Search the Community

Description Provides readers with a solid foundation in Arm assembly internals and reverse-engineering fundamentals as the basis for analyzing and securing billions of Arm devices Finding and mitigating security vulnerabilities in Arm devices is the next critical internet security frontier—Arm processors are already in use by more than 90% of all mobile devices, billions of Internet of Things (IoT) devices, and a growing number of current laptops from companies including Microsoft, Lenovo, and Apple. Written by a leading expert on Arm security, Blue Fox: Arm Assembly Internals and Reverse Engineering introduces readers to modern Armv8-A instruction sets and the process of reverse-engineering Arm binaries for security research and defensive purposes. Divided into two sections, the book first provides an overview of the ELF file format and OS internals, followed by Arm architecture fundamentals, and a deep-dive into the A32 and A64 instruction sets. Section Two delves into the process of reverse-engineering itself: setting up an Arm environment, an introduction to static and dynamic analysis tools, and the process of extracting and emulating firmware for analysis. The last chapter provides the reader a glimpse into macOS malware analysis of binaries compiled for the Arm-based M1 SoC. Throughout the book, the reader is given an extensive understanding of Arm instructions and control-flow patterns essential for reverse engineering software compiled for the Arm architecture. Providing an in-depth introduction into reverse-engineering for engineers and security researchers alike, this book: Offers an introduction to the Arm architecture, covering both AArch32 and AArch64 instruction set states, as well as ELF file format internals Presents in-depth information on Arm assembly internals for reverse engineers analyzing malware and auditing software for security vulnerabilities, as well as for developers seeking detailed knowledge of the Arm assembly language Covers the A32/T32 and A64 instruction sets supported by the Armv8-A architecture with a detailed overview of the most common instructions and control flow patterns Introduces known reverse engineering tools used for static and dynamic binary analysis Describes the process of disassembling and debugging Arm binaries on Linux, and using common disassembly and debugging tools Blue Fox: Arm Assembly Internals and Reverse Engineering is a vital resource for security researchers and reverse engineers who analyze software applications for Arm-based devices at the assembly level. [Hidden Content] [hide][Hidden Content]]

PE Anatomist shows almost all known data structures inside a PE file and makes some analytics Version: 0.1.15 (2020-05-30) Added mapping of redirects to another UNWIND_INFO between managed / unmanaged code in the ExceptionsData table for x64 Added parsing of tables and metadata of dotNET What's new? Version 0.1.15.344 (2020-05-30) PEAnatomist.exe SHA256: 04D3749A5525C9D49CD0161308510507B886BC64F323ABA2064E987331B3B128 Fixed the error in determining the minor version of VS 2017-2019 when decoding the Rich signature (regression 0.1.13 and 0.1.14) Fixed decoding of RT_STRING resources in the presence of incorrect data Added tab with detailed description of PE resource headers Resource tab redone to list without grouping by resource type Fixed sorting of the list of resources The procedure for parsing the resource directory has been changed, new criteria for data correctness have been added Fixed processing of the settings file during the first launch of the program Corrected the behavior of the COFF character parser in the presence of incorrect info about long symbol names Fixed the bug of constructing the context menu for listview in virtual mode Fixed saving the selected file type filter in the "Open file" dialog Fixed incorrect recognition of UTF16 lines in rare cases Added page of detected ANSI and UTF16 lines in PE file Added CodeView Debug Info parsing for OBJ files Added CodeView Debug Symbols parsing for OBJ files Added parsing of CodeView Types for OBJ files Added parsing of new CodeView Debug Symbol records up to S_REGREL32_INDIR_ENCTMP inclusive Added parsing of new CodeView Type leafs up to and including LF_INTERFACE2 Added parsing of type information in OBJ files compiled by MSVC with the /GL flag or others in MS ILStore format [HIDE][Hidden Content]]