Introduction |
|
xxi | |
|
Part I Arm Assembly Internals |
|
|
1 | (304) |
|
Chapter 1 Introduction to Reverse Engineering |
|
|
3 | (18) |
|
|
3 | (12) |
|
|
3 | (2) |
|
|
5 | (1) |
|
Machine Code and Assembly |
|
|
6 | (3) |
|
|
9 | (4) |
|
|
13 | (2) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
17 | (4) |
|
Chapter 2 ELF File Format Internals |
|
|
21 | (48) |
|
|
21 | (1) |
|
High-Level vs. Low-Level Languages |
|
|
22 | (2) |
|
|
24 | (6) |
|
Cross-Compiling for Other Architectures |
|
|
25 | (2) |
|
|
27 | (3) |
|
|
30 | (1) |
|
|
31 | (3) |
|
The ELF File Header Information Fields |
|
|
32 | (1) |
|
The Target Platform Fields |
|
|
33 | (1) |
|
|
34 | (1) |
|
The Table Location Fields |
|
|
34 | (1) |
|
|
34 | (9) |
|
|
36 | (1) |
|
The INTERP Program Header |
|
|
36 | (1) |
|
|
36 | (1) |
|
The DYNAMIC Program Header |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (1) |
|
The GNU EH FRAME Program Header |
|
|
38 | (1) |
|
The GNU STACK Program Header |
|
|
39 | (2) |
|
The GNLLRELRO Program Header |
|
|
41 | (2) |
|
|
43 | (9) |
|
|
45 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
47 | (1) |
|
|
47 | (1) |
|
|
47 | (1) |
|
|
47 | (1) |
|
The tdata and tbss Sections |
|
|
48 | (1) |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
The Dynamic Section and Dynamic Loading |
|
|
52 | (8) |
|
Dependency Loading (NEEDED) |
|
|
53 | (1) |
|
|
54 | (1) |
|
|
55 | (1) |
|
|
56 | (1) |
|
The Global Offset Table (GOT) |
|
|
57 | (1) |
|
The Procedure Linkage Table (PUT) |
|
|
57 | (1) |
|
The ELF Program Initialization and Termination Sections |
|
|
58 | (2) |
|
Initialization and Termination Order |
|
|
60 | (1) |
|
|
60 | (9) |
|
The Local-Exec TLS Access Model |
|
|
65 | (1) |
|
The Initial-Exec TLS Access Model |
|
|
65 | (1) |
|
The General-Dynamic TLS Access Model |
|
|
66 | (1) |
|
The Local-Dynamic TLS Access Model |
|
|
67 | (2) |
|
Chapter 3 OS Fundamentals |
|
|
69 | (24) |
|
|
69 | (11) |
|
User Mode vs. Kernel Mode |
|
|
70 | (1) |
|
|
70 | (2) |
|
|
72 | (5) |
|
|
77 | (2) |
|
|
79 | (1) |
|
Process Memory Management |
|
|
80 | (13) |
|
|
82 | (1) |
|
|
82 | (2) |
|
Anonymous and Memory-Mapped Memory |
|
|
84 | (1) |
|
Memory-Mapped Files and Modules |
|
|
84 | (3) |
|
Address Space Layout Randomization |
|
|
87 | (3) |
|
|
90 | (1) |
|
|
91 | (2) |
|
Chapter 4 The Arm Architecture |
|
|
93 | (36) |
|
Architectures and Profiles |
|
|
93 | (2) |
|
|
95 | (7) |
|
|
96 | (1) |
|
Armv8-A TrustZone Extension |
|
|
97 | (2) |
|
|
99 | (2) |
|
|
101 | (1) |
|
The AArch64 Execution State |
|
|
102 | (12) |
|
|
103 | (1) |
|
|
104 | (2) |
|
|
106 | (1) |
|
|
107 | (1) |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
109 | (1) |
|
The Platform Register (x18) |
|
|
109 | (1) |
|
The Intraprocedural Call Registers |
|
|
110 | (1) |
|
SIMD and Floating-Point Registers |
