Microsoft Word - iOSAppReverseEngineering.docx

“s” decides whether “op” sets flags or not, there are 4 flags:

N (Negative)

If the result is negative then assign 1 to N, otherwise assign 0 to N.

Z (Zero)

If the result is zero then assign 1 to Z, otherwise assign 0 to Z.

C (Carry)

For add operations (including CMN), if they have carry then assign 1 to C, otherwise

assign 0 to C; for sub operations (including CMP), Carry acts as Not-Borrow, if borrow

happens then assign 0 to C, otherwise assign 1 to C; for shift operations (excluding add

or sub), assign C the last bit to be shifted out; for the rest of operations, C stays

unchanged.

V (oVerflow)

If the operation overflows then assign 1 to V, otherwise assign 0 to V.

One thing to note, C flag works on unsigned calculations, whereas V flag works on signed

calculations.

Data processing instructions can be divided into 4 kinds:

• Arithmetic instructions

ADD R0, R1, R2 ; R0 = R1 + R2

ADC R0, R1, R2 ; R0 = R1 + R2 + C(arry)

SUB R0, R1, R2 ; R0 = R1 - R2

SBC R0, R1, R2 ; R0 = R1 - R2 - !C

RSB R0, R1, R2 ; R0 = R2 - R1

RSC R0, R1, R2 ; R0 = R2 - R1 - !C

All arithmetic instructions are based on ADD and SUB. RSB is the abbreviation of “Reverse

SuB”, which just reverse the two operands of SUB; instructions ending with “C” stands for ADD

with carry or SUB with borrow, and they will assign 1 to C flag when there is carry or there isn’t

borrow.

-^ Logical operation instructions

AND R0, R1, R2 ; R0 = R1 & R2

ORR R0, R1, R2 ; R0 = R1 | R2

EOR R0, R1, R2 ; R0 = R1 ^ R2

BIC R0, R1, R2 ; R0 = R1 &~ R2

MOV R0, R2 ; R0 = R2

MVN R0, R2 ; R0 = ~R2

There is not much to explain about these instructions with their corresponding C operators.

You may have noticed that there’s no shift instruction, because ARM uses barrel shift with 4

instructions:

LSL Logical Shift Left, as shown in figure 6- 4