Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
10 votes
1 answer
9k views

Why is this ARM binary throwing an 'Illegal instruction' error and quitting?

Issue I'm hoping someone can help me determine why this binary won't execute. It is a closed-source, stripped ARM binary. That said, it is freely downloadable on the internet so there is a link to ...
user avatar
  • 103
3 votes
2 answers
249 views

ARM Thumb2 register usage

I am reversing ARM Thumb2 code. I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends. By the way, if ...
user avatar
  • 513
10 votes
1 answer
1k views

How to write [sp+local_variable] in radare2

Hello I'm playing with my native android library, everything was going smoothly till now. I have problem with opcodes, i don't know how to tell radare2 to write str opcode with specifc registry, and ...
user avatar
  • 258
0 votes
1 answer
707 views

how to understand branch arm instruction

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? . When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #...
user avatar
7 votes
2 answers
807 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
user avatar
1 vote
1 answer
220 views

Ldr arm thumb2 must be multiple of 4?

I saw here http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/CIHDGFEG.html that on arm thumb2 ldr must be multiple of 4. I run on arm thumb 2 and want run this instruction ldr r0, ...
user avatar
2 votes
2 answers
2k views

translate arm instructions to hex

I looking for simple tool(not site) to translate arm instruction to hex like http://armconverter.com/. Without linker , I want put 1 instruction , and want get the hex . Do you know one please?
user avatar
2 votes
1 answer
1k views

Determining endianness of PE files (Windows on ARM?)

For ELF files, there is a field near the start of the ELF header that indicates the endianness of the file:e_ident[EI_DATA]. If an application wants to extract data from the header of a given ELF ...
user avatar
0 votes
1 answer
403 views

Arm function save registers r0 and r1

I see arm 32 bits assembly code. Usually each function do push { r4-r9,lr} ( save 6 registers on stack ). And in the end of function pop them . I see function that save push {r0,r1,r4-r9,lr} but ...
user avatar
  • 29
0 votes
2 answers
138 views

Edit arm thumb2 intelhex file

I have intelhex file to arm 32 bits thumb 2. I want edit this file add/ change instructions. Looking for easy and free tool (prefer gui windows tool ) to do it please.
user avatar
0 votes
1 answer
754 views

How ida choose arm Thumb/Thumb2

I load binary file to ida and choose arm cpu. How can I see if ida choose on arm/arm Thumb2 / arm Thumb? and how can I change it? Bytes translate is depend witch arm is it(arm/arm Thumb2 / arm ...
user avatar
  • 41
3 votes
2 answers
885 views

Arm ldr diffrent between # and =

In ARM assembly, what is the difference between ldr r4, =0x44454433 and ldr r4, #0x44454433 ?
user avatar
  • 49
0 votes
1 answer
240 views

Help in the process arm disassembly

I have an ARM disassembly as follow, I would be happy if you can help me to understand what it does: ldr R14 ,=0X1234 ldr r10 , [r14 , #0x555] mov.w r15, #0x6666 add.w r10,r15,r10,lsl#15 I think ...
user avatar
1 vote
1 answer
1k views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
user avatar
  • 29
1 vote
2 answers
2k views

explain c compile code

I compile c code to arm with this site https://godbolt.org/ int F(int a, int b) { int c=0; for(int i=0;i<=10;i++) { c+=a+b; } return c; } the result was F(int, ...
user avatar
  • 29
0 votes
1 answer
236 views

Newbie here: hidden values in assembly? [closed]

So i'm new to the whole reverse engineering thing with only experience in C#. So I wanted to try and change the framerate of applications (eg. this unity game) at an assembly level on iOS ( I have an ...
user avatar
2 votes
3 answers
14k views

What is an immediate value?

I just read this post. What does mean an "immediate value" ? Is there any string/ascii there? How can I find this value on the binary file? I have the same code and when I search on 0x28 address I ...
user avatar
  • 41
4 votes
3 answers
18k views

How does the ldr instruction work on ARM?

ldr r0, #0x28 What is the ldr instruction ? Does it load a string from some offset? How can I find the string/value that is actually loaded ?
user avatar
  • 49
1 vote
1 answer
584 views

Undefined instruction in Go binary compiled for ARM

I'm reverse engineering an ARM binary written in Go, and the following code sequence occurs fairly often (from runtime.cgoIsGoPointer): BL runtime.panicindex DCD 0xF7FABCFD or, from runtime....
user avatar
2 votes
1 answer
1k views

Binary encryption

I'd like to ask your help to understand the algorithm used to encrypt these hex/bin firmware (for an ARM-Cortex M4 microcontroller). In the tar file above you can find different firmware versions. ...
user avatar
  • 43
2 votes
0 answers
1k views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
user avatar
  • 43
1 vote
1 answer
1k views

How to change a string in a arm 32bit lsb executable binary using radare2?

