New answers tagged

0

The issue was that w9 is a 32-bit register and I was using a 64 bit device. By calling this.context.x9 for the 64 bit register the Frida script worked perfectly. Many thanks to @whoopdedoo, their suggestion to log this.context was what led me to search more about ARM registers and realise my mistake.


0

See: http://newosxbook.com/articles/OTA8.html (and prior episodes) #include <stdio.h> #include <fcntl.h> #include <stdlib.h> #include <ctype.h> #include <unistd.h> #define _GNU_SOURCE 1 #include <string.h> #include <sys/stat.h> // for mkdir #include <sys/mman.h> // for mmap #undef ntohl #undef ntohs #define ...


0

PC = current Instruction pointer + instruction length PC = IP + 4 PC = 0x176E4 + 4 == 176E8 destination = 0x1768C offset is encoded as a signed number of ((destination - PC)>>1) :\>python -c "print(hex((0x1768c-0x176e8)>>1)) -0x2e unconditional jump B can be encoded from E0 00 to E7 FF ==> E + (0x0 to 0x7ff ) == 0b1110 + (...


1

This is an unconditional branch (thumb) It is encoded as 11100|signed 11-bit immediate offset E 7 D 2 1110 0111 1101 0010 so your 11-bit offset is 0b11111010010. This is sign extended to -46 The operation is: PC = PC + (SignExtend(signed_immed_11) << 1) where the first PC contains the address of the branch plus 4. 0x176E4 + 4 + (-46 * 2) ==...


Top 50 recent answers are included