Internals

The emulator is actually a userland application cross-compiled for the ARM architecture. It opens the target app (app.elf) from the filesystem and maps it as is in memory. The emulator is launched with qemu-arm-static and eventually jumps to the app entrypoint.

Apps can be debugged with gdb-multiarch thanks to qemu-arm-static.

Syscall hooks

The svc instruction is replaced with udf (undefined) to generate a SIGILL signal upon execution. It allows to catch syscalls and emulate them. It can unfortunately lead to unexpected bytes being patched if \x01\xdf is found in the binary (and isn’t the svc instruction).

A disassembler could give better results, but it doesn’t look worth it. As a side note, the SVC_Call() function can’t be hooked because some syscalls are inlined.

Other alternatives were considered (for instance seccomp or ptrace) but they seem not practicable because QEMU don’t support the associated syscalls.