我正在对从使用8051微控制器的嵌入式设备中转储的某些固件进行反向工程。我遇到了这个功能，Ghidra对其进行了如下分解：
undefined FUN_CODE_1cff()
undefined R7:1 <RETURN>
FUN_CODE_1cff
1cff XCH A,R5
1d00 MOV A,R7
1d01 XCH A,R5
1d02 MOV A,R5
1d03 MOV R2,A
1d04 MOV A,R6
1d05 MOV R7,A
1d06 MOV A,R2
1d07 MOV R6,A
1d08 RET
所以我认为这是在做
+-------------+----------------+----+----+----+----+----+
| Instruction | Explanation | A | R2 | R5 | R6 | R7 |
+-------------+----------------+----+----+----+----+----+
| | | 10 | 2 | 5 | 6 | 7 |
| XCH A,R5 | Swap A with R5 | 5 | 2 | 10 | 6 | 7 |
| MOV A,R7 | Copy R7 into A | 7 | 2 | 10 | 6 | 7 |
| XCH A,R5 | Swap A with R5 | 10 | 2 | 7 | 6 | 7 |
| MOV A,R5 | Copy R5 into A | 7 | 2 | 7 | 6 | 7 |
| MOV R2,A | Copy A into R2 | 7 | 7 | 7 | 6 | 7 |
| MOV A,R6 | Copy R6 into A | 6 | 7 | 7 | 6 | 7 |
| MOV R7,A | Copy A into R7 | 6 | 7 | 7 | 6 | 6 |
| MOV A,R2 | Copy R2 into A | 7 | 7 | 7 | 6 | 6 |
| MOV R6,A | Copy A into R6 | 7 | 7 | 7 | 7 | 6 |
| RET | Return | 7 | 7 | 7 | 7 | 6 |
+-------------+----------------+----+----+----+----+----+
但这似乎有很多不必要的步骤。这样会不会更简单？
+-------------+----------------+----+----+----+----+----+
| Instruction | Explanation | A | R2 | R5 | R6 | R7 |
+-------------+----------------+----+----+----+----+----+
| | | 10 | 2 | 5 | 6 | 7 |
| XCH A,R6 | Swap A with R6 | 6 | 2 | 5 | 10 | 7 |
| XCH A,R7 | Swap A with R7 | 7 | 2 | 5 | 10 | 6 |
| MOV R2,A | Copy A into R2 | 7 | 7 | 5 | 10 | 6 |
| MOV R5,A | Copy A into R5 | 7 | 7 | 7 | 10 | 6 |
| MOV R6,A | Copy A into R6 | 7 | 7 | 7 | 7 | 6 |
| RET | Return | 7 | 7 | 7 | 7 | 6 |
+-------------+----------------+----+----+----+----+----+
这是我的假设，您不能在两个MOV寄存器之间直接XCH或R#。能够MOV不会在这里有所作为，但是我认为，如果可以XCH，则可以像这样削掉另外一行：
+-------------+-----------------+----+----+----+----+----+
| Instruction | Explanation | A | R2 | R5 | R6 | R7 |
+-------------+-----------------+----+----+----+----+----+
| | | 10 | 2 | 5 | 6 | 7 |
| XCH R6,R7 | Swap R6 with R7 | 10 | 2 | 5 | 7 | 6 |
| MOV A,R6 | Copy R6 into A | 7 | 2 | 5 | 7 | 6 |
| MOV R2,A | Copy A into R2 | 7 | 7 | 5 | 7 | 6 |
| MOV R5,A | Copy A into R5 | 7 | 7 | 7 | 7 | 6 |
| RET | Return | 7 | 7 | 7 | 7 | 6 |
+-------------+-----------------+----+----+----+----+----+
话虽这么说，没有人知道为什么可能会按原样实施吗？我不认为这是要混淆代码-我从（P87C51RB2BA）转储的芯片具有“读取保护”位，可以在对其进行编程时设置该位，并且可以选择对其进行读取加密的代码。我认为如果他们有任何理由想要混淆代码，他们会设置其中之一，但是（很幸运）看起来他们没有，因为我能够以明文形式转储芯片。 （除非我的筹码仅仅是“ functional by mistake”。）无论如何都混淆了这一部分会很奇怪。
编辑：我忘了提到有问题的函数在代码中的很多地方都被调用；实际上，这是我在该固件中看到的最常调用的功能之一。
这是一些周围的代码，从另一个看起来类似卷积的函数开始（尽管并没有那么多地被调用，并且我没有详细分析它）
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_CODE_1cd3()
undefined R7:1
FUN_CODE_1cd3 XREF[9]: FUN_CODE_0311:0462(c),
FUN_CODE_0311:04d8(c),
FUN_CODE_0311:0604(c),
FUN_CODE_0dd4:0dd6(c),
FUN_CODE_0f9b:0fa4(c),
FUN_CODE_0f9b:0fbd(c),
ibus_2002_handler:1009(c),
FUN_CODE_1134:1136(c),
ibus_3002_handler:116c(c)
CODE:1cd3 c8 XCH A,R0
CODE:1cd4 ef MOV A,R7
CODE:1cd5 c8 XCH A,R0
CODE:1cd6 e6 MOV A,@R0
CODE:1cd7 fe MOV R6,A
CODE:1cd8 08 INC R0
CODE:1cd9 e6 MOV A,@R0
CODE:1cda ff MOV R7,A
CODE:1cdb 12 1c ff LCALL FUN_CODE_1cff undefined FUN_CODE_1cff()
CODE:1cde 22 RET
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_CODE_1cdf()
undefined R7:1
FUN_CODE_1cdf XREF[2]: FUN_CODE_0cd4:0da7(c),
FUN_CODE_1569:158a(c)
CODE:1cdf 12 18 4d LCALL FUN_CODE_184d undefined FUN_CODE_184d()
CODE:1ce2 78 6c MOV R0,#0x6c
CODE:1ce4 e6 MOV A,@R0=>DAT_INTMEM_6c = ??
