Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
2
votes
2answers
757 views

Can't extract machine code from Cortex-M3 firmware

I want to extract machine code from XBee DigiMesh firmware (Cortex-M3, EM357), so I have SREC file with 3 sections inside. I suppose that one of these sections is a code section, but arm-none-eabi-...
4
votes
1answer
599 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
12
votes
1answer
15k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
1
vote
1answer
948 views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...
7
votes
3answers
5k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
1
vote
0answers
403 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
0
votes
1answer
589 views

Creating basic pseudocode from ARM ASM

I'm trying to revers this section of code, but I don't get it fully. loc_2F2E0 VLDR D19, =210.0 MOVS R1, #0 VLDR D18, =190.0 MOVS R0, #0 VCMPE.F64 ...
0
votes
1answer
272 views

What does this extra argument for a VLDR instruction mean?

Working with ASM code, bit I don't understand what does is the difference between these lines? VLDR S0, [R5] VLDR S2, [R5,#4] What is the meaning of #4?
1
vote
1answer
97 views

Reverse engineering ARM PIC

I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code. This section is right before WHILE and right at the beginning of ...
0
votes
2answers
858 views

Add new subroutine using IDA for ARM binary

I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...
1
vote
1answer
2k views

Saving .so file with IDA

I edited a ".so" file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it. Could you please explain to me step by step ...
0
votes
1answer
3k views

ARM: understanding MSR/MRS instructions

While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters. For example in IDA i have things like : MSR #...
0
votes
1answer
413 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...
0
votes
1answer
773 views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
4
votes
1answer
854 views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
1
vote
1answer
454 views

patch function in ARM binary to always return 0

I have an ARM binary in which I want to patch a function to always return 0. My understanding is this means I need to set r0 register to 0. The disassembly looks like this STMFD SP!, {R4-...
1
vote
1answer
278 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
1
vote
0answers
206 views

Calculating branch in arm64

I stumbled across this question here Offset calculation for branch instruction in ARM After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?
2
votes
1answer
221 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
4
votes
1answer
237 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
2
votes
2answers
622 views

ARM assembly: Strange instruction pattern (endless loop?)

I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC. Here some examples: .text:00001488 MOV LR, PC ....
0
votes
1answer
483 views

Why does objdump show dot dot dot?

I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
1
vote
0answers
242 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
2
votes
1answer
865 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
0
votes
1answer
115 views

Understanding memory locations

I wrote a simple program on my STM32F4 Disco MCU which only turns a LED on, and I am trying to RE my compiled binary. After decompiling the binary, I started my analysis at the first instruction set ...
1
vote
1answer
357 views

Nonsensical disassembled ARM instructions

I have been tracing through my binary and converting it to C code so I can understand it easily. As I am going through the instructions and functions, I keep stumbling upon code that don't make sense. ...
3
votes
1answer
956 views

Understanding STM32L151's disassembled firmware

I have been sorting through disassembled code for a couple of days and I have a few questions. Note: This is my first reverse engineering side project and I apologize if these are rather newbie ...
1
vote
1answer
582 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
1
vote
1answer
1k views

Injected instructions hit `bad instruction` exception

In the following code, I injected my own instructions to modify third param of sprintf() function, but the process stopped at EXC_BAD_INSTRUCTION. Can anybody tell me what happened in my code? ...
0
votes
1answer
583 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
1
vote
1answer
660 views

[ARM]How does this checksum code works and how to revert it in C?

I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation. ...
0
votes
1answer
380 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
2
votes
3answers
2k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
1
vote
1answer
7k views

IDA Pro. How to select ARM or THUMB mode when using “Make Code” command

How to select ARM or THUMB mode when using "Make Code" command? I have ARM binary and I want to specify ARM or THUMB code making manually in IDA, but how to do this?
-1
votes
1answer
2k views

How to convert assembly to C code [closed]

Is there an easy to convert assembly (ARM) to C code?
1
vote
1answer
1k views

Offset Calculation for a Branch Instruction Thumb [closed]

I did find this link: Offset calculation for branch instruction in ARM Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed. What I wanted ...
1
vote
1answer
202 views

The questions about ADR.W instruction

When reversing a ARM firmware using IDA Pro, I find a instruction: ROM:080461FC 0F F2 24 30 ADR.W R0, aBt_test_mode ; "BT_TEST_MODE" ... ROM:08046524 aBt_test_mode DCB "...
1
vote
1answer
586 views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
1
vote
0answers
242 views

Unknown firmware header for ARM device [closed]

I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I ...
3
votes
0answers
293 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
1
vote
0answers
507 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
3
votes
1answer
545 views

Identify targets of a switch table in ARM

I'm working on a disassembler for ARM Thumb2 (stripped) binaries. I can already recover the CFG of Basic Blocks (BB) that use direct jumps. My next goal is to handle indirect jumps. I'm currently ...
5
votes
1answer
1k views

Obfuscated AES decryption assembly

I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
1
vote
1answer
238 views

Adding/Finding Places for Instructions - Game Library IDA

Is there any way to add instructions to a library in IDA? My predicament is that there is no room in a game library (.so ELF, android) to fit my own code. There is an empty bss segment but IDA doesn't ...
1
vote
2answers
346 views

Putting instructions in placeholder code IDA?

In IDA, is it possible to convert placeholder data into a code segment? In the end of the library I am working with, there is an uninitialized segment starting at 016AAB31. The hex and actual data (...
1
vote
1answer
625 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
11
votes
2answers
13k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
1
vote
2answers
14k views

How can I decompile an ARM Cortex-M0 .hex file to C++?

The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS ...
4
votes
2answers
4k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
1
vote
1answer
290 views

ARM shellcode using r0 without null characters

I’m trying to write some basic ARM shell code that loads up the r0 register with 0. I cannot use null characters. I can see that subs r2, r2, r2 sets r2 to 0 without using any null bytes. However, ...