I was trying to reverse engineer a native lib code in an android app. the .so
contains many functions. But the function sUQWWyTBEs()
was referred in the Java code. I was curious how this function works, the code of the function sUQWWyTBEs()
decompiled with Ghidra
:
*************************************************************
* FUNCTION
*************************************************************
undefined __cdecl Myapp_sUQWWyTBEs()
undefined w0:1 <RETURN>
longlong * x0:8 param_1
Myapp_sUQWWyTBEs XREF[2]: Entry Point (*) , 00101350
00100e44 08 00 40 f9 ldr x8, [param_1 ]
00100e48 01 00 00 b0 adrp x1, s_c7a584936712f32773d3d0a_00101000 ; = "c7a584936712f32773d3d0a"
00100e4c 21 60 08 91 add x1, x1, #0x218
00100e50 02 9d 42 f9 ldr x2, [x8, #0x538 ]
00100e54 40 00 1f d6 br x2
in my understanding, I have made the static analysis as like following:
00100e44 08 00 40 f9 ldr x8, [param_1 ]
load the value at memory address param_1 into register x8.
0100e48 01 00 00 b0 adrp x1, s_c7a584936712f32773d3d0a_00101000
sets register x1 to 0x101000.
00100e4c 21 60 08 91 add x1, x1, #0x218
adds 0x218 to x1, so it sets x1 to 0x101218.
00100e50 02 9d 42 f9 ldr x2, [x8, #0x538 ]
loads the value at x8 + 0x538 into x2.
00100e54 40 00 1f d6 br x2
and finally branches to the address stored in x2
.
with that being said, Here I don't know the memory at address at x2
, obviously it initially depends on the value param_1
holds. is there way or how can I refer where param_1
was initialized? I don't know very much about usage of Ghidra
or other reverse engineering tools. any one might help would be appreciated.
Edit: This function returns a string like this 47fjlkj843h9asjklj94kljfsad93j4l2715943hasd...
but what I wanted is that how this value was generated or returned.
00100ca0 00 00 00 d0 adrp param_1, 0x102000
00100ca4 00 20 37 91 add param_1=>PTR_LOOP_00102dc8 , param_1, #0xdc8
the param_1 was done like this. but value it is holding btw?#538
is the offset to functionnewStringUTF
. For offsets in 32bit see docs.google.com/spreadsheets/d/…. I would assume that your binary is 64bit, thus the references are double the value of this spread sheet.