|
|
110 | (1) |
|
|
111 | (1) |
|
|
112 | (2) |
|
The AArch32 Execution State |
|
|
114 | (15) |
|
A32 and T32 Instruction Sets |
|
|
114 | (1) |
|
|
114 | (1) |
|
|
115 | (1) |
|
Switching Between Instruction Sets |
|
|
115 | (3) |
|
|
118 | (1) |
|
|
119 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
|
121 | (1) |
|
The Intraprocedural Call Register (IP, rl2) |
|
|
121 | (1) |
|
The Current Program Status Register |
|
|
121 | (1) |
|
The Application Program Status Register |
|
|
122 | (2) |
|
The Execution State Registers |
|
|
124 | (1) |
|
The Instruction Set State Register |
|
|
124 | (1) |
|
The IT Block State Register (ITSTATE) |
|
|
125 | (1) |
|
|
126 | (1) |
|
Mode and Exception Mask Bits |
|
|
126 | (3) |
|
Chapter 5 Data Processing Instructions |
|
|
129 | (66) |
|
Shift and Rotate Operations |
|
|
131 | (22) |
|
|
132 | (1) |
|
|
133 | (1) |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
134 | (1) |
|
|
135 | (1) |
|
Shift by a Constant Immediate Form |
|
|
136 | (2) |
|
|
138 | (2) |
|
Bitfield Manipulation Operations |
|
|
140 | (1) |
|
|
141 | (4) |
|
Sign- and Zero-Extend Operations |
|
|
145 | (5) |
|
Bitfield Extract and Insert |
|
|
150 | (3) |
|
|
153 | (6) |
|
|
153 | (1) |
|
|
154 | (1) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
156 | (2) |
|
|
158 | (1) |
|
|
158 | (1) |
|
|
159 | (1) |
|
|
159 | (6) |
|
|
159 | (2) |
|
|
161 | (1) |
|
|
162 | (1) |
|
CMP Instruction Operation Behavior |
|
|
163 | (2) |
|
Multiplication Operations |
|
|
165 | (21) |
|
|
166 | (1) |
|
Multiplications on A32/T32 |
|
|
167 | (2) |
|
Least Significant Word Multiplications |
|
|
169 | (2) |
|
Most Significant Word Multiplications |
|
|
171 | (2) |
|
|
173 | (3) |
|
Vector (Dual) Multiplications |
|
|
176 | (3) |
|
Long (64-Bit) Multiplications |
|
|
179 | (7) |
|
|
186 | (1) |
|
|
187 | (8) |
|
|
188 | (1) |
|
Move Immediate and MOVT on A32/T32 |
|
|
188 | (1) |
|
Move Immediate, MOVZ, and MOVK on A64 |
|
|
189 | (1) |
|
|
190 | (2) |
|
|
192 | (3) |
|
Chapter 6 Memory Access Instructions |
|
|
195 | (48) |
|
|
195 | (2) |
|
Addressing Modes and Offset Forms |
|
|
197 | (25) |
|
|
200 | (1) |
|
Constant Immediate Offset |
|
|
201 | (6) |
|
|
207 | (2) |
|
|
209 | (1) |
|
|
210 | (2) |
|
|
212 | (1) |
|
Post-Indexed Addressing Example |
|
|
213 | (1) |
|
Literal (PC-Relative) Addressing |
|
|
214 | (1) |
|
|
215 | (3) |
|
Loading an Address into a Register |
|
|
218 | (4) |
|
Load and Store Instructions |
|
|
222 | (21) |
|
Load and Store Word or Doubleword |
|
|
222 | (2) |
|
Load and Store Halfword or Byte |
|
|
224 | (2) |
|
Example Using Load and Store |
|
|
226 | (2) |
|
Load and Store Multiple (A32) |
|
|
228 | (7) |
|
|
235 | (2) |
|
A More Complicated Example Using STM and LDM |
|
|
237 | (1) |
|
Load and Store Pair (A64) |
|
|
238 | (5) |
|
