1

I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction:

var_8= -8
var_4= -4

SUB             SP, SP, #8
MOVS            R2, #1
STR             R0, [SP,#8+var_4]
STR             R1, [SP,#8+var_8]
MOV             R0, R2
ADD             SP, SP, #8
BX              LR

From my understanding (correct me if I'm wrong), by line:

SP=SP-8
Move 1 to R2
Store R0 into SP+8+var_4
Store R1 into SP+8+var_8
Move R2 into R0
SP=SP+8
Next Function

And the actual code:

%hook SomeClass
- (int)somemethod {
return 1;
}
%end

Now I don't understand why it needs STR R0, [SP,#8+var_4] and STR R1, [SP,#8+var_8] for, as I can't see it purposes. And if I were to return 0, a simple change to of MOVS R2, #1 to MOVS R2, #0 would do, wouldn't it? But that didn't works.

|improve this question
2

Objective C methods are not called directly, but via a piece of trampoline code in the ObjC's runtime "objc_msgSend" function, which in turn calls a regular C function implementing the ObjC method.

In addition to the method parameters, the C function is passed two additional parameters in the first two parameter slows, which are R0 and R1 on ARM (see this description):

  • R0: "self", a reference to the actual object that is executing the current method

Inside an instance method, self refers to the receiver (object) of the message that invoked the method, while in a class method self will indicate which class is calling.

  • R1: "_cmd"

This points to the selector being sent, in your case this should point to a string "somemethod" (or a struct containing this string, not sure about the current ARM implementation).

|improve this answer
  • Thanks for the answer. But which line of the offset should I modify to make it return 0? Modifying MOVS R2, #1 to MOVS R2, #0 still return 1 for me. – Gregor Isack Jul 18 '18 at 5:05
  • Probably you patch wrong binary. iOS usually has fat binaries (e.g. one 32-bit ARMv7 and another for 64 bit ARMv8). New devices has 64-bit processors, so if you has this, you need patch 64-bit ARMv8 binary (in the example code for 32-bit) – mailwl Jul 18 '18 at 6:16
  • @mailwl I'm patching a .dylib though, there's only one file. – Gregor Isack Jul 18 '18 at 10:17
  • @mailwl you're right. I patched the wrong binary. A simple file myfile.dylib revealed it has two archs. Now it seems to working fine. Thanks for the head-ups :) – Gregor Isack Jul 18 '18 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.