iOS逆向之循環(huán)&選擇(五)

cmp(Compare)比較指令

???CMP 把一個(gè)寄存器的內(nèi)容和另一個(gè)寄存器的內(nèi)容或立即數(shù)進(jìn)行比較。但不存儲(chǔ)結(jié)果,只是正確的更改標(biāo)志。
???一般CMP做完判斷后會(huì)進(jìn)行跳轉(zhuǎn),后面通常會(huì)跟上B指令!

  • BL 標(biāo)號(hào):跳轉(zhuǎn)到標(biāo)號(hào)處執(zhí)行
  • B.GT 標(biāo)號(hào):比較結(jié)果是大于(greater than),執(zhí)行標(biāo)號(hào),否則不跳轉(zhuǎn)
  • B.GE 標(biāo)號(hào):比較結(jié)果是大于等于(greater than or equal to),執(zhí)行標(biāo)號(hào),否則不跳轉(zhuǎn)
  • B.EQ 標(biāo)號(hào):比較結(jié)果是等于,執(zhí)行標(biāo)號(hào),否則不跳轉(zhuǎn)
  • B.HI 標(biāo)號(hào):比較結(jié)果是無(wú)符號(hào)大于,執(zhí)行標(biāo)號(hào),否則不跳轉(zhuǎn)
屏幕快照 2018-04-26 下午12.56.55.png

Switch

1、假設(shè)switch語(yǔ)句的分支比較少的時(shí)候(例如3,少于4的時(shí)候沒(méi)有意義)沒(méi)有必要使用此結(jié)構(gòu),相當(dāng)于if。

