Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1
vote
0answers
385 views

Patching an ipa (iPhone app) using Hopper Disassembler

I have learned in the past to patch some iOS apps to bypass jailbreak detection. Today, I decided to change the UI elements in the Spotify app on iOS Platform (ios 11). I downloaded a .ipa file of ...
-1
votes
1answer
134 views

Which ARM command is influencing the SP position?

I do static analysis of ARM assembly code (I can't debug it). When I look on argument that in SP+0x<SomeOffset> I can find what I'm looking for, but if I look a few lines further down I see ...
1
vote
1answer
83 views

Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

I have a .so from an Android JNI/NDK application. Here are two of its sections: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [10] .rel.plt REL ...
2
votes
2answers
954 views

How can I make sense of an Android NDK library?

So I'm currently trying to understand how an Android app interprets the data sent from a Bluetooth-enabled scale. Understanding the Java code was relatively easy. The code was obfuscated but I found ...
8
votes
1answer
4k views

Why is this ARM binary throwing an 'Illegal instruction' error and quitting?

Issue I'm hoping someone can help me determine why this binary won't execute. It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to ...
3
votes
2answers
139 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
10
votes
1answer
679 views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
0
votes
1answer
336 views

how to understand branch arm instruction

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? . When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
6
votes
2answers
517 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
0
votes
1answer
56 views

Ldr arm thumb2 must be multiple of 4?

I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4. I run on arm thumb 2 and want run this instruction ldr r0, ...
-1
votes
2answers
604 views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
1
vote
1answer
537 views

Determining endianness of PE files (Windows on ARM?)

For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
0
votes
1answer
205 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
-1
votes
2answers
49 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
0
votes
1answer
407 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
3
votes
2answers
368 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
0
votes
1answer
454 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
0
votes
2answers
661 views

explain c compile code

I compile c code to arm with this site https://godbolt.org/ int F(int a, int b) { int c=0; for(int i=0;i<=10;i++) { c+=a+b; } return c; } the result was F(int, ...
0
votes
1answer
113 views

Newbie here: hidden values in assembly? [closed]

So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
0
votes
3answers
5k views

What is an immediate value?

I just read this post. What does mean an "immediate value" ? Is there any string/ascii there? How can I find this value on the binary file? I have the same code and when I search on 0x28 address I ...
2
votes
3answers
4k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What does thw ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
1
vote
1answer
363 views

Undefined instruction in Go binary compiled for ARM

I'm reverse engineering an ARM binary written in Go, and the following code sequence occurs fairly often (from runtime.cgoIsGoPointer): BL runtime.panicindex DCD 0xF7FABCFD or, from runtime....
1
vote
1answer
458 views

Binary encryption

I'd like to ask your help to understand the algorithm used to encrypt these hex/bin firmware (for an ARM-Cortex M4 microcontroller). In the tar file above you can find different firmware versions. ...
2
votes
0answers
978 views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
1
vote
1answer
529 views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
0
votes
2answers
1k views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
2
votes
1answer
313 views

Hex-Rays function signature does not match demangled name

From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
1
vote
1answer
147 views

ARM function start points look strange sometimes in IDA Pro

I am a little bit confused with this strange issue with ARM firmware. My original firmware file has no symbols, so I need to find them by myself trough the internet. But here I have a certain function ...
2
votes
1answer
2k views

Entry point for STM32 firmware

I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler). The values I try to figure ...
2
votes
1answer
105 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
7
votes
2answers
4k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
2
votes
1answer
3k views

Inject code into JNI function (Android shared library)

An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash. You can see the ...
0
votes
1answer
540 views

DCD data in IDA disassmbed file

There is some DCD data in a disassembled binary using IDA as shown the image description. The binary is an ELF of ARM processor type. I want to know what are these data? Is it possible they be code ...
0
votes
1answer
470 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
4
votes
2answers
788 views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
3
votes
1answer
158 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
1
vote
0answers
126 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
0
votes
1answer
379 views

Help with LDRD Instruction

According to documentation, the LDRD instruction works, as follows LDRD R8, R9, [R3, #0x20]; load r8 from a word 32 bytes above the address in R3, and load r9 from a word 36 bytes above the ...
2
votes
4answers
1k views

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA ...
1
vote
1answer
1k views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
1
vote
1answer
278 views

Understanding ARM64 Obj-C Prolog

I'm trying to understand the differences between the following function prologs of a number of obj-c function decompilations. I know they store variables for the caller to use when the function ...
2
votes
1answer
774 views

Unable to boot ARM disk image

I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here). I was able to extract the contents of the image using ...
4
votes
1answer
786 views

ARM “add” instruction with shift

I'm trying to understand how ARM add with shift is implemented e.g. sym.imp.__libc_start_main : ...
1
vote
1answer
106 views

Strange bytes in interrupt table

I am currently learning ARM assembly by trying to reverse a broken printer. I retrieved the firmware from the on board NAND flash and I am now trying to make some sense of it. However, I get stuck at ...
5
votes
1answer
2k views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
2
votes
1answer
543 views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
0
votes
2answers
238 views

How to revese engineer a self-modyfing binary

I am trying to hack a code in binary .so library. But, when I open .so library with IDA the library has only one function and no strings and there is bad_offset before every address. However, when I ...
3
votes
1answer
346 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
5
votes
3answers
2k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
4
votes
3answers
453 views

Help finding CPU/SOC on a board

I have some difficult to find CPU from a board. First I though that CPU/SOC was this one : All I know (about CPU) is that's an ARM core little-endian (because I begin reverse firmware in IDA) but I ...