如何找到函数原型? (需要LD_PRELOAD)

时间:2014-08-07 07:49:14

标签: c linux assembly mips ld-preload

我有一些闭源库。我需要在函数draw_something周围创建一个钩子(LD_PRELOAD),并在此库中调用。我想禁用它(不做任何动作而不是动作)。 objdump很好地为我分解了一个功能,但我在asm中完全是一个菜鸟。库是为MIPS架构而构建的。

我不知道如何从程序集中提取C函数原型。可能吗?你能说一个函数有多少参数和它返回的内容?如果你有一个关于这个主题的文档/博客,请给我链接。

UPD:编译器为mips-linux-gnu-gcc (Sourcery G++ Lite 4.3-51) 4.3.2

反汇编功能:

00004fe0 <draw_something>:
    4fe0:   3c1c0002    lui gp,0x2
    4fe4:   279c9cc0    addiu   gp,gp,-25408
    4fe8:   0399e021    addu    gp,gp,t9
    4fec:   27bdff90    addiu   sp,sp,-112
    4ff0:   afbf006c    sw  ra,108(sp)
    4ff4:   afbe0068    sw  s8,104(sp)
    4ff8:   afb70064    sw  s7,100(sp)
    4ffc:   afb60060    sw  s6,96(sp)
    5000:   afb5005c    sw  s5,92(sp)
    5004:   afb40058    sw  s4,88(sp)
    5008:   afb30054    sw  s3,84(sp)
    500c:   afb20050    sw  s2,80(sp)
    5010:   afb1004c    sw  s1,76(sp)
    5014:   afb00048    sw  s0,72(sp)
    5018:   afbc0020    sw  gp,32(sp)
    501c:   8c99001c    lw  t9,28(a0)
    5020:   00809821    move    s3,a0
    5024:   8c84000c    lw  a0,12(a0)
    5028:   30a500ff    andi    a1,a1,0xff
    502c:   0320f809    jalr    t9
    5030:   00003021    move    a2,zero
    5034:   afa20038    sw  v0,56(sp)
    5038:   8fa30038    lw  v1,56(sp)
    503c:   24020006    li  v0,6
    5040:   10620010    beq v1,v0,5084 <draw_something+0xa4>
    5044:   8fbc0020    lw  gp,32(sp)
    5048:   24020009    li  v0,9
    504c:   afa20038    sw  v0,56(sp)
    5050:   8fbf006c    lw  ra,108(sp)
    5054:   8fa20038    lw  v0,56(sp)
    5058:   8fbe0068    lw  s8,104(sp)
    505c:   8fb70064    lw  s7,100(sp)
    5060:   8fb60060    lw  s6,96(sp)
    5064:   8fb5005c    lw  s5,92(sp)
    5068:   8fb40058    lw  s4,88(sp)
    506c:   8fb30054    lw  s3,84(sp)
    5070:   8fb20050    lw  s2,80(sp)
    5074:   8fb1004c    lw  s1,76(sp)
    5078:   8fb00048    lw  s0,72(sp)
    507c:   03e00008    jr  ra
    5080:   27bd0070    addiu   sp,sp,112
    5084:   3c0200da    lui v0,0xda
    5088:   02622021    addu    a0,s3,v0
    508c:   2405000b    li  a1,11
    5090:   8c8377a0    lw  v1,30624(a0)
    5094:   10650006    beq v1,a1,50b0 <draw_something+0xd0>
    5098:   2402000d    li  v0,13
    509c:   10620075    beq v1,v0,5274 <draw_something+0x294>
    50a0:   2402000a    li  v0,10
    50a4:   1462ffeb    bne v1,v0,5054 <draw_something+0x74>
    50a8:   8fbf006c    lw  ra,108(sp)
    50ac:   ac8577a0    sw  a1,30624(a0)
    50b0:   8f858024    lw  a1,-32732(gp)
    50b4:   27a3002c    addiu   v1,sp,44
    50b8:   8f998040    lw  t9,-32704(gp)
    50bc:   afa30040    sw  v1,64(sp)
    50c0:   00602021    move    a0,v1
    50c4:   0320f809    jalr    t9
    50c8:   24a56b00    addiu   a1,a1,27392
    50cc:   3c020013    lui v0,0x13
    50d0:   02621021    addu    v0,s3,v0
    50d4:   24030008    li  v1,8
    50d8:   8c5785f4    lw  s7,-31244(v0)
    50dc:   8c5585f8    lw  s5,-31240(v0)
    50e0:   3c02cccc    lui v0,0xcccc
    50e4:   3442cccd    ori v0,v0,0xcccd
    50e8:   02e20019    multu   s7,v0
    50ec:   00001010    mfhi    v0
    50f0:   0075a80a    movz    s5,v1,s5
    50f4:   8fb20040    lw  s2,64(sp)
    50f8:   241100c8    li  s1,200
    50fc:   02408021    move    s0,s2
    5100:   0002a0c2    srl s4,v0,0x3
    5104:   001418c0    sll v1,s4,0x3
    5108:   00141040    sll v0,s4,0x1
    510c:   00431021    addu    v0,v0,v1
    5110:   02e2a023    subu    s4,s7,v0
    5114:   27a20028    addiu   v0,sp,40
    5118:   afa2003c    sw  v0,60(sp)
    511c:   27be0033    addiu   s8,sp,51
    5120:   24160028    li  s6,40
    5124:   92020000    lbu v0,0(s0)
    5128:   3c03c000    lui v1,0xc000
    512c:   8e64000c    lw  a0,12(s3)
    5130:   8e790014    lw  t9,20(s3)
    5134:   346340c0    ori v1,v1,0x40c0
    5138:   8fa7003c    lw  a3,60(sp)
    513c:   02202821    move    a1,s1
    5140:   a3a20028    sb  v0,40(sp)
    5144:   a3a00029    sb  zero,41(sp)
    5148:   afa30010    sw  v1,16(sp)
    514c:   afb60014    sw  s6,20(sp)
    5150:   afa00018    sw  zero,24(sp)
    5154:   afa0001c    sw  zero,28(sp)
    5158:   240600c8    li  a2,200
    515c:   0320f809    jalr    t9
    5160:   26100001    addiu   s0,s0,1
    5164:   8fbc0020    lw  gp,32(sp)
    5168:   17d0ffee    bne s8,s0,5124 <draw_something+0x144>
    516c:   26310028    addiu   s1,s1,40
    5170:   3c02cccc    lui v0,0xcccc
    5174:   02f43823    subu    a3,s7,s4
    5178:   3442cccd    ori v0,v0,0xcccd
    517c:   00e20019    multu   a3,v0
    5180:   00003810    mfhi    a3
    5184:   8f858024    lw  a1,-32732(gp)
    5188:   8f998040    lw  t9,-32704(gp)
    518c:   02a03021    move    a2,s5
    5190:   8fa40040    lw  a0,64(sp)
    5194:   3c15c000    lui s5,0xc000
    5198:   afb40010    sw  s4,16(sp)
    519c:   24a56b08    addiu   a1,a1,27400
    51a0:   000738c2    srl a3,a3,0x3
    51a4:   36b540c0    ori s5,s5,0x40c0
    51a8:   241000c8    li  s0,200
    51ac:   27b40034    addiu   s4,sp,52
    51b0:   0320f809    jalr    t9
    51b4:   24110028    li  s1,40
    51b8:   92420000    lbu v0,0(s2)
    51bc:   8e64000c    lw  a0,12(s3)
    51c0:   8e790014    lw  t9,20(s3)
    51c4:   8fa7003c    lw  a3,60(sp)
    51c8:   02002821    move    a1,s0
    51cc:   a3a20028    sb  v0,40(sp)
    51d0:   a3a00029    sb  zero,41(sp)
    51d4:   afb50010    sw  s5,16(sp)
    51d8:   afb10014    sw  s1,20(sp)
    51dc:   afa00018    sw  zero,24(sp)
    51e0:   afa0001c    sw  zero,28(sp)
    51e4:   240600fa    li  a2,250
    51e8:   0320f809    jalr    t9
    51ec:   26520001    addiu   s2,s2,1
    51f0:   8fbc0020    lw  gp,32(sp)
    51f4:   1692fff0    bne s4,s2,51b8 <draw_something+0x1d8>
    51f8:   26100028    addiu   s0,s0,40
    51fc:   3c0200da    lui v0,0xda
    5200:   02628021    addu    s0,s3,v0
    5204:   2411000b    li  s1,11
    5208:   8e0377a4    lw  v1,30628(s0)
    520c:   10710037    beq v1,s1,52ec <draw_something+0x30c>
    5210:   2c62000c    sltiu   v0,v1,12
    5214:   10400029    beqz    v0,52bc <draw_something+0x2dc>
    5218:   2402000c    li  v0,12
    521c:   2402000a    li  v0,10
    5220:   14620008    bne v1,v0,5244 <draw_something+0x264>
