对 ARM-v7a 函数进行逆向工程

逆向工程 手臂 爪哇
2021-06-17 22:05:30

目前我正在尝试对以下 armeabi-v7a 函数进行逆向工程:

在此处输入图片说明

我已经编写了以下 Java 代码:

 static double getFunc(double param0, double param1, double param2, double param3) {
      double r3, s7, s8, d4, d5, d6, d7, s10, s12, s13, s14, s15;
      s14 = 100.0;
      r3 = param3 - 0xAA;
      s13 = param0;
      s15 = param2;
      s8 = 4.0;
      s7 = param3;
      s10 = 7.0;
      s13 = s13  /s14;

      if (param1 == 1) {
          s13 = s15 *s13;
          s15 = s13 * s8;
          d4 = 0.22;
          s10 = s15 / s10;
          d5 = s10;
          d4 = d5 * d4;
          d5 = 0.6;
          s12 = s7 / s14;
          d5 = d4 * d5;
          s10 = d5;
          s12 = s10 + s12;
      } else {
          s15 = s15 * s13;
          d6 = 0.34;
          s15 = s15 * s8;
          s10 = s15 / s10;
          d5 = s10;
          d5 = d5 * d6;
          d6 = 0.45;
          d6 = d5 * d6;
          s15 = d6;
          s12 = s7 / s14;
          s12 = s15 + s12;
      }

      s14 = 10.0;
      s14 = s12 * s14;
      d6 = 0.5;
      d7 = s14;
      d7 = d7 + d6;
      s14 = d7;
      d6 = 10.0;
      d7 = s14;
      d7 = d7 / d6;

      return d7;
  }

不幸的是,我没有得到正确的结果。我做错了什么,但我有点卡住了。

可能是我不了解 armeabi-v7a 程序集上的参数处理。我在代码中做对了吗?R3 是第三个参数吗?R# 总是整数值还是也可以是双精度值?VCVT.F32.F64 对 Java 实现重要吗?如果是,我该如何正确处理它们?R0 是返回寄存器?

如果有人可以审查我的代码,那就太棒了。

编辑:按要求反汇编代码:

getFunc       proc

             VLDR    S14, gvar_1318 
             SUBS    R3, #AAh
             CMP     R1, #1h
             VMOV    S13, R0
             VMOV    S15, R2
             VMOV.F32 S8, #4.000000E+00
             VMOV    S7, R3
             VMOV.F32 S10, #7.000000E+00
             VDIV.F32 S13, S13, S14
             BNE     loc 1294
             VMUL.F32 S13, S15, S13
             VMUL.F32 S15, S13, S8
             VLDR    D4, gvar_12F8
             VDIV.F32 S10, S15, S10
             VCVT.F64.F32 D5, S10 
             VCVT.F32.S32 S7, S7 
             VMUL.F64 D4, D5, D4 
             VLDR    D5, gvar_1300 
             VDIV.F32 S12, S7, S14 
             VMUL.F64 D5, D4, D5 
             VCVT.F32.F64 S10, D5 
             VADD.F32 S12, S10, S12
             B        loc_12C4
loc_1294:
             VMUL.F32 S15, S15, S13 
             VLDR    D6, gvar 1308 
             VMUL.F32 S15, S15, S8 
             VDIV.F32 S10, S15, S10 
             VCVT.F64.F32 D5, S10
             VMUL.F64 D5, D5, D6 
             VLDR    D6, gvar_1310 
             VMUL.F64 D6, D5, D6 
             VCVT.F32.S32 S7, S7 
             VCVT.F32.F64 S15, D6 
             VDIV.F32 S12, S7, S14 
             VADD.F32 S12, S15, S12
loc_12C4:
             VMOV.F32 S14, #1.000000E+01 
             VMUL.F32 S14, S12, S14 
             VMOV.F64 D6, #5.000000E-01 
             VCVT.F64.F32 D7, S14 
             VADD.F64 D7, D7, D6 
             VCVT.S32.F64 S14, D7 
             VMOV.F64 D6, #1.000000E+01 
             VCVT.F64.S32 D7, S14 
             VDIV.F64 D7, D7, D6 
             VCVT.F32.F64 S15, D7
             VMOV    R0, S15
             BX      LR

getFunc        endp


LOAD.text:000012F2           db 0, BFh, AFh, F3h, 0, 80h 
LOAD.text:000012F8 gvar_12F8 dq 3FCC28F5C28F5C29h
LOAD.text:00001300 gvar_1300 dq 3FE3333340000000h 
LOAD.text:00001308 gvar_1308 dq 3FD5C28F5C28F5C3h 
LOAD.text:00001310 gvar_1310 dq 3FDCCCCCC0000000h 
LOAD.text:00001318 gvar_1318 dd 42C80000h
LOAD.text:0000131C           db AFh, F3h, 0, 80h
2个回答

也许以下行是错误的:

if (param == 1)

我认为应该是

if (param != 1)

如果 Z==0,则 BNE 分支。

我想我发现了错误。

我错误地将程序集翻译SUBS R3, #AAhr3 = param3 - 0xAA;但它应该是param3 = param3 - 0xAA;

专家能否证实我的错误?