ARM-8 代码还原动态调试之 pstree 参数

xiaozhiwise

于 2024-09-13 19:25:06 发布

阅读量110

点赞数

文章标签：汇编

本文链接：https://blog.csdn.net/xiaozhiwise/article/details/142218359

版权

  402010:	911d22d6 	add	x22, x22, #0x748            // x22=0x419748     // "aAcC:GhH:nN:pglsStTuUVZ"

  402028:	9104e3e3 	add	x3, sp, #0x138              // x3=sp+0x138=options
  40202c:	aa1603e2 	mov	x2, x22         // x2=0x419748
  402030:	aa1403e1 	mov	x1, x20         // x1=argv
  402034:	2a1303e0 	mov	w0, w19         // w0=argc
  402038:	d2800004 	mov	x4, #0x0        // NULL
  40203c:	97ffff35 	bl	401d10 <getopt_long@plt>
  402040:	3100041f 	cmn	w0, #0x1*/      // adds w0， 判断 w0 是否为 -1
    while ((c = getopt_long(argc, argv, "aAcC:GhH:nN:pglsStTuUVZ", options, NULL)) != -1) {

  402044:	540002c0 	b.eq	40209c <ferror@plt+0x1bc>  // b.none    // 等于-1, 跳转。说明无参数。
  402048:	51010400 	sub	w0, w0, #0x41   // w0=w0-0x41, 转换成字符
  40204c:	7100d01f 	cmp	w0, #0x34       // w0 <= 0x34(52), 大小写字母共52个
  402050:	54000089 	b.ls	402060 <ferror@plt+0x180>*/ // b.plast   (w0<=0x34)
        switch (c) {
            default:

  402054:	fd242be8 	str	d8, [sp, #18512]
  402058:	fd242fe9 	str	d9, [sp, #18520]
  40205c:	940003dd 	bl	402fd0 <ferror@plt+0x10f0>*/    // exit(1)
                usage();
    
  402060:	78605b00 	ldrh	w0, [x24, w0, uxtw #1]      // w0=[x24+w0<<1]=[0x419a10+0x20<<1]=[0x419a10+0x40]=[0x419a50]=0x8b
  402064:	10000061 	adr	x1, 402070 <ferror@plt+0x190>
  402068:	8b20a820 	add	x0, x1, w0, sxth #2             // x0=0x402070+w0<<2=0x402070+0x8b<<2=0x402070+0x22c=40229C
  40206c:	d61f0000 	br	x0 */                           // x0

            case 'p':
  402070:	52800020 	mov	w0, #0x1                   	// #1
  402074:	b90046e0 	str	w0, [x23, #68] */       // [0x43c870+68]=‭[0x43C8B4‬]=1
                pids = 1;

            case 'c':
  402078:	9104e3e3 	add	x3, sp, #0x138          // x3=options
  40207c:	aa1603e2 	mov	x2, x22                 // "aAcC:GhH:nN:pglsStTuUVZ"
  402080:	aa1403e1 	mov	x1, x20                 // x1=argv
  402084:	2a1303e0 	mov	w0, w19                 // x0=argc
  402088:	d2800004 	mov	x4, #0x0                   	// #0
  40208c:	b9004abf 	str	wzr, [x21, #72]*/
                compact = 0;

  402090:	97ffff20 	bl	401d10 <getopt_long@plt>
  402094:	3100041f 	cmn	w0, #0x1                // 如果w0=-1,则顺序执行，即运行到 40209c
  402098:	54fffd81 	b.ne	402048 <ferror@plt+0x168>*/  // b.any   w0 不等于 -1，jump 402048
                break;

  /* 无参数跳转 */
  40209c:	d00001d6 	adrp	x22, 43c000 <memcpy@GLIBC_2.17>
  4020a0:	51000677 	sub	w23, w19, #0x1          // w23=argc-1
  4020a4:	b9484ac0 	ldr	w0, [x22, #2120]        // w0=[0x‭43C848‬]=optind
  4020a8:	6b0002ff 	cmp	w23, w0
  4020ac:	54002580 	b.eq	40255c <ferror@plt+0x67c>  // b.none

代码还原：

     while ((c = getopt_long(argc, argv, "aAcC:GhH:nN:pglsStTuUVZ", options, NULL)) != -1) {
        switch (c) {
            default:
                usage();
                break;

case 'p':
pids = 1;

            case 'c':
                compact = 0;
                break;
        }
    }

/* 无参数跳转 */