-
-
ARM汇编IDA简单阅读分析
-
2015-12-24 21:27
-
最近不顺，烧了块板子。
接着学点ARM汇编，这次是个for循环，但是我不会C语言啊。。这个C转过来的汇编真繁琐啊。。
seg000:08000228 sub_8000228 ; CODE XREF: sub_8000EB4+C4p
seg000:08000228 ; sub_80012D8+1Cp ...
seg000:08000228 PUSH {R4,LR} ; 入栈
seg000:0800022A MOV R3, R0 ; 把R0变量保存到R3
seg000:0800022C MOVS R4, #0 ; R4 = 0
seg000:0800022E B loc_800023A ; 跳转
seg000:08000230 ; ---------------------------------------------------------------------------
seg000:08000230
seg000:08000230 loc_8000230 ; CODE XREF: sub_8000228+14j
seg000:08000230 MOVW R0, #0x2EE0 ; R0 = 0x2ee0
seg000:08000234 BL sub_800021C ; 调用子函数
seg000:08000238 ADDS R4, R4, #1 ; R4加1
seg000:0800023A
seg000:0800023A loc_800023A ; CODE XREF: sub_8000228+6j
seg000:0800023A CMP R4, R3 ; R4与R3比较
seg000:0800023C BLT loc_8000230 ; 小于跳转
seg000:0800023E POP {R4,PC} ; 出栈返回
seg000:0800021C sub_800021C ; CODE XREF: sub_8000228+Cp
seg000:0800021C ; seg000:08002940p
seg000:0800021C MOVS R1, #0 ; R1清零
seg000:0800021E B loc_8000222 ; R1和R0比较
seg000:08000220 ; ---------------------------------------------------------------------------
seg000:08000220
seg000:08000220 loc_8000220 ; CODE XREF: sub_800021C+8j
seg000:08000220 ADDS R1, R1, #1
seg000:08000222
seg000:08000222 loc_8000222 ; CODE XREF: sub_800021C+2j
seg000:08000222 CMP R1, R0 ; R1和R0比较
seg000:08000224 BLT loc_8000220 ; 小于跳转
seg000:08000226 BX LR ; 返回
接着学点ARM汇编，这次是个for循环，但是我不会C语言啊。。这个C转过来的汇编真繁琐啊。。
seg000:08000228 sub_8000228 ; CODE XREF: sub_8000EB4+C4p
seg000:08000228 ; sub_80012D8+1Cp ...
seg000:08000228 PUSH {R4,LR} ; 入栈
seg000:0800022A MOV R3, R0 ; 把R0变量保存到R3
seg000:0800022C MOVS R4, #0 ; R4 = 0
seg000:0800022E B loc_800023A ; 跳转
seg000:08000230 ; ---------------------------------------------------------------------------
seg000:08000230
seg000:08000230 loc_8000230 ; CODE XREF: sub_8000228+14j
seg000:08000230 MOVW R0, #0x2EE0 ; R0 = 0x2ee0
seg000:08000234 BL sub_800021C ; 调用子函数
seg000:08000238 ADDS R4, R4, #1 ; R4加1
seg000:0800023A
seg000:0800023A loc_800023A ; CODE XREF: sub_8000228+6j
seg000:0800023A CMP R4, R3 ; R4与R3比较
seg000:0800023C BLT loc_8000230 ; 小于跳转
seg000:0800023E POP {R4,PC} ; 出栈返回
seg000:0800021C sub_800021C ; CODE XREF: sub_8000228+Cp
seg000:0800021C ; seg000:08002940p
seg000:0800021C MOVS R1, #0 ; R1清零
seg000:0800021E B loc_8000222 ; R1和R0比较
seg000:08000220 ; ---------------------------------------------------------------------------
seg000:08000220
seg000:08000220 loc_8000220 ; CODE XREF: sub_800021C+8j
seg000:08000220 ADDS R1, R1, #1
seg000:08000222
seg000:08000222 loc_8000222 ; CODE XREF: sub_800021C+2j
seg000:08000222 CMP R1, R0 ; R1和R0比较
seg000:08000224 BLT loc_8000220 ; 小于跳转
seg000:08000226 BX LR ; 返回
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
看一个函数库C语言出来的IO设置，真不知一般的繁琐，就为了体现计算能力么。。
