I'm starting to learn reverse engineering so I'm trying to reverse sample app, compiled for ARM(iOS) and now I'm looking into code.
This section is right before WHILE
and right at the beginning of function where values are initiated. but I can't find the raw values.
This is the function .h file:
#import "NSObject.h"
@interface SampleCalc : NSObject
+ (double)doCalc:(double)arg1;
@end
And this is the ARM code:
+[SampleCalc doCalc:]:
0002f198 movw sb, #0x6cb4 ; Objective C Implementation defined at 0x95db8 (class method), :lower16:(0xc5e60 - 0x2f1ac)
0002f19c vmov.i32 d18, #0x0
0002f1a0 movt sb, #0x9 ; :upper16:(0xc5e60 - 0x2f1ac)
0002f1a4 vmov d16, r2, r3
0002f1a8 add sb, pc ; 0xc5e60
0002f1aa movs r2, #0x0
0002f1ac add.w r3, sb, #0x8 ; 0xc5e68
0002f1b0 vldr d17, [sb]
If I understand correctly this is ARM PIC (position independent code).
But I don't get the logic here 0002f1b0
- does the brackets mean sb
is storing address and value is loaded in d17
? And what is the address - 0xc5e68
correct?
The 0xc5e60
contains:
000c5e60 db 0x00 ;
000c5e61 db 0x00 ; '.'
000c5e62 db 0x00 ; '.'
000c5e63 db 0x00 ; '.'
000c5e64 db 0x00 ; '.'
000c5e65 db 0x00 ; '.'
000c5e66 db 0x33 ; '3'
000c5e67 db 0x40 ; '@'
000c5e68 db 0x00 ;
000c5e69 db 0x00 ; '.'
000c5e6a db 0x00 ; '.'
000c5e6b db 0x00 ; '.'
000c5e6c db 0x00 ; '.'
000c5e6d db 0x00 ; '.'
000c5e6e db 0x34 ; '4'
000c5e6f db 0x40 ; '@'
000c5e70 db 0x00 ; '.'
000c5e71 db 0x00 ; '.'
000c5e72 db 0x00 ; '.'
000c5e73 db 0x00 ; '.'
000c5e74 db 0x00 ; '.'
000c5e75 db 0x00 ; '.'
000c5e76 db 0x35 ; '5'
So does that mean D17
gets value 0x00
?
Bonus question, if possible, what are all those .
and @
.
Thanks.