Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
17 votes
1 answer
22k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
user avatar
  • 185
1 vote
1 answer
1k views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...
user avatar
  • 185
9 votes
3 answers
9k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
user avatar
  • 34.9k
1 vote
0 answers
571 views

Elf binary manipulation tool on ARM

Do you know any free tool for binary manipulation elf file on ARM, something like ERESI elfsh for Intel? Purpose - adding instructions into existing binary elf file.
user avatar
0 votes
1 answer
792 views

Creating basic pseudocode from ARM ASM

I'm trying to revers this section of code, but I don't get it fully. loc_2F2E0 VLDR D19, =210.0 MOVS R1, #0 VLDR D18, =190.0 MOVS R0, #0 VCMPE.F64 ...
user avatar
0 votes
1 answer
420 views

What does this extra argument for a VLDR instruction mean?

Working with ASM code, bit I don't understand what does is the difference between these lines? VLDR S0, [R5] VLDR S2, [R5,#4] What is the meaning of #4?
user avatar
1 vote
1 answer
120 views

Reverse engineering ARM PIC

I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code. This section is right before WHILE and right at the beginning of ...
user avatar
0 votes
2 answers
1k views

Add new subroutine using IDA for ARM binary

I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...
user avatar
  • 11
1 vote
1 answer
3k views

Saving .so file with IDA

I edited a ".so" file (which extracted from an APK) with IDA Pro, and now I am trying to save it with the same format. But it seems that I cannot find it. Could you please explain to me step by step ...
user avatar
1 vote
1 answer
5k views

ARM: understanding MSR/MRS instructions

While reversing a bootloader, i have a lot of msr/mrs instructions, but i cannot find in the arm documentation the meaning of the parameters. For example in IDA i have things like : MSR #...
user avatar
  • 13
0 votes
1 answer
621 views

How to patch file by adding a branch instruction to another address in arm

I have disassembled two armv7 files in IDA. I am trying to figure out how I can create a patch to change one to another. The original file has: __text:00017B60 loc_17B60 ; ...
user avatar
  • 11
1 vote
1 answer
2k views

Reverse a BFLT file

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open. I have obtained the file that is responsible for managing ...
user avatar
4 votes
1 answer
1k views

How to find the stack and other info in a memory dump? ARM

I'm reversing a closed platform to try gain execution using an exploit, a stack overflow. I've been told that (since there are no debuggers) the best way is to use RAM dumps (that I have) to try ...
user avatar
1 vote
1 answer
853 views

patch function in ARM binary to always return 0

I have an ARM binary in which I want to patch a function to always return 0. My understanding is this means I need to set r0 register to 0. The disassembly looks like this STMFD SP!, {R4-...
user avatar
  • 2,968
1 vote
1 answer
378 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
user avatar
1 vote
0 answers
270 views

Calculating branch in arm64

I stumbled across this question here Offset calculation for branch instruction in ARM After understanding all of that, i'm interested in knowing how i can do the same for ARM64/ARMv8 architecture?
user avatar
  • 25
2 votes
1 answer
417 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
user avatar
  • 123
4 votes
1 answer
304 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
user avatar
  • 123
2 votes
2 answers
917 views

ARM assembly: Strange instruction pattern (endless loop?)

I noticed a strange instruction pattern. First the value of PC is moved into LR and then a register value is moved into PC. Here some examples: .text:00001488 MOV LR, PC ....
user avatar
  • 1,446
4 votes
1 answer
1k views

Why does objdump show dot dot dot?

I have an (ARM) object file that I want to inspect. There are some instructions that load addresses pointing to another area in the object file. I would like to see the contents of the area, but ...
user avatar
1 vote
0 answers
286 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
user avatar
2 votes
1 answer
1k views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
user avatar
0 votes
1 answer
150 views

Understanding memory locations

I wrote a simple program on my STM32F4 Disco MCU which only turns a LED on, and I am trying to RE my compiled binary. After decompiling the binary, I started my analysis at the first instruction set ...
user avatar
  • 69
1 vote
1 answer
382 views

Nonsensical disassembled ARM instructions

I have been tracing through my binary and converting it to C code so I can understand it easily. As I am going through the instructions and functions, I keep stumbling upon code that don't make sense. ...
user avatar
  • 69
3 votes
1 answer
1k views

Understanding STM32L151's disassembled firmware

I have been sorting through disassembled code for a couple of days and I have a few questions. Note: This is my first reverse engineering side project and I apologize if these are rather newbie ...
user avatar
  • 69
2 votes
1 answer
664 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
user avatar
  • 87
1 vote
1 answer
1k views

Injected instructions hit `bad instruction` exception

In the following code, I injected my own instructions to modify third param of sprintf() function, but the process stopped at EXC_BAD_INSTRUCTION. Can anybody tell me what happened in my code? ...
user avatar
  • 113
0 votes
1 answer
824 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
user avatar
1 vote
1 answer
847 views

[ARM]How does this checksum code works and how to revert it in C?

