Question

在Linux ARM平台上，objdump为我提供了以下特定功能：

00000154 <compare_count>:
 154:   e92d4008    push    {r3, lr}
 158:   e59f302c    ldr r3, [pc, #44]   ; 18c <compare_count+0x38>
 15c:   e5933014    ldr r3, [r3, #20]
 160:   e3530000    cmp r3, #0
 164:   01a00003    moveq   r0, r3
 168:   08bd8008    popeq   {r3, pc}
 16c:   e1530000    cmp r3, r0
 170:   ba000001    blt 17c <compare_count+0x28>
 174:   e3a00000    mov r0, #0
 178:   e8bd8008    pop {r3, pc}
 17c:   e59f000c    ldr r0, [pc, #12]   ; 190 <compare_count+0x3c>
 180:   ebfffffe    bl  0 <printf>
 184:   e3a0006c    mov r0, #108    ; 0x6c
 188:   e8bd8008    pop {r3, pc}
 18c:   00000000    andeq   r0, r0, r0
 190:   00000038    andeq   r0, r0, r8, lsr r0

可以将其翻译回C代码吗？什么是近似翻译？

Answer 1

0x18c处的字不仅仅是零，而是全局变量的空间持有者。（其地址在链接时放置）这个全局变量似乎是结构或由整数组成的数组的指针。我们假设它是一个数组。

0x190处的字包含外部函数的地址。

extern int * a_global_array;
void unknown_function(void);

int a_function(int n)
{
  int temp_val = a_global_array[5];
  if (temp_val == 0) return 0;
  if (temp_val >= n) return 0;
  unknown_function();
  return 108;
}

Answer 2

#define MAX 108

typedef struct X {
    int pad[5];
    int count;
} X_type;

X_type a;

int compare_count(int i, int i2, int i3) {
    if (a.count == 0)
        return a.count;
    if (a.count < i) {
        printf("%d", i2, i3, a.count);
        return MAX;
    }
    return 0;
}

objdump的

...somepadding...
00000154 <compare_count>:
 154:   e92d4008    push    {r3, lr}
 158:   e59f3030    ldr r3, [pc, #48]   ; 190 <compare_count+0x3c>
 15c:   e5933014    ldr r3, [r3, #20]
 160:   e3530000    cmp r3, #0
 164:   0a000002    beq 174 <compare_count+0x20>
 168:   e1530000    cmp r3, r0
 16c:   a3a03000    movge   r3, #0
 170:   ba000001    blt 17c <compare_count+0x28>
 174:   e1a00003    mov r0, r3
 178:   e8bd8008    pop {r3, pc}
 17c:   e59f0010    ldr r0, [pc, #16]   ; 194 <compare_count+0x40>
 180:   ebfffffe    bl  0 <printf>
 184:   e3a0306c    mov r3, #108    ; 0x6c
 188:   e1a00003    mov r0, r3
 18c:   e8bd8008    pop {r3, pc}
 190:   00000000    .word   0x00000000
 194:   00000000    .word   0x00000000

Answer 3

我不熟悉ARM指令集，但在快速浏览参考手册之后，这是我的第一次尝试：

// push    {r3, lr}
r3 = pc[44];
// ldr r3, [pc, #44]   ; 18c <compare_count+0x38>

r3 = r3[20];
// ldr r3, [r3, #20]

if (r3 == 0) 
// cmp r3, #0
{
  return r3;
  // moveq   r0, r3
  // popeq   {r3, pc}
}
if (r3 >= r0)
// cmp r3, r0
// blt 17c <compare_count+0x28>
{
  return 0;
  // mov r0, #0
  // pop {r3, pc}
}

printf(pc[12]);
// ldr r0, [pc, #12]   ; 190 <compare_count+0x3c>
// bl  0 <printf>

return 108;
// mov r0, #108    ; 0x6c
// pop {r3, pc}

// looks like the rest of it is data or 
// garbage values for padding alignment?
/*
andeq   r0, r0, r0
andeq   r0, r0, r8, lsr r0
*/

将一些装配线转换为C代码

3 个答案: