Figure out the objective-c code from this snipette

Question

I am very new to the reverse engineering but I am trying to create objective-c code from an ARM assembly for iOS. I have come a very long way but now I am stuck at a point. Can anyone please tell me what the following code means (taken from IDA pro):

__text:0050F428                 PUSH            {R4-R7,LR}
__text:0050F42A                 ADD             R7, SP, #0xC
__text:0050F42C                 PUSH.W          {R8,R10,R11}

__text:0050F430                 MOVW            R2, #(:lower16:(aNNYnnQsJNFsQFs - 0x50F440)) ; "¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+"...

__text:0050F434                 MOVS            R1, #0

__text:0050F436                 MOVT.W          R2, #(:upper16:(aNNYnnQsJNFsQFs - 0x50F440)) ; "¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+"...

__text:0050F43A                 MOVS            R3, #0x36

__text:0050F43C                 ADD             R2, PC  ; "¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+"...

__text:0050F43E                 MOV.W           R9, #0x32

__text:0050F442                 MOV.W           R12, #0x65

__text:0050F446                 MOV.W           LR, #0x39

__text:0050F44A                 MOVS            R4, #0x62

__text:0050F44C                 MOV.W           R10, #0x34

__text:0050F450                 MOV.W           R11, #0x64

__text:0050F454                 MOVS            R6, #0x31

__text:0050F456 loc_50F456                              ; CODE XREF: sub_50F428+154j

__text:0050F456                 LDRB.W          R8, [R2,R1]

__text:0050F45A                 STRB.W          R8, [R0,R1]

__text:0050F45E                 CMP.W           R8, #0x3A

__text:0050F462                 BGT             loc_50F46E

__text:0050F464                 CMP.W           R8, #0xD

__text:0050F468                 IT EQ

__text:0050F46A                 STREQB          R3, [R0,R1]

__text:0050F46C                 B               loc_50F578 ; jumptable 0050F522 default case

The Pseudocode from Hopper is:

r2 = ""\\xB1;\\xF4\\xB8;\\xAD\\xBB\\r\\r\\xB8\\xAD\\xF4;\\r|Y\\xAD\\xAD\\xB8\\x9Fs\\xBBj\\xB2\\r\\xAD\\xB3\\xD8;\\xB3fs\\xD8\\xB2\\xB8\\xD8\\x9F\\xF4fs|Yj\\xBBY\\xD8\\xBB\\xF4\\xF4\\xB1j\\xB1\\xAD\\xF4f\\xAD\\xB1\\xD8Y;\\xB8\\xF4\\xBB\\xF4";"

r8 = *(r2 + r1);
*(r0 + r1) = r8;
if (r8 > 0x3a) goto loc_50f46e;

What I fail to understand is the type of the variable the whose value will be loaded in r2 register. If r2 contains a hex string then should i convert it to NSData? When the comparison is being done with 0x3A, what does that mean? Are they comparing the size of the data to 0x3A (58 in decimal i suppose).

Sorry if this is very naive. As I said I am new and trying to learn.

Answer 1

You have to see the three instructions

MOVW            R2, #(:lower16:(aNNYnnQsJNFsQFs - 0x50F440)) ; "¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+"...
MOVT.W          R2, #(:upper16:(aNNYnnQsJNFsQFs - 0x50F440)) ; "¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+"...
ADD             R2, PC  ; "¦;(+;¡+\r\r+¡(;\r|Y¡¡+ƒs+j¦\r¡¦+;¦fs+¦+"...

together. The MOVW and MOVT.W load the relative address of a string into R2; adding PC to it is the standard way on ARM to make code - and data - location-independent so the loader doesn't have to adjust to the load address.

So, these instructions make R2 point to the string '|;(+;......'.

Also note that R1 gets initialized to 0.

At loc_50F456 - which i assume is a loop start - the instructions get one byte from the R2 string into R8, and write the byte to another string at R0. As R0 hasn't been initialized yet, it's probably a function parameter. Note that the LDRB and the STRB opcodes both index with R1 in addition to R0. This is typical for a loop that copies from R2 to R0 with R1 being incremented each time.

After that, R8 still holds the byte from the R2 string. Comparing it to 0x3A means comparing it to 58 decimal, yes. But as the byte originates in a string, which consists of ASCII characters, you should look up the ASCII character for 0x3A, which is :. So the BGT is done on any character 'greater' than that, which includes letters and some punctuation, but doesn't include numbers. And next, the code compares the character to 0x0D - carriage return - which is \r, and occurs several times in your string. If it is \r, it gets replaced with the value from R3, which has been initialized to 0x36 earlier, which is the ASCII digit 6.

At loc_50F46E, you'll probably have more code that mangles your letters somehow.

This seems to me like a part of a password checker, or serial number checker, where the password is encrypted in the code, so a simple strings command doesn't reveal it.

BTW, if you're learning, it's often much easier to run this in a debugger, single-step, and check what each register contains after each step. In my experience, this helps you understand what's going on quicker than just glancing at the code, especially if you aren't familiar with what exactly each opcodes does.

Also, don't rely on recompilation to C or something similar. Whatever a decompiler produces is an Approximation, and often one that doesn't resemble the original code very well. The C decompilation will allow you to understand code structure faster, once you're able to read assembly, but it will horribly confuse you if you don't understand the assembly and try to use it instead.