2

I came across this part in the book Reverse Engineering For Beginners book by Denis Yurichev. It writes about reverse engineering Classes in C++, but it doesn't provide any examples in ARM.

Page 546

_this$ = -4
; size = 4
??0c@@QAE@XZ PROC ; c::c, COMDAT
; _this$ = ecx
push ebp
mov ebp, esp
push ecx
mov DWORD PTR _this$[ebp], ecx
mov eax, DWORD PTR _this$[ebp]
mov DWORD PTR [eax], 667
mov ecx, DWORD PTR _this$[ebp]
mov DWORD PTR [ecx+4], 999
mov eax, DWORD PTR _this$[ebp]
mov esp, ebp
pop ebp
ret 0
??0c@@QAE@XZ ENDP ; c::c
_this$ = -4 ; size = 4
_a$ = 8
; size = 4
_b$ = 12
; size = 4
??0c@@QAE@HH@Z PROC ; c::c, COMDAT
; _this$ = ecx
push ebp
mov ebp, esp
push ecx
mov DWORD PTR _this$[ebp], ecx
mov eax, DWORD PTR _this$[ebp]
mov ecx, DWORD PTR _a$[ebp]
mov DWORD PTR [eax], ecx
mov edx, DWORD PTR _this$[ebp]
mov eax, DWORD PTR _b$[ebp]
mov DWORD PTR [edx+4], eax
mov eax, DWORD PTR _this$[ebp]
mov esp, ebp
pop ebp
ret 8
??0c@@QAE@HH@Z ENDP ; c::c

As you can see ECX is used to hold the pointer of this for accessing the members of the class. How is this done in ARM assembly?

2
  • 1
    One way would be to write a simple program and compile for both architectures, and compare them. I believe this behavior may also depend on the compiler and options used. Apr 23 at 3:18
  • This is what was done in the end. See answer below.
    – LUser
    Apr 24 at 17:07
0

Because it is compiler specific , it is not required to be internally the same always. It seems though that CLANG and GCC use R0 to store this.

C++

class MyClass {
  int field_;
 public:
  void set_field() { this->field_ = 42; }
};

void test() {
  MyClass x;
  x.set_field();
}

ARM:

test():
        push    {r11, lr}
        mov     r11, sp
        sub     sp, sp, #8
        add     r0, sp, #4
        bl      MyClass::set_field()
        mov     sp, r11
        pop     {r11, lr}
        bx      lr
MyClass::set_field():
        sub     sp, sp, #4
        str     r0, [sp]
        ldr     r1, [sp]
        mov     r0, #42
        str     r0, [r1]
        add     sp, sp, #4
        bx      lr

Intel :

MyClass::set_field():
        push    rbp
        mov     rbp, rsp
        mov     QWORD PTR [rbp-8], rdi
        mov     rax, QWORD PTR [rbp-8]
        mov     DWORD PTR [rax], 42
        nop
        pop     rbp
        ret
test():
        push    rbp
        mov     rbp, rsp
        sub     rsp, 16
        lea     rax, [rbp-4]
        mov     rdi, rax
        call    MyClass::set_field()
        nop
        leave
        ret

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.