Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1
vote
2answers
20k views

How can I decompile an ARM Cortex-M0 .hex file to C++?

The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS ...
1
vote
1answer
1k views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...
1
vote
0answers
523 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
0
votes
1answer
735 views

Creating basic pseudocode from ARM ASM

I'm trying to revers this section of code, but I don't get it fully. loc_2F2E0 VLDR D19, =210.0 MOVS R1, #0 VLDR D18, =190.0 MOVS R0, #0 VCMPE.F64 ...
0
votes
1answer
345 views

What does this extra argument for a VLDR instruction mean?

Working with ASM code, bit I don't understand what does is the difference between these lines? VLDR S0, [R5] VLDR S2, [R5,#4] What is the meaning of #4?
1
vote
1answer
108 views

Reverse engineering ARM PIC

I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code. This section is right before WHILE and right at the beginning of ...
0
votes
1answer
4k views

ARM: understanding MSR/MRS instructions

While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters. For example in IDA i have things like : MSR #...
1
vote
1answer
349 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
0
votes
1answer
1k views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
4
votes
1answer
1k views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
0
votes
1answer
707 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
1
vote
1answer
682 views

patch function in ARM binary to always return 0

I have an ARM binary in which I want to patch a function to always return 0. My understanding is this means I need to set r0 register to 0. The disassembly looks like this STMFD SP!, {R4-...
3
votes
3answers
3k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
1
vote
0answers
245 views

Calculating branch in arm64

I stumbled across this question here Offset calculation for branch instruction in ARM After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?
-2
votes
1answer
4k views

Reverse Engineering bootloader

I am in trouble with GearFit bootloader. I can not find the load address when disassembled into IDA pro..... Here is the link to download it.
10
votes
3answers
20k views

How to decompile an Objective-C static library (for iOS)?

I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. I had no problem until I tried to display ...
3
votes
1answer
325 views

iOS Obfuscated Import Table

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back. When I open the binary in IDA I see this in the ...
2
votes
1answer
633 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
2
votes
1answer
351 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
2
votes
2answers
347 views

Why does this ARM subroutine put a parameter into the stack frame and take it straight back out?

I have this small subroutine (from Hopper, but IDA is similar): sub_stringbegin: 000127b8 push {r11, lr} 000127bc add ...
2
votes
2answers
826 views

ARM assembly: Strange instruction pattern (endless loop?)

I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC. Here some examples: .text:00001488 MOV LR, PC ....
3
votes
1answer
925 views

Why does objdump show dot dot dot?

I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
1
vote
0answers
264 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
2
votes
1answer
1k views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
1
vote
2answers
2k views

Android ARM64 kernel disassembly IDA pro64

I extracted Samsung Galaxy S6 kernel image from its stock boot.img. The result is a raw code kernel image. I load into IDA 6.8 (64-bit) using ROM Start: 0xffffffc000205000 size:0x18C020000, load ...
0
votes
1answer
493 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
0
votes
1answer
143 views

Understanding memory locations

I wrote a simple program on my STM32F4 Disco MCU which only turns a LED on, and I am trying to RE my compiled binary. After decompiling the binary, I started my analysis at the first instruction set ...
1
vote
1answer
374 views

Nonsensical disassembled ARM instructions

I have been tracing through my binary and converting it to C code so I can understand it easily. As I am going through the instructions and functions, I keep stumbling upon code that don't make sense. ...
3
votes
1answer
1k views

Understanding STM32L151's disassembled firmware

I have been sorting through disassembled code for a couple of days and I have a few questions. Note: This is my first reverse engineering side project and I apologize if these are rather newbie ...
1
vote
1answer
1k views

Injected instructions hit `bad instruction` exception

In the following code, I injected my own instructions to modify third param of sprintf() function, but the process stopped at EXC_BAD_INSTRUCTION. Can anybody tell me what happened in my code? ...
3
votes
0answers
318 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
4
votes
2answers
5k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
1
vote
1answer
10k views

IDA Pro. How to select ARM or THUMB mode when using "Make Code" command

How to select ARM or THUMB mode when using "Make Code" command? I have ARM binary and I want to specify ARM or THUMB code making manually in IDA, but how to do this?
-1
votes
1answer
3k views

How to convert assembly to C code [closed]

Is there an easy to convert assembly (ARM) to C code?
1
vote
0answers
307 views

Unknown firmware header for ARM device [closed]

I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I ...
1
vote
1answer
228 views

The questions about ADR.W instruction

When reversing a ARM firmware using IDA Pro, I find a instruction: ROM:080461FC 0F F2 24 30 ADR.W R0, aBt_test_mode ; "BT_TEST_MODE" ... ROM:08046524 aBt_test_mode DCB "...
1
vote
1answer
870 views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
5
votes
2answers
594 views

ARM - Is calling function from external static library possible?

Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
9
votes
3answers
7k views

Are there any ARM disassemblers that provide structured output?

Are there any ARM (or other non-x86) disassemblers that decompose an instruction into its component parts in a machine-friendly structure? Ideally it would be something like XED or distorm3, which ...
1
vote
0answers
593 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
3
votes
1answer
664 views

Identify targets of a switch table in ARM

I'm working on a disassembler for ARM Thumb2 (stripped) binaries. I can already recover the CFG of Basic Blocks (BB) that use direct jumps. My next goal is to handle indirect jumps. I'm currently ...
5
votes
1answer
1k views

Obfuscated AES decryption assembly

I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
1
vote
1answer
384 views

Adding/Finding Places for Instructions - Game Library IDA

Is there any way to add instructions to a library in IDA? My predicament is that there is no room in a game library (.so ELF, android) to fit my own code. There is an empty bss segment but IDA doesn't ...
1
vote
1answer
734 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
1
vote
1answer
345 views

ARM shellcode using r0 without null characters

I’m trying to write some basic ARM shell code that loads up the r0 register with 0. I cannot use null characters. I can see that subs r2, r2, r2 sets r2 to 0 without using any null bytes. However, ...
1
vote
1answer
4k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
2
votes
1answer
254 views

Dissassembly when you have partial source?

So, as you may know, many android bootloaders are based on the Little Kernel project on codeaurora, and as such one could say you have partial source to most android bootloaders, typically in the ...
1
vote
0answers
65 views

How to modify arm .so? [duplicate]

I want to modify android app writen on c++. It stores its code mostly in .so file. The code is compiled for arm architecture. When I open it in IDA it says that it can only read but modify. But I ...
3
votes
2answers
754 views

What is the correct disassembly for ARM opcode E1F322D1?

I'm adapting the reko decompiler to use Capstone for its disassembler, instead of rolling my own. I'm using the .NET bindings provided by Capstone.NET. The strategy is to replace the old ARM ...
1
vote
1answer
510 views

Specific byte purpose in header of little endian ARM binary

I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of ...