I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation. ...
user avatar
0 votes
1 answer
530 views

Mach-O functions pointer

I'm trying to understand how Mach-O files work, i already succeed with parsing of load commands, sections, symbols table etc.. anyway i'm trying to figure out a way to find class methods pointer to ...
user avatar
3 votes
3 answers
3k views

Any Disassembler for iOS?

Is there any iOS app for arm Disassembling? I mean one that can run on iPhone. Nor IDA or Hopper have any iOS version
user avatar
1 vote
1 answer
10k views

IDA Pro. How to select ARM or THUMB mode when using "Make Code" command

How to select ARM or THUMB mode when using "Make Code" command? I have ARM binary and I want to specify ARM or THUMB code making manually in IDA, but how to do this?
user avatar
-1 votes
1 answer
3k views

How to convert assembly to C code [closed]

Is there an easy to convert assembly (ARM) to C code?
user avatar
  • 11
1 vote
1 answer
2k views

Offset Calculation for a Branch Instruction Thumb [closed]

I did find this link: Offset calculation for branch instruction in ARM Which was quite helpful but also confusing for me. I tried few ways to get it working with my offsets but failed. What I wanted ...
user avatar
  • 25
1 vote
1 answer
233 views

The questions about ADR.W instruction

When reversing a ARM firmware using IDA Pro, I find a instruction: ROM:080461FC 0F F2 24 30 ADR.W R0, aBt_test_mode ; "BT_TEST_MODE" ... ROM:08046524 aBt_test_mode DCB "...
user avatar
  • 381
1 vote
1 answer
1k views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
user avatar
  • 1,446
1 vote
0 answers
322 views

Unknown firmware header for ARM device [closed]

I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I ...
user avatar
3 votes
0 answers
344 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
user avatar
1 vote
0 answers
672 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
user avatar
  • 139
3 votes
1 answer
693 views

Identify targets of a switch table in ARM

I'm working on a disassembler for ARM Thumb2 (stripped) binaries. I can already recover the CFG of Basic Blocks (BB) that use direct jumps. My next goal is to handle indirect jumps. I'm currently ...
user avatar
  • 403
5 votes
1 answer
2k views

Obfuscated AES decryption assembly

I have recently been sifting my way through a whole load of assembly to try to identify how a program is decrypting some data. Thus far I have identified how the IV is extracted, that the IV is 16 ...
user avatar
  • 109
1 vote
1 answer
436 views

Adding/Finding Places for Instructions - Game Library IDA

Is there any way to add instructions to a library in IDA? My predicament is that there is no room in a game library (.so ELF, android) to fit my own code. There is an empty bss segment but IDA doesn't ...
user avatar
  • 41
1 vote
2 answers
413 views

Putting instructions in placeholder code IDA?

In IDA, is it possible to convert placeholder data into a code segment? In the end of the library I am working with, there is an uninitialized segment starting at 016AAB31. The hex and actual data (...
user avatar
  • 41
1 vote
1 answer
771 views

IDA Strings to Functions (ARM, Protected Functions)

I am working with an ARM (android apk: libgame.so) file that has protected functions (sub_xxxx, etc). The strings are supposed to have cross references with their function, but most of them reference ...
user avatar
  • 41
11 votes
2 answers
19k views

Decrypting IPA Binary on OS X

I've been reading this PDF on reverse-engineering iOS applications and have reached slide 39, decrypting the binary. However, I've been attempting to disassemble and explore the binary in OS X 10.9.5 ...
user avatar
1 vote
2 answers
22k views

How can I decompile an ARM Cortex-M0 .hex file to C++?

The source file is in intel 32 bit .hex format, it was built for a nuvoton NUC220LE3AE. I want to decompile it to C++, or at least assembly. I have some experience with assembly, but mostly with MIPS ...
user avatar
5 votes
2 answers
5k views

Reversing Hisense TV Firmware

I am looking for methods to get root on my Linux smart tv. Anyone have any ideas, in order to try extract the kernel config. Hisense is no help when asking for GPL source. I ran metasploit against it ...
user avatar
  • 159
1 vote
1 answer
391 views

ARM shellcode using r0 without null characters

I’m trying to write some basic ARM shell code that loads up the r0 register with 0. I cannot use null characters. I can see that subs r2, r2, r2 sets r2 to 0 without using any null bytes. However, ...
user avatar
1 vote
2 answers
2k views

Problem with IDA pro 6.8 disassemble galaxy s6 sboot

I have some problem with Galaxy S6 boot loader (sboot.bin). From 0x3F000 of that file, I think that there exists the real boot loader. So I tried to disassemble it with ida 6.8 pro (64bit) But It does ...
user avatar
  • 11
1 vote
1 answer
4k views

Opening mono droid .so files in .NET decompiler

What is the format for .so native android files developed in Xamarin Mono droid? From this SO post it appears they are actually .NET IL binaries (not native machine code). However, this other SO post ...
user avatar
  • 257

1
3 4
5
6 7