Загрузка...

Help me understand what this wonder feature does (ARM/Thumb)

Thread in Reversing / Assembler created by renameduser_4440583 Aug 24, 2021. 393 views

  1. renameduser_4440583
    renameduser_4440583 Topic starter Aug 24, 2021 0 Aug 24, 2021
    Во время реверса клиента SAMP на андроид наткнулся на вот это чудо:
    Code
    .text:00088840 ; =============== S U B R O U T I N E =======================================
    
.text:00088840
    
.text:00088840 ; Attributes: bp-based frame
    
.text:00088840
    
.text:00088840 ; void __fastcall encrypt(int *a1, char *a2, unsigned int a3, int a4)
    
.text:00088840 encrypt                                 ; CODE XREF: sub_94800+278↓p
    
.text:00088840
    
.text:00088840 var_30          = -0x30
    
.text:00088840 var_2C          = -0x2C
    
.text:00088840 var_28          = -0x28
    
.text:00088840 var_24          = -0x24
    
.text:00088840
    
.text:00088840 ; __unwind {
    
.text:00088840                 PUSH            {R4-R7,LR}
    
.text:00088842                 ADD             R7, SP, #0xC
    
.text:00088844                 PUSH.W          {R8-R11}
    
.text:00088848                 SUB             SP, SP, #0x14
    
.text:0008884A                 STR             R0, [SP,#0x30+var_30]
    
.text:0008884C                 MOVS            R0, #0
    
.text:0008884E                 CMP.W           R0, R2,LSR#2
    
.text:00088852                 STR             R1, [SP,#0x30+var_24]
    
.text:00088854                 BEQ             loc_88922
    
.text:00088856                 MOVW            R12, #0x79B9
    
.text:0008885A                 LSRS            R0, R2, #2
    
.text:0008885C                 MOV.W           R8, #0
    
.text:00088860                 MOVT            R12, #0x9E37
    
.text:00088864                 STR             R0, [SP,#0x30+var_2C]
    
.text:00088866                 STR             R3, [SP,#0x30+var_28]
    
.text:00088866 ; End of function encrypt
    ну или (бесполезный) псевдокод:
    Code
    void __fastcall encrypt(int *a1, char *a2, unsigned int a3, int a4)
    
{
    
  int v4; // [sp+38h] [bp+8h]
    

    
  if ( !(a3 >> 2) )
    
    JUMPOUT(0x88922);
    
  sub_88868(a3 >> 2, (int)a2, a3, a4, v4);
    
}
    немного листинга после этой функции до заведомо другой функции (насильно превратил в код, до этого там был обычный undefined):
    Code
    .text:00088868 ; =============== S U B R O U T I N E =======================================
    
.text:00088868
    
.text:00088868
    
.text:00088868 sub_88868                               ; CODE XREF: sub_8892A-A↓j
    
.text:00088868                 PUSH.W          {R0-R11,LR}
    
.text:0008886C                 MOV.W           R0, #0x150000
    
.text:00088870                 ADD             R0, SP
    
.text:00088872                 BL              sub_3E594
    
.text:00088876                 ADD.W           R0, R0, #0x2D0000
    
.text:0008887A                 MOV             R1, R0
    
.text:0008887C                 POP.W           {R0-R11,LR}
    
.text:00088880                 PUSH.W          {R0-R11,LR}
    
.text:00088884                 MOV             R0, PC
    
.text:00088886                 BL              sub_83284
    
.text:0008888A                 POP.W           {R0-R11,LR}
    
.text:0008888E                 SUB             SP, SP, #8
    
.text:00088890                 ADD             SP, SP, #8
    
.text:00088892                 MOV             R0, R0
    
.text:00088894                 MOV             R0, R0
    
.text:00088896                 MOV             R0, R0
    
.text:00088898                 POP             {PC}
    
.text:00088898 ; End of function sub_88868
    
.text:00088898
    
.text:0008889A ; ---------------------------------------------------------------------------
    
.text:0008889A                 LDM             R4, {R2,R4,R6,R7}
    
.text:0008889C                 STRB            R2, [R5,#0x14]
    
.text:0008889C ; ---------------------------------------------------------------------------
    
.text:0008889E                 DCB 0x84
    
.text:0008889F                 DCB 0xEF
    
.text:000888A0 ; ---------------------------------------------------------------------------
    
.text:000888A0                 LDR.W           R2, [R11,#0x9D]!
    
.text:000888A4                 STRB            R4, [R1,R2]
    
.text:000888A6                 ASRS            R3, R3, #1
    
.text:000888A8                 BKPT            0x29 ; ')'
    
.text:000888AA                 BMI             loc_887BA
    
.text:000888AC                 ADDS            R7, #0x68 ; 'h'
    
.text:000888AE                 SXTB            R2, R4
    
.text:000888B0                 LDR             R3, [SP,#0xF8]
    
.text:000888B2                 STRB            R4, [R6,#5]
    
.text:000888B4                 BCC             loc_888D0
    
.text:000888B6                 STR             R6, [R3,#0x18]
    
.text:000888B8                 MOV             R0, R0
    
.text:000888BA                 MOV             R0, R0
    
.text:000888BC                 MOV             R0, R0
    
.text:000888BE                 LDR             R0, [SP,#0xC]
    
.text:000888C0                 CMP             R3, #0
    
.text:000888C2                 LDR.W           R4, [R0,R8,LSL#2]
    
.text:000888C6                 ADD.W           R0, R0, R8,LSL#2
    
.text:000888CA                 LDR             R5, [R0,#4]
    
.text:000888CC                 STR             R0, [SP,#0x10]
    
.text:000888CE                 BEQ             loc_88910
    
.text:000888D0
    
.text:000888D0 loc_888D0                               ; CODE XREF: .text:000888B4↑j
    
.text:000888D0                 LDR             R0, [SP]
    
.text:000888D2 ; START OF FUNCTION CHUNK FOR sub_8892A
    
.text:000888D2
    
.text:000888D2 loc_888D2                               ; CODE XREF: sub_8892A+6A↓j
    
.text:000888D2                                         ; sub_8892A+6E↓j
    
.text:000888D2                 MOV             R11, R12
    
.text:000888D4                 LDR.W           R9, [R0]
    
.text:000888D8                 LDR.W           R10, [R0,#4]
    
.text:000888DC                 LDR             R6, [R0,#8]
    
.text:000888DE                 LDR             R2, [R0,#0xC]
    
.text:000888E0
    
.text:000888E0 loc_888E0                               ; CODE XREF: sub_8892A-1C↓j
    
.text:000888E0                 ADD.W           LR, R9, R5,LSL#4
    
.text:000888E4                 ADD.W           R1, R10, R5,LSR#5
    
.text:000888E8                 EOR.W           R1, R1, LR
    
.text:000888EC                 ADD.W           R0, R5, R11
    
.text:000888F0                 EORS            R0, R1
    
.text:000888F2                 SUBS            R3, #1
    
.text:000888F4                 ADD             R4, R0
    
.text:000888F6                 ADD.W           R0, R11, R4
    
.text:000888FA                 ADD             R11, R12
    
.text:000888FC                 ADD.W           R1, R6, R4,LSL#4
    
.text:00088900                 EOR.W           R0, R0, R1
    
.text:00088904                 ADD.W           R1, R2, R4,LSR#5
    
.text:00088908                 EOR.W           R0, R0, R1
    
.text:0008890C                 ADD             R5, R0
    
.text:0008890E                 BNE             loc_888E0
    
.text:00088910
    
.text:00088910 loc_88910                               ; CODE XREF: .text:000888CE↑j
    
.text:00088910                 LDR             R0, [SP,#-8+arg_10]
    
.text:00088912                 ADD.W           R8, R8, #2
    
.text:00088916                 STRD.W          R4, R5, [R0]
    
.text:0008891A                 LDR             R0, [SP,#-8+arg_4]
    
.text:0008891C                 LDR             R3, [SP,#-8+arg_8]
    
.text:0008891E                 CMP             R8, R0
    
.text:00088920                 BCC             sub_88868
    
.text:00088922
    
.text:00088922 loc_88922                               ; CODE XREF: encrypt+14↑j
    
.text:00088922                 ADD             SP, SP, #0x14
    
.text:00088924                 POP.W           {R8-R11}
    
.text:00088928                 POP             {R4-R7,PC}
    
.text:00088928 ; } // starts at 88840
    
.text:00088928 ; END OF FUNCTION CHUNK FOR sub_8892A
    
.text:0008892A
    
.text:0008892A ; =============== S U B R O U T I N E =======================================
    
.text:0008892A
    
.text:0008892A ; Attributes: bp-based frame
    
.text:0008892A
    
.text:0008892A sub_8892A                               ; CODE XREF: .text:00036E2E↑p
    
