Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1
vote
1answer
226 views

How to detect whether stack or alternative memory access type in LDM/STM instruction?

I am attempting to disassemble some ARM machine code. The ARM Instruction Set defines the Block Data Transfer instructions (LDM and STM) as below, used for loading and storing to multiple registers at ...
1
vote
1answer
1k views

Breakpoints on ARM

Recently I read that breakpoints on ARM are enforced by either using BKPT instructions or by using instructions that are defined as invalid. Which method does gdb use? Do you know of any online ...
3
votes
1answer
1k views

Computing the length of a string in ARM

I was trying to reverse the following ARM code. mystery7 02 46 MOV R2, R0 08 B9 CBNZ R0, loc_100E1D8 00 20 MOVS R0, #0 70 47 BX LR loc_100E1D8 90 F9 00 30 ...
5
votes
2answers
6k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
5
votes
1answer
659 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
1
vote
1answer
343 views

ADC in ARM : What is the corresponding C?

I have the following 2 ARM instructions in a basic block which is part of a function that I'm trying to convert to C. ADDS r4, r2, r7 ADC r5, r3, r7, ASR#31 From my understanding, the first ...
2
votes
1answer
264 views

How to recognize the function call in a dynamic lib?

when I disassemble an OpenCV dynamic library file (libopencv_imgproc.so), I find that there are a lot of bl instructions which target address are in the .plt section. But, I could'n find its symbol ...
2
votes
1answer
1k views

Division on ARM [duplicate]

When performing division on ARM, this is the code snippet that I encountered. 0x83d8 <main+12>: mov r3, #10 0x83dc <main+16>: str r3, [r11, #-8] 0x83e0 <main+20>: ...
2
votes
2answers
427 views

Floating point registers on ARM

When I disassemble ARM code that deals with floating point values, how can I print out the registers? (I'm using Gdb). 0x000083d8 <+12>: ldr r3, [pc, #56] ; 0x8418 <main+76> ...
2
votes
2answers
343 views

Conditional instructions on ARM

I'm trying to understand the syntax of the IT instruction that is to be used to enable conditional execution of instructions on ARM, in Thumb2 mode. The way I understand it, the bits in the CPSR ...
3
votes
1answer
1k views

How do i make gnu as recognize all ARMV7 instructions?

I disassembled an android library with IDA, and want to do some extra steps at the end of one of the functions. Currently, the last instruction bytes are BD E8 F0 8F, in thumb mode, which IDA ...
3
votes
2answers
961 views

Patching a Mach-O Binary Header to remove a LC_SEGMENT

i have an ARMv7 Mach-O Executable on which I want to patch out a certain segment in the binary header which prevents DYLD injection. more information here under point 3. of preventing dyld injection....
0
votes
2answers
774 views

What is the correct disassembly for ARM7 opcode E1F120D1?

I'm writing a disassembler for ARM opcodes and I'm struggling with a particular encoding. The offending instruction is E1F120D1. I think I've followed the instructions closely, and expect the ...
4
votes
3answers
13k views

Decompile ARM native binary - IDA Pro detects file as Shared Object

I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as ELF for ARM (Shared object) Binary file If I choose ELF for ARM (Shared object), ...
0
votes
1answer
646 views

How to map a function argument to local variable?

Well, I've got an function that the pseudo code looks like: void d4l_auxadc_cali_unlocked_ioctl() { unsigned int v0; // r1@1 unsigned int v1; // r7@1 ... However, I am aware that the ...
3
votes
1answer
297 views

iOS Obfuscated Import Table

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back. When I open the binary in IDA I see this in the ...
4
votes
3answers
761 views

Soundness of ARM disassembly

I'm interested in formal verification of software at binary code level. Obviously, the first step would be to recover the actual assembly instructions from binaries. IDAPro can do a pretty good job ...
-2
votes
1answer
3k views

Reverse Engineering bootloader

I am in trouble with GearFit bootloader. I can not find the load address when disassembled into IDA pro..... Here is the link to download it.
1
vote
0answers
423 views

Static binary instrumentation tools for android .so libraries?

I'm trying to statically inject code into an android app. The best way would be to use APKStudio and the like, but there are very harsh restrictions on the device and the app itself, so that apk ...
2
votes
1answer
1k views

has anyone used PIN for ARM

While looking around for "PIN for ARM" I came across this. However, I don't seem to be able to locate it. Is it even made publicly available? Has anyone used this or anything similar?
1
vote
1answer
182 views

How do I map the std::_Ios_Openmode passed to basic_fstream to an actual value?

I am working on some ARM disassembly. A file is being operated on: 0000e550 sub r3, r11, #0x2d0 0000e554 mov r0, r3 ; /tmp/MAC 0000e558 ldr r1, = 0x9a60c ; 0xec04 (sub_e3a8 + 0x85c) ...
2
votes
2answers
319 views

Why does this ARM subroutine put a parameter into the stack frame and take it straight back out?

