Reverse Engineering for Beginners

CHAPTER 7. SCANF() CHAPTER 7. SCANF()

7.1.5 ARM.

Optimizing Keil 6/2013 (Thumb mode)

.text:00000042 scanf_main

.text:00000042

.text:00000042 var_8 = -8

.text:00000042

.text:00000042 08 B5 PUSH {R3,LR}

.text:00000044 A9 A0 ADR R0, aEnterX ; "Enter X:\n"

.text:00000046 06 F0 D3 F8 BL __2printf

.text:0000004A 69 46 MOV R1, SP

.text:0000004C AA A0 ADR R0, aD ; "%d"

.text:0000004E 06 F0 CD F8 BL __0scanf

.text:00000052 00 99 LDR R1, [SP,#8+var_8]

.text:00000054 A9 A0 ADR R0, aYouEnteredD___ ; "You entered %d...\n"

.text:00000056 06 F0 CB F8 BL __2printf

.text:0000005A 00 20 MOVS R0, #0

.text:0000005C 08 BD POP {R3,PC}

In order forscanf()to be able to read item it needs a parameter—pointer to anint.intis 32-bit, so we need 4 bytes to

store it somewhere in memory, and it fits exactly in a 32-bit register. A place for the local variablexis allocated in the stack

andIDAhas named itvar_8. It is not necessary, however, to allocate a such sinceSP(stack pointer) is already pointing to that

space and it can be used directly. So,SP’s value is copied to theR1register and, together with the format-string, passed to

scanf(). Later, with the help of theLDRinstruction, this value is moved from the stack to theR1register in order to be

passed toprintf().

ARM64

Listing 7.3: Non-optimizing GCC 4.9.1 ARM64
1 .LC0:
2 .string "Enter X:"
3 .LC1:
4 .string "%d"
5 .LC2:
6 .string "You entered %d...\n"
7 scanf_main:
8 ; subtract 32 from SP, then save FP and LR in stack frame:
9 stp x29, x30, [sp, -32]!
10 ; set stack frame (FP=SP)
11 add x29, sp, 0
12 ; load pointer to the "Enter X:" string:
13 adrp x0, .LC0
14 add x0, x0, :lo12:.LC0
15 ; X0=pointer to the "Enter X:" string
16 ; print it:
17 bl puts
18 ; load pointer to the "%d" string:
19 adrp x0, .LC1
20 add x0, x0, :lo12:.LC1
21 ; find a space in stack frame for "x" variable (X1=FP+28):
22 add x1, x29, 28
23 ; X1=address of "x" variable
24 ; pass the address to scanf() and call it:
25 bl __isoc99_scanf
26 ; load 32-bit value from the variable in stack frame:
27 ldr w1, [x29,28]
28 ; W1=x
29 ; load pointer to the "You entered %d...\n" string
30 ; printf() will take text string from X0 and "x" variable from X1 (or W1)
31 adrp x0, .LC2
32 add x0, x0, :lo12:.LC2
33 bl printf
34 ; return 0
35 mov w0, 0
36 ; restore FP and LR, then add 32 to SP:
37 ldp x29, x30, [sp], 32