Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
0
votes
1answer
23 views

IDA - ObjC - Meaning of _BYTE and dword_0?

This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
5
votes
1answer
748 views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
0
votes
1answer
45 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
0
votes
1answer
701 views

How to Modify this Branch in ARM64?

I try to modify the branch of this disassembly in a binary: SUB SP, SP, #0x60 STP X26, X25, [SP,#0x50+var_40] STP X24, X23, [SP,#0x50+var_30] STP X22, ...
3
votes
3answers
183 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
2
votes
0answers
75 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
0
votes
0answers
14 views

Building firmware.bin from mtd partitions

Working on reversing current router firmware here and I can't find any sources from the manufacturer for their firmware and toolchain. I wanted to do this approach. firmware.bin is loaded and ...
3
votes
2answers
79 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
0
votes
1answer
272 views

Firmware reverse engineering

this question is a follow-up from this previous post: Flash dump binwalk blank, low entropy I need to reverse engineer a firmware from a very secure device. I was able to reverse engineer the PCB ...
1
vote
0answers
25 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
0
votes
0answers
51 views

Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
1
vote
1answer
26 views

Mach-O ARM64 using literal values instead of a frame pointer (BP) register

I'm investigating an iOS app Mach-O binary in IDA and noticed it's using a fixed constant as an offset to the SP to denote the start of the stack frame instead of a register. Is this normal? ARM ...
3
votes
1answer
38 views

What binary value does Thread and Process ID Register contains in Android ARM?

I have following instructions in Android shared library: MRC p15, 0, R3,c13,c0, 3 LDR R3, [R3,#4] MOV R0, #0 STR R0, [R3,#0xC] According to ARM documentation: Reading or writing the Thread and ...
-1
votes
1answer
166 views

What is the following assembly code doing? [closed]

str fp,[sp, -4]! add fp, sp, #0 sub sp, sp, #12 str r0, [fp, #-8] str r1 [fp, #-12] L5: ldr r3, [fp, #-8] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [fp, #-12] ldrb r3, [r3] cmp r3, #0 beq .L2 ldr r3, [...
2
votes
0answers
68 views

When virtual table is not the first element of structure?

Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
1
vote
0answers
135 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
0
votes
1answer
39 views

How is `va_list` implemented in Assembler level on ARMv7 Android?

I need to extract all arguments from CallStaticObjectMethodV JNI call on ARMv7 Android at Assembler level. Can anyone advice how is va_list implemented on low level in ARMv7 Android?
3
votes
1answer
102 views

Enumerating (name, addresses) in PLT of an ELF file without elf.h

I want to show users imported symbols of a given ELF file like this(#1) in a disassembler project.(Android app) 1d21a: f7fa e8e8 blx 173ec ; __android_log_print@plt ... Currently, I can only show ...
2
votes
0answers
92 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
1
vote
1answer
120 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
0
votes
1answer
38 views

Why does this command crash IDA Android native debugger?

In Android shared library that heavily protected against debugging, I found following code: CODE32 ldr pc, [pc, #-4] For me, this instruction looks like NOP; it just jumps to next instruction in ARM ...
0
votes
1answer
86 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
1
vote
0answers
57 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
1answer
1k views

Offset Calculation for a Branch Instruction Thumb [closed]

I did find this link: Offset calculation for branch instruction in ARM Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed. What I wanted ...
2
votes
0answers
391 views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
0
votes
0answers
24 views

LLDB Cannot calculate virtual address from ASLR slide

I am trying to set a breakpoint at an Objective-C method in an iOS app (armv7). I create a toy app, dumped the sections to find the loaded address of the __text section, and calculated the mapped ...
0
votes
1answer
95 views

Understand what Ioctl do

I looking in ida on arm linux binary . I can see there that there is ioctl call ioctl(fd,req,num). fd is fd to /dev/module. ,req is some 4bytes and num is some number. How can I understand what ...
0
votes
0answers
81 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
1
vote
1answer
104 views

How to inject some code to ARM .so files permanently?

I am trying to figure out how to solve the following. I have two ARM .SO libraries (32 bit and 64 bit) with the same functions. There is a method which returns const char* , it looks like this in ...
0
votes
0answers
263 views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
2
votes
1answer
3k views

Inject code into JNI function (Android shared library)

An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash. You can see the ...
1
vote
0answers
111 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
8
votes
1answer
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
1
vote
1answer
63 views

MEMORY macro in IDA Pro pseudocode

I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example: int S_u8init_flag = 0; // ...
1
vote
0answers
129 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
4
votes
1answer
690 views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
0
votes
1answer
145 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
7
votes
2answers
4k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
4
votes
1answer
146 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
1
vote
1answer
56 views

How is thumb branch calculated

I have the instruction which is: 5ff1aed4 bl sub_5ff171d0 which assembles to: FCF77CF9 This appears to mean that the program is branching backwards, However I can't seem to find ...
0
votes
0answers
72 views

Dumping flash from a running Cortex-M

I have a working device with a STM32F405ZGT6 in it. I want to dump the software it runs. As far as I can tell, there's no external flash on the device, so it must be running off of the internal flash....
2
votes
2answers
451 views

Floating point registers on ARM

When I disassemble ARM code that deals with floating point values, how can I print out the registers? (I'm using Gdb). 0x000083d8 <+12>: ldr r3, [pc, #56] ; 0x8418 <main+76> ...
2
votes
3answers
4k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What does thw ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
2
votes
1answer
77 views

Process Immediately Killed

I'm trying to reverse an ARM executable. It's for an embedded system, but I don't have any details about the normally targeted environment. Here's what file shows: ELF 32-bit LSB executable, ARM, ...
1
vote
0answers
72 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
-1
votes
1answer
1k views

how should i change an instruction to NOP in IDA?

I am new with IDA assembler and i used to work with hopper app. the problem is i can't change instruction in IDA from something like CBNZ to NOP. is there any button to do this? i can't find anything ...
0
votes
1answer
183 views

Confused about a firmware binary

I'm trying to reverse engineer an ARM Thumb2 firmware binary, and I've come across a few oddities. Parts of the file when treated as RGB binary data form perfect images, which seems unusual for a ...
5
votes
1answer
398 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
3
votes
2answers
139 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
2
votes
0answers
75 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...