Tutorial ARM64 Branching write up

Sterling0x1 · June 5, 2018

Lately quite few people asked about branching, so I figured I make a little write up about it.

It is not as advanced as it seems, if you understand the code flow and how branches manipulate that.

Think about it this way. Branches will break the code flow and execute whatever is at the address where it points to. Similar to water, as it runs in rivers, or turns to a different direction, maybe a new path opens up... Code flow is similar, but we can use conditions ?

Take a good look at this image.

So what we see in there kinda explains what branches are and what they mean. I normally ignore conditional branches as "CBZ, CBNZ, TBZ, TBNZ" as I can get the same effect with a simple unconditional branch "B" to the right loc or a NOP. You can play with them, as you change them around, you'd get the opposite effect "CBZ to CBNZ" and so on.

I'd stick with "B and BL" for now and some examples behind the logic.

B - unconditional branching

Branch hex value somehow looks like this:

05 00 00 14

05 00 00 - This is the distance between the start offset and target offset.

14 - branch's opcode.

1 - unconditional b

4 - branching to a forward address in binary

So basically we branching 5 instructions (or call it 5 lines) forward (underneath if you look at it in ida).

If it looked like this:

05 00 00 17

7 - branching to a backwards address in the binary.

Some examples (note that this is most useful in binaries with symbols):

That word hack game I hacked the other day. Developer left debug functions in the game so I hooked up existing menu buttons with those functions with simple unconditional branching.

you find the debug function:

BuyGem 100289D20

then find a button to hook it too. I normally search for "click, press" or if it has social media buttons you can search those.

InboxButtonClicked 100074DF8

From here on its pretty straight forward. Load up armconverter.com go to branch tab and add the offsets:

Current offset: 100074DF8 // inbox button

Instruction to write: B #0x100074DF8 // unconditionally branches to BuyGem

you get a hex value. Set that to first line of inbox button.

Other example.

look at this image

so we have two options. premium and premium plus. If we want to force premium, we can use branch but if you take a look the offsets, you see we'd have to branch 1 line under so we can just simply NOP the instruction. if we want to get premium + we'd have to branch to that loc address instead. This way we can manipulate the code to flow the way we want it to without conditionals.

BL - Branch with link

This one works slightly differently. It takes the code flow to another function, executes that and flow returns to the original one and carries on.

80 F6 4B 94

80 F6 4B - distance between the two address

94 - Branch with Link's opcode

9 - Branch with link

4 - branching forward

same as "B" if it was 97 it would branch backwards.

Example:

You find a game with cool down.

BL StartCooldown

Then you see this function: ResetCooldown