ARM 上的浮点寄存器

逆向工程 手臂
2021-07-03 06:51:14

当我反汇编处理浮点值的 ARM 代码时,如何打印出寄存器?(我正在使用 Gdb)。

   0x000083d8 <+12>:    ldr r3, [pc, #56]   ; 0x8418 <main+76>
   0x000083dc <+16>:    str r3, [r11, #-8]
   0x000083e0 <+20>:    vldr    s14, [r11, #-8]
   0x000083e4 <+24>:    vldr    s15, [pc, #40]  ; 0x8414 <main+72>

s14在这种情况下,我如何打印出登记册?

2个回答

要打印s14来自 gdb的值

info registers s14

p $reg

在从源用户模式+ GDB 8.2 Ubuntu 16.04构建的 QEMU v3.0.0 中,如果您这样做:info registers并且info vector它不显示浮点值而是将它们四舍五入为整数,我认为存在错误。

但是,以下确实有效。首先我加载:

1.5, 2.5, 3.5, 4.5

进入 v0/q0。

ARMv8

(gdb) p $v0
$2 = {
  d = {
    f = {[0] = 8.0000018998980522, [1] = 1024.0002455711365}, 
    u = {[0] = 4620693218751676416, [1] = 4652218416153755648}, 
    s = {[0] = 4620693218751676416, [1] = 4652218416153755648}
  }, 
  s = {
    f = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}, 
    u = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}, 
    s = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}
  }, 
  h = {
    u = {[0] = 0, [1] = 16320, [2] = 0, [3] = 16416, [4] = 0, [5] = 16480, [6] = 0, [7] = 16528}, 
    s = {[0] = 0, [1] = 16320, [2] = 0, [3] = 16416, [4] = 0, [5] = 16480, [6] = 0, [7] = 16528}
  }, 
  b = {
    u = {[0] = 0, [1] = 0, [2] = 192, [3] = 63, [4] = 0, [5] = 0, [6] = 32, [7] = 64, [8] = 0, [9] = 0, [10] = 96, [11] = 64, [12] = 0, [13] = 0, [14] = 144, [15] = 64}, 
    s = {[0] = 0, [1] = 0, [2] = -64, [3] = 63, [4] = 0, [5] = 0, [6] = 32, [7] = 64, [8] = 0, [9] = 0, [10] = 96, [11] = 64, [12] = 0, [13] = 0, [14] = -112, [15] = 64}
  }, 
  q = {
    u = {[0] = 85818282497786728556221825347259203584}, 
    s = {[0] = 85818282497786728556221825347259203584}
  }
}

和:

(gdb) p $v0.s
$3 = {
  f = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}, 
  u = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}, 
  s = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}
}

和:

(gdb) p $v0.s.f
$3 = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}

测试设置

ARMv7

(gdb) p $q0
$3 = {
  u8 = {[0] = 0, [1] = 0, [2] = 192, [3] = 63, [4] = 0, [5] = 0, [6] = 32, [7] = 64, [8] = 0, [9] = 0, [10] = 96, [11] = 64, [12] = 0, [13] = 0, [14] = 144, [15] = 64}, 
  u16 = {[0] = 0, [1] = 16320, [2] = 0, [3] = 16416, [4] = 0, [5] = 16480, [6] = 0, [7] = 16528}, 
  u32 = {[0] = 1069547520, [1] = 1075838976, [2] = 1080033280, [3] = 1083179008}, 
  u64 = {[0] = 4620693218751676416, [1] = 4652218416153755648}, 
  f32 = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}, 
  f64 = {[0] = 8.0000018998980522, [1] = 1024.0002455711365}
}

和:

(gdb) p $q0.f32
$5 = {[0] = 1.5, [1] = 2.5, [2] = 3.5, [3] = 4.5}

测试设置

漏洞

我之前提到的错误在 ARMv8 中导致:

(gdb) i r v0
v0             {
  d = {
    f = {[0x0] = 0x8, [0x1] = 0x400}, 
    u = {[0x0] = 0x402000003fc00000, [0x1] = 0x4090000040600000}, 
    s = {[0x0] = 0x402000003fc00000, [0x1] = 0x4090000040600000}
  }, 
  s = {
    f = {[0x0] = 0x1, [0x1] = 0x2, [0x2] = 0x3, [0x3] = 0x4}, 
    u = {[0x0] = 0x3fc00000, [0x1] = 0x40200000, [0x2] = 0x40600000, [0x3] = 0x40900000}, 
    s = {[0x0] = 0x3fc00000, [0x1] = 0x40200000, [0x2] = 0x40600000, [0x3] = 0x40900000}
  }, 
  h = {
    u = {[0x0] = 0x0, [0x1] = 0x3fc0, [0x2] = 0x0, [0x3] = 0x4020, [0x4] = 0x0, [0x5] = 0x4060, [0x6] = 0x0, [0x7] = 0x4090}, 
    s = {[0x0] = 0x0, [0x1] = 0x3fc0, [0x2] = 0x0, [0x3] = 0x4020, [0x4] = 0x0, [0x5] = 0x4060, [0x6] = 0x0, [0x7] = 0x4090}
  }, 
  b = {
    u = {[0x0] = 0x0, [0x1] = 0x0, [0x2] = 0xc0, [0x3] = 0x3f, [0x4] = 0x0, [0x5] = 0x0, [0x6] = 0x20, [0x7] = 0x40, [0x8] = 0x0, [0x9] = 0x0, [0xa] = 0x60, [0xb] = 0x40, [0xc] = 0x0, [0xd] = 0x0, [0xe] = 0x90, [0xf] = 0x40}, 
    s = {[0x0] = 0x0, [0x1] = 0x0, [0x2] = 0xc0, [0x3] = 0x3f, [0x4] = 0x0, [0x5] = 0x0, [0x6] = 0x20, [0x7] = 0x40, [0x8] = 0x0, [0x9] = 0x0, [0xa] = 0x60, [0xb] = 0x40, [0xc] = 0x0, [0xd] = 0x0, [0xe] = 0x90, [0xf] = 0x40}
  }, 
  q = {
    u = {[0x0] = 0x4090000040600000402000003fc00000}, 
    s = {[0x0] = 0x4090000040600000402000003fc00000}
  }
}

所以请注意该v0.s.f如何舍入整数而不是浮点数:

  s = {
    f = {[0x0] = 0x1, [0x1] = 0x2, [0x2] = 0x3, [0x3] = 0x4},

SVE

尚未在 QEMU 上实现,请参阅:https : //stackoverflow.com/questions/52888916/how-to-assemble-arm-sve-instructions-with-gnu-gas-or-llvm-and-run-it-on- qemu/52888917#52888917