News for hackers. Stuff that matters.
Re:Using ARM Inline Assembly and Naked Functions to Fool Dis... by userbinator on Wednesday May 06, 2015 @05:53AM (#9497531)
That's a bit surprising (particularly the IDA case), and probably an indication that the ARM code/data separator in these disassemblers needs some work... because my experience with x86 IDA is that it is not going to think some address is the start of a function and disassemble it unless it actually finds a control flow instruction like call/jump leading to it, and it starts at the entry point when it does code/data separation so it shouldn't falsely identify data as code (indirect jumps, however, do tend to make it stumble, so code that doesn't get disassembled is the more common case.)

Another possibility could be blind reliance on debug information that's causing it to think that symbol is a function; strip the binary and try again.

Re:Using ARM Inline Assembly and Naked Functions to Fool Dis... by evilsocket on Wednesday May 06, 2015 @06:52AM (#9497702)
good point although the post is just a simple PoC ... to fool the kind of behaviour you're talking about, one could simply install a signal handler, call the fake function, handle the sigsegv or whatever, and then use the function as data ... also, since ARM instrutions are 4 bytes each, you could play with 3 bytes declaration ... funny things happen ;)