Note:

Arm® is a registered trademark of Arm® Limited (or its subsidiaries) in the US and/or elsewhere.

Abstract

This course teaches you to read ARM64 code you have never seen before, and to keep reading it when it comes from an Apple binary rather than from a textbook.

Reading a binary is a different skill from writing the program it came from, and the class treats it as one. It begins at the execution model and the procedure call standard, works through the instruction set organised by what the instructions do rather than by how they are encoded, and ends with a function nobody has annotated being read to a written verdict — first in front of the class, then by the class.

Two parts of the course exist because ordinary ARM64 material leaves them out while real listings are full of them. The first is the set of instructions a reader meets in system and kernel code: the system register access and the five-field encoding a disassembler falls back to printing when a register has no architectural name, the instructions whose purpose is to raise an exception rather than to compute, and the ordered and atomic access forms that look almost identical to ordinary loads and stores and mean something quite different. The second is Apple’s implementation treated as a reading problem — the implementation-defined registers that print as raw encodings, the instructions that are not in the published architecture at all and therefore print as undefined, and the arm64e dialect with its signing, authenticating and stripping instructions.

This class is the entry point to our iOS Security Research sequence, and it is deliberately built to stand on its own. Nothing in it is about iOS, and a student who never touches an Apple platform still gets a complete ARM64 reversing course.

Who Should Attend

This class is planned and organized for professionals who aim to start a career in reverse engineering and vulnerability research, as well as people already working as incident responders, threat hunters, malware analysts and pentesters who need to read ARM64 code rather than only x86.

It is also the required starting point for anyone intending to take iOS Security Research 1 or Android Security Research.

Key Learning Objectives

This class has the following goals:

  • Read an unfamiliar ARM64 function to a written description of what it does with each of its arguments.
  • Navigate a program nobody has annotated, and rename functions from evidence rather than from guessing.
  • Explain the execution model, both register files, and the procedure call standard and frame record chain that makes a backtrace possible.
  • Recognise every addressing mode and say which of them leaves its base register updated — the distinction between walking a structure and reading a field of it.
  • Follow address formation to the global it names: the page-relative instruction and the add or load that completes it.
  • Recognise the shapes of an if, a loop and a switch in a listing that labels none of them.
  • Decode a system register access in both directions, including a register the disassembler left as a raw five-field encoding.
  • Identify the instructions that raise an exception: the supervisor call, the inserted breakpoint, the hypervisor and monitor calls, and the exception return.
  • Classify the ordered and atomic memory access forms, and the three barriers, on sight.
  • Read an Apple listing, including the instructions that print as undefined and are not.
  • Decode a pointer authentication instruction: which operation, which key class, which key, which modifier.
  • Recognise the memory tagging instructions, and check a part for the feature rather than inferring it from the year.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Ability to program in C.
  • Exposure to Assembly language of some kind.
  • No ARM experience, no Apple platform experience and no reverse engineering experience is assumed.
  • Knowledge in Assembly x86/x64 might be useful, but is not required.

Lab Requirements

Students must prepare the following lab configuration:

  • IDA Pro, IDA Free or an equivalent disassembler.
  • An ARM64 environment in which short programs can be compiled and run — an Apple Silicon Mac, or an ARM64 Linux virtual machine.

Additional lab instructions will be sent to students prior the class.

Where a measurement needs hardware a student does not have — memory tagging arrives on the newest silicon and on nothing older — it is demonstrated live by the instructor with its commands and its outputs, and labelled as a demonstration. A promised exercise a student cannot perform is worse than an honest demonstration.

Summary of Training Topics

The list of sections presented in this class is:

Orientation and the toolchain

  • What reading compiled code actually is
  • The working environment

The architecture

  • The execution model and the two register files
  • The procedure call standard

The instruction set, by what it does

  • Data processing and the logical instructions
  • Memory operations
  • Flags, comparison and conditional execution
  • Control flow
  • System registers, and the instructions that raise an exception
  • Ordered and atomic memory access

Apple’s implementation, as a reading problem

  • What is different in an Apple listing
  • Pointer authentication, and memory tagging, as instructions

Reversing in practice

  • Reading an unfamiliar function to a verdict

What This Course Hands to iOS Security Research 1

iOS Security Research 1 opens assuming all sixteen items below and teaches none of them again. The list is the interface between the two courses, and it is published here so that a student deciding whether their own background already qualifies can check rather than guess.

  1. The general register file, and that a 32-bit write clears the upper half.
  2. The vector and floating point register file, and how its widths are named.
  3. The procedure call standard, and the frame record chain.
  4. The addressing modes, and which of them updates the base register.
  5. Address formation, and therefore how to follow a reference to a global.
  6. The condition flags and the conditional instructions.
  7. The branch family, the call and the return.
  8. The shapes of an if, a loop and a switch in a listing.
  9. The bitfield instructions, insert and extract.
  10. The system register access, both directions, and the five-field encoding a disassembler falls back to printing.
  11. The instructions that raise an exception: the supervisor call, the inserted breakpoint, the hypervisor and monitor calls, the exception return.
  12. The ordered and atomic access forms, and the three barriers, recognised on sight but not yet interpreted.
  13. That some Apple instructions print as undefined and are not.
  14. The pointer authentication instruction family, decoded but not interpreted.
  15. The habit of reading a whole function before concluding anything about it.
  16. The habit of checking a claim about a listing against the listing.

Three of those items stop deliberately short, and the boundary is where it is on purpose. This course teaches you to decode a pointer authentication instruction and to recognise the ordered and atomic forms; what the signing scheme guarantees and what the ordering guarantees are taught in iOS Security Research 1 and 2, which assume exactly this much and no more.

What This Course Deliberately Does Not Do

It does not explain what any security feature guarantees, or how one is attacked. It teaches the instructions and leaves the security reasoning to the courses that need it, which is why the pointer authentication module here is about decoding rather than about defence.

Note: Topics can be added, merged or removed without prior notice!