1

I was reversing an libil2cpp.so and decompiled it using ghidra and as of now my assembly language knowledge is very limited and studied it long time btw I had an assembly code like this:

                    ********************************************
                    *                 FUNCTION                 *
                    ********************************************
                    void __stdcall gameOverANDTERMINATED(int param_1, float param_2)
         void               <VOID>           <RETURN>
         int                r0:4             param_1
         float              r1:4             param_2
                                                                                                      
    0037127c 70 4c 2d e9              stmdb           sp!,{r4 r5 r6 r10 r11 lr}
    00371280 10 b0 8d e2              add             r11, sp, #0x10
    00371284 04 8b 2d ed              vpush           {d8,d9}
    00371288 0c 61 9f e5              ldr             r6, [DAT_0037139c]                                                                                      ; = 00CE6282h
    0037128c 00 40 a0 e1              cpy             r4, param_1
    00371290 01 50 a0 e1              cpy             r5, param_2
    00371294 06 60 8f e0              add             r6, pc, r6
    00371298 00 00 d6 e5              ldrb            param_1, [r6,#0x0]=>DAT_0105751e                                                                        ; = ??
    0037129c 00 00 50 e3              cmp             param_1, #0x0
    003712a0 05 00 00 1a              bne             LAB_003712bc
    003712a4 f4 00 9f e5              ldr             param_1, [DAT_003713a0]                                                                                 ; = 00CC11A8h
    003712a8 00 00 9f e7              ldr             param_1, [pc,param_1]=>PTR_DAT_01032458                                                                 ; = 00d954fc
    003712ac 00 00 90 e5              ldr             param_1=>__DT_SYMTAB[671].st_size, [param_1,#0x0]=>DAT_00d954fc                                          ; = 00002BE8h
    003712b0 2b be fd eb              bl              thunk_FUN_0029b5bc                                                                                     ; undefined thunk_FUN_0029b5bc()
    003712b4 01 00 a0 e3              mov             param_1, #0x1
    003712b8 00 00 c6 e5              strb            param_1, [r6,#0x0]=>DAT_0105751e                                                                        ; = ??
                    LAB_003712bc                                                                                                        XREF[1]: 003712a0(j)  
    003712bc e0 60 9f e5              ldr             r6, [DAT_003713a4]                                                                                      ; = 00CC1060h
    003712c0 06 60 9f e7              ldr             r6, [pc,r6]=>->Class$PlayingSceneController                                                             ; = 010df7d8
    003712c4 00 00 96 e5              ldr             param_1, [r6,#0x0]=>Class$PlayingSceneController                                                        ; = ??
    003712c8 5c 00 90 e5              ldr             param_1, [param_1,#0x5c]
    003712cc 00 00 d0 e5              ldrb            param_1, [param_1,#0x0]
    003712d0 00 00 50 e3              cmp             param_1, #0x0
    003712d4 25 00 00 0a              beq             LAB_00371370
    003712d8 c8 00 9f e5              ldr             param_1, [DAT_003713a8]                                                                                 ; = 00CC02B0h
    003712dc 10 5a 09 ee              vmov            s18, r5
    003712e0 00 00 9f e7              ldr             param_1, [pc,param_1]=>->Method$CapsuleGame.CapsuleSingleton<CapsuleExecute>.get_Instance()             ; = 010d9080
    003712e4 00 00 90 e5              ldr             param_1, [param_1,#0x0]=>Method$CapsuleGame.CapsuleSingleton<CapsuleExecute>.get_Instance()             ; = ??
    003712e8 cb c8 19 eb              bl              CapsuleGame.CapsuleSingleton<T>$$get_Instance                                                          ; undefined CapsuleGame.CapsuleSingleton<T>$$get_Instance()
    003712ec 00 50 a0 e1              cpy             r5, param_1
    003712f0 00 00 50 e3              cmp             param_1, #0x0
    003712f4 00 00 00 1a              bne             LAB_003712fc
    003712f8 50 be fd eb              bl              thunk_FUN_00293108                                                                                     ; undefined thunk_FUN_00293108()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN
                    LAB_003712fc                                                                                                        XREF[1]: 003712f4(j)  
    003712fc 00 00 96 e5              ldr             param_1, [r6,#0x0]=>Class$PlayingSceneController                                                        ; = ??
    00371300 00 20 a0 e3              mov             r2, #0x0
    00371304 54 10 d5 e5              ldrb            param_2, [r5,#0x54]
    00371308 00 8a b0 ee              vmov.f32        s16, 0x40000000
    0037130c 5c 00 90 e5              ldr             param_1, [param_1,#0x5c]
    00371310 00 00 51 e3              cmp             param_2, #0x0
    00371314 49 8a b0 0e              vmoveq.f32      s16, s18
    00371318 00 20 c0 e5              strb            r2, [param_1,#0x0]
    0037131c 88 00 9f e5              ldr             param_1, [DAT_003713ac]                                                                                 ; = 00CBFF84h
    00371320 00 00 9f e7              ldr             param_1, [pc,param_1]=>->Class$GamePref                                                                 ; = 010dc8d0
    00371324 0c 50 94 e5              ldr             r5, [r4,#0xc]
    00371328 00 00 90 e5              ldr             param_1, [param_1,#0x0]=>Class$GamePref                                                                 ; = ??
    0037132c bb 10 d0 e5              ldrb            param_2, [param_1,#0xbb]
    00371330 02 00 11 e3              tst             param_2, #0x2
    00371334 03 00 00 0a              beq             LAB_00371348
    00371338 74 10 90 e5              ldr             param_2, [param_1,#0x74]
    0037133c 00 00 51 e3              cmp             param_2, #0x0
    00371340 00 00 00 1a              bne             LAB_00371348
    00371344 34 be fd eb              bl              thunk_FUN_002948b8                                                                                     ; undefined thunk_FUN_002948b8()
                    LAB_00371348                                                                                                        XREF[2]: 00371334(j), 00371340(j)  
    00371348 05 00 a0 e1              cpy             param_1, r5
    0037134c 00 10 a0 e3              mov             param_2, #0x0
    00371350 5b 7d 03 eb              bl              GamePref$$updateScore                                                                                  ; void GamePref$$updateScore(int param_1)
    00371354 40 8a b5 ee              vcmp.f32        s16, #0
    00371358 10 fa f1 ee              vmrs            apsr, fpscr
    0037135c 05 00 00 1a              bne             LAB_00371378
    00371360 04 00 a0 e1              cpy             param_1, r4
    00371364 04 8b bd ec              vpop            {d8,d9}
    00371368 70 4c bd e8              ldmia           sp!,{r4 r5 r6 r10 r11 lr}
    0037136c 75 00 00 ea              b               PlayingSceneController$$showGameOverMenu                                                               ; undefined PlayingSceneController$$showGameOverMenu()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN
                    LAB_00371370                                                                                                        XREF[1]: 003712d4(j)  
    00371370 04 8b bd ec              vpop            {d8,d9}
    00371374 70 8c bd e8              ldmia           sp!,{r4 r5 r6 r10 r11 pc}
                    LAB_00371378                                                                                                        XREF[1]: 0037135c(j)  
    00371378 10 1a 18 ee              vmov            param_2, s16
    0037137c 04 00 a0 e1              cpy             param_1, r4
    00371380 47 01 00 eb              bl              PlayingSceneController$$showGameOverMenu                                                               ; undefined PlayingSceneController$$showGameOverMenu()
    00371384 00 10 a0 e1              cpy             param_2, param_1
    00371388 04 00 a0 e1              cpy             param_1, r4
    0037138c 00 20 a0 e3              mov             r2, #0x0
    00371390 04 8b bd ec              vpop            {d8,d9}
    00371394 70 4c bd e8              ldmia           sp!,{r4 r5 r6 r10 r11 lr}
    00371398 41 48 11 ea              b               UnityEngine.MonoBehaviour$$StartCoroutine                                                              ; undefined UnityEngine.MonoBehaviour$$StartCoroutine()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN
                    DAT_0037139c                                                                                                        XREF[1]: 00371288(R)  
    0037139c 82 62 ce 00              undefined4      00CE6282h
                    DAT_003713a0                                                                                                        XREF[1]: 003712a4(R)  
    003713a0 a8 11 cc 00              undefined4      00CC11A8h
                    DAT_003713a4                                                                                                        XREF[1]: 003712bc(R)  
    003713a4 60 10 cc 00              undefined4      00CC1060h
                    DAT_003713a8                                                                                                        XREF[1]: 003712d8(R)  
    003713a8 b0 02 cc 00              undefined4      00CC02B0h
                    DAT_003713ac                                                                                                        XREF[1]: 0037131c(R)  
    003713ac 84 ff cb 00              undefined4      00CBFF84h

the specific part I was concentrating is this part:

