Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1
vote
1answer
43 views

Confusion between different ARM architectures

I am trying to develop a machine learning model to help with the process of reverse engineering. As the first stage, we are currently trying to train an embedding model that understand the ...
2
votes
1answer
37 views

ARM multiply compiler optimization

I need help interpreting this compiler optimization: ;R12 = 0x88888889; UMULL LR, R2, R12, R3 ; R3 * 0x88888889; MOV R2, R2,LSR#3 ; ((R3 * 0x88888889 << 32) >&...
1
vote
1answer
20 views

JTAG TCK on Intel X Scale (ArmV5) PXA270

Is TCK on JTAG the same speed as CPU clock on a Intel X Scale (ArmV5) PXA270? I'm probing signals on pads around the CPU and got a waveform like: But I don't know whether any of this data is JTAG, or ...
3
votes
1answer
292 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
0
votes
1answer
94 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
-2
votes
0answers
27 views

print instructions app executes using frida android

i connected my android device over tcp and now i want my device to print all instructions as the app executes when it loads this module but print instructions from current thread not those present in ...
1
vote
0answers
42 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
181 views

Help in the process arm disassembly

I have an ARM disassembly as follow, I would be happy if you can help me to understand what it does: ldr R14 ,=0X1234 ldr r10 , [r14 , #0x555] mov.w r15, #0x6666 add.w r10,r15,r10,lsl#15 I think ...
0
votes
1answer
36 views

ARM7 32-bit Branch Offset Calculator

I need to patch an arm7 program by replacing this fopen function by another function. .text:00018D68 52 D7 FF EB BL fopen ... .plt:0000EAB8 ; FILE *fopen(const ...
0
votes
1answer
482 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...
3
votes
2answers
119 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
1
vote
0answers
46 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
47 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
3
votes
1answer
236 views

Can you change the architecture in Ghidra after importing?

I've been analyzing an ARMv7 binary for a while and have done a lot of work with it (e.g. labeling functions, creating structs, labeling globals etc.). Unfortunately, I just realized that Ghidra ...
0
votes
2answers
2k views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
1
vote
1answer
37 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
1
vote
1answer
65 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
1
vote
1answer
60 views

I have a two pin debug interface, confused on how to use it

I'm very much on the software side of things so I'm super inexperienced with debugging hardware. A custom processor I'm working with gives 2 debug pins, and given that it's an ARM system I suspect it ...
1
vote
0answers
25 views

ARM 20-pin JTAG header?

I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header: but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
1
vote
1answer
57 views

Issue understanding simple ARM ASM function

I'm a little stuck trying to understand this simple piece of code. It get's a number in R0. The first part seems to be a R0 = abs(R0), but then it get's more difficult. The number of leading zeros is ...
5
votes
1answer
354 views

ARM bx instruction branches to address not specified as argument

I'm debugging an ARM cortex M4 (STM32F4) running FreeRTOS. Inside the assembly FreeRTOS function vPortSVCHandler, there's a branch instruction bx r14 using GDB, I step through instruction by ...
4
votes
0answers
1k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
1
vote
0answers
24 views

ARMv7 Word Patch (CBZ)

I'm disassembling an iPhone app I'm trying to batch the instruction CBZ -> CBNZ Instruction Code: D9 09 00 34 As per my understanding, CBZ will jump to the address if value of register is 0 I have ...
1
vote
3answers
404 views

Firmware reverse engineering

this question is a follow-up from this previous post: Flash dump binwalk blank, low entropy I need to reverse engineer a firmware from a very secure device. I was able to reverse engineer the PCB ...
1
vote
0answers
42 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
3
votes
2answers
199 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
8
votes
1answer
95 views

Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)

I have a static library archive which I try to understand. First I use 'ar' to extract the object files. The object files ar "ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped" ...
1
vote
1answer
161 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
1
vote
0answers
19 views

finding specific string in ios dyld_shared_cache

Im trying to find the library inside a dyld cache that contains a specific string. I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
0
votes
1answer
118 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
0
votes
1answer
141 views

Finding function at offset loaded with ADRP/ADD

I have this assembly: ADRP X8, #off_FFFFFFF006F1E960@PAGE ADD X8, X8, #off_FFFFFFF006F1E960@PAGEOFF LDR X0, [X8] ; qword_FFFFFFF0077F08A8 LDR X8, [X0] ...
0
votes
2answers
74 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
0
votes
1answer
60 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
1
vote
1answer
63 views

Recognize binary architecture

I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux. When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
0
votes
1answer
89 views

Reverse engineering MCU with “poor” datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
1
vote
2answers
142 views

What does this decompiled line mean?

__dest = (byte *)(**(code **)(*plVar5 + 0x10))(plVar5,(ulonglong)(numBytes + 1)); memcpy(__dest,param_2,numBytes + 1); Can someone please explain what the first line does step by step? I get that ...
0
votes
3answers
213 views

Reverse engineer .so file from android app with radare2

I have a .so file from an android app, and I know how to list all functions in IDA Pro. How can I do this with radare2?
0
votes
0answers
67 views

Find vulnerabilities in ARM IoT device

I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro. I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
1answer
48 views

In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware

In this firmware that is ARM Little endian. There is two strings : 0x00006953 : Foretrex 701 0x00006960 : Foretrex 601 The issue, is there is no direct Xreft to any of thoses strings ? For the ...
0
votes
0answers
15 views

Using Gdb-Server with Ida 7.4 failed

I have gdb-server to arm , downloded from https://github.com/therealsaumil/static-arm-bins/blob/master/gdbserver-armel-static-8.0.1. When I use Ida 6.6 to connect remotly to this gdb-server that work ...
0
votes
0answers
39 views

Identify encrypt /decrypt rsa function

I have arm static binary that I know it use RSA. How can I find the encrypt/decrypt function?
0
votes
0answers
35 views

Find common functions in arm static binary

According to Detecting libc function with IDA I have static binary for arm and I want to find common function like fread sleep printf ioctl etc. When I looking for string in this binary I found glibc ...
0
votes
0answers
174 views

a.out: Invalid ELF image for this architecture

I am trying to run arm executable using qemu and I am getting this following error a.out: Invalid ELF image for this architecture. My assemble code hello.s .text .global _start _start: mov r0, #1 ...
0
votes
0answers
50 views

Loading garmin Foretrex 601 firmware into IDA Pro

I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin) But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch. The GCD file can be ...
9
votes
1answer
5k views

Why is this ARM binary throwing an 'Illegal instruction' error and quitting?

Issue I'm hoping someone can help me determine why this binary won't execute. It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to ...
7
votes
3answers
6k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
0
votes
2answers
211 views

IDA Freeware 7.0 disassemble ARM .so file

I have a .so file from an android app, and I want to disassemble it with IDA. However I get the error: The processor type 'arm' is not included in the installed version of IDA. IDA Version: Freeware ...
0
votes
1answer
80 views

Detecting libc function with IDA

I have binary than running on Arm , static and striped. I don't know which compiler compiled this binary. How can I identify function like fread sleep printf ioctl
2
votes
0answers
172 views

Help identify missing component for jtag connection

I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector. (See here) I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU When I follow the wires, TCK, ...
-1
votes
2answers
142 views

How to see assembly of main function?

How can I dump the assembly of main function of binary(not striped) in ubuntu? I want to see the assembly command and the hex value of this command There are 1 binary for arm and 1 binary for x86

1
2 3 4 5 6