.text:0008892A                                         ; sub_40134+156↑p
    
.text:0008892A
    
.text:0008892A var_34          = -0x34
    
.text:0008892A var_30          = -0x30
    
.text:0008892A var_2C          = -0x2C
    
.text:0008892A var_28          = -0x28
    
.text:0008892A var_24          = -0x24
    
.text:0008892A var_20          = -0x20
    
.text:0008892A var_1C          = -0x1C
    
.text:0008892A arg_4           =  0xC
    
.text:0008892A arg_8           =  0x10
    
.text:0008892A arg_E           =  0x16
    
.text:0008892A arg_10          =  0x18
    
.text:0008892A arg_350         =  0x358
    
.text:0008892A
    
.text:0008892A ; FUNCTION CHUNK AT .text:000888D2 SIZE 00000058 BYTES
    
.text:0008892A
    
.text:0008892A ; __unwind {
    
.text:0008892A                 PUSH            {R4-R7,LR}
    
.text:0008892C                 ADD             R7, SP, #0xC
    
.text:0008892E                 PUSH.W          {R8-R11}
    
.text:00088932                 SUB             SP, SP, #0x18
    
.text:00088934                 STR             R0, [SP,#0x34+var_30]
    
.text:00088936                 MOVS            R0, #0
    
.text:00088938                 CMP.W           R0, R2,LSR#2
    
.text:0008893C                 STR             R1, [SP,#0x34+var_24]
    
.text:0008893E                 BEQ             loc_88A20
    
.text:00088940                 LSRS            R0, R2, #2
    
.text:00088942                 MOV             R2, #0x9E3779B9
    
.text:0008894A                 STR             R0, [SP,#0x34+var_2C]
    
.text:0008894C                 MUL.W           R0, R3, R2
    
.text:00088950                 MOVW            R10, #0x8647
    
.text:00088954                 MOV.W           R9, #0
    
.text:00088958                 MOVT            R10, #0x61C8
    
.text:0008895C                 STR             R3, [SP,#0x34+var_28]
    
.text:0008895E                 STR             R0, [SP,#0x34+var_34]
    
.text:00088960
    
.text:00088960 loc_88960                               ; CODE XREF: sub_8892A+F4↓j
    
.text:00088960                 PUSH.W          {R0-R11,LR}
    
.text:00088964                 MOV.W           R0, #0x150000
    
.text:00088968                 ADD             R0, SP
    
.text:0008896A                 BL              sub_3E594
    
.text:0008896E                 ADD.W           R0, R0, #0x2D0000
    
.text:00088972                 MOV             R1, R0
    
.text:00088974                 POP.W           {R0-R11,LR}
    
.text:00088978                 PUSH.W          {R0-R11,LR}
    
.text:0008897C                 MOV             R0, PC
    
.text:0008897E                 BL              sub_833C8
    
.text:00088982                 POP.W           {R0-R11,LR}
    
.text:00088986                 SUB             SP, SP, #8
    
.text:00088988                 ADD             SP, SP, #8
    
.text:0008898A                 MOV             R0, R0
    
.text:0008898C                 MOV             R0, R0
    
.text:0008898E                 MOV             R0, R0
    
.text:00088990                 POP             {PC}
    
.text:00088992 ; ---------------------------------------------------------------------------
    
.text:00088992                 ADD             R2, SP, #0x30+arg_350
    
.text:00088994                 BLT             loc_888D2
    
.text:00088996                 STRB            R1, [R7,#arg_E]
    
.text:00088998                 BGT             loc_888D2
    
.text:0008899A                 STRH            R1, [R1,R4]
    
.text:0008899A ; ---------------------------------------------------------------------------
    
.text:0008899C                 DCB 0xDD
    
.text:0008899D                 DCB 0xB7
    
.text:0008899E ; ---------------------------------------------------------------------------
    
.text:0008899E                 LSRS            R1, R4, #0x1B
    
.text:000889A0                 LSLS            R3, R2, #7
    
.text:000889A2                 ASRS            R4, R6, #0x16
    
.text:000889A4                 LDR             R4, [R5,#0x48]
    
.text:000889A6                 CBZ             R4, loc_889F8+2
    
.text:000889A6 ; ---------------------------------------------------------------------------
    
.text:000889A8                 DCB    2
    
.text:000889A9                 DCB 0xF9
    
.text:000889AA ; ---------------------------------------------------------------------------
    
.text:000889AA                 LDRH            R4, [R0,#0x2C]
    
.text:000889AC                 STM             R4, {R0,R1,R3-R5,R7}
    
.text:000889AE                 STM             R4!, {R0,R1,R5,R6}
    
.text:000889B0                 MOV             R0, R0
    
.text:000889B2                 MOV             R0, R0
    
.text:000889B4                 MOV             R0, R0
    
.text:000889B6                 LDR             R0, [SP,#0x30+var_20]
    