   @ IO口设置，入口SP指向的地址底16位是具体要设置哪一位， @ SP高16位决定IO的状态，通过繁琐 的计算获得设置的模式 @ sub_80039EC: @ CODE XREF: sub_8000276+20p @ sub_800029C+20p PUSH.W {R4-R8,LR} MOV R2, R0 @ r2=0x40010c00 PB MOVS R5, #0 @ R5=0 MOVS R6, #0 @ R6=0 MOVS R0, #0 @ R0=0 MOVS R3, #0 @ R3=0 MOVS R4, #0 @ R4=0 MOVS R7, #0 @ R7=0 LDRB.W R12, [R1,#3] @ R12=0X48,利用堆栈传递的数据 AND.W R5, R12, #0xF @ 0X48 & 0XF = 0X8 LDRB.W R12, [R1,#3] @ r12=0x48 TST.W R12, #0x10 @ 检测第4位等不等于1 BEQ loc_8003A18 @ 等于0跳转 LDRB.W R12, [R1,#2] @ R12=0X03 堆栈传递的数据 ORR.W R5, R12, R5 @ 0x03 逻辑或 0x08 = 0x0B loc_8003A18: @ CODE XREF: sub_80039EC+22j LDRH.W R12, [R1] @ r12= 0x4000 堆栈传递的数据 TST.W R12, #0xFF @ 测试底8等不等于0XFF BEQ loc_8003A86 @ 等于0跳转 LDR R4, [R2] @ 取出PB口底8位的设置 MOVS R0, #0 @ R0=0 B loc_8003A80 @ --------------------------------------------------------------------------- loc_8003A28: @ CODE XREF: sub_80039EC+96j MOV.W R12, #1 @ r12= 1 LSL.W R3, R12, R0 @ R12左移R0位 LDRH.W R12, [R1] @ R12=0X4000 AND.W R6, R12, R3 @ 0X4000与R3 CMP R6, R3 @ R6和R3比较 BNE loc_8003A7E @ 不等于跳转 LSLS R3, R0, #2 @ R3=R0左移2位 MOV.W R12, #0xF @ R12=0X0F LSL.W R7, R12, R3 @ 0XF左移R3位 BICS R4, R7 @ 位请0 LSL.W R12, R5, R3 @ R5左移R3 ORR.W R4, R12, R4 @ R12逻辑或R4 = PB1= 0XB LDRB.W R12, [R1,#3] @ R12= 0X48 CMP.W R12, #0x28 @ R12和0X28比较 BNE loc_8003A68 @ 不等于跳转 MOV.W R12, #1 @ R12 = 1 LSL.W R12, R12, R0 STR.W R12, [R2,#0x14] @ BRR关IO口 B loc_8003A7E @ --------------------------------------------------------------------------- loc_8003A68: @ CODE XREF: sub_80039EC+6Cj LDRB.W R12, [R1,#3] @ 取出条件，堆栈传递的数据 CMP.W R12, #0x48 @ R12和0X48比较 BNE loc_8003A7E @ 不等于跳转 MOV.W R12, #1 @ R12= 1 LSL.W R12, R12, R0 @ 1左移0位 STR.W R12, [R2,#0x10] @ BSRR开IO loc_8003A7E: @ CODE XREF: sub_80039EC+4Ej @ sub_80039EC+7Aj ... ADDS R0, R0, #1 loc_8003A80: @ CODE XREF: sub_80039EC+3Aj CMP R0, #8 @ 0和8比较 BCC loc_8003A28 @ 如果小于跳转 STR R4, [R2] @ 8位完成把设置的数据写入入口地址 loc_8003A86: @ CODE XREF: sub_80039EC+34j LDRH.W R12, [R1] CMP.W R12, #0xFF BLE locret_8003AFA @ 小于等于0XFF跳转 LDR R4, [R2,#4] @ 读出高8位设置 MOVS R0, #0 B loc_8003AF4 @ --------------------------------------------------------------------------- loc_8003A96: @ CODE XREF: sub_80039EC+10Aj ADD.W R12, R0, #8 @ R12=8 MOV.W R8, #1 @ R8= 1 LSL.W R3, R8, R12 @ R8左移R12 LDRH.W R12, [R1] @ 读出存在堆栈里的变量 AND.W R6, R12, R3 @ R12 ＆ r3 CMP R6, R3 @ R6和R3比较 BNE loc_8003AF2 @ 不等于跳转 LSLS R3, R0, #2 @ R0 左移2位 MOV.W R12, #0xF @ R12= 0XF LSL.W R7, R12, R3 @ R12左移R3位 BICS R4, R7 @ 清0相应位 LSL.W R12, R5, R3 @ R5左移R3 ORR.W R4, R12, R4 @ R12或R4 LDRB.W R12, [R1,#3] @ 读出堆栈传递的数据 CMP.W R12, #0x28 @ R12和0X28比较 BNE loc_8003AD8 @ 不等于跳转 ADD.W R12, R0, #8 @ R8加8 表示高8位 LSL.W R8, R8, R12 @ R8左移R12 STR.W R8, [R2,#0x14] @ 写入关闭IO loc_8003AD8: @ CODE XREF: sub_80039EC+DEj LDRB.W R12, [R1,#3] @ 取出堆栈传递的条件数据 CMP.W R12, #0x48 @ 然后用这个数据和0X48比较 BNE loc_8003AF2 @ 没到最高位继续计算 ADD.W R12, R0, #8 @ 表示高8位 MOV.W R8, #1 @ r8= 1 LSL.W R8, R8, R12 @ 左移R12位 STR.W R8, [R2,#0x10] @ 打开IO loc_8003AF2: @ CODE XREF: sub_80039EC+C0j @ sub_80039EC+F4j ADDS R0, R0, #1 loc_8003AF4: @ CODE XREF: sub_80039EC+A8j CMP R0, #8 BCC loc_8003A96 @ 再算出高8位设置 STR R4, [R2,#4] @ 写入高8位设置 locret_8003AFA: @ CODE XREF: sub_80039EC+A2j POP.W {R4-R8,PC} @ 返回 |