__text:00000001000067F8                 EXPORT _funA
__text:00000001000067F8 _funA                                   ; CODE XREF: _main+20↓p
__text:00000001000067F8
__text:00000001000067F8 var_24          = -0x24
__text:00000001000067F8 var_20          = -0x20
__text:00000001000067F8 var_1C          = -0x1C
__text:00000001000067F8 var_18          = -0x18
__text:00000001000067F8 var_14          = -0x14
__text:00000001000067F8 var_10          = -0x10
__text:00000001000067F8 var_C           = -0xC
__text:00000001000067F8 var_8           = -8
__text:00000001000067F8 var_4           = -4
__text:00000001000067F8 var_s0          =  0
__text:00000001000067F8
__text:00000001000067F8                 SUB             SP, SP, #0x40
__text:00000001000067FC                 STP             X29, X30, [SP,#0x30+var_s0]
__text:0000000100006800                 ADD             X29, SP, #0x30
__text:0000000100006804                 STUR            W0, [X29,#var_4]
__text:0000000100006808                 LDUR            W0, [X29,#var_4]
__text:000000010000680C                 MOV             X8, X0
__text:0000000100006810                 SUBS            W0, W0, #1
__text:0000000100006814                 STUR            W8, [X29,#var_8]
__text:0000000100006818                 STUR            W0, [X29,#var_C]
__text:000000010000681C                 B.EQ            loc_10000684C
__text:0000000100006820                 B               loc_100006824
__text:0000000100006824 ; ---------------------------------------------------------------------------
__text:0000000100006824
__text:0000000100006824 loc_100006824                           ; CODE XREF: _funA+28↑j
__text:0000000100006824                 LDUR            W8, [X29,#var_8]
__text:0000000100006828                 SUBS            W9, W8, #2
__text:000000010000682C                 STUR            W9, [X29,#var_10]
__text:0000000100006830                 B.EQ            loc_100006860
__text:0000000100006834                 B               loc_100006838
__text:0000000100006838 ; ---------------------------------------------------------------------------
__text:0000000100006838
__text:0000000100006838 loc_100006838                           ; CODE XREF: _funA+3C↑j
__text:0000000100006838                 LDUR            W8, [X29,#var_8]
__text:000000010000683C                 SUBS            W9, W8, #3
__text:0000000100006840                 STUR            W9, [X29,#var_14]
__text:0000000100006844                 B.EQ            loc_100006874
__text:0000000100006848                 B               loc_100006888
__text:000000010000684C ; ---------------------------------------------------------------------------
__text:000000010000684C
__text:000000010000684C loc_10000684C                           ; CODE XREF: _funA+24↑j
__text:000000010000684C                 ADRP            X0, #asc_100007F08@PAGE ; "打坐"
__text:0000000100006850                 ADD             X0, X0, #asc_100007F08@PAGEOFF ; "打坐"
__text:0000000100006854                 BL              _printf
__text:0000000100006858                 STR             W0, [SP,#0x30+var_18]
__text:000000010000685C                 B               loc_100006898
__text:0000000100006860 ; ---------------------------------------------------------------------------
__text:0000000100006860
__text:0000000100006860 loc_100006860                           ; CODE XREF: _funA+38↑j
__text:0000000100006860                 ADRP            X0, #asc_100007F0F@PAGE ; "加紅"
__text:0000000100006864                 ADD             X0, X0, #asc_100007F0F@PAGEOFF ; "加紅"
__text:0000000100006868                 BL              _printf
__text:000000010000686C                 STR             W0, [SP,#0x30+var_1C]
__text:0000000100006870                 B               loc_100006898
__text:0000000100006874 ; ---------------------------------------------------------------------------
__text:0000000100006874
__text:0000000100006874 loc_100006874                           ; CODE XREF: _funA+4C↑j
__text:0000000100006874                 ADRP            X0, #asc_100007F16@PAGE ; "加藍(lán)"
__text:0000000100006878                 ADD             X0, X0, #asc_100007F16@PAGEOFF ; "加藍(lán)"
__text:000000010000687C                 BL              _printf
__text:0000000100006880                 STR             W0, [SP,#0x30+var_20]
__text:0000000100006884                 B               loc_100006898
__text:0000000100006888 ; ---------------------------------------------------------------------------
__text:0000000100006888
__text:0000000100006888 loc_100006888                           ; CODE XREF: _funA+50↑j
__text:0000000100006888                 ADRP            X0, #asc_100007F1D@PAGE ; "啥都不干"
__text:000000010000688C                 ADD             X0, X0, #asc_100007F1D@PAGEOFF ; "啥都不干"
__text:0000000100006890                 BL              _printf
__text:0000000100006894                 STR             W0, [SP,#0x30+var_24]
__text:0000000100006898
__text:0000000100006898 loc_100006898                           ; CODE XREF: _funA+64↑j
__text:0000000100006898                                         ; _funA+78↑j ...
__text:0000000100006898                 LDP             X29, X30, [SP,#0x30+var_s0]
__text:000000010000689C                 ADD             SP, SP, #0x40
__text:00000001000068A0                 RET
__text:00000001000068A0 ; End of function _funA

2、各個(gè)分支常量的差值較大的時(shí)候,編譯器會(huì)在效率還是內(nèi)存進(jìn)行取舍,這個(gè)時(shí)候編譯器還是會(huì)編譯成類(lèi)似于if,else的結(jié)構(gòu)。

