# Reverse engineer a ARM-v7a function

Currently I am trying to reverse engineer the following armeabi-v7a function:

I already wrote the following Java code:

`````` static double getFunc(double param0, double param1, double param2, double param3) {
double r3, s7, s8, d4, d5, d6, d7, s10, s12, s13, s14, s15;
s14 = 100.0;
r3 = param3 - 0xAA;
s13 = param0;
s15 = param2;
s8 = 4.0;
s7 = param3;
s10 = 7.0;
s13 = s13  /s14;

if (param1 == 1) {
s13 = s15 *s13;
s15 = s13 * s8;
d4 = 0.22;
s10 = s15 / s10;
d5 = s10;
d4 = d5 * d4;
d5 = 0.6;
s12 = s7 / s14;
d5 = d4 * d5;
s10 = d5;
s12 = s10 + s12;
} else {
s15 = s15 * s13;
d6 = 0.34;
s15 = s15 * s8;
s10 = s15 / s10;
d5 = s10;
d5 = d5 * d6;
d6 = 0.45;
d6 = d5 * d6;
s15 = d6;
s12 = s7 / s14;
s12 = s15 + s12;
}

s14 = 10.0;
s14 = s12 * s14;
d6 = 0.5;
d7 = s14;
d7 = d7 + d6;
s14 = d7;
d6 = 10.0;
d7 = s14;
d7 = d7 / d6;

return d7;
}
``````

Unfortunately, I don't get the correct result. I am doing something wrong but I am a little bit stuck.

It might be that I don't understand the parameter handling on the armeabi-v7a assembly. Do I get it right in the code? Is R3 the third parameter? Are R# always integer values or could it be also double values? Is the VCVT.F32.F64 important for the Java implementation? If yes, how do I handle them correctly? R0 is the return register?

It would be awesome if somebody could review my code.

edit: the dissassembly code as requested:

``````getFunc       proc

VLDR    S14, gvar_1318
SUBS    R3, #AAh
CMP     R1, #1h
VMOV    S13, R0
VMOV    S15, R2
VMOV.F32 S8, #4.000000E+00
VMOV    S7, R3
VMOV.F32 S10, #7.000000E+00
VDIV.F32 S13, S13, S14
BNE     loc 1294
VMUL.F32 S13, S15, S13
VMUL.F32 S15, S13, S8
VLDR    D4, gvar_12F8
VDIV.F32 S10, S15, S10
VCVT.F64.F32 D5, S10
VCVT.F32.S32 S7, S7
VMUL.F64 D4, D5, D4
VLDR    D5, gvar_1300
VDIV.F32 S12, S7, S14
VMUL.F64 D5, D4, D5
VCVT.F32.F64 S10, D5
B        loc_12C4
loc_1294:
VMUL.F32 S15, S15, S13
VLDR    D6, gvar 1308
VMUL.F32 S15, S15, S8
VDIV.F32 S10, S15, S10
VCVT.F64.F32 D5, S10
VMUL.F64 D5, D5, D6
VLDR    D6, gvar_1310
VMUL.F64 D6, D5, D6
VCVT.F32.S32 S7, S7
VCVT.F32.F64 S15, D6
VDIV.F32 S12, S7, S14
loc_12C4:
VMOV.F32 S14, #1.000000E+01
VMUL.F32 S14, S12, S14
VMOV.F64 D6, #5.000000E-01
VCVT.F64.F32 D7, S14
VCVT.S32.F64 S14, D7
VMOV.F64 D6, #1.000000E+01
VCVT.F64.S32 D7, S14
VDIV.F64 D7, D7, D6
VCVT.F32.F64 S15, D7
VMOV    R0, S15
BX      LR

getFunc        endp

LOAD.text:000012F2           db 0, BFh, AFh, F3h, 0, 80h
LOAD.text:0000131C           db AFh, F3h, 0, 80h
``````
• Can you please paste disassembly as text instead of a screenshot? – Igor Skochinsky Sep 19 '18 at 6:16
• I paste the disassembly in the original post. – foobar12 Sep 20 '18 at 15:19

Maybe the following line is wrong:

``````if (param == 1)
``````

I think it should be

``````if (param != 1)
``````

BNE branches if Z==0.

• Thanks but unfortunately, that was not the problem. I tested it with both conditions. – foobar12 Sep 19 '18 at 7:31
• But you posted only the wrong one.. – josh Sep 19 '18 at 8:58
• Yes but I tested the function with param = 1 and param = 0 but still I get the wrong output. – foobar12 Sep 20 '18 at 15:17
• Don't worry. Couldn't you step-wise compare the values in the assembler with the ones in your "assembly-like" Java code? – josh Sep 20 '18 at 15:49

I guess I found the error.

I incorrectly translated the assembly `SUBS R3, #AAh` into `r3 = param3 - 0xAA;` but it should be `param3 = param3 - 0xAA;`

Could an expert confirm my mistake?