1 option
Reverse Engineering Armv8-A Systems : A Practical Guide to Kernel, Firmware, and TrustZone Analysis.
- Format:
- Book
- Author/Creator:
- Kim, Austin.
- Language:
- English
- Subjects (All):
- ARM microprocessors--Programming.
- ARM microprocessors.
- Computer firmware.
- Physical Description:
- 1 online resource (447 pages)
- Edition:
- 1st ed.
- Place of Publication:
- Birmingham : Packt Publishing, Limited, 2025.
- Summary:
- Unlock the secrets hidden in binary code without needing the source! Written by a Linux kernel engineer and author with over 14 years of industry experience, this book lays a solid foundation in reverse engineering and takes you from curious analyst to expert. You'll master advanced techniques to dissect kernel binaries, including kernel module files, vmlinux, and vmcore, giving you the power to analyze systems at their core. This practical, three-part journey starts with the essentials of reverse engineering, introducing the key features of Armv8-A processors and the ELF file format. The second part walks you through the reverse-engineering process, from Arm environment setup to using static and dynamic analysis tools, including innovative methods for analyzing kernel binaries and the powerful debugging tool uftrace. The final part covers security, exploring TrustZone and the latest security techniques to safeguard Arm devices at the hardware level. By the end of this reverse engineering book, you'll have comprehensive Armv8-A expertise and the practical skills to analyze any binary with confidence while leveraging advanced security features to harden your systems.
- Contents:
- Cover
- Copyright
- Foreword
- Contributors
- Table of Contents
- Preface
- Part 1: Fundamentals of Armv8-A Architecture
- Chapter 1: Learning Fundamentals of Arm Architecture
- Technical requirements
- Introduction to the Arm architecture
- What is the Arm architecture?
- Cortex® processor and architecture
- Armv8 profiles
- Registers
- General-purpose registers
- Special registers
- SP_ELx
- ELR_ELx
- PC
- Program status registers
- PSTATE
- SPSR_ELx
- System registers
- Lowest exception levels
- How to access the system register
- Key registers related to reverse engineering
- Procedure Call Standard for the Arm Architecture (AAPCS)
- Background
- Introduction to AAPCS
- Register used for AAPCS
- BL instruction
- Exception levels
- Exception levels and privilege levels
- EL0 with PL0
- EL1 with PL1
- EL2 with PL2
- EL3 with PL3
- Instructions to switch exception levels
- How to determine the current exception level
- Example routine to read CurrentEL
- Exceptions
- Key principles of exceptions
- Types of exception
- Exception vector table
- Details of exception vector table
- EL1 with SP_EL0
- EL1 (current EL with SPx)
- EL0 (AArch64)
- EL0 (AArch32)
- How an exception is generated with the big picture
- Step 1: Indicating the cause of exception
- Step 2: Updating registers
- Step 3: Switching the exception level
- Step 4: Branching to exception vector address
- Step 5: Exception handling
- How an exception handler works
- Synchronous exception handler
- IRQ and FIQ exception handler
- SError exception handler
- Summary
- Chapter 2: Understanding the ELF Binary Format
- Introduction to ELF
- Why do we need to learn about ELF?
- What is ELF?
- Layout of an ELF file
- ELF header
- How to identify an ELF header
- How to view the ELF header.
- Exploring the ELF header
- The e_ident field
- The e_type field
- The e_machine field
- The e_entry field
- The e_phoff and e_shoff fields
- The e_shstrndx field
- Section headers
- Layout of section headers
- Exploring section headers
- The sh_name field
- The sh_type field
- The sh_flags field
- The sh_addr field
- The sh_offset and sh_size fields
- Sections
- The .text section
- The .bss, .data, and .rodata sections
- The dynamic section
- The .init section
- The GOT section
- The PLT section
- Program headers
- Layout of the program header
- Exploring program headers
- The p_type field
- The p_flags field
- The p_offset, p_vaddr, and p_paddr fields
- Chapter 3: Manipulating Data with Arm Data Processing Instructions
- Move operations
- The MOV instruction
- Examples of the MOV instruction
- The MVN instruction
- Examples of the MVN instruction
- Arithmetic operations
- The ADD instruction
- Examples of the ADD instruction
- The ADC instruction
- Example of the ADC instruction
- The SUB instruction
- Examples of the SUB instruction
- SBC instruction
- Examples of the SBC instruction
- Bit-shift operations
- The LSL instruction
- Examples of the LSL instruction
- The LSR instruction
- Examples of the LSR instruction
- The ASR instruction
- The ROR instruction
- Case study - bit-shift operations in assembly code
- Logical operations
- The AND instruction
- Example of the AND instruction
- The ORR instruction
- Example of the ORR instruction
- The ORN instruction
- Example of the ORN instruction
- The BIC instruction
- Examples of the BIC instruction
- The EOR instruction
- Examples of the EOR instruction
- Practicing logical operations
- The AND operation
- The OR operation
- The XOR operation
- Practicing data processing instructions.