I have a arm 32bit lsb executable which prints "hello world" to the screen. How do I change the string to "Good bye" using radare2. I believe this will teach me the basics of RE and radare2. Thank ...
user avatar
0 votes
2 answers
3k views

How can i start the RE process in radare2?(make changes to the registers) [closed]

I'm an absolute newbie to reverse engineering. I have a 32bit lsb arm binary which I would like to reverse engineer using radare2. How should I begin ?
user avatar
2 votes
1 answer
366 views

Hex-Rays function signature does not match demangled name

From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
user avatar
1 vote
1 answer
222 views

ARM function start points look strange sometimes in IDA Pro

I am a little bit confused with this strange issue with ARM firmware. My original firmware file has no symbols, so I need to find them by myself trough the internet. But here I have a certain function ...
user avatar
2 votes
1 answer
4k views

Entry point for STM32 firmware

I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler). The values I try to figure ...
user avatar
  • 123
2 votes
1 answer
157 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
user avatar
  • 121
8 votes
2 answers
15k views

ARM64 syscalls table

I wonder if there some syscall table for Linux ARM64 architecture? I found syscall table for Linux ARM32 and many other architectures, but the problem still exists. Does anyone know where can I find ...
user avatar
2 votes
1 answer
4k views

Inject code into JNI function (Android shared library)

An android app loads a native library (.so) using System.loadLibrary. It then calls a specific function, which takes 3 input variables, and returns a string containing a MD5 hash. You can see the ...
user avatar
-1 votes
1 answer
1k views

DCD data in IDA disassmbed file

There is some DCD data in a disassembled binary using IDA as shown the image description. The binary is an ELF of ARM processor type. I want to know what are these data? Is it possible they be code ...
user avatar
0 votes
1 answer
801 views

ARM ELF Obfuscation [closed]

Metamorphic is a technique to obfuscate a binary and change the opcode sequence and create new samples with same functionality. In my case, I have some elf binary of ARM processor type and their ...
user avatar
4 votes
2 answers
1k views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
user avatar
  • 2,277
3 votes
2 answers
273 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
user avatar
  • 131
1 vote
0 answers
191 views

Why does IDA mark this as end of function?

I'm analyzing a .so file that is a part of an android application. I've stumbled upon this block of code: LOAD:0001B63C sub_1B63C ; CODE XREF: sub_1B628+Cp LOAD:...
user avatar
  • 231
0 votes
1 answer
912 views

Help with LDRD Instruction

According to documentation, the LDRD instruction works, as follows LDRD R8, R9, [R3, #0x20]; load r8 from a word 32 bytes above the address in R3, and load r9 from a word 36 bytes above the ...
user avatar
2 votes
4 answers
3k views

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA ...
user avatar
  • 233
1 vote
1 answer
2k views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
user avatar
1 vote
1 answer
540 views

Understanding ARM64 Obj-C Prolog

I'm trying to understand the differences between the following function prologs of a number of obj-c function decompilations. I know they store variables for the caller to use when the function ...
user avatar
  • 201
2 votes
1 answer
980 views

Unable to boot ARM disk image

I'd wish to reverse engineer the firmware of the Netgear R8300 - Nighthawk X8 AC5000 Smart WiFi Router / R8300 (available to download here). I was able to extract the contents of the image using ...
user avatar
  • 131
4 votes
2 answers
2k views

ARM "add" instruction with shift

I'm trying to understand how ARM add with shift is implemented e.g. sym.imp.__libc_start_main : ...
user avatar
  • 357
1 vote
1 answer
134 views

Strange bytes in interrupt table

I am currently learning ARM assembly by trying to reverse a broken printer. I retrieved the firmware from the on board NAND flash and I am now trying to make some sense of it. However, I get stuck at ...
user avatar
  • 46
6 votes
1 answer
4k views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
user avatar
2 votes
1 answer
2k views

How to find Xref to strings in proprietary binaries?

When I try to disassemble proprietary ARM binaries (no symbol), like Android phone's boot loaders, I find there are a bunch of strings that do not have any "Xrefs to" in IDA Pro. The image has ...
user avatar
0 votes
2 answers
267 views

How to revese engineer a self-modyfing binary

I am trying to hack a code in binary .so library. But, when I open .so library with IDA the library has only one function and no strings and there is bad_offset before every address. However, when I ...
user avatar
  • 1
4 votes
1 answer
593 views

How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?

Context and Background Information Part 1: ARM firmware compared to firmware for other architectures I looked at the ARM firmware in these two questions: Running a binary identified as an ARM ...
user avatar
  • 6,859
6 votes
3 answers
4k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
user avatar
4 votes
3 answers
607 views

Help finding CPU/SOC on a board

I have some difficult to find CPU from a board. First I though that CPU/SOC was this one : All I know (about CPU) is that's an ARM core little-endian (because I begin reverse firmware in IDA) but I ...
user avatar
2 votes
0 answers
252 views

Help identify missing component for jtag connection

I found JTAG header for ARM (OMAP3x). It's a Cortex 10-pin 0.05" JTAG/SWD Connector. (See here) I think it's JTAG because PIN#3 and 5 are on GND and it's close of CPU When I follow the wires, TCK, ...
user avatar
2 votes
2 answers
1k views

Can't extract machine code from Cortex-M3 firmware

I want to extract machine code from XBee DigiMesh firmware (Cortex-M3, EM357), so I have SREC file with 3 sections inside. I suppose that one of these sections is a code section, but arm-none-eabi-...
user avatar
4 votes
1 answer
1k views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...
user avatar

1 2 3
4
5
7