1

I am new and am still learning assembly languuage. In a native android app library that has been disassembled i found this function which had 1 instruction.

addres    hex     arm instruction                            function
2cc3ad   71704708 stmdaeq r7, {r0, r4, r5, r6, ip, sp, lr} ^ function0(unsigned char)

I have read in articles that arguments used to call a function are are stored on r0,r1 and r2 respectively. I wanted to add 200 into register r0 so that the instruction can store the value into the the memory referenced by those registers. So i inserted the the hex value of a a mov instruction at the address 2cc3ad so that in a hex editor it appeared like this. mov ro, #200 is C800A0E3 in hex.

address     Hex              Instruction    
2cc3ad      C800A0E3         mov ro, #200   
2cc3b1      71704708         stmdaeq r7, {r0, r4, r5, r6, ip, sp, lr} ^

After editing and adding those bytes i saved to the file. Before using the edited library i tried to redisassemble it but the disassembler gave an error as well as the app which used the library. In my understanding by adding that byte to the library i corrupted the whole file. Is there a way or an instruction i can use to to assign a certain value to r0 or to store the value to the memory referenced by those registers in that function without modifying the whole library?

1 Answer 1

0

Actually what I needed to do was to branch to an empty code cave and insert my code there. Also, I was using a disassembler which was not correctly analysing the function, for example this 71704708hex value was decoded as a thumb instruction set on another disassembler while on the disassembler I first used it was an ARM instruction set. The starting address of the function was also incorrect.

1
  • After disassembling the edited binary file i noticed that the disassembler displayed branching to an stt object instead to an address.I dont know if the disassebler read it incorrectly or what.
    – Silent
    Oct 4, 2021 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.