Help/Support Whats this Function? LLDB

Goran · September 7, 2017

i just got one address from iGG, then i w s e over LLDB, and got this

* thread #1: tid = 0x36f39, 0x00425cb4 covetHome, stop reason = breakpoint 1.1
frame #0: 0x00425cb4 covetHome
-> 0x425cb4: andlo r6, r1, r0, lsr r11
0x425cb8: andlt r6, r7, r0, lsr r3
0x425cbc: stceq p8, c14, [r0, #-756]

what i need to do next???

to watch or breakpoint what???

Ted2 · September 7, 2017

stop reason = breakpoint 1.1

your breakpoint is hit, type in 'register read' to know the values.

Goran · September 7, 2017

On 9/7/2017 at 5:33 PM, Ted2 said:

stop reason = breakpoint 1.1

your breakpoint is hit, type in 'register read' to know the values.

Expand

I know that R1 hold value, but how the hell i find in ida when this dont exist

Goran · September 7, 2017

this is what i got in IDA PRO

sub_331CA6
PUSH            {R4-R7,LR} ; Push registers
ADD             R7, SP, #0xC ; Rd = Op1 + Op2
MOV             R4, R1 ; Rd = Op2
MOV             R5, R0 ; Rd = Op2
LDR             R0, [R4,#0xC] ; Load from Memory
LDR             R0, [R0,#0x54] ; Load from Memory
LDR.W           R6, [R0,#0xD0] ; Load from Memory
MOV             R0, R6 ; Rd = Op2
BL.W            sub_FB2FC8 ; Branch with Link
MOV             R0, R6 ; Rd = Op2
BL.W            sub_FC5A74 ; Branch with Link
MOV             R6, R0 ; Rd = Op2
LDR             R0, [R4,#0xC] ; Load from Memory
MOV             R1, R5 ; Rd = Op2
LDR             R0, [R0,#0x54] ; Load from Memory
LDR.W           R2, [R0,#0xD4] ; Load from Memory
MOV             R0, R6 ; Rd = Op2
LDR             R3, [R2] ; Load from Memory
BLX             R3      ; Branch with Link and Exchange (register indirect)
MOV             R0, R6 ; Rd = Op2
POP             {R4-R7,PC} ; Pop registers

Ted2 · September 7, 2017

Dude, you ALWAYS say R1 holds the value, I think you never even checked for real. It can be R4 etc either, CHECK IT.

Goran · September 7, 2017

On 9/7/2017 at 5:38 PM, Ted2 said:

Dude, you ALWAYS say R1 holds the value, I think you never even checked for real. It can be R4 etc either, CHECK IT.

Expand

thats the case, it is now always, but i just post here and it says R1...

that is not important in this case, important is WHAT TO DO NEXT....

TRIED TO WATCH

0x425cb4: andlo r6, r1, r0, lsr r11
0x425cb8: andlt r6, r7, r0, lsr r3
0x425cbc: stceq p8, c14, [r0, #-756]

BUT NOTHING HAPPENED...