Microsoft Word - iOSAppReverseEngineering.docx

-^ Branch instructions

Branch instructions can be divided into 2 kinds: unconditional branches and conditional

branches.

² Unconditional branches

B Label ; PC = Label

BL Label ; LR = PC – 4; PC = Label

BX Rd ; PC = Rd ,and switch instruction set

Unconditional branches are easy to understand, for example:

foo():

B Label ; Jump to Label to keep executing

....... ; Can’t reach here

Label:

.......

² Conditional branches

The “cond” of conditional branches are decided by the 4 flag mentioned in section 6.2.1,

their correspondences are:

cond flag

EQ Z = 1

NE Z = 0

CS C = 1

HS C = 1

CC C = 0

LO C = 0

MI N = 1

PL N = 0

VS V = 1

VC V = 0

HI C = 1 & Z = 0

LS C = 0 | Z = 1

GE N = V

LT N != V

GT Z = 0 & N = V

LE Z = 1 | N != V

Before every conditional branch there will be a data processing instruction to set the flag,

which determines if the condition is met or not, hence influence the code execution flow.

Label:

LDR R0, [R1], #4

CMP R0, 0 ; If R0 == 0 then Z = 1; else Z = 0

BNE Label ; If Z == 0 then jump

• THUMB instructions

THUMB instruction set is a subset of ARM instruction set. Every THUMB instruction is 16

bits long, so THUMB instructions are more space saving than ARM instructions, and can be

faster transferred on 16-bit data bus. However, you can’t make an omelet without breaking

eggs. All THUMB instructions except “b” can’t be executed conditionally; barrel shift can’t