patch function in ARM binary to always return 0

Question

I have an ARM binary in which I want to patch a function to always return 0. My understanding is this means I need to set r0 register to 0.

The disassembly looks like this

STMFD           SP!, {R4-R6,LR}
<lots of code>
LDMFD           SP!, {R4-R6,PC}

Can I overwrite all of this with a mov r0, 0 -> 0000A0E3 followed by a return (mov pc, lr -> 0EF0A0E1)?

Answer 1

As you stated, returning in ARM/Thumb is to set the R0 register and return.

You can patch the program a number of ways to do what you want. You can replace the top most instructions with mov r0, 0 and mov pc, lr and leaving the remaining code as is would make it not execute those instructions after mov pc, lr and just return to the calling function.

MOV R0, 0
MOV PC, LR
// leave the rest as is, it wont execute

You can also patch starting after STMFD SP!, {R4-R6,LR} with MOV R0, 0 and then nopping all the way to the return statement LDMFD SP!, {R4-R6,PC}.

STMFD SP!, {R4-R6,LR}
MOV R0, 0
// NOP ALL THE WAY TO:
LDMFD SP!, {R4-R6,PC}

You can also just patch starting after STMFD SP!, {R4-R6,LR} with MOV R0, 0 and then replacing the following instruction with LDMFD SP!, {R4-R6,PC} to return early making the rest of the code below it un-executed.

STMFD SP!, {R4-R6,LR}
MOV R0, 0
LDMFD SP!, {R4-R6,PC}
// leave the rest as is, it wont execute