Skip to main content
35 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
julian's user avatar
  • 7,158
13 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
Ciro Santilli OurBigBook.com's user avatar
12 votes
Accepted

ARM bx instruction branches to address not specified as argument

Values around FFFFFFFF are used in Cortex-M for exception returns (ECX_RETURN). Currently defined values: 0xFFFFFFF1 - return to Handler mode, restore state from main stack 0xFFFFFFF9 - return to ...
Igor Skochinsky's user avatar
  • 36.7k
11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
Igor Skochinsky's user avatar
  • 36.7k
11 votes
Accepted

ARMv8 (AArch64, ARM64) opcodes list

This doc may be interesting for you: https://github.com/CAS-Atlantic/AArch64-Encoding
Axifive's user avatar
  • 246
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
w s's user avatar
  • 8,508
9 votes
Accepted

Why does vtable function pointers have +1?

If it is ARM architecture that may use THUMB encoding it can be result of the following issue: If I remember correctly, calls to the virtual functions can be executed with assembly command similar to ...
w s's user avatar
  • 8,508
9 votes

ARM64 syscalls table

Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility. See arch/arm64/include/asm/...
tonysdg's user avatar
  • 191
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
0xec's user avatar
  • 6,090
9 votes

Do I have to learn computer architecture for underestanding or doing reverse engineering?

A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer. That said - it depends on your target. If you are reverse engineering a Java application or a ...
h0r53's user avatar
  • 223
8 votes
Accepted

getting function address by reading ADRP and ADD instruction values

For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction. 0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
cimarron's user avatar
  • 1,341
7 votes
Accepted

Running a binary identified as an ARM excutable by binwalk --disasm

Obstacles One of the difficulties associated with analyzing firmware is that firmware binaries do not usually have a standard format and do not segregate code and data in a standard manner like ELF ...
julian's user avatar
  • 7,158
7 votes
Accepted

Unable to boot ARM disk image

I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g ...
Joshua Wright's user avatar
7 votes
Accepted

How to write [sp+local_variable] in radare2

So to make an order from the comments - you can do it by using two approaches. Use the original opcodes and write them using wx which stands for "write hex": wx e10b00f9 If you still want to use wa ...
Megabeets's user avatar
  • 8,999
7 votes
Accepted

How to Modify this Branch in ARM64?

So, there are these options: to always take the branch, you need to convert CBZ (compare and branch if zero) to simple B (branch always). Let's have a look at the encodings of both: B: 31 30 ...
Igor Skochinsky's user avatar
  • 36.7k
7 votes
Accepted

Disassemble ELF - PC is set to 0?

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In ...
perror's user avatar
  • 19.1k
7 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
Lero's user avatar
  • 86
7 votes

ARMv8 (AArch64, ARM64) opcodes list

Eureka! HERE IS THIS TABLE P.S. It's really hard to google it (keywords I used - "b arm64 opcode"), so I decided to post it as answer. Hope it'll be helpful for others.
Olvin Roght's user avatar
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
Shane Reilly's user avatar
6 votes
Accepted

IDA Pro. How to select ARM or THUMB mode when using "Make Code" command

When IDA first analyzes the binary, it detects which parts of the code are ARM, and which part are THUMB instructions. Then, it creates segments according to the analysis, and marks each segment as a "...
Guntram Blohm's user avatar
6 votes

Extracting a NAND flash dump with OOB data

I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip). upgtool can extract ...
Amaury Pouly's user avatar
6 votes
Accepted

how should i change an instruction to NOP in IDA?

NOTE: I'm assuming you're using IDA 7.X, although this should work equally well for 6.X versions. The option you're looking for is called Patch Program. For your specific question, you'd do the ...
hairlessbear's user avatar
6 votes
Accepted

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you ...
Simeon Pilgrim's user avatar
6 votes

Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)

This is most likely code that was compiled without optimizations (-O0 ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code ...
Igor Skochinsky's user avatar
  • 36.7k
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
w s's user avatar
  • 8,508
5 votes
Accepted

Stepping through ARM firmware image

You can debug and even step the execution with the following ways: Emulating a code snippet. You can find the detailed steps of code snippet emulation with QEMU in hexblog. In this approach you have ...
ebux's user avatar
  • 1,759
5 votes

Reversing Hisense TV Firmware

My achievements. I added to the startup telnetd, and ftpd. I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
hawkeye's user avatar
  • 51
5 votes
Accepted

Help finding CPU/SOC on a board

On this photo you can see there are two "layers" in this chip separated by a matrix of solder balls. This is package on package — a method used to save board space. The actual processor is hidden ...
Vladislav Ivanov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible