Hot answers tagged

12

Values around FFFFFFFF are used in Cortex-M for exception returns (ECX_RETURN). Currently defined values: 0xFFFFFFF1 - return to Handler mode, restore state from main stack 0xFFFFFFF9 - return to Thread mode, restore state from main stack 0xFFFFFFFD - return to Thread mode, restore state from process stack So the actual branch address is taken from the ...


6

This is most likely code that was compiled without optimizations (-O0 ). In such code redundant operations are very common as the compiler faithfully translates individual statements to machine code but does not try to perform optimizations to remove or simplify redundant ones.


5

you can right click the file you import at Active Project tab in ghidra main window, and select Set Language


5

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


4

This is function dflt (or __aeabi_i2d) from the ARM compiler libraries. It performs a conversion of a 32-bit signed integer in R0 into a a soft-float double (64-bit floating point value) in R0:R1. An IEEE 754 double consists of a sign bit, 11-bit exponent and 52-bit fraction: 63 62 52 51 0 +------------...


4

This general pattern of exclusive-access instructions is usually seen when atomic variables are modified. C++ Example (C++11 or later) #include <atomic> void release( std::atomic<int>& refcount ) { refcount--; } You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code. C Example (C11) #...


4

code does mean that something is interpreted as code to execute (most likely a function) But more can be recovered from this snippet than just that something is executed: Step 1: (**(code **)(*plVar5 + 0x10)) This is most likely a C++ vtable call. plVar5 should be some variable containing a C++ object, or rather a pointer that should be interpreted as a ...


3

This is probably because *ledTimer is volatile. Here's a short bit of code that produces a similar result: int main() { volatile unsigned short *ledTimer{(unsigned short *)0x14f36}; for (--(*ledTimer); *ledTimer; --(*ledTimer)); } Now compile with gcc 8.3.1 with -march=armv7 -O1 and we get something that starts to resemble what you've listed: main: ...


3

This sounds analogous to given a document, infer the language. I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for known processor types. Effectively a unigram model. If you source the files in a common format I can give you a hand.


2

There are several ways to show the different functions of a binary file in radare2. Start by opening the binary file and analyze it. $ r2 -A libdbm64.so Command: afl The simplest way to list the functions, is the afl command which stands for analysis function list. The command will list all the functions in the binary and print it with four columns: ...


2

In your Ubuntu terminal, go to the directory where the file is located and type this: objdump -M intel -D name-of-file | grep -A20 main.: (assuming you want intel assembly since it's easier to read but if not, remove "-M intel" from the command above.) This should show you the first twenty lines of your main function. objdump should skip a line after a ...


2

There's a few other options can help you narrow down the specific architecture / core / SoC. Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains. Look at disassembly to identify the offsets of key memory regions (code, data, flash etc) Similarly, SoCs tend to have memory mapped peripherals. Identifying what's being accessed here ...


2

While ARMv7-A does include the Thumb-2 subset used in ARMv7-M, the actually used instructions in ARMv7-A binaries will likely be pretty different from those used in ARMv7-M microcontrollers. For one example, microcontrollers rarely use NEON floating-point or vector instructions from ARMv7-A (Cortex-M4F has FPU but IIRC it’s single precision only). Conversely,...


2

You can't - the Intel hex format doesn't hold this kind of data. You need to manually look for the correct architecture. You can use IDA or Ghidra for that and open in the following for each architecture it might be. Then you need to disassemble the whole file and look if it makes sense. (Control flow, number of functions, xrefs,...) Or of course, use some ...


2

Seems like you've already figured this out, but this is a Ghidra markup. It can be enabled/disabled via Edit -> Tool Options -> Listing Fields -> Operands Field -> Always Show Primary Reference Here's what the help says about the option: Always Show Primary Reference - Option to force the display of the primary reference on all operands.  If a ...


2

This is not really related to reverse engineering and might be a better fit for another StackExchange site. That said, I would look into using the x86/x86_64 QEMU with USB passthrough in full-system mode. Basically it will be running a small x86 virtual machine with that driver loaded and passing the USB device directly through to the VM. Then you can set ...


2

Usually all the grounds on the PCB are connected together, so look for something like a metal shield, USB connector housing, or any other element that should be connected to ground (e.g. a capacitor). There may also be big copper areas used for the ground plane.


1

Is your binary relocated on load (ASLR)? In that case 14608 points to some random memory (probably unallocated). You need to use a position-independent instruction to load the address of the dlopen stub (e.g. ADRL).


1

Your translation is wrong. The two BIC instructions clear the 13 low bits of the stack pointer (1FC0|3F = 1FFF). In kernel mode, this produces a pointer to the thread_info structure for the current thread. The ldr then reads the field at offset 8 in it which seems to be addr_limit and r3+1 apparently should not exceed it. Combined, the code matches this ...


1

when I set a breakpoint at say 0x010451 It's critical to first understand that there is actually no such valid address for an instruction. On an ARM processor, instructions are always aligned to their width - 16 bit thumb instructions are aligned to 16 bits, 32 bit ARM instructions are aligned to 32 bits, etc. Rather, such values that are not actually ...


1

You are on the right lines with integer division. The first 3 instructions are reasonably clear - R2 after UMULL is the result of an integer division by 1.875 (= 0x100000000 / 0x88888889) the following MOV is then a further integer divide by 8 resulting in R2 now containing the original R3 divided by 15 (= 1.875 * 8) the first RSB is then a multiplication ...


1

No, TCK doesn’t have to match the CPU clock. In fact its usual speed is in kilohertz, not megahertz. However, you likely won’t see it in the oscilloscope or logic analyzer because it is driven by the JTAG probe and not the CPU. Discovering the JTAG pins requires active probing using something like JTAGulator, you are unlikely to find it via passive ...


1

Binwalk has this feature but you need to enable it explicitly: -A, --opcodes Scan target file(s) for common executable opcode signatures A project which explicitly tries to determine an architecture of a given binary is cpu_rec from Airbus. Please note that both solutions can only handle a small set of processors: binwalk has a short list of ...


1

In ARM the syscalls are either Supervisor call or Software interrupt. You can just search->text in IDA for: SVC 0x SWI 0x


1

In order to view the assembly from any function of a compiled binary you will need a disassembler. There are many disassemblers that can be used for this function including: IDA Pro (Commercial) Ghidra (Open Source) Radare2 (Open Source) To use these tools you will usually just load the binary into the software and it will present you with the assembly ...


1

It is proposed in the official document of arm When s = 1 and RD = R15 (PC), this instruction is used to save the status register CPSR, not to do calculation


Only top voted, non community-wiki answers of a minimum length are eligible