android 源码crtbegin_static.S中的_start函数如下(抽取重要部分):
_start:
mov r0,sp @取堆栈指针 sp指向main函数的参数argc(堆栈内容依次为argc,argv[],argc[])
mov r1,#0
adr r2,0f @标号0地址,即执行main函数的指针
adr r3,1f @标号1地址,即数组指针
b __libc_init
.....
可以看出main函数即_start 调用_libc_init时,寄存器R2的值.
静态链接程序实例IDA的反汇编代码(加上自己的注释):
.text:000080E0 ; Attributes: bp-based frame
.text:000080E0
.text:000080E0 EXPORT start
.text:000080E0 start
.text:000080E0
.text:000080E0 preinit_array= -0x14
.text:000080E0 init_array= -0x10
.text:000080E0 fini_array= -0xC
.text:000080E0 ctors= -8
.text:000080E0
.text:000080E0 LDR R12, =(dword_1DFF4 - 0x80FC)
.text:000080E4 STMFD SP!, {R11,LR}
.text:000080E8 LDR R3, =0xFFFFFF68
.text:000080EC ADD R11, SP, #4
.text:000080F0 SUB SP, SP, #0x10
.text:000080F4 ADD R12, PC, R12 ; dword_1DFF4
.text:000080F8 LDR R3, [R12,R3]
.text:000080FC STR R3, [R11,#preinit_array] ; unk_1df00
.text:00008100 LDR R3, =0xFFFFFF6C
.text:00008104 ADD R0, R11, #4
.text:00008108 LDR R3, [R12,R3]
.text:0000810C STR R3, [R11,#init_array] ; unk_1def4
.text:00008110 LDR R3, =0xFFFFFF70
.text:00008114 MOV R1, #0
.text:00008118 LDR R3, [R12,R3]
.text:0000811C STR R3, [R11,#fini_array] ; unk_1deec
.text:00008120 LDR R3, =0xFFFFFF74
.text:00008124 LDR R3, [R12,R3]
.text:00008128 STR R3, [R11,#ctors] ; unk_1df08
.text:0000812C LDR R3, =0xFFFFFF78
.text:00008130 LDR R2, [R12,R3] ; r2 is main .
.text:00008130 ; r2 is 0x8240
.text:00008134 SUB R3, R11, #-preinit_array
.text:00008138 BL __libc_init
.text:0000813C SUB SP, R11, #4
.text:00008140 LDMFD SP!, {R11,PC}
.text:00008140 ; End of function start
.text:00008140
.text:00008140 ; ---------------------------------------------------------------------------
转载于:https://my.oschina.net/Draymond/blog/1017438