1

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string comparisons to identify which cgi file's functions should be run.

The issue is I am now trying to map the functions to their respective cgi names, but I am relatively new to binary debugging and cannot figure how to identify which values represent the string hard-coded into memory that the input is being compared to. I am using Radare2 and a sample of the code and a screenshot of the structure can be seen below.

Any advice would be appreciated!

0x000099a4   08001be5    ldr r0, [fp - local_8h]   ; const char * s1
0x000099a8   b81709e3    movw r1, 0x97b8
0x000099ac   021040e3    movt r1, 2                ; const char * s2
0x000099b0   5affffeb     bl sym.imp.strcmp        ;[3]; int strcmp(const char *s1, const char *s2)
0x000099b4   0030a0e1    mov r3, r0
0x000099b8   000053e3    cmp r3, 0
0x000099bc   0500001a    bne 0x99d8                ;[4]
0x000099c0   10001be5    ldr r0, [fp - local_10h]
0x000099c4   14101be5    ldr r1, [fp - local_14h]
0x000099c8   18201be5    ldr r2, [fp - local_18h]
0x000099cc   1f4e00eb    bl sub.setuid_250         ;[5]
0x000099d0   0c000be5    str r0, [fp - local_ch]

Structure

  • 1
    could you provide the output of the command ag $$ > graph.dot (you can plot it using dot -Tpng graph.dot -o graph.png if you got graphviz)? – Nordwald Apr 12 '17 at 4:54
3

You need to read the ARM instruction reference. movt is the "Move Top" instruction, which sets the top 16 bits of a register to the specified value without changing the low 16 bits.

In other words, the sequence:

movw r1, 0x97b8
movt r1, 2    

is equivalent to:

r1 = 0x97b8
r1 |= (2<<16);

which results in r1= 0x297b8, so that check that address for the string being compared to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.