Practical Reverse Engineering Exercise Solutions: Page 78 / Exercise 2
Exercise 2 of the ARM chapter has a rather short disassembly compared to the first exercise. Again, we are tasked with the decompilation of the provided function
The disassembly is as follows:
First of all, we notice that the function has been compiled in Thumb mode, as there are several instructions having a width of 16 bits, which is not possible in ARM mode. Furthermore, the instructions
IT are specific to Thumb mode and not available in ARM mode.
The function takes one argument, which is passed in register
r0. In line 3, a single byte is loaded from memory at address (
r0+0x63), so we can infer the argument is a structure with a character field at offset 0x63. The preliminary structure definition is given below:
The function returns either 0 or 1 in the register
r0, so we can specify the return type to be of type
BOOL. We arrive at the following function prototype:
In line 2, it is checked whether the passed argument is equal to 0, i.e. NULL. When it equals to NULL, the function returns 1 or TRUE.
In the block beginning with line 3, a single byte is loaded from address (
r0+0x63) and stored in
r0. Afterwards it is compared against 0 (line 4) and in case of inequality, 1 is stored in r0 (line 6).
To summarize, the function indicates to the caller whether the field at offset
0x63 of the passed structure is not set.
This very simple function can be written in C as follows: