1

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function works, the code of the function sUQWWyTBEs() decompiled with Ghidra:

*************************************************************
                             *                           FUNCTION                          
                             *************************************************************
                             undefined  __cdecl  Myapp_sUQWWyTBEs()
             undefined         w0:1           <RETURN>
             longlong *        x0:8           param_1
                             Myapp_sUQWWyTBEs XREF[2]:     Entry Point (*) , 00101350   
        00100e44 08  00  40  f9    ldr        x8, [param_1 ]
        00100e48 01  00  00  b0    adrp       x1, s_c7a584936712f32773d3d0a_00101000           ; = "c7a584936712f32773d3d0a"
        00100e4c 21  60  08  91    add        x1, x1, #0x218
        00100e50 02  9d  42  f9    ldr        x2, [x8, #0x538 ]
        00100e54 40  00  1f  d6    br         x2

in my understanding, I have made the static analysis as like following:

00100e44 08 00 40 f9 ldr x8, [param_1 ]

load the value at memory address param_1 into register x8.

0100e48 01 00 00 b0 adrp x1, s_c7a584936712f32773d3d0a_00101000

sets register x1 to 0x101000.

00100e4c 21 60 08 91 add x1, x1, #0x218

adds 0x218 to x1, so it sets x1 to 0x101218.

00100e50 02 9d 42 f9 ldr x2, [x8, #0x538 ]

loads the value at x8 + 0x538 into x2.

00100e54 40 00 1f d6 br x2

and finally branches to the address stored in x2.

with that being said, Here I don't know the memory at address at x2, obviously it initially depends on the value param_1 holds. is there way or how can I refer where param_1 was initialized? I don't know very much about usage of Ghidra or other reverse engineering tools. any one might help would be appreciated.

Edit: This function returns a string like this 47fjlkj843h9asjklj94kljfsad93j4l2715943hasd... but what I wanted is that how this value was generated or returned.

8
  • 1
    If this is a function called from Java the first step is to look at the Java declaration of the method what parameters it has. On native side the first parameter of a JNI function should be the pointer to the JNI environment providing a lot of methods for Java native conversions.
    – Robert
    Jun 3, 2021 at 21:27
  • @Robert at the at entry this code appears: 00100ca0 00 00 00 d0 adrp param_1, 0x102000 00100ca4 00 20 37 91 add param_1=>PTR_LOOP_00102dc8 , param_1, #0xdc8 the param_1 was done like this. but value it is holding btw?
    – hanan
    Jun 10, 2021 at 17:33
  • so param_1 appears to be holding jni env and being used as a frame pointer.
    – hanan
    Jun 11, 2021 at 14:54
  • 1
    My guess would be that #538 is the offset to function newStringUTF. For offsets in 32bit see docs.google.com/spreadsheets/d/…. I would assume that your binary is 64bit, thus the references are double the value of this spread sheet.
    – Robert
    Jun 11, 2021 at 15:01
  • @Robert I have loaded the code into JEB decompiler and it outputs as link. JEB comments each instruction's output but I wanted how the output was generated?
    – hanan
    Jun 14, 2021 at 12:07

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.