|
|
有个LCR表的固件想搞清他的算法，对LCR一窍不通啊，只能硬着头皮上了。 从while后面开始肯，今天肯了个按键的函
 ROM:08000E54 sub_8000E54: @ CODE XREF: sub_8002950+1AEp ROM:08000E54 @ sub_8002B82:loc_8002C92p ... ROM:08000E54 PUSH {R4,LR} ROM:08000E56 BL sub_8000D9A @ 按键扫描 ROM:08000E5A MOV R4, R0 ROM:08000E5C CBNZ R4, loc_8000E8A @ R4不等于0跳转 ROM:08000E5E MOVS R0, #0 ROM:08000E60 LDR R1, =0x2000000C ROM:08000E62 STR R0, [R1] @ 保存R0到0X20000000C ROM:08000E64 LDR R0, =0x20000010 ROM:08000E66 LDR R0, [R0] @ 读出0X20000010里的数据放到R0 ROM:08000E68 CBZ R0, loc_8000E70 @ 等于0跳转 ROM:08000E6A LDR R0, =0x20000010 ROM:08000E6C LDR R0, [R0] @ 读0X20000000C里面的数据到R0 ROM:08000E6E UXTB R4, R0 @ 扩展到32位 ROM:08000E70 ROM:08000E70 loc_8000E70: @ CODE XREF: sub_8000E54+14j ROM:08000E70 LDR R0, =0x20000014 ROM:08000E72 LDR R0, [R0] @ 读取0X200000014到R0 ROM:08000E74 CBZ R0, loc_8000E7C @ 等于0跳转 ROM:08000E76 LDR R0, =0x20000014 ROM:08000E78 LDR R0, [R0] @ 读取0X200000014到R0 ROM:08000E7A UXTB R4, R0 @ 扩展到32位 ROM:08000E7C ROM:08000E7C loc_8000E7C: @ CODE XREF: sub_8000E54+20j ROM:08000E7C MOVS R0, #0 ROM:08000E7E LDR R1, =0x20000014 ROM:08000E80 STR R0, [R1] @ 读取0X20000014到R0 ROM:08000E82 LDR R1, =0x20000010 ROM:08000E84 STR R0, [R1] @ 读取0X20000010到R0 ROM:08000E86 MOV R0, R4 @ R0=R4 ROM:08000E88 ROM:08000E88 locret_8000E88: @ CODE XREF: sub_8000E54+5Ej ROM:08000E88 POP {R4,PC} ROM:08000E8A @ --------------------------------------------------------------------------- ROM:08000E8A ROM:08000E8A loc_8000E8A: @ CODE XREF: sub_8000E54+8j ROM:08000E8A LDR R0, =0x2000000C ROM:08000E8C LDR R0, [R0] @ 读取0X2000000C里面的数据到R0 ROM:08000E8E ADDS R0, R0, #1 @ R0 +1 ROM:08000E90 LDR R1, =0x2000000C ROM:08000E92 STR R0, [R1] @ 把数据写会0X20000000C ROM:08000E94 MOV R0, R1 @ R0=0X20000000C ROM:08000E96 LDR R0, [R0] @ 读取0X2000000C到R0 ROM:08000E98 CMP R0, #2 @ R0与2比较 ROM:08000E9A BNE loc_8000EA0 @ 不等于跳转 ROM:08000E9C LDR R0, =0x20000010 @ 等于2, R0=0X20000010 ROM:08000E9E STR R4, [R0] @ R4存到0X20000010 ROM:08000EA0 ROM:08000EA0 loc_8000EA0: @ CODE XREF: sub_8000E54+46j ROM:08000EA0 LDR R0, =0x2000000C ROM:08000EA2 LDR R0, [R0] @ 读取0X2000000C里面的数据到R0 ROM:08000EA4 CMP R0, #0xC8 @ R0和0XC8比较 ROM:08000EA6 BNE loc_8000EB0 @ 不等于跳转 ROM:08000EA8 ADD.W R0, R4, #0x1E @ R4加0X1E放到R0 ROM:08000EAC LDR R1, =0x20000014 ROM:08000EAE STR R0, [R1] @ R0储存到0X20000014 ROM:08000EB0 ROM:08000EB0 loc_8000EB0: @ CODE XREF: sub_8000E54+52j ROM:08000EB0 MOVS R0, #0 @ R0=0 ROM:08000EB2 B locret_8000E88 @ 返回 |
|
|
|
|
|
|