.text:000889B8                 CMP             R3, #0
    
.text:000889BA                 LDR.W           R6, [R0,R9,LSL#2]
    
.text:000889BE                 ADD.W           R0, R0, R9,LSL#2
    
.text:000889C2                 LDR             R5, [R0,#4]
    
.text:000889C4                 STR             R0, [SP,#0x30+var_1C]
    
.text:000889C6                 BEQ             loc_88A0E
    
.text:000889C8                 LDR             R0, [SP,#0x30+var_2C]
    
.text:000889CA                 LDR.W           LR, [SP,#0x30+var_30]
    
.text:000889CE                 LDR.W           R11, [R0]
    
.text:000889D2                 LDR             R4, [R0,#4]
    
.text:000889D4                 LDR             R2, [R0,#8]
    
.text:000889D6                 LDR.W           R12, [R0,#0xC]
    
.text:000889DA
    
.text:000889DA loc_889DA                               ; CODE XREF: sub_8892A+E2↓j
    
.text:000889DA                 ADD.W           R8, R2, R6,LSL#4
    
.text:000889DE                 ADD.W           R1, R12, R6,LSR#5
    
.text:000889E2                 EOR.W           R1, R1, R8
    
.text:000889E6                 ADD.W           R0, R6, LR
    
.text:000889EA                 EORS            R0, R1
    
.text:000889EC                 SUBS            R3, #1
    
.text:000889EE                 SUB.W           R5, R5, R0
    
.text:000889F2                 ADD.W           R0, LR, R5
    
.text:000889F6                 ADD             LR, R10
    
.text:000889F8
    
.text:000889F8 loc_889F8                               ; CODE XREF: sub_8892A+7C↑j
    
.text:000889F8                 ADD.W           R1, R11, R5,LSL#4
    
.text:000889FC                 EOR.W           R0, R0, R1
    
.text:00088A00                 ADD.W           R1, R4, R5,LSR#5
    
.text:00088A04                 EOR.W           R0, R0, R1
    
.text:00088A08                 SUB.W           R6, R6, R0
    
.text:00088A0C                 BNE             loc_889DA
    
.text:00088A0E
    
.text:00088A0E loc_88A0E                               ; CODE XREF: sub_8892A+9C↑j
    
.text:00088A0E                 LDR             R0, [SP,#0x30+var_1C]
    
.text:00088A10                 ADD.W           R9, R9, #2
    
.text:00088A14                 STRD.W          R6, R5, [R0]
    
.text:00088A18                 LDR             R0, [SP,#0x30+var_28]
    
.text:00088A1A                 LDR             R3, [SP,#0x30+var_24]
    
.text:00088A1C                 CMP             R9, R0
    
.text:00088A1E                 BCC             loc_88960
    
.text:00088A20
    
.text:00088A20 loc_88A20                               ; CODE XREF: sub_8892A+14↑j
    
.text:00088A20                 ADD             SP, SP, #0x18
    
.text:00088A22                 POP.W           {R8-R11}
    
.text:00088A26                 POP             {R4-R7,PC}
    
.text:00088A26 ; } // starts at 8892A
    
.text:00088A26 ; End of function sub_8892A
    в 1 и 2 аргументах передаются массивы (точнее, ссылки на них) из 4 int'ов и из 8 char'ов соответственно. 3 и 4 аргумент - 8 и 32.
    Code
    .text:00094A6C                 ADD.W           R0, R6, #0x398 ; a1 - int[4]
    
.text:00094A70                 ADD.W           R1, R6, #0x3B8 ; a2 - char[8]
    
.text:00094A74                 MOVS            R2, #8  ; a3
    
.text:00094A76                 MOVS            R3, #0x20 ; ' ' ; a4
    
.text:00094A78                 BL              encrypt ; addr = 0x88840
    если что, в R6 находится SP
    пробовал изменить границы, но там дохрена неопределенных переменных и ничего полезного соответственно нет...
    надеюсь кто-нибудь поопытнее меня сможет понять, что делает эта функция со вторым аргументом.
    и да, по моим тестам, она выдаёт каждый раз разный результат при одинаковых значениях.
     
    Aug 24, 2021
  2. MaxRWS
    MaxRWS Mar 20, 2022 0 Dec 15, 2021
    Конец функции encrypr() неверно определён.
    Но даже в этом небольшом куске видна константа 0x9E3779B9, которая сама за себя говорит.
     
    Mar 20, 2022 Edited
Loading...
Top