: 00009086 movw r3, #...
0
votes
0answers
32 views

Function obfuscation with hundreds of LDR PC, what is it called and how is it generated?

I am working on some obfuscated code. To my understanding, here is how the obfuscation works: Take the subroutine you want to obfuscate, like; LDR R2, [R0,#8] MOV R0, #0 CMP ...
0
votes
1answer
36 views

LPC2378FBD144 Arm7 hex file

I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3 im little confused about memory organization values i should put in the memory organization thank you for ...
4
votes
3answers
212 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
1
vote
1answer
68 views

Migrate x86 printer drivers to arm [Brother]

I have a Brother DCP 197C printer and I would like to print from my phone using a raspberry pi. To archieve it I need to install drivers, but brother only provide x86 and x64 drivers, any way to do it?...
0
votes
1answer
83 views

Setting Breakpoints on Thumb Instructions in GDB

I'm practicing reversing a stripped arm binary, and found that when I set a breakpoint at say 0x010451, and run the program, gdb spins forever until I hit ctrl+c. When I do, the current pc is at the ...
0
votes
0answers
63 views

Reverse an encryption algorithem in APK .so file

I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...

1
2 3 4 5 6