Help/Support Set r0 to a fixed value? How?

arthurdapaz · June 23, 2016

Hello friends! My assembly knowledge is poor and I have a problemo here.

The image below shows what I'm trying to patch.

I have set breakpoint (via gdb) on this highlighted address (0x1100E2), which moves to r0 the value of processed sub_1C00F2 as noticed when viewing rX registers.

r0             0x23aac00        37399552
r1             0x34     52
r2             0x176abfb0       392871856
r3             0x3      3
r4             0x0      0
r5             0x176abfb0       392871856
r6             0x23aac00        37399552
r7             0x1149370        18125680
r8             0x16e08ac0       383814336
r9             0x16e08aa0       383814304
r10            0x40000  262144
r11            0xffffffff       -1
r12            0x39d53aec       970275564
sp             0x1149364        18125668
lr             0x1db6b5 1947317
pc             0x1c00e2 1835234
cpsr           0x20000030       536870960

How can I set r0 value to this 0x23aac00 (37399552) and fix it, so the CMP.W right after will result the same always?

Archangel04 · June 23, 2016

MOV R0,#0x23aac00

Just convert it to hex via the hex converter up there. See the original in hex, reverse it and see which ARM it is. Use the same ARM and replace it into the binary (make sure its a duplicate so you have the origjnal one just in case)

Zahir · June 23, 2016

@

U know this wont work right? MOV R0,#0x23aac00

June 23, 2016

Check twitter

arthurdapaz · June 23, 2016

oh guys! I got, actually, thanks to @shmoo. I was misunderstanding the logic. The trick is different, we need to consider the CMP.W and what it is doing... It is comparing R0 with 0xFFFFFFFF, so, I just need to fix this comparison value, instead of setting r0 to any random number.

So, we replace this BL sub_... with a MOV R0, #0xFFFFFFFF and the CMP.W will always return what we want! Anything different from #0xFFFFFFFF (which is -1), will return other value.