Questions tagged [arm]

A family of instruction set architectures based on a RISC architecture developed by British company ARM Holdings. Heavily used in embedded devices such as mobile phones, tablets, set-top boxes, ...

Filter by
Sorted by
Tagged with
1
vote
1answer
7k views

How to debug ARM binary with IDA pro on Windows?

I'm newbie, I have a little knowledge of debugging x86 binary. However, I have to work with ARM. I'm getting stuck on install QEMU and can't debug an ARM binary. Thank you a lot for give me tutorials ...
12
votes
3answers
12k views

How to detect thumb mode in ARM disassembly?

I try to build a small disassembler for ARM, and I would like to know how do objdump manage to sort out the normal mode instructions (32-bits instruction wide) from the thumb mode instructions (16-...
0
votes
1answer
2k views

Semantics of the RRX shift instruction in ARM and Carry flag updates?

Still looking at ARM assembler semantics (and, I try hard to read the specification, I ensure you!!!). I have some doubts about the ARM bit-shift instructions in general and RRX in particular. Lets ...
2
votes
1answer
6k views

What is the meaning of '!' in ldm arm assembler instruction?

I am quite new to ARM assembly, I already saw that the bang (!) is used to really update a register after a computation in the addressing mode syntax, but I can't figure out what is the difference of ...
1
vote
0answers
622 views

crackme binary crashing on Raspberry pi

I was trying out a basic ARM crackme here. Upon running it on my Raspberry pi, it segfaults without giving me any warning. Moreover, I'm unable to set breakpoints anywhere(even on the entry point). Is ...
1
vote
2answers
1k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
1
vote
1answer
1k views

IDA doesn't understand -0.0f (0x80000000)?

I'm relatively new to IDA. Recently I was disassembling an ARM binary that contains some signal processing routines. One of the data tables used by the routine is an array of floats, and one of those ...
4
votes
2answers
4k views

Where the pointer to virtual function table is located?

I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation. But now I see a VFT whose index ...
3
votes
3answers
2k views

Insert logging into existing binary code, ARM

I want to add logging to some function(s) in the shared (.so) library. (ARM, Android, a mix of Arm and Thumb modes; C++, some functions are virtual and therefore nameless, invoked via VFT.) Does ...
6
votes
1answer
2k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
5
votes
2answers
1k views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
2
votes
2answers
536 views

What is stored in the virtual function table? (Android NDK, GNU C++)

I see that the virtual method table (VMT, a.k.a. VFT) contains some odd values, e.g.: obj:0x123c1a8 [704] vmt:0x611f77f8 data: 0123c1a8 f8 77 1f 61 00 96 23 01 00 00 00 00 c4 e0 b4 5c 00 00 00 00 00 ...
3
votes
2answers
36k views

Difference between 'add' and 'adds' in ARM assembler?

I am starting to look a bit more precisely at ARM assembler and I looked up some dumps from objdump. I saw a lot of instruction (add is not the only one) with an extra s at the end (adds, subs, ...). ...
6
votes
1answer
5k views

ARM shellcode for linux - svc 0 vs svc 1

Checking out Linux ARM shellcode I see that the system call is made by using the svc 1 instruction. However, I have also seen examples where they use svc 0 as the instruction that calls the system ...
2
votes
1answer
4k views

Set breakpoint on shared library

I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
1
vote
1answer
782 views

Cannot find the caller of the main function in a disassembled firmware

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this: init() ...
3
votes
3answers
484 views

Need to extend the list of libraries that a shared (.so) library uses

I have a number of shared libraries calling each other (.so, ARM, Android), binary-only. I want to add logging to some functions, funcA(), ..., funcZ() defined in libsomething.so. The functions are ...
1
vote
2answers
1k views

what does the imediate value of the BKPT opcode is being used for?

Assembler syntax BKPT # where: See Standard assembler syntax fields on page A6-7. Specifies an 8-bit value that is stored in the instruction. This value is ignored by the ARM hardware, but can be ...
5
votes
1answer
4k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
3
votes
3answers
900 views

Patching ARM7 code during runtime

How do I go about patching ARM7 binary code for an ELF Shared Object during run-time? To elaborate, I want to patch a specific routine during run-time for my own application. I tried googling to ...
10
votes
3answers
20k views

How to decompile an Objective-C static library (for iOS)?

I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success. I had no problem until I tried to display ...
6
votes
1answer
156 views

ARM debugging interesting behavior

I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:- 0x00008058 <+4>: mov r1, pc 0x0000805c <+8>...
2
votes
0answers
450 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
8
votes
1answer
2k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
4
votes
1answer
8k views

What do the following ARM instructions mean?

I have some ARMv7 instructions that I do not understand, despite reading the reference at: ARM Information Center In the context of: a7a4d8: b530 push {r4, r5, lr} a7a4da: 466c ...
7
votes
2answers
245 views

How do I determine the length of a routine on ARMv7?

I am disassembling and reverse engineering the logic of an assembly routine written in ARMv7 (hope I'm using the right terminology, as I'm a newbie for this particular processor). In doing so, I came ...
4
votes
2answers
449 views

Is the output of the gcc compilers the same for all ARM platforms?

Trying to understand how the code is converted in ARM platform from code to binary. Are the gcc compilers used in the different ARM platforms (iOS, Android, Blackberry) the same compiler, except that ...
9
votes
2answers
1k views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
12
votes
3answers
10k views

Locating Linux Kernel Symbols on ARM

Igor posted a great answer previously on SO about the format of the Linux kernel image on ARM. Assuming I can't boot my kernel image, can someone give me pointers on finding this compressed symbol ...
9
votes
3answers
7k views

Are there any ARM disassemblers that provide structured output?

Are there any ARM (or other non-x86) disassemblers that decompose an instruction into its component parts in a machine-friendly structure? Ideally it would be something like XED or distorm3, which ...
29
votes
2answers
9k views

Why are machine code decompilers less capable than for example those for the CLR and JVM?

Java and .NET decompilers can (usually) produce an almost perfect source code, often very close to the original. Why can't the same be done for the native code? I tried a few but they either don't ...

1 2 3 4 5
6