https://blog.omiilgo.com/tags/arm64/ Recent content in Arm64 on Security Notes Hugo en-us Fri, 21 Mar 2025 13:00:00 +0800 https://blog.omiilgo.com/posts/ios-swift-vs-objc-name-recovery/ Fri, 21 Mar 2025 13:00:00 +0800 https://blog.omiilgo.com/posts/ios-swift-vs-objc-name-recovery/ Lab Swift class LabVault: $s… mangled names, xcrun swift demangle, nm before/after strip, the one @objc method that survives in __objc_methname. class-dump, lldb, ASAN. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-native-library-re-notes/ Sat, 04 Jan 2025 10:00:00 +0800 https://blog.omiilgo.com/posts/android-native-library-re-notes/ One lab APK, one arm64-v8a .so. file/readelf/llvm-objdump through JNI_OnLoad, Java_* exports, GetStringUTFChars, a 32-byte stack copy, tombstone and ASAN. Frida logs length and prefix only. https://blog.omiilgo.com/posts/ios-dyld-shared-cache-symbolication/ Mon, 19 Aug 2024 15:00:00 +0800 https://blog.omiilgo.com/posts/ios-dyld-shared-cache-symbolication/ Lab crash on a self-signed LabSession: dwarfdump -u, atos against the dSYM, why UIKit frames are not in nm of the app, crash report with [REDACTED] paths. No DSC extraction. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Fri, 16 Feb 2024 09:00:00 +0800 https://blog.omiilgo.com/posts/android-binder-parcel-reversing/ Self-built AIDL service com.lab.binder. dumpsys and logcat Binder, Parcel bytes for writeInterfaceToken + int + string, ARM64 BnEcho::onTransact. No privilege escalation. https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Mon, 04 Sep 2023 11:00:00 +0800 https://blog.omiilgo.com/posts/android-frida-jni-trace-lab/ Lab APK com.lab.jni.trace. Hook NativeBridge.nInit in Java.perform and the Java_* export with Interceptor.attach, then compare argument length and prefix. Console output redacted. https://blog.omiilgo.com/posts/ios-objc-msgsend-reversing/ Wed, 27 Oct 2021 16:40:00 +0800 https://blog.omiilgo.com/posts/ios-objc-msgsend-reversing/ otool load commands, class-dump selectors, lldb break on objc_msgSend, recover IMP for -[LabSession startWithToken:], redacted argument log. FairPlay-encrypted App Store bins are out of scope. https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ Wed, 09 Jun 2021 14:10:00 +0800 https://blog.omiilgo.com/posts/android-jni-registernatives-lab/ APK where nm -D shows no Java_* exports. Walk JNI_OnLoad, recover the JNINativeMethod table, map Java names to ARM64 IMPs, Frida-trace the native with arguments redacted. https://blog.omiilgo.com/posts/cpp-vtable-recovery-from-disassembly/ Thu, 11 Mar 2021 10:00:00 +0800 https://blog.omiilgo.com/posts/cpp-vtable-recovery-from-disassembly/ Two-class toy hierarchy, virtual dtor plus two methods. objdump/readelf of the compiler vtable, ctor writing the vptr, virtual call through [x0,#16], gdb print of the slot. https://blog.omiilgo.com/posts/arm64-calling-convention-for-reversers/ Mon, 03 Aug 2020 13:00:00 +0800 https://blog.omiilgo.com/posts/arm64-calling-convention-for-reversers/ AAPCS64 as it shows up in IDA: x0–x7, x29/x30, 16-byte SP, PACIBSP. Toy function with nine integer args so the ninth is on the stack. objdump of prologue and epilogue. https://blog.omiilgo.com/posts/elf-got-plt-lazy-binding-lab/ Wed, 22 Apr 2020 11:20:00 +0800 https://blog.omiilgo.com/posts/elf-got-plt-lazy-binding-lab/ Lab walkthrough of lazy PLT binding on a PIE: readelf, objdump, GOT slot before/after the first call, Partial vs Full RELRO. https://blog.omiilgo.com/posts/ios-macho-load-commands-lab/ Thu, 16 Jan 2020 11:00:00 +0800 https://blog.omiilgo.com/posts/ios-macho-load-commands-lab/ Full otool -l walk of a self-signed LabSession: mach_header_64, LC_SEGMENT_64 __TEXT/__DATA, LC_LOAD_DYLIB, LC_CODE_SIGNATURE, LC_ENCRYPTION_INFO_64 cryptid=0. size -x, nm, class-dump, lldb. cryptid=1 stops the lab. https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Mon, 02 Dec 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/android-jni-onload-name-mangling/ Self-built APK where javah-style Java_com_lab_onload_Bridge_* exports sit next to a RegisterNatives table. readelf -s, ARM64 JNIEnv GetObjectClass, crash on an unbounded UTF copy.