I have this small subroutine (from Hopper, but IDA is similar): sub_stringbegin: 000127b8 push {r11, lr} 000127bc add ...
1
vote
1answer
6k views

How to debug ARM binary with IDA pro on Windows?

I'm newbie, I have a little knowledge of debugging x86 binary. However, I have to work with ARM. I'm getting stuck on install QEMU and can't debug an ARM binary. Thank you a lot for give me tutorials ...
8
votes
2answers
9k views

How to detect thumb mode in ARM disassembly?

I try to build a small disassembler for ARM, and I would like to know how do objdump manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-...
0
votes
1answer
2k views

Semantics of the RRX shift instruction in ARM and Carry flag updates?

Still looking at ARM assembler semantics (and, I try hard to read the specification, I ensure you!!!). I have some doubts about the ARM bit-shift instructions in general and RRX in particular. Lets ...
2
votes
1answer
4k views

What is the meaning of '!' in ldm arm assembler instruction?

I am quite new to ARM assembly, I already saw that the bang (!) is used to really update a register after a computation in the addressing mode syntax, but I can't figure out what is the difference of ...
1
vote
0answers
588 views

crackme binary crashing on Raspberry pi

I was trying out a basic ARM crackme here. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is ...
2
votes
2answers
1k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
1
vote
1answer
967 views

IDA doesn't understand -0.0f (0x80000000)?

I'm relatively new to IDA. Recently I was disassembling an ARM binary that contains some signal processing routines. One of the data tables used by the routine is an array of floats, and one of those ...
5
votes
2answers
4k views

Where the pointer to virtual function table is located?

I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation. But now I see a VFT whose index ...
3
votes
3answers
1k views

Insert logging into existing binary code, ARM

I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.) Does ...
5
votes
1answer
1k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
4
votes
2answers
852 views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
2
votes
2answers
469 views

What is stored in the virtual function table? (Android NDK, GNU C++)

I see that the virtual method table (VMT, a.k.a. VFT) contains some odd values, e.g.: obj:0x123c1a8 [704] vmt:0x611f77f8 data: 0123c1a8 f8 77 1f 61 00 96 23 01 00 00 00 00 c4 e0 b4 5c 00 00 00 00 00 ...
3
votes
2answers
23k views

Difference between 'add' and 'adds' in ARM assembler?

I am starting to look a bit more precisely at ARM assembler and I looked up some dumps from objdump. I saw a lot of instruction (add is not the only one) with an extra s at the end (adds, subs, ...). ...
5
votes
1answer
4k views

ARM shellcode for linux - svc 0 vs svc 1

Checking out Linux ARM shellcode I see that the system call is made by using the svc 1 instruction. However, I have also seen examples where they use svc 0 as the instruction that calls the system ...
2
votes
1answer
3k views

Set breakpoint on shared library

I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
1
vote
1answer
727 views

Cannot find the caller of the main function in a disassembled firmware

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this: init() ...
3
votes
3answers
445 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
1
vote
2answers
1k views

what does the imediate value of the BKPT opcode is being used for?

Assembler syntax BKPT # where: See Standard assembler syntax fields on page A6-7. Specifies an 8-bit value that is stored in the instruction. This value is ignored by the ARM hardware, but can be ...
5
votes
1answer
3k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
3
votes
3answers
665 views

Patching ARM7 code during runtime

How do I go about patching ARM7 binary code for an ELF Shared Object during run-time? To elaborate, I want to patch a specific routine during run-time for my own application. I tried googling to ...
10
votes
3answers
17k views

How to decompile an Objective-C static library (for iOS)?

I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. I had no problem until I tried to display ...
6
votes
1answer
147 views

ARM debugging interesting behavior

I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:- 0x00008058 <+4>: mov r1, pc 0x0000805c <+8>...
2
votes
0answers
437 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
8
votes
1answer
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
4
votes
1answer
7k views

What do the following ARM instructions mean?

I have some ARMv7 instructions that I do not understand, despite reading the reference at: ARM Information Center In the context of: a7a4d8: b530 push {r4, r5, lr} a7a4da: 466c ...
7
votes
2answers
216 views

How do I determine the length of a routine on ARMv7?

I am disassembling and reverse engineering the logic of an assembly routine written in ARMv7 (hope I'm using the right terminology, as I'm a newbie for this particular processor). In doing so, I came ...
4
votes
2answers
410 views

Is the output of the gcc compilers the same for all ARM platforms?

Trying to understand how the code is converted in ARM platform from code to binary. Are the gcc compilers used in the different ARM platforms (iOS, Android, Blackberry) the same compiler, except that ...
9
votes
2answers
948 views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...