Reverse Engineering on Arm does not start with debuggers or disassemblers.
It starts with understanding why assembly exists and what it represents.
Processors do not execute C, C++, or Python.
They execute binary machine code.
Assembly is the bridge between human logic and silicon behavior.
0x01: Why Assembly Exists
High-level languages are written for humans.
Processors require explicit electrical instructions.
Compilation is the process of translating:
- Human logic → Assembly mnemonics
- Assembly mnemonics → Machine code (opcodes)
Assembly exists because machine code is:
- Unreadable to humans
- Binary-only
- Architecturally strict
Assembly provides a human-readable representation of machine intent.
0x02: Bits, Bytes, and Encoding Reality
At the lowest level, computers operate on binary states:
- 0 → Off
- 1 → On
A bit stores one binary value.
A byte is a fixed grouping of bits.
Modern systems standardized on:
- 8-bit bytes
- 256 possible values per byte
This standardization enabled:
- Efficient numeric representation
- Predictable memory addressing
- Character encoding consistency
0x03: Characters Are Just Numbers
Characters are encoded bytes, not abstract symbols.
Examples (ASCII / UTF-8):
- A →
0x41 - R →
0x52 - M →
0x4D
Binary encoding of "Arm":
01000001 01010010 01001101
This is critical in reverse engineering:
- Strings
- Function names
- Hardcoded keys
- Debug artifacts
All are just byte patterns.
0x04: Machine Code vs Assembly
Processors execute machine code, not assembly.
Machine code:
- Fixed-size binary encodings
- Architecture-defined
- Directly consumed by the CPU
Assembly language:
- Human-readable mnemonics
- One-to-one mapping with machine instructions
- Architecture-specific syntax
Example:
ADD R1, R0, #2
Represents a specific binary pattern understood by the processor.
0x05: Opcodes, Registers, and Intent
An instruction encoding contains:
- Opcode → What operation to perform
- Operands → Registers / immediates / memory references
Registers:
- Fast, temporary storage
- Reduce memory access
- Central to performance and control flow
Example concept:
R1 = R0 + 2
Encoded as:
- Opcode (ADD)
- Source register (R0)
- Destination register (R1)
- Immediate value (#2)
Reverse engineers reconstruct intent by decoding these patterns.
0x06: Memory Access Semantics
Brackets indicate memory dereferencing:
LDR R3, [R2]
Meaning:
- Treat
R2as an address - Load memory contents into
R3
This distinction is critical when analyzing:
- Function calls
- Stack frames
- Pointers
- Data structures
[MISSION CHECKPOINT]
Understanding the difference between machine code and assembly is non-negotiable.
Assembly is not executed.
It is interpreted into meaning.
Machine code is executed.