                    LAB_00371348                                                                                                        XREF[2]: 00371334(j), 00371340(j)  
    00371348 05 00 a0 e1              cpy             param_1, r5
    0037134c 00 10 a0 e3              mov             param_2, #0x0
    00371350 5b 7d 03 eb              bl              updateScore                                                                                  
    00371354 40 8a b5 ee              vcmp.f32        s16, #0
    00371358 10 fa f1 ee              vmrs            apsr, fpscr
    0037135c 05 00 00 1a              bne             LAB_00371378
    00371360 04 00 a0 e1              cpy             param_1, r4
    00371364 04 8b bd ec              vpop            {d8,d9}
    00371368 70 4c bd e8              ldmia           sp!,{r4 r5 r6 r10 r11 lr}
    0037136c 75 00 00 ea              b               showGameOverMenu                                                               ; undefined showGameOverMenu()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN

I wanted to change the value of param_1 got called with the function updateScore and assign param_1 with the 249F0 using ghidra like for example MOV param_1, #0x249F0 using patch instruction command but that was not possible. BTW now param_1 was copied the value of r5 which was assigned value by previous instructions but I am unable to modify it.

all in all, How can I assign 0x249F0 value on param_1 or even `r5' registers? is this possible? is there another way I could have achieved this goal?

Edit: HERE IS DECOMPILED updateScore function:

