35
votes
Accepted
Approach to extract useful information from binary file
General Prerequisites
When analyzing binaries, it is important to be able to put what is observed into context. For example, how can CPU instructions be differentiated from data in a binary with a ...
- 7,058
13
votes
Accepted
ARM64 syscalls table
arm64 syscall numbers are defined at: https://github.com/torvalds/linux/blob/v4.17/include/uapi/asm-generic/unistd.h
This is a bit confusing since it is quite different from x86 and x86_64 and arm 32-...
12
votes
Accepted
ARM bx instruction branches to address not specified as argument
Values around FFFFFFFF are used in Cortex-M for exception returns
(ECX_RETURN). Currently defined values:
0xFFFFFFF1 - return to Handler mode, restore state from main stack
0xFFFFFFF9 - return to ...
- 36.2k
11
votes
Accepted
Decrypting IPA Binary on OS X
Currently you can't decrypt iOS apps without a device. The encryption keys are ultimately protected by an unknown key which is burned into the processor and cannot be extracted using software, that's ...
- 36.2k
11
votes
Accepted
Extracting a NAND flash dump with OOB data
So, I have figured it out myself in the end. I'll try to describe the process.
First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
- 36.2k
11
votes
Accepted
ARMv8 (AArch64, ARM64) opcodes list
This doc may be interesting for you:
https://github.com/CAS-Atlantic/AArch64-Encoding
- 246
10
votes
Accepted
Do I have to learn computer architecture for underestanding or doing reverse engineering?
The question is too broad, but I'll try to answer and hope that it will help.
It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to.
...
- 8,353
9
votes
Accepted
Why does vtable function pointers have +1?
If it is ARM architecture that may use THUMB encoding it can be result of the following issue:
If I remember correctly, calls to the virtual functions can be executed with assembly command similar to ...
- 8,353
9
votes
ARM64 syscalls table
Update: See this answer for up-to-date information on where ARM64 syscall definitions are found. Note that the information below may just be for backwards-compatibility.
See arch/arm64/include/asm/...
- 191
9
votes
Accepted
Find function in a stripped dynamic ELF library
There're two broad ways in which you can declare JNI functions.
The first is the more obvious way in which the JNI function has to follow a specific naming convention like JNIEXPORT void JNICALL ...
- 6,030
9
votes
Do I have to learn computer architecture for underestanding or doing reverse engineering?
A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer.
That said - it depends on your target. If you are reverse engineering a Java application or a ...
- 211
8
votes
Accepted
getting function address by reading ADRP and ADD instruction values
For the first instruction (0x90000008) it matches the opcode below for PC relative addressing instruction.
0x90000008 = 0b10010000000000000000000000001000 so we have op=1 (ADRP), immlo=0, immhi=0 and ...
- 1,331
7
votes
Accepted
Running a binary identified as an ARM excutable by binwalk --disasm
Obstacles
One of the difficulties associated with analyzing firmware is that firmware binaries do not usually have a standard format and do not segregate code and data in a standard manner like ELF ...
- 7,058
7
votes
Accepted
Unable to boot ARM disk image
I generally try to avoid booting the whole embedded OS when analyzing a target system. Instead, try to run a single target binary with qemu-system-arm -E PATH="/bin:/usr/bin" -E OTHERENVVARS=foo -g ...
7
votes
Accepted
How to write [sp+local_variable] in radare2
So to make an order from the comments - you can do it by using two approaches.
Use the original opcodes and write them using wx which stands for "write hex":
wx e10b00f9
If you still want to use wa ...
- 8,909
7
votes
Accepted
How to Modify this Branch in ARM64?
So, there are these options:
to always take the branch, you need to convert CBZ (compare and branch if zero) to simple B (branch always). Let's have a look at the encodings of both:
B:
31 30 ...
- 36.2k
7
votes
Accepted
Disassemble ELF - PC is set to 0?
In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime.
In ...
- 18.9k
7
votes
Accepted
How does API call work on Android (NDK)?
To answer your question, let us first set a solid ground in terms of entities and definitions.
ELF stands for "Executable and Linkable format".
That is, it defines the structure and shape of two ...
- 86
7
votes
ARMv8 (AArch64, ARM64) opcodes list
Eureka!
HERE IS THIS TABLE
P.S. It's really hard to google it (keywords I used - "b arm64 opcode"), so I decided to post it as answer. Hope it'll be helpful for others.
- 345
7
votes
What do these 2 Ghidra warnings mean?
From Ghidra.re:
Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable.
One reason for this is that there actually is a jump table, but ...
- 386
6
votes
What is the correct disassembly for ARM opcode E1F322D1?
From http://bear.ces.cwru.edu/eecs_382/ARM7-TDMI-manual-pt2.pdf:
E1F322D1 equals 11100001111100110010001011010001 in binary.
Your question is specific to the offset, so we can examine the last dozen ...
- 20.6k
6
votes
Accepted
IDA Pro. How to select ARM or THUMB mode when using "Make Code" command
When IDA first analyzes the binary, it detects which parts of the code are ARM, and which part are THUMB instructions. Then, it creates segments according to the analysis, and marks each segment as a "...
- 12.9k
6
votes
Extracting a NAND flash dump with OOB data
I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip).
upgtool can extract ...
- 226
6
votes
Accepted
In Ghidra what do I need to set so disassembler is in Thumb mode instead of ARM
So once in an architecture that has Thumb (ARMv7+) selecting the region of interest and pressing CTRL+R will bring up the Set Register Value editor, and selecting TMode and setting value 1.
If you ...
- 932
6
votes
Why use MOV R0, R3 and then MOV R3, R0 (thus back and forth)
This is most likely code that was compiled without optimizations (-O0 ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code ...
- 36.2k
5
votes
How can I decompile an ARM Cortex-M0 .hex file to C++?
Short answer: You can't.
At least, don't expect a readable, and compilable, C source code. There's discussion why elsewhere on this site, so i won't get into details.
Also, note there's not an easy ...
- 12.9k
5
votes
Reversing Hisense TV Firmware
My achievements.
I added to the startup telnetd, and ftpd.
I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve ...
- 51
5
votes
Accepted
Opening mono droid .so files in .NET decompiler
If you're looking at a "normal" mono droid application (compiled with something like Xamarin) then you'll see some of these structures in the APK/ZIP'
/assemblies/Sikur.Monodroid.dll
/assemblies/...
- 358
Only top scored, non community-wiki answers of a minimum length are eligible