Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

50 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
2k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
3
votes
0answers
316 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
2
votes
0answers
27 views

Finding (or building) a kernel for Huawei EchoLife EG8145V5

I have a Huawei EchoLife EG8145V5 for which I am trying to build some software. It has a built-in Linux distro of some sort, but I would like to add to it, as there is "plenty" of storage ...
2
votes
0answers
67 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
2
votes
0answers
80 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
2
votes
0answers
87 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
2
votes
0answers
1k views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
2
votes
0answers
186 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
2
votes
0answers
81 views

When virtual table is not the first element of structure?

Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
2
votes
0answers
732 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
2
votes
0answers
113 views

Understanding ESIL

I cross-compiled a simple program with the aarch-linux-gnu-gcc compiler for ARM. So the machine is "ARM aarch64". I want to understand a single instruction and it's realization in ESIL. The opcode of ...
2
votes
0answers
1k views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
2
votes
0answers
213 views

Help identify missing component for jtag connection

I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector. (See here) I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU When I follow the wires, TCK, ...
2
votes
0answers
450 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
1
vote
1answer
80 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
1
vote
0answers
68 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
1
vote
0answers
324 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
1
vote
0answers
67 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
60 views

Immediate offset LDR in presumed malloc function looks wrong in static analysis

I am attempting to disassemble a ROM image for a BCM4366C [1] after reading a blog post where researchers reversed some other Broadcom chips [2] . I have analyzed the ROM image in Ghidra and I have ...
1
vote
0answers
55 views

ARM 20-pin JTAG header?

I'm trying to find the JTAG header for an Intel X Scale (ArmV5) PXA270 board. I found and populated a 20-pin header: but JTAGulator doesn't think it has a valid combination of TDI/TDO/TMS/TCK on ...
1
vote
0answers
32 views

ARMv7 Word Patch (CBZ)

I'm disassembling an iPhone app I'm trying to batch the instruction CBZ -> CBNZ Instruction Code: D9 09 00 34 As per my understanding, CBZ will jump to the address if value of register is 0 I have ...
1
vote
0answers
82 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
1
vote
0answers
35 views

finding specific string in ios dyld_shared_cache

Im trying to find the library inside a dyld cache that contains a specific string. I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
1
vote
0answers
88 views

Find vulnerabilities in ARM IoT device

I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro. I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
1
vote
0answers
60 views

Bin patching Arm7tdmi CRC32?

Ok so I am total noob here. I wanted to play with the bin from an instrument cluster I work on a lot. I was able to pull the bin off the MCU with a J-link. If I erase the chip and flash it with a bin ...
1
vote
0answers
127 views

Strange behaviour debugging Android ARM binary with gdbserver

I'm trying to run this armv5 binary from OWASP's mobile security guide (validate) using Android Studio's emulator on my x86_64 machine. I'm seeing very weird behaviour and would appreciate any ...
1
vote
0answers
142 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
0answers
353 views

Simplify two 32 bit expressions into one 64 bit expression in decompilation

I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like: gTime._0_4_ = (undefined4)(time1 >>...
1
vote
0answers
90 views

Help understanding ARM Assembly example code - loops, set flags and code mnemonics

This is the example code: _start: LDR r0, =n LDR r0, [r0] LDR r1, =array1 MOV r2, #0 LDR r4, =array2 loop: LDR r3, [r1], #4 CMP r3, #58 BGT a_point CMP r3, #47 BLT a_point SUB r3, r3, #0x30 STR r3, [...
1
vote
1answer
203 views

Bp on memory access in arm deb

I'm using idapro for arm native debugging (with androidseever) . I'd like to check when a memory data is read by code (what instruction and where). Hardware bp is not possible. How can i do? How to ...
1
vote
0answers
540 views

Patching an ipa (iPhone app) using Hopper Disassembler

I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
1
vote
0answers
158 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
1
vote
0answers
516 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
1
vote
0answers
239 views

Calculating branch in arm64

I stumbled across this question here Offset calculation for branch instruction in ARM After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?
1
vote
0answers
263 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
1
vote
0answers
583 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
1
vote
0answers
481 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
1
vote
0answers
622 views

crackme binary crashing on Raspberry pi

I was trying out a basic ARM crackme here. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is ...
0
votes
0answers
28 views

Is there a way to get Ghidra to show the result of an integer division function (div_t) returned in a register more sensibly?

The program I am reverse engineering has a function which I have identified as the C standard div function div_t div(int, int). The div_t result is returned in two ARM registers, r0 for the quotient ...
0
votes
0answers
85 views

Loading a U-Boot ARM flash image into IDA Pro

I have a U-Boot image file which was extracted from flash memory of a board with an Hi3520D ARM CPU. I would like to load this file into IDA Pro and dig out the password that is required for accessing ...
0
votes
0answers
31 views

Function obfuscation with hundreds of LDR PC, what is it called and how is it generated?

I am working on some obfuscated code. To my understanding, here is how the obfuscation works: Take the subroutine you want to obfuscate, like; LDR R2, [R0,#8] MOV R0, #0 CMP ...
0
votes
0answers
63 views

Reverse an encryption algorithem in APK .so file

I try to reverse a cipher algorithm (I guess Tiny Encryption Algorithm (TEA)) in an android application. But I have a serious problem in initializing arguments. How I can understand that I have ...
0
votes
0answers
36 views

Emulator that emulates arm hardware

I want to hook arm instructions as they executes but most of the emulators are based on VirtualBox that uses houdini to translate arm instructions to x86, and i really can't hook a native JNI lib, ...
0
votes
1answer
405 views

Having hard time analyzing stripped code

This is my first time doing RE on a statically linked and stripped binary with ghidra. And I'm having a really hard time analyzing what function does what just by looking the decompiled code present ...
0
votes
1answer
306 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
0
votes
0answers
74 views

Why is U-Boot changing this bit marked as “DO NOT CHANGE”?

While reverse engineering very early hardware initialization code of an old S3C6410 based tablet, I came across an instruction that changes a bit that the user manual (relevant info on pg. 3-50) ...
0
votes
0answers
123 views

Why decrement a hex value in assembly code?

I am running a disassembly of a firmware image for a Cortex-M4 and the entry point is doing something strange. EntryPoint: 00001000 db 0x00 ; '.' 00001001 db 0xff ; '.' 00001002 ...
0
votes
0answers
1k views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
0
votes
0answers
107 views

Dumping flash from a running Cortex-M

I have a working device with a STM32F405ZGT6 in it. I want to dump the software it runs. As far as I can tell, there's no external flash on the device, so it must be running off of the internal flash....
0
votes
2answers
94 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.