- Initializing variables
- Checking the state
- Clearing a bit
- Handling the else part
- Chapter 4: Reading and Writing with Memory Access Instructions
- The LDR instruction
- Syntax: LDR instruction in basic form
- LDR instruction with offset addressing mode
- The STR instruction
- Syntax: STR instruction in its basic form
- STR instruction with offset addressing mode
- Extension: Memory access operation
- Various load operations
- Various store operations
- The secret behind load operations
- Practicing memory access instructions
- Introducing example code
- Analyzing assembly routine: STR and LDR
- Chapter 5: Controlling Execution with Flow Control Instructions
- Branch instructions
- The B instruction
- The BL instruction
- The BR instruction
- The BLR instruction
- Analyzing an example routine
- Comparison operations
- The condition flags in PSTATE
- The CMP instruction
- CMP instruction example
- The CMN instruction
- CMN instruction example
- The TST instruction
- TST instruction example
- Conditional codes
- Introducing conditional codes
- Analyzing an example routine with conditional codes
- Conditional branch operations
- The CBZ instruction
- The CBNZ instruction
- The TBZ instruction
- The TBNZ instruction
- Analyzing assembly routines for reverse engineering
- System control operations
- The SVC instruction
- The HVC instruction
- The SMC instruction
- Part 2: Background Knowledge for Binary Analysis
- Chapter 6: Introducing Reverse Engineering
- Why reverse engineering is necessary
- Library and firmware debugging
- Legacy systems
- Improving debugging skills.
- Case study - how reverse engineering skills enhance debugging abilities
- Methods of reverse engineering
- Static analysis
- Dynamic analysis
- Dump analysis
- Introducing binary for dump analysis
- Advantage of dump analysis
- Compilation process
- What the compiler does
- The breakdown of compilation
- The compiler option - optimization level
- Assembly instructions and machine code
- Opcode and instruction
- Background knowledge of reverse engineering
- Assembly instructions
- Linux kernel
- ELF format
- Chapter 7: Setting Up a Practice Environment with an Arm Device
- Raspberry Pi
- Introducing Raspberry Pi
- Arm processor profile in each Raspberry Pi
- QEMU
- User-mode emulation
- Full system emulation
- Chapter 8: Unpacking the Kernel with Linux Fundamentals
- Architecture overview
- What is the Linux kernel?
- Resource manager
- Supporting the execution environment
- Understanding system calls
- User space and kernel space
- How the system call works
- System call number and system call handler
- Monitoring system call operations
- Process management
- Introducing processes
- The data structure of the process
- Understanding the call stack of the process
- Multiprocess management
- Introducing threads
- Memory management
- Key memory features in the Linux system
- Introducing the virtual memory system
- Virtual addresses in user space and kernel space
- Understanding the virtual memory area
- Key security hardening features
- LSM
- Address sanitizer
- Why the Address Sanitizer was introduced
- Understanding the KASLR feature
- Part 3: Unlocking Key Binary Analysis Skills for Reverse Engineering
- Chapter 9: Understanding Basic Static Analysis
- Introducing static analysis.
- What is static analysis?
- Programs used for static analysis
- Identifying binaries
- Introducing binary utilities to check binary files
- The file utility
- The readelf utility
- The xxd utility
- Identifying the raw data of binary file
- Identifying the raw data of a text file
- Case study of the corrupted binary file
- Analyzing the control flow with if statements
- Basic if statement
- The if-else statement
- The else-if statement
- The if with return statement
- Analyzing the control flow with for loops
- Basic for loop
- A for loop with a break statement
- A for loop with a continue statement
- A for loop with a return 0 statement
- Identifying log output patterns
- Why do we need to understand log output routines?
- Analyzing the call to the printf function
- When printf becomes puts
- Chapter 10: Going Deeper with Advanced Static Analysis
- Methodology for static analysis
- Setting clear and flexible goals
- Techniques for analyzing instructions
- Line-by-line analysis
- Control flow analysis using function calls
- Understanding the limitations of static analysis
- Comparing static analysis and dynamic analysis
- Introducing advanced static analysis
- Key features of kernel binaries
- Selecting kernel binaries for analysis
- Debugging program for kernel binaries
- Structure of kernel binaries
- Exploring vmlinux
- How to generate vmlinux
- Inspecting header sections in vmlinux
- Understanding *.ko files (kernel modules)
- Types of device drivers
- Why is it important to analyze *.ko files?
- Checking header information in a *.ko file
- Inspecting metadata in the .modinfo section
- Accessing system registers
- Handling exceptions in the kernel
- Managing sp_el0 and current macro
- Instructions to identify exception levels.
- Understanding the pattern of struct data structures.
- Notes:
- Description based on publisher supplied metadata and other sources.
- ISBN:
- 1-83508-258-0
- OCLC:
- 1528961818
- Publisher Number:
- CIPO000262559
The Penn Libraries is committed to describing library materials using current, accurate, and responsible language. If you discover outdated or inaccurate language, please fill out this feedback form to report it and suggest alternative language.