Chapter 7 Conditional Execution |
|
|
243 | (32) |
|
Conditional Execution Overview |
|
|
243 | (1) |
|
|
244 | (5) |
|
|
245 | (1) |
|
Signed vs. Unsigned Integer Overflows |
|
|
246 | (2) |
|
|
248 | (1) |
|
|
249 | (3) |
|
The If-Then (IT) Instruction in Thumb |
|
|
250 | (2) |
|
Flag-Setting Instructions |
|
|
252 | (13) |
|
The Instruction "S" Suffix |
|
|
253 | (1) |
|
The S Suffix on Add and Subtract Instructions |
|
|
253 | (3) |
|
The S Suffix on Logical Shift Instructions |
|
|
256 | (1) |
|
The S Suffix on Multiply Instructions |
|
|
257 | (1) |
|
The S Suffix on Other Instructions |
|
|
257 | (1) |
|
Test and Comparison Instructions |
|
|
257 | (1) |
|
|
258 | (2) |
|
|
260 | (1) |
|
|
261 | (3) |
|
|
264 | (1) |
|
Conditional Select Instructions |
|
|
265 | (3) |
|
Conditional Comparison Instructions |
|
|
268 | (7) |
|
Boolean AND Conditionals Using CCMP |
|
|
269 | (3) |
|
Boolean OR Conditionals Using CCMP |
|
|
272 | (3) |
|
|
275 | (30) |
|
|
275 | (15) |
|
Conditional Branches and Loops |
|
|
277 | (4) |
|
Test and Compare Branches |
|
|
281 | (1) |
|
|
282 | (2) |
|
|
284 | (4) |
|
|
288 | (2) |
|
Functions and Subroutines "* |
|
|
290 | (15) |
|
The Procedure Call Standard |
|
|
291 | (2) |
|
Volatile vs. Nonvolatile Registers |
|
|
293 | (1) |
|
Arguments and Return Values |
|
|
293 | (2) |
|
|
295 | (3) |
|
Leaf and Nonleaf Functions |
|
|
298 | (1) |
|
|
298 | (1) |
|
|
299 | (1) |
|
|
299 | (6) |
|
Part II Reverse Engineering |
|
|
305 | (132) |
|
Chapter 9 Arm Environments |
|
|
307 | (14) |
|
|
308 | (2) |
|
|
310 | (11) |
|
|
310 | (4) |
|
QEMU Full-System Emulation |
|
|
314 | (1) |
|
|
315 | (6) |
|
Chapter 10 Static Analysis |
|
|
321 | (42) |
|
|
322 | (6) |
|
|
322 | (1) |
|
Disassemblers and Decompilers |
|
|
322 | (1) |
|
|
323 | (5) |
|
Call-By-Reference Example |
|
|
328 | (6) |
|
|
334 | (15) |
|
|
336 | (1) |
|
|
336 | (5) |
|
|
341 | (2) |
|
|
343 | (2) |
|
|
345 | (2) |
|
|
347 | (2) |
|
|
349 | (14) |
|
Chapter 11 Dynamic Analysis |
|
|
363 | (42) |
|
|
364 | (21) |
|
|
365 | (1) |
|
|
366 | (2) |
|
|
368 | (1) |
|
|
369 | (1) |
|
|
370 | (1) |
|
|
370 | (4) |
|
|
374 | (2) |
|
|
376 | (1) |
|
|
377 | (2) |
|
|
379 | (2) |
|
|
381 | (1) |
|
|
382 | (3) |
|
|
385 | (5) |
|
|
386 | (2) |
|
|
388 | (2) |
|
Debugging a Memory Corruption |
|
|
390 | (8) |
|
Debugging a Process with GDB |
|
|
398 | (7) |
|
Chapter 12 Reversing arm64 macOS Mai ware |
|
|
405 | (32) |
|
|
406 | (7) |
|
|
407 | (3) |
|
macOS Hello World (arm64) |
|
|
410 | (3) |
|
Hunting for Malicious arm64 Binaries |
|
|
413 | (6) |
|
|
419 | (16) |
|
|
420 | (1) |
|
Anti-Debugging Logic (via ptrace) |
|
|
421 | (4) |
|
Anti-Debugging Logic (via sysctl) |
|
|
425 | (4) |
|
Anti-VM Logic (via SIP Status and the Detection of VM Artifacts) |
|
|
429 | (6) |
|
|
435 | (2) |
Index |
|
437 | |