__text:00000001000067C8                 EXPORT _funA
__text:00000001000067C8 _funA                                   ; CODE XREF: _main+20↓p
__text:00000001000067C8
__text:00000001000067C8 var_2C          = -0x2C
__text:00000001000067C8 var_28          = -0x28
__text:00000001000067C8 var_24          = -0x24
__text:00000001000067C8 var_20          = -0x20
__text:00000001000067C8 var_1C          = -0x1C
__text:00000001000067C8 var_18          = -0x18
__text:00000001000067C8 var_14          = -0x14
__text:00000001000067C8 var_10          = -0x10
__text:00000001000067C8 var_C           = -0xC
__text:00000001000067C8 var_8           = -8
__text:00000001000067C8 var_4           = -4
__text:00000001000067C8 var_s0          =  0
__text:00000001000067C8
__text:00000001000067C8                 SUB             SP, SP, #0x40
__text:00000001000067CC                 STP             X29, X30, [SP,#0x30+var_s0]
__text:00000001000067D0                 ADD             X29, SP, #0x30
__text:00000001000067D4                 STUR            W0, [X29,#var_4]
__text:00000001000067D8                 LDUR            W0, [X29,#var_4]
__text:00000001000067DC                 MOV             X8, X0
__text:00000001000067E0                 SUBS            W0, W0, #1
__text:00000001000067E4                 STUR            W8, [X29,#var_8]
__text:00000001000067E8                 STUR            W0, [X29,#var_C]
__text:00000001000067EC                 B.EQ            loc_100006830
__text:00000001000067F0                 B               loc_1000067F4
__text:00000001000067F4 ; ---------------------------------------------------------------------------
__text:00000001000067F4
__text:00000001000067F4 loc_1000067F4                           ; CODE XREF: _funA+28↑j
__text:00000001000067F4                 LDUR            W8, [X29,#var_8]
__text:00000001000067F8                 SUBS            W9, W8, #4
__text:00000001000067FC                 STUR            W9, [X29,#var_10]
__text:0000000100006800                 B.EQ            loc_10000686C
__text:0000000100006804                 B               loc_100006808
__text:0000000100006808 ; ---------------------------------------------------------------------------
__text:0000000100006808
__text:0000000100006808 loc_100006808                           ; CODE XREF: _funA+3C↑j
__text:0000000100006808                 LDUR            W8, [X29,#var_8]
__text:000000010000680C                 SUBS            W9, W8, #0xC8
__text:0000000100006810                 STUR            W9, [X29,#var_14]
__text:0000000100006814                 B.EQ            loc_100006844
__text:0000000100006818                 B               loc_10000681C
__text:000000010000681C ; ---------------------------------------------------------------------------
__text:000000010000681C
__text:000000010000681C loc_10000681C                           ; CODE XREF: _funA+50↑j
__text:000000010000681C                 LDUR            W8, [X29,#var_8]
__text:0000000100006820                 SUBS            W9, W8, #0x1F4
__text:0000000100006824                 STR             W9, [SP,#0x30+var_18]
__text:0000000100006828                 B.EQ            loc_100006858
__text:000000010000682C                 B               loc_100006880
__text:0000000100006830 ; ---------------------------------------------------------------------------
__text:0000000100006830
__text:0000000100006830 loc_100006830                           ; CODE XREF: _funA+24↑j
__text:0000000100006830                 ADRP            X0, #asc_100007F00@PAGE ; "打坐"
__text:0000000100006834                 ADD             X0, X0, #asc_100007F00@PAGEOFF ; "打坐"
__text:0000000100006838                 BL              _printf
__text:000000010000683C                 STR             W0, [SP,#0x30+var_1C]
__text:0000000100006840                 B               loc_100006890
__text:0000000100006844 ; ---------------------------------------------------------------------------
__text:0000000100006844
__text:0000000100006844 loc_100006844                           ; CODE XREF: _funA+4C↑j
__text:0000000100006844                 ADRP            X0, #asc_100007F07@PAGE ; "加紅"
__text:0000000100006848                 ADD             X0, X0, #asc_100007F07@PAGEOFF ; "加紅"
__text:000000010000684C                 BL              _printf
__text:0000000100006850                 STR             W0, [SP,#0x30+var_20]
__text:0000000100006854                 B               loc_100006890
__text:0000000100006858 ; ---------------------------------------------------------------------------
__text:0000000100006858
__text:0000000100006858 loc_100006858                           ; CODE XREF: _funA+60↑j
__text:0000000100006858                 ADRP            X0, #asc_100007F0E@PAGE ; "加藍(lán)"
__text:000000010000685C                 ADD             X0, X0, #asc_100007F0E@PAGEOFF ; "加藍(lán)"
__text:0000000100006860                 BL              _printf
__text:0000000100006864                 STR             W0, [SP,#0x30+var_24]
__text:0000000100006868                 B               loc_100006890
__text:000000010000686C ; ---------------------------------------------------------------------------
__text:000000010000686C
__text:000000010000686C loc_10000686C                           ; CODE XREF: _funA+38↑j
__text:000000010000686C                 ADRP            X0, #asc_100007F15@PAGE ; "擺攤"
__text:0000000100006870                 ADD             X0, X0, #asc_100007F15@PAGEOFF ; "擺攤"
__text:0000000100006874                 BL              _printf
__text:0000000100006878                 STR             W0, [SP,#0x30+var_28]
__text:000000010000687C                 B               loc_100006890
__text:0000000100006880 ; ---------------------------------------------------------------------------
__text:0000000100006880
__text:0000000100006880 loc_100006880                           ; CODE XREF: _funA+64↑j
__text:0000000100006880                 ADRP            X0, #asc_100007F1C@PAGE ; "啥都不干"
__text:0000000100006884                 ADD             X0, X0, #asc_100007F1C@PAGEOFF ; "啥都不干"
__text:0000000100006888                 BL              _printf
__text:000000010000688C                 STR             W0, [SP,#0x30+var_2C]
__text:0000000100006890
__text:0000000100006890 loc_100006890                           ; CODE XREF: _funA+78↑j
__text:0000000100006890                                         ; _funA+8C↑j ...
__text:0000000100006890                 LDP             X29, X30, [SP,#0x30+var_s0]
__text:0000000100006894                 ADD             SP, SP, #0x40
__text:0000000100006898                 RET
__text:0000000100006898 ; End of function _funA

3、在分支比較多的時(shí)候:在編譯的時(shí)候會(huì)生成一個(gè)表(跳轉(zhuǎn)表每個(gè)地址四個(gè)字節(jié))。

__text:00000001000067DC                 EXPORT _funA
__text:00000001000067DC _funA                                   ; CODE XREF: _main+20↓p
__text:00000001000067DC
__text:00000001000067DC var_28          = -0x28
__text:00000001000067DC var_24          = -0x24
__text:00000001000067DC var_20          = -0x20
__text:00000001000067DC var_1C          = -0x1C
__text:00000001000067DC var_18          = -0x18
__text:00000001000067DC var_14          = -0x14
__text:00000001000067DC var_10          = -0x10
__text:00000001000067DC var_4           = -4
__text:00000001000067DC var_s0          =  0
__text:00000001000067DC
__text:00000001000067DC                 SUB             SP, SP, #0x40
__text:00000001000067E0                 STP             X29, X30, [SP,#0x30+var_s0]
__text:00000001000067E4                 ADD             X29, SP, #0x30
__text:00000001000067E8                 STUR            W0, [X29,#var_4]
__text:00000001000067EC                 LDUR            W0, [X29,#var_4]
__text:00000001000067F0                 SUBS            W0, W0, #1 ; switch 4 cases
__text:00000001000067F4                 MOV             X8, X0
__text:00000001000067F8                 SUBS            W0, W0, #3
__text:00000001000067FC                 STUR            X8, [X29,#var_10]
__text:0000000100006800                 STUR            W0, [X29,#var_14]
__text:0000000100006804                 B.HI            def_10000681C ; jumptable 000000010000681C default case
__text:0000000100006808                 ADRP            X8, #jpt_10000681C@PAGE
__text:000000010000680C                 ADD             X8, X8, #jpt_10000681C@PAGEOFF
__text:0000000100006810                 LDUR            X9, [X29,#var_10]
__text:0000000100006814                 LDRSW           X10, [X8,X9,LSL#2]
__text:0000000100006818                 ADD             X8, X10, X8
__text:000000010000681C                 BR              X8      ; switch jump
__text:0000000100006820 ; ---------------------------------------------------------------------------
__text:0000000100006820
__text:0000000100006820 loc_100006820                           ; CODE XREF: _funA+40↑j
__text:0000000100006820                                         ; DATA XREF: __text:jpt_10000681C↓o
__text:0000000100006820                 ADRP            X0, #asc_100007F00@PAGE ; jumptable 000000010000681C case 1
__text:0000000100006824                 ADD             X0, X0, #asc_100007F00@PAGEOFF ; "打坐"
__text:0000000100006828                 BL              _printf
__text:000000010000682C                 STR             W0, [SP,#0x30+var_18]
__text:0000000100006830                 B               loc_100006880
__text:0000000100006834 ; ---------------------------------------------------------------------------
__text:0000000100006834
__text:0000000100006834 loc_100006834                           ; CODE XREF: _funA+40↑j
__text:0000000100006834                                         ; DATA XREF: __text:0000000100006890↓o
__text:0000000100006834                 ADRP            X0, #asc_100007F07@PAGE ; jumptable 000000010000681C case 2
__text:0000000100006838                 ADD             X0, X0, #asc_100007F07@PAGEOFF ; "加紅"
__text:000000010000683C                 BL              _printf
__text:0000000100006840                 STR             W0, [SP,#0x30+var_1C]
__text:0000000100006844                 B               loc_100006880
__text:0000000100006848 ; ---------------------------------------------------------------------------
__text:0000000100006848
__text:0000000100006848 loc_100006848                           ; CODE XREF: _funA+40↑j
__text:0000000100006848                                         ; DATA XREF: __text:0000000100006894↓o
__text:0000000100006848                 ADRP            X0, #asc_100007F0E@PAGE ; jumptable 000000010000681C case 3
__text:000000010000684C                 ADD             X0, X0, #asc_100007F0E@PAGEOFF ; "加藍(lán)"
__text:0000000100006850                 BL              _printf
__text:0000000100006854                 STR             W0, [SP,#0x30+var_20]
__text:0000000100006858                 B               loc_100006880
__text:000000010000685C ; ---------------------------------------------------------------------------
__text:000000010000685C
__text:000000010000685C loc_10000685C                           ; CODE XREF: _funA+40↑j
__text:000000010000685C                                         ; DATA XREF: __text:0000000100006898↓o
__text:000000010000685C                 ADRP            X0, #asc_100007F15@PAGE ; jumptable 000000010000681C case 4
__text:0000000100006860                 ADD             X0, X0, #asc_100007F15@PAGEOFF ; "擺攤"
__text:0000000100006864                 BL              _printf
__text:0000000100006868                 STR             W0, [SP,#0x30+var_24]
__text:000000010000686C                 B               loc_100006880
__text:0000000100006870 ; ---------------------------------------------------------------------------
__text:0000000100006870
__text:0000000100006870 def_10000681C                           ; CODE XREF: _funA+28↑j
__text:0000000100006870                 ADRP            X0, #asc_100007F1C@PAGE ; jumptable 000000010000681C default case
__text:0000000100006874                 ADD             X0, X0, #asc_100007F1C@PAGEOFF ; "啥都不干"
__text:0000000100006878                 BL              _printf
__text:000000010000687C                 STR             W0, [SP,#0x30+var_28]
__text:0000000100006880
__text:0000000100006880 loc_100006880                           ; CODE XREF: _funA+54↑j
__text:0000000100006880                                         ; _funA+68↑j ...
__text:0000000100006880                 LDP             X29, X30, [SP,#0x30+var_s0]
__text:0000000100006884                 ADD             SP, SP, #0x40
__text:0000000100006888                 RET
__text:0000000100006888 ; End of function _funA

還原高級(jí)代碼(if...else...)

OC代碼

#import <UIKit/UIKit.h>
#import "AppDelegate.h"

int g = 12;
void func(int a, int b) {
    if (a > b) {
        g = a;
    } else {
        g = b;
    }
}

