What does adding to a function pointer do?

Question

i'm dissassembling an arm shared object and i'm seeing this line:

iVar1 = SecurityAccess(param_2,SeedEncrypt + 1,0x1);

the SecurityAccess SeedEncrypt is:

int SecurityAccess(int param_1,void *param_2,uint param_3)

and the SeedEncrypt function signature:

uint SeedEncrypt (uint param_1,uint param_2)

As you can see it is a pointer to a function (SeedEncrypt being a function), so my question is, what does the SeedEncrypt + 1 means?

I saw online that you increment the address by the size of the function's return type, and as the SeedEncrypt address is 000a1fd6 and the signature is uint, how should i interpret it?

This the SeedEncrypt function decompiled:

---

                         *                          FUNCTION                          *
                         **************************************************************
           uint __stdcall SeedEncrypt (uint param_1, uint param_2)
                           assume LRset = 0x0
                           assume TMode = 0x1
         uint              r0:4           <RETURN>
         uint              r0:4           param_1
         uint              r1:4           param_2
                         SeedEncrypt 
    000a1fd6 83 08           lsrs       r3,param_1,#0x2
    000a1fd8 59 40           eors       param_2,r3
    000a1fda 43 08           lsrs       r3,param_1,#0x1
    000a1fdc 58 40           eors       param_1,r3
    000a1fde c3 00           lsls       r3,param_1,#0x3
    000a1fe0 08 1c           adds       param_1,param_2,#0x0
    000a1fe2 58 40           eors       param_1,r3
    000a1fe4 70 47           bx         lr

Answer 1

Tl;dr: The function SendEncrypt is written using the Thumb instruction set.

---

Many (most?) ARM processors support two instruction sets: the ARM instruction set, and the Thumb instruction set. In the ARM instruction set every instruction is 4 bytes long, and in the Thumb instruction set every instruction is 2 bytes long.

In instructions that jump, the least significant bit of the supposed jump target is actually cleared out of the jump target, and instead chooses whether to decode the instructions over there as ARM or as Thumb.

For example, suppose we have an instruction to jump to the address which r3 holds:

bx r3

If r3 is even, then it means that the instructions at where r3 points to are ARM instructions, which are 4 bytes wide. In particular, in this case, r3 must be divisible by 4.

On the other hand, if r3 is odd, then the real jump target is r3 & ~1 (equivalently r3 - 1) and the instructions over there would be decoded as Thumb instructions, which are 2 bytes wide. In this case, r3 - 1 does not have to be divisible by 4, but only by 2 (which is automatic assuming r3 is odd)

Therefore, for any function which is written using the Thumb instruction set, a function pointer that points to it will have a +1 to signify that the function is written as Thumb.

In your case, SendEncrypt is apparently written in Thumb, and therefore the function pointer that is passed to SecurityAccess has a +1

Answer 2

SeedEncrypt's code is ARM Thumb code, a compressed subset of the ARM istruction set with 2-byte opcodes.

To differentiate between normal and Thumb code, the least significant bit of code pointers is used, and a pointer to a Thumb function will have it set. Disassemblers often recognize this, and show a +1 after the pointer.

__