    5224:   3c02c000    lui v0,0xc000
    5228:   8f858024    lw  a1,-32732(gp)
    522c:   8f998040    lw  t9,-32704(gp)
    5230:   8fa40040    lw  a0,64(sp)
    5234:   0320f809    jalr    t9
    5238:   24a56b14    addiu   a1,a1,27412
    523c:   ae1177a4    sw  s1,30628(s0)
    5240:   3c02c000    lui v0,0xc000
    5244:   8e64000c    lw  a0,12(s3)
    5248:   8e790014    lw  t9,20(s3)
    524c:   344240c0    ori v0,v0,0x40c0
    5250:   24030028    li  v1,40
    5254:   8fa70040    lw  a3,64(sp)
    5258:   afa20010    sw  v0,16(sp)
    525c:   afa30014    sw  v1,20(sp)
    5260:   afa00018    sw  zero,24(sp)
    5264:   afa0001c    sw  zero,28(sp)
    5268:   240501e0    li  a1,480
    526c:   0320f809    jalr    t9
    5270:   240600c8    li  a2,200
    5274:   8e64000c    lw  a0,12(s3)
    5278:   8e790020    lw  t9,32(s3)
    527c:   0320f809    jalr    t9
    5280:   00002821    move    a1,zero
    5284:   8fbf006c    lw  ra,108(sp)
    5288:   8fa20038    lw  v0,56(sp)
    528c:   8fbc0020    lw  gp,32(sp)
    5290:   8fbe0068    lw  s8,104(sp)
    5294:   8fb70064    lw  s7,100(sp)
    5298:   8fb60060    lw  s6,96(sp)
    529c:   8fb5005c    lw  s5,92(sp)
    52a0:   8fb40058    lw  s4,88(sp)
    52a4:   8fb30054    lw  s3,84(sp)
    52a8:   8fb20050    lw  s2,80(sp)
    52ac:   8fb1004c    lw  s1,76(sp)
    52b0:   8fb00048    lw  s0,72(sp)
    52b4:   03e00008    jr  ra
    52b8:   27bd0070    addiu   sp,sp,112
    52bc:   10620013    beq v1,v0,530c <draw_something+0x32c>
    52c0:   2402000d    li  v0,13
    52c4:   1462ffdf    bne v1,v0,5244 <draw_something+0x264>
    52c8:   3c02c000    lui v0,0xc000
    52cc:   8f858024    lw  a1,-32732(gp)
    52d0:   8f998040    lw  t9,-32704(gp)
    52d4:   8fa40040    lw  a0,64(sp)
    52d8:   0320f809    jalr    t9
    52dc:   24a56b20    addiu   a1,a1,27424
    52e0:   2402000a    li  v0,10
    52e4:   1000ffd6    b   5240 <draw_something+0x260>
    52e8:   ae0277a4    sw  v0,30628(s0)
    52ec:   8f858024    lw  a1,-32732(gp)
    52f0:   8f998040    lw  t9,-32704(gp)
    52f4:   8fa40040    lw  a0,64(sp)
    52f8:   0320f809    jalr    t9
    52fc:   24a56b18    addiu   a1,a1,27416
    5300:   2402000c    li  v0,12
    5304:   1000ffce    b   5240 <draw_something+0x260>
    5308:   ae0277a4    sw  v0,30628(s0)
    530c:   8f858024    lw  a1,-32732(gp)
    5310:   8f998040    lw  t9,-32704(gp)
    5314:   8fa40040    lw  a0,64(sp)
    5318:   0320f809    jalr    t9
    531c:   24a56b1c    addiu   a1,a1,27420
    5320:   2402000d    li  v0,13
    5324:   1000ffc6    b   5240 <draw_something+0x260>
    5328:   ae0277a4    sw  v0,30628(s0)

1 个答案:

答案 0 :(得分:3)

您不需要原型,您只需要知道:

  • 如何调整堆栈指针
  • 要保存/恢复的注册表。

据我所知,在Linux / MIPS的情况下,答案就像经典的C:

  • 来电恢复用于参数的堆栈
  • 来电者保存用于参数的寄存器
  • 被叫函数保存并恢复其使用的其他寄存器。

详情请见此处:http://math-atlas.sourceforge.net/devel/assembly/mipsabi32.pdf

这意味着你对函数的原型并不重要,因为恢复堆栈和参数寄存器是调用者的责任,编译器会自动发出代码来保存/恢复它使用的寄存器。所以你可以做到void draw_something(){}

或者它可能需要特定的返回值,在这种情况下int draw_something(){return 0;}可能会有效。

如果函数导致后来依赖的副作用(例如更新光标位置),这将无法工作,因为当然你不会生成代码来执行此操作。