Reverse Engineering for Beginners

(avery) #1

CHAPTER 20. LINEAR CONGRUENTIAL GENERATOR CHAPTER 20. LINEAR CONGRUENTIAL GENERATOR


Listing 20.7: Optimizing GCC 4.4.5 (objdump)

objdump -D rand_O3.o


00000000 :
0: 3c020000 lui v0,0x0
4: 03e00008 jr ra
8: ac440000 sw a0,0(v0)


0000000c :
c: 3c030000 lui v1,0x0
10: 8c620000 lw v0,0(v1)
14: 00200825 move at,at
18: 00022880 sll a1,v0,0x2
1c: 00022100 sll a0,v0,0x4
20: 00a42021 addu a0,a1,a0
24: 00042980 sll a1,a0,0x6
28: 00a42023 subu a0,a1,a0
2c: 00822021 addu a0,a0,v0
30: 00042940 sll a1,a0,0x5
34: 00852021 addu a0,a0,a1
38: 000420c0 sll a0,a0,0x3
3c: 00821021 addu v0,a0,v0
40: 00022080 sll a0,v0,0x2
44: 00441021 addu v0,v0,a0
48: 3c043c6e lui a0,0x3c6e
4c: 3484f35f ori a0,a0,0xf35f
50: 00441021 addu v0,v0,a0
54: ac620000 sw v0,0(v1)
58: 03e00008 jr ra
5c: 30427fff andi v0,v0,0x7fff


objdump -r rand_O3.o


RELOCATION RECORDS FOR [.text]:
OFFSET TYPE VALUE
00000000 R_MIPS_HI16 .bss
00000008 R_MIPS_LO16 .bss
0000000c R_MIPS_HI16 .bss
00000010 R_MIPS_LO16 .bss
00000054 R_MIPS_LO16 .bss


Let’s consider the two relocations for themy_srand()function. The first one, for address 0 has a type ofR_MIPS_HI16
and the second one for address 8 has a type ofR_MIPS_LO16. That implies that address of the beginning of the .bss
segment is to be written into the instructions at address of 0 (high part of address) and 8 (low part of address). The
rand_statevariable is at the very start of the .bss segment. So we see zeroes in the operands of instructionsLUIand
SW, because nothing is there yet—the compiler don’t know what to write there. The linker will fix this, and the high part of
the address will be written into the operand ofLUIand the low part of the address—to the operand ofSW.SWwill sum up
the low part of the address and what is in register $V0 (the high part is there).


It’s the same story with the my_rand() function: R_MIPS_HI16 relocation instructs the linker to write the high part of the .bss
segment address into instructionLUI. So the high part of the rand_state variable address is residing in register $V1. The
LWinstruction at address 0x10 sums up the high and low parts and loads the value of the rand_state variable into $V1. The
SWinstruction at address 0x54 do the summing again and then stores the new value to the rand_state global variable.


IDA processes relocations while loading, thus hiding these details, but we ought to remember them.


20.5 Thread-safe version of the example.


The thread-safe version of the example is to be demonstrated later:65.1 on page 656.

Free download pdf