Hot answers tagged

34 votes
Accepted

Approach to extract useful information from binary file

General Prerequisites When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
  • 6,889
12 votes
Accepted

ARM64 syscalls table

arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
12 votes
Accepted

ARM bx instruction branches to address not specified as argument

Values around FFFFFFFF are used in Cortex-M for exception returns (ECX_RETURN). Currently defined values: 0xFFFFFFF1 - return to Handler mode, restore state from main stack 0xFFFFFFF9 - return to ...
  • 35.1k
11 votes
Accepted

How to detect thumb mode in ARM disassembly?

An ARM object file should contain symbols identifying the regions that are arm code ($a), thumb code ($t) and literal data ($d). You can see these as symbols #4 and #5 in your read-elf output. i.e. ...
  • 2,249
11 votes
Accepted

Decrypting IPA Binary on OS X

Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
  • 35.1k
11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
  • 35.1k
10 votes
Accepted

ARMv8 (AArch64, ARM64) opcodes list

This doc may be interesting for you: https://github.com/CAS-Atlantic/AArch64-Encoding
  • 236
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
  • 7,955
9 votes

ARM64 syscalls table

Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility. See arch/arm64/include/asm/...
  • 191
9 votes
Accepted

Find function in a stripped dynamic ELF library

There're two broad ways in which you can declare JNI functions. The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
  • 5,890
9 votes

Do I have to learn computer architecture for underestanding or doing reverse engineering?

A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer. That said - it depends on your target. If you are reverse engineering a Java application or a ...
  • 211
8 votes
Accepted

Why does vtable function pointers have +1?

If it is ARM architecture that may use THUMB encoding it can be result of the following issue: If I remember correctly, calls to the virtual functions can be executed with assembly command similar to ...
  • 7,955
8 votes
Accepted

getting function address by reading ADRP and ADD instruction values

For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction. 0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
  • 1,331
7 votes
Accepted

Replacing small length instruction with larger length instruction

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try: It's very likely you have a function or 2 in your text segment that are present in ...
7 votes
Accepted

What is the meaning of '!' in ldm arm assembler instruction?

The ! denotes writeback of the base register. Base register is the register used to address the memory to be read or written - in your case it's R4. Writeback means that the base register will be ...
  • 35.1k
7 votes
Accepted

Unable to boot ARM disk image

I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g ...
7 votes
Accepted

How to write [sp+local_variable] in radare2

So to make an order from the comments - you can do it by using two approaches. Use the original opcodes and write them using wx which stands for "write hex": wx e10b00f9 If you still want to use wa ...
  • 8,689
7 votes
Accepted

Disassemble ELF - PC is set to 0?

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In ...
  • 18.1k
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
6 votes
Accepted

How do i make gnu as recognize all ARMV7 instructions?

By default, as, uses the old 'divided' syntax for arm and thumb instructions. Hence it is not recognising your pop.w instruction. To make it work, add .syntax unified at the start of your program. ...
  • 2,249
6 votes

What is the correct disassembly for ARM opcode E1F322D1?

From http://bear.ces.cwru.edu/eecs_382/ARM7-TDMI-manual-pt2.pdf: E1F322D1 equals 11100001111100110010001011010001 in binary. Your question is specific to the offset, so we can examine the last dozen ...
6 votes
Accepted

IDA Pro. How to select ARM or THUMB mode when using "Make Code" command

When IDA first analyzes the binary, it detects which parts of the code are ARM, and which part are THUMB instructions. Then, it creates segments according to the analysis, and marks each segment as a "...
6 votes

Extracting a NAND flash dump with OOB data

I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip). upgtool can extract ...
6 votes
Accepted

Running a binary identified as an ARM excutable by binwalk --disasm

Obstacles One of the difficulties associated with analyzing firmware is that firmware binaries do not usually have a standard format and do not segregate code and data in a standard manner like ELF ...
  • 6,889
6 votes
Accepted

How does API call work on Android (NDK)?

To answer your question, let us first set a solid ground in terms of entities and definitions. ELF stands for "Executable and Linkable format". That is, it defines the structure and shape of two ...
  • 76
6 votes
Accepted

In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM

So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1. If you ...
6 votes

ARMv8 (AArch64, ARM64) opcodes list

Eureka! HERE IS THIS TABLE P.S. It's really hard to google it (keywords I used - "b arm64 opcode"), so I decided to post it as answer. Hope it'll be helpful for others.
6 votes

Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)

This is most likely code that was compiled without optimizations (-O0 ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code ...
  • 35.1k

Only top scored, non community-wiki answers of a minimum length are eligible