int main(int argc, char * argv[]) {
    func(1, 2);
    return 0;
}

main函數(shù)匯編分析

__text:00000001000068CC _main
__text:00000001000068CC
__text:00000001000068CC var_10          = -0x10
__text:00000001000068CC var_8           = -8
__text:00000001000068CC var_4           = -4
__text:00000001000068CC var_s0          =  0
__text:00000001000068CC
__text:00000001000068CC                 SUB             SP, SP, #0x20
__text:00000001000068D0                 STP             X29, X30, [SP,#0x10+var_s0]
__text:00000001000068D4                 ADD             X29, SP, #0x10
__text:00000001000068D8                 MOV             W8, #1
int W8 = 1;
__text:00000001000068DC                 MOV             W9, #2
int W9 = 2;
__text:00000001000068E0                 STUR            WZR, [X29,#var_4]
__text:00000001000068E4                 STR             W0, [SP,#0x10+var_8]
int var_8 = W0;
__text:00000001000068E8                 STR             X1, [SP,#0x10+var_10]
int var_10 = X1;
__text:00000001000068EC                 MOV             X0, X8
int X0 = X8;
__text:00000001000068F0                 MOV             X1, X9
int X1 = X9;
__text:00000001000068F4                 BL              _func
跳轉(zhuǎn)到func函數(shù)
__text:00000001000068F8                 MOV             W8, #0
__text:00000001000068FC                 MOV             X0, X8
__text:0000000100006900                 LDP             X29, X30, [SP,#0x10+var_s0]
__text:0000000100006904                 ADD             SP, SP, #0x20
__text:0000000100006908                 RET
__text:0000000100006908 ; End of function _main

由此分析:函數(shù)名為func,并且?guī)蓚€(gè)參數(shù),參數(shù)類(lèi)型為int。

func函數(shù)匯編分析

//__text:0000000100006884                 EXPORT _func
//__text:0000000100006884 _func                                   ; CODE XREF: _main+28↓p
//__text:0000000100006884
//__text:0000000100006884 var_8           = -8
//__text:0000000100006884 var_4           = -4
//__text:0000000100006884
//__text:0000000100006884                 SUB             SP, SP, #0x10
int g = 12;//具體的值需要?jiǎng)討B(tài)調(diào)試得到
void func(int a, int b) {

//__text:0000000100006888                 STR             W0, [SP,#0x10+var_4]
    int var_4 = a;
//__text:000000010000688C                 STR             W1, [SP,#0x10+var_8]
    int var_8 = b;
//__text:0000000100006890                 LDR             W0, [SP,#0x10+var_4]
    int W0 = var_4;
//__text:0000000100006894                 LDR             W1, [SP,#0x10+var_8]
    int W1 = var_8;
//__text:0000000100006898                 CMP             W0, W1

    //__text:000000010000689C                 B.LE            loc_1000068B4

    if (W0 > W1) {
        //__text:00000001000068A0                 ADRP            X8, #_g@PAGE
        //__text:00000001000068A4                 ADD             X8, X8, #_g@PAGEOFF
        int* X8 = &g;
        //__text:00000001000068A8                 LDR             W9, [SP,#0x10+var_4]
        int W9 = var_4;
        //__text:00000001000068AC                 STR             W9, [X8]
        * X8 = W9;
    } else {
        //__text:00000001000068B4                 ADRP            X8, #_g@PAGE
        //__text:00000001000068B8                 ADD             X8, X8, #_g@PAGEOFF
        int* X8 = &g;
        //__text:00000001000068BC                 LDR             W9, [SP,#0x10+var_8]
        int W9 = var_8;
        //__text:00000001000068C0                 STR             W9, [X8]
        * X8 = W9;
    }

//__text:00000001000068C4                 ADD             SP, SP, #0x10
//__text:00000001000068C8                 RET
//__text:00000001000068C8 ; End of function _func
}

最后再做下優(yōu)化就是OC的代碼了。

最后編輯于
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成,瀏覽時(shí)請(qǐng)結(jié)合常識(shí)與多方信息審慎甄別。
平臺(tái)聲明:文章內(nèi)容(如有圖片或視頻亦包括在內(nèi))由作者上傳并發(fā)布,文章內(nèi)容僅代表作者本人觀點(diǎn),簡(jiǎn)書(shū)系信息發(fā)布平臺(tái),僅提供信息存儲(chǔ)服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容