To learn more about Armv8-A, you can check the following materials:

• Armv8-A Reference Manual: https://developer.arm.com/documentation/ddi0487/gb
• Programmer’s Guide for Armv8-A: https://developer.arm.com/documentation/den0024/latest/

An Arm processor is a semiconductor composed of transistors in terms of hardware. From a software engineer’s point of view, how can we control the Arm processor? There are a number of Arm processors available in the market but software developers are often in situations where they need to configure Arm processors in different ways depending on the requirements of the project.

What is the Arm architecture?

The Arm architecture is how the Arm company describes the Arm processor from a software point of view. The key elements of the Arm architecture include registers, assembly instructions, exceptions, and TrustZone®, which software developers need to understand.

Let’s take a look at the following screenshot:

Figure 1.1: TRACE32 debugger window

Figure 1.1 shows the key elements of the Arm architecture. [1] Assembly Instruction shows the assembly instructions that the Arm processor can decode and execute...

Whenever you read an assembly code, you will notice that there are registers that are used as the input or output of instructions. If you do not understand how registers are used, it is difficult to analyze the assembly routine. Therefore, it is important to learn how the registers are used.

In this section, you will learn how registers in Armv8-A are organized, as follows:

• General-purpose registers
• Special registers
• System registers

At the end of this section, you will learn about the key set of registers when performing reverse engineering. First, let’s explore the general-purpose registers.

General-purpose registers

When you begin to learn about registers, the first registers you’ll encounter are the general-purpose registers. Let’s look at the list of general-purpose registers in Armv8-A and learn how each register is used:

Program code consists of multiple functions. On your system, a lot of libraries generated by different compilers are integrated to run multiple functions for the application as well as drivers.

This section covers AAPCS, which specifies the standard across function calls.

Background

Let’s begin this section by taking a look at the following example code:

01 int add_func(int x, int y)
02 {
03     int result = x + y;
04     printf("x:%d, y:%d \n", x, y);
05     
06     return result;
07 }

If you write the preceding add_func function, you may expect it to execute as follows:

• Any function can call the add_func function
• After the task of the add_func function is completed, it returns to the instruction that called the add_func function

Also, the add_func function can be called from the assembly routine. For this, we need a standard to manage interactions between functions...

One of the most important features of Armv8-A is exception levels (ELs), as exception handling and registers are organized based on exception level.

Exception levels and privilege levels

What is an exception level? When you look into the Linux kernel or RTOS code, you will notice that several system registers are suffixed with EL1 or EL2:

01 MSR TTBR0_EL1, X1
02 ADD X0, X0, #0x800
03 MSR VBAR_EL2, X1

The preceding example shows that TTBR0_EL1 is suffixed with EL1 in line 01, and VBAR_EL2 is suffixed with EL2 in line 03.

In practice, an exception level is written as ELn or ELx, where the n or x characters are suffixed to EL and the value of n or x can range from 0 to 3. EL0 is called exception level zero and EL1 is called exception level one.

When you hear about exception levels for the first time, you may assume the exception level is related to the exception, as the name implies. However, exception levels correspond to privilege levels rather...

In general, CPU architecture supports exceptions. For example, intel x86, MIPS, Armv7, and RISC-V define exceptions.

Key principles of exceptions

When the Arm core generates an exception, it will pause the execution of the software and perform the following actions:

• The program counter (PC) is branched into an exception vector address.
• The exception level can be changed.

We can find assembly instructions at the exception vector address. In practice, these instructions are called exception handlers. At the software level, we can say that when an exception occurs, PC jumps to the exception vector address, and the exception handler runs.

Types of exception

Like other CPU architectures, Armv8-A defines exceptions, including synchronous, IRQ, FIQ, and SError exceptions. These four exceptions can be categorized into two types: synchronous exceptions and asynchronous exceptions. A synchronous exception can be generated while the Arm core...

In this chapter, we learned about the basic concepts of the Armv8-A architecture.

First, we studied Arm architecture and the different types of Arm processors. It is important to understand the Arm processor family and the architecture version when selecting the correct debugging tool.

Next, we learned about registers, including general-purpose registers, special registers, and system registers. We also looked at AAPCS, which is a rule that explains how function calls work. Both the registers and AAPCS are important when you do reverse engineering with binary files.

Then, we covered exception levels and exception handling. These help you understand how software architecture works and give you a better overall picture of the system. This chapter has given you the basic background knowledge you need to start reverse engineering.

In the next chapter, we will learn about ELF, which is important when analyzing various binaries in reverse engineering.

Join our...