CODE:1ce5 24 05 ADD A,#0x5
CODE:1ce7 f5 2f MOV DAT_INTMEM_2f,A = ??
CODE:1ce9 22 RET
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_CODE_1cea()
undefined R7:1
FUN_CODE_1cea XREF[1]: FUN_CODE_165c:16b1(c)
CODE:1cea e5 1d MOV A,BANK3_R5 = ??
CODE:1cec 60 06 JZ LAB_CODE_1cf4
CODE:1cee 12 1c 70 LCALL FUN_CODE_1c70 undefined FUN_CODE_1c70()
CODE:1cf1 12 1b d5 LCALL FUN_CODE_1bd5 undefined FUN_CODE_1bd5()
LAB_CODE_1cf4 XREF[1]: CODE:1cec(j)
CODE:1cf4 22 RET
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_CODE_1cf5()
undefined R7:1
FUN_CODE_1cf5 XREF[3]: FUN_CODE_0311:0520(c),
FUN_CODE_0311:0611(c),
FUN_CODE_1569:15b2(c)
CODE:1cf5 e5 2d MOV A,DAT_INTMEM_2d = ??
CODE:1cf7 04 INC A
CODE:1cf8 ff MOV R7,A
CODE:1cf9 30 e7 02 JNB ACC.7,LAB_CODE_1cfe = ??
CODE:1cfc 7f 01 MOV R7,#0x1
LAB_CODE_1cfe XREF[1]: CODE:1cf9(j)
CODE:1cfe 22 RET
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_CODE_1cff()
undefined R7:1
FUN_CODE_1cff XREF[23]: FUN_CODE_0cd4:0cf2(c),
FUN_CODE_0cd4:0d17(c),
FUN_CODE_0cd4:0d23(c),
FUN_CODE_0cd4:0d2f(c),
FUN_CODE_0cd4:0d3b(c),
FUN_CODE_0cd4:0d61(c),
FUN_CODE_0dd4:0e46(c),
FUN_CODE_1068:10d9(c),
FUN_CODE_1068:10f6(c),
ibus_3004_handler:1190(c),
ibus_3004_handler:11b5(c),
ibus_3004_handler:11c1(c),
ibus_3004_handler:11cd(c),
ibus_3004_handler:11d9(c),
FUN_CODE_184d:1861(c),
FUN_CODE_184d:1886(c),
FUN_CODE_1988:1996(c),
FUN_CODE_1988:19b4(c),
FUN_CODE_1a5c:1a63(c),
FUN_CODE_1a5c:1a76(c), [more]
CODE:1cff cd XCH A,R5
CODE:1d00 ef MOV A,R7
CODE:1d01 cd XCH A,R5
CODE:1d02 ed MOV A,R5
CODE:1d03 fa MOV R2,A
CODE:1d04 ee MOV A,R6
CODE:1d05 ff MOV R7,A
CODE:1d06 ea MOV A,R2
CODE:1d07 fe MOV R6,A
CODE:1d08 22 RET
LAB_CODE_1d09 XREF[1]: CODE:1cc2(j)
CODE:1d09 7b 01 MOV R3,#0x1
CODE:1d0b 7a 00 MOV R2,#0x0
CODE:1d0d 02 1b 12 LJMP LAB_CODE_1b12
DAT_CODE_1d10 XREF[1]: start:152a(R)
CODE:1d10 01 undefined1 01h
DAT_CODE_1d11 XREF[1]: start:1538(R)
CODE:1d11 1b undefined1 1Bh
DAT_CODE_1d12 XREF[3]: start:14ed(R), start:14ff(R),
start:1547(R)
CODE:1d12 00 undefined1 00h
DAT_CODE_1d13 XREF[4]: start:14f1(R), start:14ff(R),
start:152a(R), start:154b(R)
CODE:1d13 01 undefined1 01h
DAT_CODE_1d14 XREF[3]: start:14f1(R), start:152a(R),
start:154f(R)
CODE:1d14 1f undefined1 1Fh
DAT_CODE_1d15 XREF[2]: start:152a(R), start:154f(R)
CODE:1d15 08 undefined1 08h
CODE:1d16 00 ?? 00h
编辑2：该设备是用于Brinks警报面板的手持编程设备，与my video here中看到的相同。
答案 0 :(得分：2)
通过一些猜测（请参阅评论），我们得出结论
FUN_CODE_1cff
1cff XCH A,R5
1d00 MOV A,R7
1d01 XCH A,R5
1d02 MOV A,R5
1d03 MOV R2,A
1d04 MOV A,R6
1d05 MOV R7,A
1d06 MOV A,R2
1d07 MOV R6,A
1d08 RET
很有可能是由某些非优化编译器生成的从小端到大端的转换函数。在C语言中，它将类似于：
uint16_t Convert16_BE2LE(uint16 var)
{
uint16_t retVal;
retVal = ((var & 0x00FF) << 8) | ((var & 0xFF00) >> 8);
return retVal;
}
R5，R2被编译器用作暂存器。
正如我在评论中提到的那样，早在2000-2005年，我就与Wind River的ccz80编译器一起使用，在优化方面产生了类似的结果。只需将特定的C结构转换为固定的操作码序列即可。结果，该代码是正确的，但对于那些曾经进行手工汇编编程的人来说，它看起来并不是最理想的选择。但是，另一方面，这使编译器便宜，小巧（约150-200K）并且非常快。