1

This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my industry. The following method takes in a string and returns some content represented by long long.

signed __int64 __cdecl +[Lib generateLongLongValue:](Lib_meta *self, SEL a2, id a3)
{
  void *v3; // x0
  void *v4; // x19
  char *v5; // x0
  char *v6; // x20
  unsigned __int64 v7; // x25
  signed __int64 v8; // x22
  signed __int64 v9; // x26
  int v10; // w0
  signed __int64 v11; // x8
  signed __int64 v12; // x23
  int v13; // w0
  __int16 v14; // w24
  __int16 i; // w23
  __int16 v16; // w0
  bool v17; // w9
  signed __int64 v18; // x20

  v3 = (void *)objc_retain(a3, a2);
  v4 = v3;
  v5 = (char *)objc_msgSend(v3, "length");
  v6 = v5;
  v7 = (unsigned __int64)(v5 - 1);
  if ( v5 == (_BYTE *)&dword_0 + 1 )
  {
LABEL_25:
    v18 = -1LL;
    goto LABEL_26;
  }
  ...
}

Converted into standard Objective-C, this would look like so (I think):

+ (NSInteger)generateLongLongValue:(NSString*)string
{
    NSInteger v18;

    if (string.length - 1 == (_BYTE *)&dword_0 + 1) {
        v18 = -1LL;
        goto LABEL_26;
    }

    ...
}

I'm really lost as to what (_BYTE *)&dword_0 + 1 is supposed to mean here. Could somebody please provide some sort of explanation, or provide resources that I can look into so I can understand for myself?

Cheers

1 Answer 1

1

I suspect you’ve got a false positive during analysis and a constant (0 or 1) got wrongly converted to an offset (probably because in your database 0 is a valid address). The decompiler uses info from disassembly so in cases like this it may be necessary to clean up the disassembly:

Press Tab on the line with &dword_0 and if there is an offset dword_0 or similar in the disassembly, press O to remove it, then Tab back to pseudocode and press F5 to refresh.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.