Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1
vote
1answer
93 views

Reverse engineering ARM PIC

I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code. This section is right before WHILE and right at the beginning of ...
0
votes
2answers
809 views

Add new subroutine using IDA for ARM binary

I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...
1
vote
1answer
2k views

Saving .so file with IDA

I edited a ".so" file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it. Could you please explain to me step by step ...
0
votes
1answer
2k views

ARM: understanding MSR/MRS instructions

While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters. For example in IDA i have things like : MSR #...
0
votes
1answer
380 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...
0
votes
1answer
690 views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
4
votes
1answer
822 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
1answer
436 views

patch function in ARM binary to always return 0

I have an ARM binary in which I want to patch a function to always return 0. My understanding is this means I need to set r0 register to 0. The disassembly looks like this STMFD SP!, {R4-...
1
vote
1answer
274 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
1
vote
0answers
198 views

Calculating branch in arm64

I stumbled across this question here Offset calculation for branch instruction in ARM After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?
2
votes
1answer
212 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
4
votes
1answer
236 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
2
votes
2answers
592 views

ARM assembly: Strange instruction pattern (endless loop?)

I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC. Here some examples: .text:00001488 MOV LR, PC ....
0
votes
1answer
426 views

Why does objdump show dot dot dot?

I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
1
vote
0answers
233 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
2
votes
1answer
829 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
0
votes
1answer
114 views

Understanding memory locations

I wrote a simple program on my STM32F4 Disco MCU which only turns a LED on, and I am trying to RE my compiled binary. After decompiling the binary, I started my analysis at the first instruction set ...
1
vote
1answer
351 views

Nonsensical disassembled ARM instructions

I have been tracing through my binary and converting it to C code so I can understand it easily. As I am going through the instructions and functions, I keep stumbling upon code that don't make sense. ...
3
votes
1answer
908 views

Understanding STM32L151's disassembled firmware

I have been sorting through disassembled code for a couple of days and I have a few questions. Note: This is my first reverse engineering side project and I apologize if these are rather newbie ...
1
vote
1answer
570 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
1
vote
1answer
953 views

Injected instructions hit `bad instruction` exception

In the following code, I injected my own instructions to modify third param of sprintf() function, but the process stopped at EXC_BAD_INSTRUCTION. Can anybody tell me what happened in my code? ...
0
votes
1answer
537 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
1
vote
1answer
611 views

[ARM]How does this checksum code works and how to revert it in C?

I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation. ...
0
votes
1answer
360 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
2
votes
3answers
2k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
1
vote
1answer
7k views

IDA Pro. How to select ARM or THUMB mode when using “Make Code” command

How to select ARM or THUMB mode when using "Make Code" command? I have ARM binary and I want to specify ARM or THUMB code making manually in IDA, but how to do this?
-1
votes
1answer
2k views

How to convert assembly to C code [closed]

Is there an easy to convert assembly (ARM) to C code?
1
vote
1answer
1k views

Offset Calculation for a Branch Instruction Thumb [closed]

I did find this link: Offset calculation for branch instruction in ARM Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed. What I wanted ...
1
vote
1answer
200 views

The questions about ADR.W instruction

When reversing a ARM firmware using IDA Pro, I find a instruction: ROM:080461FC 0F F2 24 30 ADR.W R0, aBt_test_mode ; "BT_TEST_MODE" ... ROM:08046524 aBt_test_mode DCB "...
1
vote
1answer
578 views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
1
vote
0answers
233 views

Unknown firmware header for ARM device [closed]

I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I ...
3
votes
0answers
290 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
1
vote
0answers
486 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
2
votes
1answer
525 views

Identify targets of a switch table in ARM

I'm working on a disassembler for ARM Thumb2 (stripped) binaries. I can already recover the CFG of Basic Blocks (BB) that use direct jumps. My next goal is to handle indirect jumps. I'm currently ...
5
votes
1answer
1k views

Obfuscated AES decryption assembly

I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
1
vote
1answer
233 views

Adding/Finding Places for Instructions - Game Library IDA

Is there any way to add instructions to a library in IDA? My predicament is that there is no room in a game library (.so ELF, android) to fit my own code. There is an empty bss segment but IDA doesn't ...
1
vote
2answers
343 views

Putting instructions in placeholder code IDA?

In IDA, is it possible to convert placeholder data into a code segment? In the end of the library I am working with, there is an uninitialized segment starting at 016AAB31. The hex and actual data (...
1
vote
1answer
614 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
11
votes
2answers
12k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
1
vote
2answers
13k views

How can I decompile an ARM Cortex-M0 .hex file to C++?

The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS ...
4
votes
2answers
3k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
1
vote
1answer
288 views

ARM shellcode using r0 without null characters

I’m trying to write some basic ARM shell code that loads up the r0 register with 0. I cannot use null characters. I can see that subs r2, r2, r2 sets r2 to 0 without using any null bytes. However, ...
1
vote
2answers
2k views

Problem with IDA pro 6.8 disassemble galaxy s6 sboot

I have some problem with galaxy s6 boot loader(sboot.bin). From 0x3F000 of that file, I think that there exists the real boot loader. So I tried to disassemble it with ida 6.8 pro (64bit) But It ...
1
vote
1answer
3k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
1
vote
2answers
2k views

Android ARM64 kernel disassembly IDA pro64

I extracted Samsung Galaxy S6 kernel image from its stock boot.img. The result is a raw code kernel image. I load into IDA 6.8 (64-bit) using ROM Start: 0xffffffc000205000 size:0x18C020000, load ...
3
votes
2answers
522 views

ARM - Is calling function from external static library possible?

Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
1
vote
1answer
209 views

Dissassembly when you have partial source?

So, as you may know, many android bootloaders are based on the Little Kernel project on codeaurora, and as such one could say you have partial source to most android bootloaders, typically in the ...
1
vote
0answers
45 views

How to modify arm .so? [duplicate]

I want to modify android app writen on c++. It stores its code mostly in .so file. The code is compiled for arm architecture. When I open it in IDA it says that it can only read but modify. But I ...
3
votes
2answers
670 views

What is the correct disassembly for ARM opcode E1F322D1?

I'm adapting the reko decompiler to use Capstone for its disassembler, instead of rolling my own. I'm using the .NET bindings provided by Capstone.NET. The strategy is to replace the old ARM ...
1
vote
1answer
401 views

Specific byte purpose in header of little endian ARM binary

I have a little endian 32-bit ARM binary, compiled for a CPU that's running embedded Linux. I want to figure out what a specific byte in the binary means. An example hex view of the first few bytes of ...