0

I was trying to reverse engineer a native lib code in an android app. the .so contains many functions. But the function sUQWWyTBEs() was referred in the Java code. I was curious how this function works, the code of the function sUQWWyTBEs() decompiled with Ghidra:

*************************************************************
                             *                           FUNCTION                          
                             *************************************************************
                             undefined  __cdecl  Myapp_sUQWWyTBEs()
             undefined         w0:1           <RETURN>
             longlong *        x0:8           param_1
                             Myapp_sUQWWyTBEs XREF[2]:     Entry Point (*) , 00101350   
        00100e44 08  00  40  f9    ldr        x8, [param_1 ]
        00100e48 01  00  00  b0    adrp       x1, s_c7a584936712f32773d3d0a_00101000           ; = "c7a584936712f32773d3d0a"
        00100e4c 21  60  08  91    add        x1, x1, #0x218
        00100e50 02  9d  42  f9    ldr        x2, [x8, #0x538 ]
        00100e54 40  00  1f  d6    br         x2

in my understanding, I have made the static analysis as like following:

00100e44 08 00 40 f9 ldr x8, [param_1 ]

load the value at memory address param_1 into register x8.

0100e48 01 00 00 b0 adrp x1, s_c7a584936712f32773d3d0a_00101000

sets register x1 to 0x101000.

00100e4c 21 60 08 91 add x1, x1, #0x218

adds 0x218 to x1, so it sets x1 to 0x101218.

00100e50 02 9d 42 f9 ldr x2, [x8, #0x538 ]

loads the value at x8 + 0x538 into x2.

00100e54 40 00 1f d6 br x2

and finally branches to the address stored in x2.

with that being said, Here I don't know the memory at address at x2, obviously it initially depends on the value param_1 holds. is there way or how can I refer where param_1 was initialized? I don't know very much about usage of Ghidra or other reverse engineering tools. any one might help would be appreciated.

Edit: This function returns a string like this 47fjlkj843h9asjklj94kljfsad93j4l2715943hasd... but what I wanted is that how this value was generated or returned.

8
  • 1
    If this is a function called from Java the first step is to look at the Java declaration of the method what parameters it has. On native side the first parameter of a JNI function should be the pointer to the JNI environment providing a lot of methods for Java native conversions.
    – Robert
    Jun 3 at 21:27
  • @Robert at the at entry this code appears: 00100ca0 00 00 00 d0 adrp param_1, 0x102000 00100ca4 00 20 37 91 add param_1=>PTR_LOOP_00102dc8 , param_1, #0xdc8 the param_1 was done like this. but value it is holding btw?
    – hanan
    Jun 10 at 17:33
  • so param_1 appears to be holding jni env and being used as a frame pointer.
    – hanan
    Jun 11 at 14:54
  • 1
    My guess would be that #538 is the offset to function newStringUTF. For offsets in 32bit see docs.google.com/spreadsheets/d/…. I would assume that your binary is 64bit, thus the references are double the value of this spread sheet.
    – Robert
    Jun 11 at 15:01
  • @Robert I have loaded the code into JEB decompiler and it outputs as link. JEB comments each instruction's output but I wanted how the output was generated?
    – hanan
    Jun 14 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.