Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

In fact, stack is in memory as well. But it works like a stack, i.e. follows the “first in last out”


rule. The stack of ARM is full descending, meaning that the stack grows towards lower address,


the latest object is placed at the bottom, which is at the lowest address, as shown in the figure 6-






Figure 6-1 The stack of ARM


A register, named “stack pointer” (hereafter referred to as SP), holds the bottom address of


stack, i.e. the stack address. We can push a register into stack to save its value, or pop a register


out of stack to load its value. During process running, SP changes a lot, but before and after a


block of code is executed, SP should stay the same, otherwise there will be a fatal problem.


Why? Let’s take an example:


static int global_var0;
static int global_var1;

...

void foo(void)
{
bar();
// other operations;
}

In the above code snippet, suppose that foo() uses registers A, B, C, and D; foo() calls bar(),


and suppose that bar() uses registers A, B, and C. Because registers A, B and C are overlapped in


foo() and bar(), bar() needs to save values of A, B, and C into stack before it starts execution.

Free download pdf