Reverse Engineering for Beginners

(avery) #1

CHAPTER 24. 64-BIT VALUES IN 32-BIT ENVIRONMENT CHAPTER 24. 64-BIT VALUES IN 32-BIT ENVIRONMENT


Chapter 24


64-bit values in 32-bit environment


In a 32-bit environment,GPR’s are 32-bit, so 64-bit values are stored and passed as 32-bit value pairs^1.


24.1 Returning of 64-bit value


#include <stdint.h>


uint64_t f ()
{
return 0x1234567890ABCDEF;
};


24.1.1 x86


In a 32-bit environment, 64-bit values are returned from functions in theEDX:EAXregister pair.


Listing 24.1: Optimizing MSVC 2010

_f PROC
mov eax, -1867788817 ; 90abcdefH
mov edx, 305419896 ; 12345678H
ret 0
_f ENDP


24.1.2 ARM.


A 64-bit value is returned in the R0-R1 register pair (R1 is for the high part and R0 for the low part):


Listing 24.2: Optimizing Keil 6/2013 (ARM mode)

||f|| PROC
LDR r0,|L0.12|
LDR r1,|L0.16|
BX lr
ENDP


|L0.12|
DCD 0x90abcdef
|L0.16|
DCD 0x12345678


(^1) By the way, 32-bit values are passed as pairs in 16-bit environment in the same way:53.4 on page 576

Free download pdf