Reverse Engineering for ARM Platforms

This course will familiarize students with all aspects of writing Assembly code on the ARM platforms. By the end of this course students will be able to understand and write Assembly programs on the ARM platform. This includes being able to understand programs that were created by a high level language compiler. This course is fundamental for  anyone wishing to do reverse engineering on the ARM platforms. The BeagleBone family of boards is used in this course.

A non-exhaustive list of topics to be covered includes:

  • ARM overview
    • History
    • Families
    • RISC not CISC
    • Configurable endianness
  • Features
    • Lots of registers
    • Fixed width instructions
    • Load and store architecture
    • 8 privilege modes (rings)
    • Conditional execution (reduces branching)
    • Barrel shifter (allows combining operations)
  • Thumb vs. ARM mode
    • ARM mode has 32-bit wide instructions
    • Thumb mode has 16-bit wide instructions
    • Thumb-2 mode has both 16 and 32 bit wide instructions
    • Conditional execution in Thumb mode requires IT command
  • Data types
    • Byte (8-bit)
    • Half word (16-bit)
    • Word (32-bit)
    • Double word (64-bit)
  • Registers
    • 16 general purpose 32-bit registers (R0...R15)
    • R13 used as stack pointer (SP)
    • R14 used as link register (LR) for function return address
    • R15 used as program counter (PC) like IP but 2 instructions ahead
    • Current program status register (CPSR)
  • Coprocessors
    • 16 defined by ARM architecture
    • Varying functions
      • Math
      • Graphics
    • Each coprocessor has 16 registers
    • Access is only via:
      • MCR (write)
      • MRC (read)
  • Instructions
    • Load/store
    • Push/pop
    • Doing math
    • Defining and calling functions
    • Branching
    • Conditional instructions
  • Miscelaneous and next steps




Dr. Philip Polstra

Dr. Philip Polstra (Dr. Phil) has been involved with technology since an early age. He and one of his brothers cleaned out their savings to purchase a TI-99/4a computer in the early 80’s, much to the chagrin of his parents. He has been tinkering with computers and electronics ever since. Phil is an internationally recognized hardware hacker and information security expert. He has made repeat appearances at several of the top conferences worldwide. Here are just a few of the conferences he has spoken at: DEFCON (six times in four years), Blackhat, 44CON, GrrCON, BruCon, ForenSecure, SecTOR, c0c0n, Shakacon, B-sides Detroit, and B-sides Iowa. His work on developing small affordable hacking devices is documented in the book “Hacking and Penetration Testing with Low Power Devices”. He is also known for his work on USB hacking and forensics. Phil has published several articles on USB-related topics.

Phil is an Associate Professor in the department of Math, Computer Science, and Statistics at Bloomsburg University of Pennsylvania where he teaches Digital Forensics. His current research focus is on developing ultra-low-power hacking hardware. Phil also performs security penetration tests and forensic investigations on a consulting basis. His book “Linux Forensics” is considered a must have by a number of people in the forensics and information security community.

In addition to in-person training, consulting, presenting at conferences, and running conference workshops, Phil has also produced hundreds of instructional videos. His video courses are available at, PluralSight, O’Reilly,, and elsewhere.

When not teaching, Phil enjoys spending time with his family, tinkering with electronics, attending infosec conferences, experimenting with software defined radio (SDR) and various aviation activities. Phil is an accomplished aviator with a dozen ratings, all of which are current. Phil’s ratings include Commercial Pilot, Flight Instructor, Airframe and Powerplant Mechanic, Aircraft Inspector, and Avionics Technician. His flight hours are measured in the thousands and he has been known to build aircraft.

Books Authored by Philip

Linux Forensics     (5 Stars on

Linux Forensics will guide you step by step through the process of investigating a computer running Linux. Everything you need to know from the moment you receive the call from someone who thinks they have been attacked until the final report is written is covered in this book. All of the tools discussed in this book are free and most are also open source.

Hacking and Penetration Testing with Low Power Devices     (4.5 Stars on

Hacking and Penetration Testing with Low Power Devices shows you how to perform penetration tests using small, low-powered devices that are easily hidden and may be battery-powered. It shows how to use an army of devices, costing less than you might spend on a laptop, from distances of a mile or more. The book shows you how to use devices running a version of The Deck, a full-featured penetration testing and forensics Linux distribution, and can run for days or weeks on batteries due to their low power consumption. Author Philip Polstra shows how to use various configurations, including a device the size of a deck of cards that can easily be attached to the back of a computer.