-1

I tried to reverse engineer an apk app, and it was loading a native code. I have observed that the app was using the native code like this

public static String v = sUQWWyTBEs().toString().substring(32, 37);

the disassembled function sUQWWyTBEs() with Ghidra contained this code:

                             *************************************************************
                             *                           FUNCTION                          
                             *************************************************************
                             undefined  __cdecl  Myapp_sUQWWyTBEs()
             undefined         w0:1           <RETURN>
             longlong *        x0:8           param_1
                             Myapp_sUQWWyTBEs XREF[2]:     Entry Point (*) , 00101350   
        00100e44 08  00  40  f9    ldr        x8, [param_1 ]
        00100e48 01  00  00  b0    adrp       x1, s_c7a584936712f32773d3d0a_00101000           ; = "c7a584936712f32773d3d0a"
        00100e4c 21  60  08  91    add        x1, x1, #0x218
        00100e50 02  9d  42  f9    ldr        x2, [x8, #0x538 ]
        00100e54 40  00  1f  d6    br         x2

I don't have much experience on assembly code. my question what these code is doing? in respect to the code what the above variable v is stored?

5
  • Maybe this should be migrated to the Reverse Engineering Stack Exchange?
    – hft
    May 21 at 6:08
  • yeah I realized later, That I posted in security.stackexchange but how can I migrate it though?
    – hanan
    May 21 at 6:13
  • I flagged it for moderator intervention. The mods migrated it already.
    – hft
    May 21 at 16:14
  • You might be getting down votes on this SE because you didn't put much effort into figuring it out yourself. Here is a tutorial: azeria-labs.com/writing-arm-assembly-part-1
    – hft
    May 21 at 16:16
  • You can also access official documentation regarding ARM instructions here: developer.arm.com
    – hft
    May 21 at 16:17
3
    00100e44 08  00  40  f9    ldr        x8, [param_1 ]

This load the value at memory address param_1 into register x8.

    00100e48 01  00  00  b0    adrp       x1, s_c7a584936712f32773d3d0a_00101000  

This sets register x1 to 0x101000.

    00100e4c 21  60  08  91    add        x1, x1, #0x218

This adds 0x218 to x1, so sets x1 to 0x101218.

    00100e50 02  9d  42  f9    ldr        x2, [x8, #0x538 ]

This loads the value at x8 + 0x538 into x2.

    00100e54 40  00  1f  d6    br         x2

This branches to the memory address stored in x2.

So, unless I am missing something, it looks like there may not be enough information to say what happens unless you provide the additional disassembly at x2. It might be easier to figure out if you can step through the code with a debugger rather than via static analysis.

2
  • "So, unless I am missing something, it looks like there may not be enough information to say what happens unless you provide the additional disassembly at x2", I am really don't know much about ghidra, How can I get the additional disassembly at x2? right clicking on it gives me a set of menus, and I dont know which to click. sorry I am noob here. but can you instruct me this? thanks
    – hanan
    May 21 at 6:19
  • It's difficult to say without more info. Since the actual value in x2 depends on the value of param_1.
    – hft
    May 21 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.