Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 5
Exercise 5 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called
All instructions have a width of 16 bits, so we are dealing with code in Thumb state.
One argument is passed to the function in register
R0 and we can infer from the numerous comparisons that it is presumably of type integer (32 bit).
There are several exit points of the function, as we can see from the Branch and Exchange instructions (
BX LR). Before each branch instruction, a
LDR pseudoinstruction into register
R0 is carried out. It uses PC-relative addressing to load a constant string value into
We arrive at the following function prototype:
The pattern from line 3 to 12 strongly indicates that the original program utilizes the switch-case programming construct, as the input value is compared to a range of numbers. For the input 6, the string “E” is returned, for the input 7 the string “D”, for #8 the string “C” and so on and so forth:
Our proposed C code for mystery5 is as follows: