Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1 vote
1 answer
58 views

Hopper Disassembler AArch64 assemble instruction syntax error

As the screenshot shown above, I attempt to change cbz to cbnz, hopper gives me "syntax error". At this moment I can only change it by editing the instruction encoding in hex view as a ...
0 votes
2 answers
138 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
0 votes
1 answer
37 views

Reverse engineering ELF: The e_phentsize field in the ELF header is less than the size of an ELF program header

I have extracted the .so binary libTheArmKing.so (located in lib directory in apk file) from a hack of World War Heroes game (an Android game) from Plantimod Forum. file output: libTheArmKing.so: ELF ...
1 vote
2 answers
72 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
2 votes
1 answer
88 views

STM32 - Disable Voltage Check

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to disable the Voltage check (allow alternative power source)...
0 votes
1 answer
6k views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
5 votes
1 answer
215 views

What's the format of Mediatek MRE VXP file and how to create a workable VXP binary?

Background Mediatek's MRE (MAUI Runtime Environment) is the default runtime on Nokia S30+ platform, replacing the J2ME platform on older Nokia. From MRE's page: MRE (MAUI Runtime Environment) is a ...
1 vote
1 answer
282 views

Breakpoint on memory access in ARM debugging

I'm using IDA Pro for ARM native debugging (with androidserver). I'd like to check when a memory address is read by code (what instruction and where). Hardware breakpoint is not possible. How can I do ...
2 votes
1 answer
86 views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
0 votes
1 answer
17 views

Gdb hardware watchpoint error on android

After failing to find a solution to this I have started using Gdb and have encountered another error. Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
0 votes
0 answers
18 views

Patching a B(ranch) causes segfault in ARMv7 binary, while the same patch (with JMP) works on x64 binary

Any ideas why trying to patch a ARMv7 binary causes a segfault while basically the same patch on the Win64 version of the software works as expected? Here is the Win64 version, that works UPX0:...
0 votes
1 answer
345 views

Running ELF file built for ARM arhitecture

My goal is to run and debug ELF file (c444) which is compiled for the ARM architecture. I have some experience with x32 and x64 Intel architectures. However, I down know how to proceed with ARM-based ...
0 votes
0 answers
48 views

not called functions

trying to reverse a Cortex-M0 bin file using Ghidra. There are functions that are Never Called any where in the code! (but actually should be called somewhere !) What could be the reasons? Tnx
0 votes
1 answer
625 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
1 vote
1 answer
2k views

Offset Calculation for a Branch Instruction Thumb [closed]

I did find this link: Offset calculation for branch instruction in ARM Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed. What I wanted ...
2 votes
1 answer
3k views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
1 vote
1 answer
135 views

ARM - Understanding a "base address" when reversing firmware

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
1 vote
1 answer
114 views

Need help identifying this SoC

Does anybody know the manufacturer of this ARM CPU / SoC? I cannot find any information about it. I don't even know what the character in front of “Star” means. “SAV500D” seems to be the model, the ...
1 vote
1 answer
55 views

ARM/THUMB assembly mismatch between binaries causes crash

I am trying to play around with an app for Android and every time I try to call a function (lua_gettop() from the Lua 5.1 library) from the app's address space, it hits me with ILL_ILLOPC. I made sure ...
2 votes
0 answers
73 views

Is it possible to dump firmware of a device via USB port?

I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port. lsusb command says that this device has following ...
0 votes
0 answers
160 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
2 votes
1 answer
695 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
0 votes
1 answer
90 views

ADDS(operations with S suffix) -Arm

This question was asked before here but in the answers I did get what i was looking for. Consider this: ADDS R0 RO R1 As far as I know to update the cpsr flags a subtraction has to be made. So after ...
0 votes
1 answer
246 views

android index.android.bundle file

I downloaded an app from Raccoon. I got these files: com.company.name-3423.apk config.ar-3423.apk config.armeabi_v7a-3423.apk config.en-3423.apk config.iw-3423.apk config.ru-3423.apk config.xhdpi-3423....
17 votes
1 answer
22k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
2 votes
1 answer
288 views

Arm custom u-boot reversing

I'm trying to reverse a custom u-boot that implements cryptography for the Kernel at runtime (the Kernel at rest is encrypted also in a flash). I can probably ask the IoT vendor to provide the ...
1 vote
1 answer
118 views

Change iOS app binary file

I want to manipulate iOS binary file and change two strings in it. I used hex editor to search and change these strings. But after the binary file is uploaded and replaced with the origin app's binary ...
3 votes
1 answer
142 views

Code caves in arm assembly

In a disassembled elf binary i found these arm thumb instructions: function0 0x002cc3a8 8079 ldrb r0, [r0, #6] 0x002cc3aa 7047 bx lr In the codecave these were the initial hex ...
1 vote
2 answers
2k views

Problem with IDA pro 6.8 disassemble galaxy s6 sboot

I have some problem with Galaxy S6 boot loader (sboot.bin). From 0x3F000 of that file, I think that there exists the real boot loader. So I tried to disassemble it with ida 6.8 pro (64bit) But It does ...
0 votes
1 answer
83 views

Reading from buffer and printing output to a text file

00001f10 2846 mov r0, r5 00001f12 6349 ldr r1, [pc, #0x18c] {data_20a0} 00001f14 7944 add r1, pc {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} ...
0 votes
1 answer
47 views

Branching in arm assembly

This is an example assembly code: function0() 0x0.mov r0, #1 0x8.mov r1, #20 0x10.mov r2, #6 0x18.cmp r1, #16 0x20.b function1 function1() 0x28.cmp r0, #1 0x30.b functionX functionX(...
1 vote
1 answer
81 views

How to insert arm instructions into a function in a native library?

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction. addres hex arm instruction ...
2 votes
1 answer
82 views

When would a program normally transfer data between memory and coprocessor?

In the analysis of an ARM binary, when would one normally encounter transfer operations between memory and a coprocessor? These are encoded as the LDC and STC operators. Would it be common for ...
0 votes
1 answer
193 views

What does this function do?

I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
0 votes
1 answer
91 views

ARM floating point register S0 used without initialization

The following code snippet is the first few assembly instructions of a function. The code runs on armv8a. SUB SP, SP, #0x170 is the first assembly instruction of the function. Please note the ...
1 vote
0 answers
206 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
5 votes
2 answers
2k views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
0 votes
2 answers
68 views

How to calculate the value needed to branch two points in IDA pro?

I need to find how to get the value to make a branch between two points in IDA Pro, but I can’t figure it out. For more context: the instructions I’m following says “Calculate the value needed to do a ...
0 votes
0 answers
65 views

How can I identify JTAG in this case and utilize it?

I'm developer and I somehow tried today to reverse engineer and take apart a hardware, just after learning that some devices have hardware debugging. First thing to try to know in my understanding of ...
0 votes
1 answer
194 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
2 votes
0 answers
83 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
0 votes
1 answer
274 views

Where stack canary is located?

Is stack canary located between the local variable in stack and the place that the function saved the registers in the beginning of function? push r5,lr so I can't change any registers (while the ...
0 votes
1 answer
702 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
2 votes
1 answer
78 views

How to know when a subroutine starts when reversing an ARM64 file?

I'm kinda new in the ARM world, and a question suddenly came up in my mind: how does (your favorite reverse engineering tool) know where a subroutine of an ARM64 file is starting (because I'd like to ...
1 vote
1 answer
91 views

Debug bFLT in qemu-arm-static

I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static . I want to debug that binary dynamically with GDB. I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1 vote
1 answer
109 views

Ghidra showing pointer being given as size argument of calloc

I'm attempting to figure out the structure of a "God object". I found where it's being initialized, but I've never seen calloc used like this before: god = (God *)calloc(1,(size_t)&...
2 votes
1 answer
843 views

How to extract the kernel assembly code from a zImage?

here is the situation, i have a OnePlus phone and i want to explore his kernel, so i downloaded the zip firmware from the oneplus website, extract the img files from the payload.bin, use this tool to ...
2 votes
0 answers
81 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
0 votes
1 answer
621 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...

1
2 3 4 5
7