Currently I am trying to reverse engineer the following armeabi-v7a function:

enter image description here

I already wrote the following Java code:

 static double getFunc(double param0, double param1, double param2, double param3) {
      double r3, s7, s8, d4, d5, d6, d7, s10, s12, s13, s14, s15;
      s14 = 100.0;
      r3 = param3 - 0xAA;
      s13 = param0;
      s15 = param2;
      s8 = 4.0;
      s7 = param3;
      s10 = 7.0;
      s13 = s13  /s14;

      if (param1 == 1) {
          s13 = s15 *s13;
          s15 = s13 * s8;
          d4 = 0.22;
          s10 = s15 / s10;
          d5 = s10;
          d4 = d5 * d4;
          d5 = 0.6;
          s12 = s7 / s14;
          d5 = d4 * d5;
          s10 = d5;
          s12 = s10 + s12;
      } else {
          s15 = s15 * s13;
          d6 = 0.34;
          s15 = s15 * s8;
          s10 = s15 / s10;
          d5 = s10;
          d5 = d5 * d6;
          d6 = 0.45;
          d6 = d5 * d6;
          s15 = d6;
          s12 = s7 / s14;
          s12 = s15 + s12;

      s14 = 10.0;
      s14 = s12 * s14;
      d6 = 0.5;
      d7 = s14;
      d7 = d7 + d6;
      s14 = d7;
      d6 = 10.0;
      d7 = s14;
      d7 = d7 / d6;

      return d7;

Unfortunately, I don't get the correct result. I am doing something wrong but I am a little bit stuck.

It might be that I don't understand the parameter handling on the armeabi-v7a assembly. Do I get it right in the code? Is R3 the third parameter? Are R# always integer values or could it be also double values? Is the VCVT.F32.F64 important for the Java implementation? If yes, how do I handle them correctly? R0 is the return register?

It would be awesome if somebody could review my code.

edit: the dissassembly code as requested:

getFunc       proc

             VLDR    S14, gvar_1318 
             SUBS    R3, #AAh
             CMP     R1, #1h
             VMOV    S13, R0
             VMOV    S15, R2
             VMOV.F32 S8, #4.000000E+00
             VMOV    S7, R3
             VMOV.F32 S10, #7.000000E+00
             VDIV.F32 S13, S13, S14
             BNE     loc 1294
             VMUL.F32 S13, S15, S13
             VMUL.F32 S15, S13, S8
             VLDR    D4, gvar_12F8
             VDIV.F32 S10, S15, S10
             VCVT.F64.F32 D5, S10 
             VCVT.F32.S32 S7, S7 
             VMUL.F64 D4, D5, D4 
             VLDR    D5, gvar_1300 
             VDIV.F32 S12, S7, S14 
             VMUL.F64 D5, D4, D5 
             VCVT.F32.F64 S10, D5 
             VADD.F32 S12, S10, S12
             B        loc_12C4
             VMUL.F32 S15, S15, S13 
             VLDR    D6, gvar 1308 
             VMUL.F32 S15, S15, S8 
             VDIV.F32 S10, S15, S10 
             VCVT.F64.F32 D5, S10
             VMUL.F64 D5, D5, D6 
             VLDR    D6, gvar_1310 
             VMUL.F64 D6, D5, D6 
             VCVT.F32.S32 S7, S7 
             VCVT.F32.F64 S15, D6 
             VDIV.F32 S12, S7, S14 
             VADD.F32 S12, S15, S12
             VMOV.F32 S14, #1.000000E+01 
             VMUL.F32 S14, S12, S14 
             VMOV.F64 D6, #5.000000E-01 
             VCVT.F64.F32 D7, S14 
             VADD.F64 D7, D7, D6 
             VCVT.S32.F64 S14, D7 
             VMOV.F64 D6, #1.000000E+01 
             VCVT.F64.S32 D7, S14 
             VDIV.F64 D7, D7, D6 
             VCVT.F32.F64 S15, D7
             VMOV    R0, S15
             BX      LR

getFunc        endp

LOAD.text:000012F2           db 0, BFh, AFh, F3h, 0, 80h 
LOAD.text:000012F8 gvar_12F8 dq 3FCC28F5C28F5C29h
LOAD.text:00001300 gvar_1300 dq 3FE3333340000000h 
LOAD.text:00001308 gvar_1308 dq 3FD5C28F5C28F5C3h 
LOAD.text:00001310 gvar_1310 dq 3FDCCCCCC0000000h 
LOAD.text:00001318 gvar_1318 dd 42C80000h
LOAD.text:0000131C           db AFh, F3h, 0, 80h
  • Can you please paste disassembly as text instead of a screenshot?
    – Igor Skochinsky
    Sep 19 '18 at 6:16
  • 1
    I paste the disassembly in the original post.
    – foobar12
    Sep 20 '18 at 15:19

Maybe the following line is wrong:

if (param == 1)

I think it should be

if (param != 1)

BNE branches if Z==0.

  • Thanks but unfortunately, that was not the problem. I tested it with both conditions.
    – foobar12
    Sep 19 '18 at 7:31
  • But you posted only the wrong one..
    – josh
    Sep 19 '18 at 8:58
  • Yes but I tested the function with param = 1 and param = 0 but still I get the wrong output.
    – foobar12
    Sep 20 '18 at 15:17
  • Don't worry. Couldn't you step-wise compare the values in the assembler with the ones in your "assembly-like" Java code?
    – josh
    Sep 20 '18 at 15:49

I guess I found the error.

I incorrectly translated the assembly SUBS R3, #AAh into r3 = param3 - 0xAA; but it should be param3 = param3 - 0xAA;

Could an expert confirm my mistake?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.