                    ********************************************
                    *                 FUNCTION                 *
                    ********************************************
                    void __stdcall updateScore(int param_1)
         void               <VOID>           <RETURN>
         int                r0:4             param_1
                    GamePref$$updateScore                                                                                               XREF[1]: PlayingSceneController$$gameOver:00371350(c)  
    004508c4 30 48 2d e9              stmdb           sp!,{r4 r5 r11 lr}
    004508c8 08 b0 8d e2              add             r11, sp, #0x8
    004508cc a0 50 9f e5              ldr             r5, [DAT_00450974]                                                                                      ; = 00C07326h
    004508d0 00 40 a0 e1              cpy             r4, param_1
    004508d4 05 50 8f e0              add             r5, pc, r5
    004508d8 00 00 d5 e5              ldrb            param_1, [r5,#0x0]=>DAT_01057c02                                                                        ; = ??
    004508dc 00 00 50 e3              cmp             param_1, #0x0
    004508e0 05 00 00 1a              bne             LAB_004508fc
    004508e4 8c 00 9f e5              ldr             param_1, [DAT_00450978]                                                                                 ; = 00BE6778h
    004508e8 00 00 9f e7              ldr             param_1, [pc,param_1]=>PTR_DAT_01037068                                                                 ; = 00d91bf4
    004508ec 00 00 90 e5              ldr             param_1=>__DT_SYMTAB[443].st_name+1, [param_1,#0x0]=>DAT_00d91bf4                                        ; = 00001DA1h
    004508f0 9b 40 fa eb              bl              thunk_FUN_0029b5bc                                                                                     ; undefined thunk_FUN_0029b5bc()
    004508f4 01 00 a0 e3              mov             param_1, #0x1
    004508f8 00 00 c5 e5              strb            param_1, [r5,#0x0]=>DAT_01057c02                                                                        ; = ??
                    LAB_004508fc                                                                                                        XREF[1]: 004508e0(j)  
    004508fc 78 50 9f e5              ldr             r5, [DAT_0045097c]                                                                                      ; = 00BE09A4h
    00450900 05 50 9f e7              ldr             r5, [pc,r5]=>->Class$GamePref                                                                           ; = 010dc8d0
    00450904 00 00 95 e5              ldr             param_1, [r5,#0x0]=>Class$GamePref                                                                      ; = ??
    00450908 bb 10 d0 e5              ldrb            r1, [param_1,#0xbb]
    0045090c 02 00 11 e3              tst             r1, #0x2
    00450910 03 00 00 0a              beq             LAB_00450924
    00450914 74 10 90 e5              ldr             r1, [param_1,#0x74]
    00450918 00 00 51 e3              cmp             r1, #0x0
    0045091c 00 00 00 1a              bne             LAB_00450924
    00450920 bd 40 fa eb              bl              thunk_FUN_002948b8                                                                                     ; undefined thunk_FUN_002948b8()
                    LAB_00450924                                                                                                        XREF[2]: 00450910(j), 0045091c(j)  
    00450924 15 00 00 eb              bl              getScore                                                                                     ; undefined getScore()
    00450928 04 00 50 e1              cmp             param_1, r4
    0045092c 30 88 bd a8              ldmiage         sp!,{r4 r5 r11 pc}
    00450930 00 00 95 e5              ldr             param_1, [r5,#0x0]=>Class$GamePref                                                                      ; = ??
    00450934 bb 10 d0 e5              ldrb            r1, [param_1,#0xbb]
    00450938 02 00 11 e3              tst             r1, #0x2
    0045093c 04 00 00 0a              beq             LAB_00450954
    00450940 74 10 90 e5              ldr             r1, [param_1,#0x74]
    00450944 00 00 51 e3              cmp             r1, #0x0
    00450948 01 00 00 1a              bne             LAB_00450954
    0045094c b2 40 fa eb              bl              thunk_FUN_002948b8                                                                                     ; undefined thunk_FUN_002948b8()
    00450950 00 00 95 e5              ldr             param_1, [r5,#0x0]=>Class$GamePref                                                                      ; = ??
                    LAB_00450954                                                                                                        XREF[2]: 0045093c(j), 00450948(j)  
    00450954 5c 00 90 e5              ldr             param_1, [param_1,#0x5c]
    00450958 04 10 a0 e1              cpy             r1, r4
    0045095c 00 20 a0 e3              mov             r2, #0x0
    00450960 08 00 90 e5              ldr             param_1, [param_1,#0x8]
    00450964 aa b8 12 eb              bl              UnityEngine.PlayerPrefs$$SetInt                                                                        ; undefined UnityEngine.PlayerPrefs$$SetInt()
    00450968 00 00 a0 e3              mov             param_1, #0x0
    0045096c 30 48 bd e8              ldmia           sp!,{r4 r5 r11 lr}
    00450970 39 ba 12 ea              b               UnityEngine.PlayerPrefs$$Save                                                                          ; undefined UnityEngine.PlayerPrefs$$Save()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN
                    DAT_00450974                                                                                                        XREF[1]: 004508cc(R)  
    00450974 26 73 c0 00              undefined4      00C07326h
                    DAT_00450978                                                                                                        XREF[1]: 004508e4(R)  
    00450978 78 67 be 00              undefined4      00BE6778h
                    DAT_0045097c                                                                                                        XREF[1]: 004508fc(R)  
    0045097c a4 09 be 00              undefined4      00BE09A4h

7
  • Which architecture is libil2cpp.so compiled for?
    – raspiduino
    Aug 11, 2022 at 2:39
  • 1
    @raspiduino, armv7 in this case.
    – hanan
    Aug 11, 2022 at 7:10
  • 1
    Of course, previously searched on google and make such conclusions that ghidra decompiler somehow put in there for simplicity or may be. But any idea to achieve such goal?
    – hanan
    Aug 11, 2022 at 7:16
  • 1
    @raspiduino I have edited the question and added the decompiled updateScore fucntion. take a look plz.
    – hanan
    Aug 11, 2022 at 7:46
  • 1
    I can't think of anyway other than storing the value 0x249F0 to an unused place in the binary, then use LDR to load it from its address to the param_1. Hopefully someone will think of a better way to do it
    – raspiduino
    Aug 11, 2022 at 8:10

1 Answer 1

2

ARM limits the values of constants you can use in the MOV instruction: The complete MOV instruction needs to fit into 32 bits, so there is no space for an arbitrary 32-bit constant. Probably 0x25000 would be possible. If it needs to be 0x249F0 exactly, there is no chance to put that into the 32-bit space occupied by mov param_2, #0

Using LDR in PC-relative mode, and storing 0x249F0 in free space close to the instruction might work, but you would need to find a free 32-bit slot yourself first.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.