Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 3
Exercise 3 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function
It is provided in Thumb mode, as we can see from the instruction width, which is consistently 16 bits. Furthermore, the decompilation is greatly facilitated thanks to the lack of any conditional statements. Any kind of NULL-checks, for instance, are omitted.
The function mystery3 takes two arguments in
r1, as these registers are accessed without prior initialization. Both arguments are pointers to some unknown structure, as they are accessed in memory load and store operations with different offsets. The return value is always 0, as 0 is put into register r0 before exiting. Thus far, we arrive at the following function prototype:
As far as the data types of the arguments are concerned, we can make the following statements about their composition:
The function copies values of the first argument’s structure into the second element’s structure: