-
Notifications
You must be signed in to change notification settings - Fork 13
5: The ARM processor
Once we have IDA open, we will begin to see some weird letters and numbers on the screen. These are instructions in the ARM assembly language. Mobile devices such as Android and iOS devices are powered by a processor running the ARM architecture. Here we will be focusing on armv7(32-bit) exclusively, since MCPE Android does not yet have an arm64(64-bit) build.
The armv7 processor has 16 main 32-bit registers.
r0-r12 are general purpose registers, they can be used for almost anything.
r13 is the stack pointer. This register holds a pointer to the top of the stack and should not be changed.
r14 is the link register. Before a Branch with Link (BL or BLX) is executed, the address of the following instruction is stored into r14. r14 can act as a general purpose register if its value is pushed to the stack in the function prologue.
r15 is the program counter. This register holds the address of the next instruction to execute and is constantly updated to keep the program running. If the PC is changed, the program will jump to its held address at the next CPU loop.
The ARM calling convention follows the following rules:
r0-r3 will hold the first four parameters (given that the parameters are of a primitive type, a pointer, or a reference). In the case of class member functions, r0 will hold the pointer to this.
The stack will hold any parameters which are: greater than 32-bit (such as a long, however the compiler may choose to pass each half of the long to two registers); or a full object.
The return of a function is stored in r0 at the end of that function.
Before a function is called using a BL or BLX instruction, the address of the following instruction is stored into r14. When the called function completes, it will execute a BX LR to return to the calling function.
If the called function is large and needs to use r14 as a general purpose register, then it will push r14 onto the stack in the function prologue and then pop it into r15 at the end of the function, which acts as a return.
If a function returns a full object, then the calling convention follows this exception to the above rules:
The calling function will allocate memory on the stack for the returned object. It will store the pointer to this stack space in r0. If the called function is object-oriented, then the this pointer will instead be stored in r1.
TODO