Reverse Engineering for Beginners

(avery) #1
CHAPTER 3. HELLO, WORLD! CHAPTER 3. HELLO, WORLD!
The register containing theputs()address is called $T9, because registers prefixed with T- are called “temporaries” and
their contents may not be preserved.

3.5.3 Non-optimizing GCC.


Non-optimizing GCC is more verbose.

Listing 3.20: Non-optimizing GCC 4.4.5 (assembly output)
1 $LC0:
2 .ascii "Hello, world!\012\000"
3 main:
4 ; function prologue.
5 ; save the RA ($31) and FP in the stack:
6 addiu $sp,$sp,-32
7 sw $31,28($sp)
8 sw $fp,24($sp)
9 ; set the FP (stack frame pointer):
10 move $fp,$sp
11 ; set the GP:
12 lui $28,%hi(gnu_local_gp)
13 addiu $28,$28,%lo(
gnu_local_gp)
14 ; load the address of the text string:
15 lui $2,%hi($LC0)
16 addiu $4,$2,%lo($LC0)
17 ; load the address of puts() using the GP:
18 lw $2,%call16(puts)($28)
19 nop
20 ; call puts():
21 move $25,$2
22 jalr $25
23 nop ; branch delay slot
24
25 ; restore the GP from the local stack:
26 lw $28,16($fp)
27 ; set register $2 ($V0) to zero:
28 move $2,$0
29 ; function epilogue.
30 ; restore the SP:
31 move $sp,$fp
32 ; restore the RA:
33 lw $31,28($sp)
34 ; restore the FP:
35 lw $fp,24($sp)
36 addiu $sp,$sp,32
37 ; jump to the RA:
38 j $31
39 nop ; branch delay slot


We see here that register FP is used as a pointer to the stack frame. We also see 3NOP^31 s. The second and third of which
follow the branch instructions.

Perhaps, the GCC compiler always addsNOPs (because ofbranch delay slots) after branch instructions and then, if optimization
is turned on, maybe eliminates them. So in this case they are left here.

Here is alsoIDAlisting:

Listing 3.21: Non-optimizing GCC 4.4.5 (IDA)
1 .text:00000000 main:
2 .text:00000000
3 .text:00000000 var_10 = -0x10
4 .text:00000000 var_8 = -8
5 .text:00000000 var_4 = -4
6 .text:00000000
7 ; function prologue.
8 ; save the RA and FP in the stack:
9 .text:00000000 addiu $sp, -0x20
10 .text:00000004 sw $ra, 0x20+var_4($sp)


(^31) No OPeration

Free download pdf