Blue Fox: Arm Assembly Internals and Reverse Engineering

Title Page
Introduction
	Notes
Part I: Arm Assembly Internals
	Chapter 1: Introduction to Reverse Engineering
		Introduction to Assembly
		High‐Level Languages
		Disassembling
		Decompilation
		Notes
	Chapter 2: ELF File Format Internals
		Program Structure
		High‐Level vs. Low‐Level Languages
		The Compilation Process
		The ELF File Overview
		The ELF File Header
		ELF Program Headers
		ELF Section Headers
		The Dynamic Section and Dynamic Loading
		Thread‐Local Storage
		Notes
	Chapter 3: OS Fundamentals
		OS Architecture Overview
		Process Memory Management
		Notes
	Chapter 4: The Arm Architecture
		Architectures and Profiles
		The Armv8‐A Architecture
		The AArch64 Execution State
		The AArch32 Execution State
		Notes
	Chapter 5: Data Processing Instructions
		Shift and Rotate Operations
		Logical Operations
		Arithmetic Operations
		Multiplication Operations
		Division Operations
		Move Operations
		Notes
	Chapter 6: Memory Access Instructions
		Instructions Overview
		Addressing Modes and Offset Forms
		Load and Store Instructions
		Notes
	Chapter 7: Conditional Execution
		Conditional Execution Overview
		Conditional Codes
		Conditional Instructions
		Flag‐Setting Instructions
		Conditional Select Instructions
		Conditional Comparison Instructions
		Notes
	Chapter 8: Control Flow
		Branch Instructions
		Functions and Subroutines
		Notes
Part II: Reverse Engineering
	Chapter 9: Arm Environments
		Arm Boards
		Emulation with QEMU
		Notes
	Chapter 10: Static Analysis
		Static Analysis Tools
		Call‐By‐Reference Example
		Control Flow Analysis
		Analyzing an Algorithm
		Notes
	Chapter 11: Dynamic Analysis
		Command‐Line Debugging
		Remote Debugging
		Debugging a Memory Corruption
		Debugging a Process with GDB
		Notes
	Chapter 12: Reversing arm64 macOS Malware
		Background
		Hunting for Malicious arm64 Binaries
		Analyzing arm64 Malware
		Conclusion
		Notes
Index
Copyright
Dedication
About the Authors
Acknowledgments
End User License Agreement