11 votes
Accepted

ARMv8 (AArch64, ARM64) opcodes list

This doc may be interesting for you: https://github.com/CAS-Atlantic/AArch64-Encoding
Axifive's user avatar
  • 246
7 votes

ARMv8 (AArch64, ARM64) opcodes list

Eureka! HERE IS THIS TABLE P.S. It's really hard to google it (keywords I used - "b arm64 opcode"), so I decided to post it as answer. Hope it'll be helpful for others.
Olvin Roght's user avatar
5 votes

ARMv8 (AArch64, ARM64) opcodes list

The canonical source is the ARM Architecture Reference Manual. If you prefer machine readable format, the XML files are available too.
Igor Skochinsky's user avatar
  • 36.6k
5 votes
Accepted

How Does ARM64 EOR with Shift Work?

It's the 2nd operand (i.e. w8 in your example) that is shifted before the relevant calculation is done. You can see the explanation in the same document you linked to in the section Syntax of Operand2 ...
Ian Cook's user avatar
  • 2,548
4 votes

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I think that the code is supposed to be checking for hooks. The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes

Change iOS app binary file

All apps and binaries that are executed on Apple platforms need to be signed by key/certificate issued by Apple. By modifying a single byte in the app binaries, you have invalidated this signature and ...
Robert's user avatar
  • 1,057
3 votes
Accepted

LDR specifier combination UXTW

Not Sure i selected uxtw in this post Right Clicked and Search Google For UXTW the First Hit is Arm Documentation SUB Wd|WSP, Wn|WSP, Wm{, extend {#amount}} ; 32-bit general registers SUB Xd|SP, ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

indirect return value address

From https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md x8 pointer to where to write the return value if >128 bits, otherwise scratch register So it seems x8 is used to pass an ...
Johann Aydinbas's user avatar
2 votes
Accepted

What do the following AARCH64 LDR and STR instructions do exactly?

This is a pretty standard assembly syntax and not particular to AArch64. The general pattern looks like: [reg, displacement] (In some assemblers parentheses are used instead of square brackets) The ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

IOS ASLR address calculation with delta offset (ARM64)

you can set a breakpoint using lldb on func.013e09a8 like this: b -a 0x013e09a8 -s AppExecutableName No manual ASLR calculations required. If you continue in lldb with con you should see something ...
Kamil.S's user avatar
  • 131
2 votes

Deobfuscating IOS dll file (I think arm64)

If you have really dll files in an iOS app then most likely it is a Xamarin based app. But the dll file you have does not contain .Net byte code: Because code interpreters were (or are?) not allowed ...
Robert's user avatar
  • 1,057
1 vote
Accepted

Function calls to unmapped memory

In iOS, the system frameworks are loaded together and often reference each other directly. If you're using Ghidra, you can get it to resolve these references by importing the shared cache as a file ...
August Vrubel's user avatar
1 vote

IDA Pro could not disassemble native function properly

It's difficult to say for sure without the sample, but I suspect that the code has been encrypted/scrambled, and is decrypted on load, most likely by some function which runs before the entrypoint (e....
Igor Skochinsky's user avatar
  • 36.6k
1 vote
Accepted

ARM64 Stack Layout - Why 100x'A' Doesn't Crash?

The return address has been placed below the buffer on the stack. I presume it's the 0x55000008e0 entry in your second screenshot. This means that you won't be able to overwrite the return address via ...
ynwarcs's user avatar
  • 421
1 vote
Accepted

Objective-C stub functions on AARCH64

This is an example of optimizing a tail call - a call to another function which is done as the last statement of the current function. Because the LR (link register) has not been modified, the ret/blr ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Stuck decompiling ARM64 function

It looks like the code for this function is mainly taken from here. So I think if you fix up the prototypes of asin and atan2 to return angles, you should see the roll, pitch, and yaw values being ...
genghiskhan's user avatar
1 vote

Visual Arm64 Emulator

visual2 Maybe this? https://tomcl.github.io/visual2.github.io/ GUIDE https://tomcl.github.io/visual2.github.io/guide.html#content Source https://github.com/ImperialCollegeLondon/Visual2 Related info: ...
fquinto's user avatar
  • 111
1 vote

How Does ARM64 EOR with Shift Work?

I found a simple online ARM emulator here: https://wunkolo.github.io/OakSim/ I crafted an example and it appears that the instruction works by first performing the Logical Shift Right on register w8, ...
h0r53's user avatar
  • 223
1 vote

strange arm construct in objective-c application

The problem is the call to _chkstk_darwin. It is an internal compiler helper which probes the stack to make sure there’s enough space for local variables and does not modify X0, however IDA currently ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

IDA show xrefs in .pdata and nothing else

I don't know if it's true or not, but I patched the B BlKernelSp0SystemErrorHandler and B BlKernelExceptionHandler with ERET (aka exception return), and the EFI file jumps back and stop at the place ...
raspiduino's user avatar
1 vote
Accepted

IDA show xrefs in .pdata and nothing else

These functions look like exception handlers and are probably “called” by the processor when an exception or a fault happens. You need to inspect system registers to determine the cause of the ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

android index.android.bundle file

You can try Android's bundletool. As Google explains, on building an AAB with bundletool, it may be helpful "to convert your app's compiled code and resources into app bundles".
auspicious99's user avatar
1 vote
Accepted

Read and write to register with Frida

The issue was that w9 is a 32-bit register and I was using a 64 bit device. By calling this.context.x9 for the 64 bit register the Frida script worked perfectly. Many thanks to @whoopdedoo, their ...
Jon's user avatar
  • 177
1 vote

Ghidra : iOS Application : Mach-O binary -> Symbol files of dylib or framework are not generated

It's very likely that Ghidra doesn't know how to read the symbols from the dyld_shared_cache. You can try to use a different tool like IDA PRO, Rizin or radare2 or Cutter, etc. But, which binary are ...
BadSugar's user avatar
  • 110
1 vote
Accepted

empty .data section in AARCH64 elf binaries

The .data is filled with relocation information at load time. from IDA: LOAD:0000000000000598 08 20 01 00+ Elf64_Rela <0x12008, 0x403, 0x11EF> ; R_AARCH64_RELATIVE LOAD:...
macro_controller's user avatar
1 vote

What to look for in the ARM64 assembly of a Golang binary to find the list of kill signals that affect the binary execution?

Traditionally only two signals are reserved for users - SIGUSR1 and SIGUSR2. But there are possibilities for others as well as mentioned here. I would check if the signals SIGUSR1 and SIGUSR2 does ...
goofy's user avatar
  • 11
1 vote
Accepted

Format String Direct Parameter Behavior

After posting the question, I started to think about the difference in the libc I was using. I compiled the basic test binary again but with musl, and also saw the unexpected behavior there. This ...
multithr3at3d's user avatar
1 vote

reversing enrichment routine

This STR operation adds 8 bytes to the offset at X21, then stores the value of X0 there. You are working with QWORD sized variables (8), so in C code it is something like: (uint64_t *)(offset_at_X21 ...
Yotamz's user avatar
  • 1,217

Only top scored, non community-wiki answers of a minimum length are eligible