I want to know where a specific std::string comes from, find the enrichment routine in the C++ application I'm reversing.

The variable I'm looking for it at @ [X21,#8], I don't fully understand the following code, is that @ *(*off_1B2000) + 8) ? ( off_1B2000.readPointer().add(8).readPointer() ? )

Do I need to look for who sets the global pointer off_1B2000 ?

Is that an inline constructor ?

Let's assume I break in the start routine, I want to know where to set write watchpoint to figure out who writes to *(x21+8) do I set @ *(*off_1B2000) + 8) ?

ADRP            X0, #off_1B2000@PAGE
ADD             X21, SP, #0x260+v1
ADD             X24, SP, #0x260+v1
MOV             X8, X24
LDR             X0, [X0,#off_1B2000@PAGEOFF]
STR             XZR, [X21,#0x50]
ADD             X0, X0, #0x18
STR             X0, [X21]
STR             X0, [X21,#8] // <<  *(x21+8)=x0 This is who I'm looking for
STR             X0, [X21,#0x10]
STR             X0, [X21,#0x18]
STR             X0, [X21,#0x20]
STR             X0, [X21,#0x28]
STR             X0, [X21,#0x30]
STR             X0, [X21,#0x38]
STR             X0, [X21,#0x40]
MOV             W0, #0xFFFFFFFF
STR             W0, [X21,#0x48]
MOV             W0, #1
STR             W0, [X21,#0x4C]
MOV             X0, X19
STR             WZR, [X21,#0x58]
STR             WZR, [X21,#0x5C]
STRB            WZR, [X21,#0x60]
BL              sub_9F7000
  • What exactly is "enrichment routine"? I'm not familiar with the term.
    – Igor Skochinsky
    May 11 '20 at 13:37
  • Terminology; for example, person_id to Person object -> enrichment. Some routine takes an id and I want to figure out where the enrichment takes place, find the query to the DB (not the case, or might be.. statically compiled)
    – whoopdedoo
    May 11 '20 at 14:04
  • so it's just a weird term for "lookup"?
    – Igor Skochinsky
    May 11 '20 at 14:06

This STR operation adds 8 bytes to the offset at X21, then stores the value of X0 there.

You are working with QWORD sized variables (8), so in C code it is something like:

(uint64_t *)(offset_at_X21 + 1) = X0


The first instruction sets X0=address of off_1B2000 (const 0x1B2000). Later it is dereferenced [X0,#offset...]. This is *(0x1B2000+0x1B2000), which is odd. Could it be LDR X0,[X0]? IDA may give it the name "#off_1B2000" because it is clear that this is the value.

X21 pointes to the variable "v1" on the stack, (set by ADD X21,SP,#0x260+v1).

The result of the code is something like this:

[v1+8] = *(off_1B2000)

  • That I understood, please explain the relation to off_1B2000
    – whoopdedoo
    May 11 '20 at 9:16
  • Edited my answer
    – Yotamz
    May 11 '20 at 9:55
  • Thanks but where do I set the watchpoint ?
    – whoopdedoo
    May 11 '20 at 10:02
  • The watchpoint is on write to off_1B2000. And yes it looks like a constructor of a class instance, pointed to by v1 on the stack. The v1+8 is the second QWORD of the class.
    – Yotamz
    May 11 '20 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.