Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
28
votes
2answers
8k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...
12
votes
3answers
9k views

Locating Linux Kernel Symbols on ARM

Igor posted a great answer previously on SO about the format of the Linux kernel image on ARM. Assuming I can't boot my kernel image, can someone give me pointers on finding this compressed symbol ...
12
votes
1answer
15k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
11
votes
2answers
13k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
10
votes
3answers
18k views

How to decompile an Objective-C static library (for iOS)?

I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. I had no problem until I tried to display ...
10
votes
1answer
679 views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
9
votes
2answers
9k views

How to detect thumb mode in ARM disassembly?

I try to build a small disassembler for ARM, and I would like to know how do objdump manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-...
9
votes
2answers
970 views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
8
votes
1answer
4k views

Why is this ARM binary throwing an 'Illegal instruction' error and quitting?

Issue I'm hoping someone can help me determine why this binary won't execute. It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to ...
8
votes
1answer
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
7
votes
2answers
4k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
7
votes
3answers
5k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
7
votes
3answers
5k views

Are there any ARM disassemblers that provide structured output?

Are there any ARM (or other non-x86) disassemblers that decompose an instruction into its component parts in a machine-friendly structure? Ideally it would be something like XED or distorm3, which ...
7
votes
2answers
219 views

How do I determine the length of a routine on ARMv7?

I am disassembling and reverse engineering the logic of an assembly routine written in ARMv7 (hope I'm using the right terminology, as I'm a newbie for this particular processor). In doing so, I came ...
6
votes
1answer
148 views

ARM debugging interesting behavior

I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:- 0x00008058 <+4>: mov r1, pc 0x0000805c <+8>...
6
votes
2answers
517 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
5
votes
3answers
2k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
5
votes
1answer
750 views

Find function in a stripped dynamic ELF library

Im currently reverse engineering an android app and this app calls a function named "getUserInfo" in an ARM 32bit ELF library called "libcms.so" (from TikTok) via the Java Native Interface. My ...
5
votes
2answers
4k views

Where the pointer to virtual function table is located?

I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation. But now I see a VFT whose index ...
5
votes
2answers
6k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
5
votes
1answer
677 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
5
votes
1answer
3k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
5
votes
1answer
2k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
5
votes
1answer
398 views

How does API call work on Android (NDK)?

In windows platform, an application usually references its IAT(Import Access Table) to get the address of the APIs it wants, then call it. Then some mechanisms are done as demonstrated here nicely. ...
5
votes
1answer
2k views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
5
votes
1answer
1k views

Obfuscated AES decryption assembly

I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
5
votes
1answer
4k views

ARM shellcode for linux - svc 0 vs svc 1

Checking out Linux ARM shellcode I see that the system call is made by using the svc 1 instruction. However, I have also seen examples where they use svc 0 as the instruction that calls the system ...
4
votes
2answers
410 views

Is the output of the gcc compilers the same for all ARM platforms?

Trying to understand how the code is converted in ARM platform from code to binary. Are the gcc compilers used in the different ARM platforms (iOS, Android, Blackberry) the same compiler, except that ...
4
votes
3answers
801 views

Soundness of ARM disassembly

I'm interested in formal verification of software at binary code level. Obviously, the first step would be to recover the actual assembly instructions from binaries. IDAPro can do a pretty good job ...
4
votes
2answers
147 views

Disassemble ELF - PC is set to 0?

I tried to disassemble a ELF file which is a shared object file executed on armv7a (Android). I saw a strange block. It seems that the PC, program counter register, is set to 0. Did I miss something ...
4
votes
3answers
453 views

Help finding CPU/SOC on a board

I have some difficult to find CPU from a board. First I though that CPU/SOC was this one : All I know (about CPU) is that's an ARM core little-endian (because I begin reverse firmware in IDA) but I ...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
4
votes
2answers
788 views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
4
votes
1answer
857 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
4
votes
3answers
13k views

Decompile ARM native binary - IDA Pro detects file as Shared Object

I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as ELF for ARM (Shared object) Binary file If I choose ELF for ARM (Shared object), ...
4
votes
1answer
7k views

What do the following ARM instructions mean?

I have some ARMv7 instructions that I do not understand, despite reading the reference at: ARM Information Center In the context of: a7a4d8: b530 push {r4, r5, lr} a7a4da: 466c ...
4
votes
1answer
693 views

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

In IDA I would press Alt+G and set the T register to 1 to first the code to be Thumb, but in Ghidra am not not sure how to force it. The context is I have some functions pointed to by a data ...
4
votes
1answer
146 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
4
votes
1answer
786 views

ARM “add” instruction with shift

I'm trying to understand how ARM add with shift is implemented e.g. sym.imp.__libc_start_main : ...
4
votes
2answers
874 views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
4
votes
1answer
600 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
4
votes
1answer
237 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
3
votes
2answers
24k views

Difference between 'add' and 'adds' in ARM assembler?

I am starting to look a bit more precisely at ARM assembler and I looked up some dumps from objdump. I saw a lot of instruction (add is not the only one) with an extra s at the end (adds, subs, ...). ...
3
votes
2answers
685 views

What is the correct disassembly for ARM opcode E1F322D1?

I'm adapting the reko decompiler to use Capstone for its disassembler, instead of rolling my own. I'm using the .NET bindings provided by Capstone.NET. The strategy is to replace the old ARM ...
3
votes
3answers
692 views

Patching ARM7 code during runtime

How do I go about patching ARM7 binary code for an ELF Shared Object during run-time? To elaborate, I want to patch a specific routine during run-time for my own application. I tried googling to ...
3
votes
2answers
368 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
3
votes
3answers
1k views

Insert logging into existing binary code, ARM

I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.) Does ...
3
votes
2answers
538 views

ARM - Is calling function from external static library possible?

Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
3
votes
1answer
1k views

How do i make gnu as recognize all ARMV7 instructions?

I disassembled an android library with IDA, and want to do some extra steps at the end of one of the functions. Currently, the last instruction bytes are BD E8 F0 8F, in thumb mode, which IDA ...
3
votes
3answers
183 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...