iOS Hacker Xcode使用和内联汇编
生活随笔
收集整理的這篇文章主要介紹了
iOS Hacker Xcode使用和内联汇编
小編覺得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.
1.在C/C++/Objective C調(diào)用匯編函數(shù)
在iOS工程里新建Assemble文件,編寫代碼
.text .align 4 .globl _funcAdd_arm_funcAdd_arm:add w0,w0,w1add w0,w0,w2add w0,w0,w3add w0,w0,w4add w0,w0,w5ret
然后在main函數(shù)里導(dǎo)出,就可以直接用了。
extern int funcAdd_arm(int a, int b, int c, int d, int e,int f);int main(int argc, char * argv[]){int num1 = funcAdd_arm(1,2,3,4,5,6);NSLog(@"%d\n",num); }
2.內(nèi)聯(lián)匯編
第1行是匯編語(yǔ)句,如果有多句需要用\t\n來分隔
第2行是輸出操作數(shù),都是 "=r"(var) 的形式,var可以是任意內(nèi)存變量(輸出結(jié)果會(huì)存到這個(gè)變量中),除了r之外,一般還有下面這些標(biāo)識(shí)符:
r 上面的寄存器的任意一個(gè)(誰(shuí)閑著就用誰(shuí))
m 內(nèi)存
i 立即數(shù)(常量,只用于輸入操作數(shù))
g 寄存器、內(nèi)存、立即數(shù) 都行(gcc你看著辦)
第3行是輸入操作數(shù),也是和輸出操作數(shù)一樣的格式。
第4行是的作用可以在匯編代碼一運(yùn)行之前,將指定的寄存器保存起來,當(dāng)匯編代碼結(jié)束后再恢復(fù)。
真機(jī)運(yùn)行的匯編代碼
armasm`main:0x100020970 <+0>: stp x29, x30, [sp, #-16]!0x100020974 <+4>: mov x29, sp0x100020978 <+8>: sub sp, sp, #800x10002097c <+12>: orr w8, wzr, #0x10x100020980 <+16>: orr w9, wzr, #0x20x100020984 <+20>: orr w2, wzr, #0x30x100020988 <+24>: orr w3, wzr, #0x40x10002098c <+28>: movz w4, #0x50x100020990 <+32>: orr w5, wzr, #0x60x100020994 <+36>: stur wzr, [x29, #-4]0x100020998 <+40>: stur w0, [x29, #-8]0x10002099c <+44>: stur x1, [x29, #-16]0x1000209a0 <+48>: mov x0, x80x1000209a4 <+52>: mov x1, x90x1000209a8 <+56>: bl 0x100020918 ; funcAdd at main.m:150x1000209ac <+60>: orr w8, wzr, #0x10x1000209b0 <+64>: orr w1, wzr, #0x20x1000209b4 <+68>: orr w2, wzr, #0x30x1000209b8 <+72>: orr w3, wzr, #0x40x1000209bc <+76>: movz w4, #0x50x1000209c0 <+80>: orr w5, wzr, #0x60x1000209c4 <+84>: stur w0, [x29, #-20]0x1000209c8 <+88>: mov x0, x80x1000209cc <+92>: bl 0x100020900 ; funcAdd_arm0x1000209d0 <+96>: stur w0, [x29, #-24]0x1000209d4 <+100>: ldur w8, [x29, #-20]0x1000209d8 <+104>: mov x6, x80x1000209dc <+108>: mov x10, sp0x1000209e0 <+112>: str x6, [x10]0x1000209e4 <+116>: adrp x0, 40x1000209e8 <+120>: add x0, x0, #5200x1000209ec <+124>: bl 0x10002246c ; symbol stub for: NSLog0x1000209f0 <+128>: adrp x10, 00x1000209f4 <+132>: add x10, x10, #23040x1000209f8 <+136>: mov x8, x100x1000209fc <+140>: stur w8, [x29, #-28]0x100020a00 <+144>: ldur w8, [x29, #-28]0x100020a04 <+148>: mov x0, x80x100020a08 <+152>: mov x10, sp0x100020a0c <+156>: str x0, [x10]0x100020a10 <+160>: adrp x0, 40x100020a14 <+164>: add x0, x0, #5520x100020a18 <+168>: bl 0x10002246c ; symbol stub for: NSLog0x100020a1c <+172>: stur wzr, [x29, #-20]0x100020a20 <+176>: stur wzr, [x29, #-24]0x100020a24 <+180>: movz x0, #0x10x100020a28 <+184>: movz x1, #0x20x100020a2c <+188>: movz x2, #0x30x100020a30 <+192>: movz x3, #0x40x100020a34 <+196>: movz x4, #0x50x100020a38 <+200>: movz x5, #0x60x100020a3c <+204>: bl 0x100020900 ; funcAdd_arm0x100020a40 <+208>: mov x8, x00x100020a44 <+212>: movz x9, #0x20x100020a48 <+216>: stur w8, [x29, #-20] -> 0x100020a4c <+220>: stur w9, [x29, #-24]
在iOS工程里新建Assemble文件,編寫代碼
.text .align 4 .globl _funcAdd_arm_funcAdd_arm:add w0,w0,w1add w0,w0,w2add w0,w0,w3add w0,w0,w4add w0,w0,w5ret
然后在main函數(shù)里導(dǎo)出,就可以直接用了。
extern int funcAdd_arm(int a, int b, int c, int d, int e,int f);int main(int argc, char * argv[]){int num1 = funcAdd_arm(1,2,3,4,5,6);NSLog(@"%d\n",num); }
2.內(nèi)聯(lián)匯編
VC的內(nèi)聯(lián)匯編非常簡(jiǎn)單,幾乎和直接寫匯編差不多,但是Xcode內(nèi)聯(lián)匯編比較復(fù)雜,格式如下:
asm ( 匯編語(yǔ)句 : 輸出操作數(shù) // 非必需 : 輸入操作數(shù) // 非必需 : 其他被污染的寄存器 // 非必需 );第1行是匯編語(yǔ)句,如果有多句需要用\t\n來分隔
第2行是輸出操作數(shù),都是 "=r"(var) 的形式,var可以是任意內(nèi)存變量(輸出結(jié)果會(huì)存到這個(gè)變量中),除了r之外,一般還有下面這些標(biāo)識(shí)符:
r 上面的寄存器的任意一個(gè)(誰(shuí)閑著就用誰(shuí))
m 內(nèi)存
i 立即數(shù)(常量,只用于輸入操作數(shù))
g 寄存器、內(nèi)存、立即數(shù) 都行(gcc你看著辦)
第3行是輸入操作數(shù),也是和輸出操作數(shù)一樣的格式。
第4行是的作用可以在匯編代碼一運(yùn)行之前,將指定的寄存器保存起來,當(dāng)匯編代碼結(jié)束后再恢復(fù)。
實(shí)例代碼如下:
#import <UIKit/UIKit.h> #import "AppDelegate.h"extern int funcAdd_arm(int a, int b, int c, int d, int e,int f);int funcAdd(a,b,c,d,e,f) {int g=a+b+c+d+e+f;return g; }int main(int argc, char * argv[]) {int num = funcAdd(1, 2, 3, 4, 5, 6);int num2 = funcAdd_arm(1,2,3,4,5,6);NSLog(@"%d\n",num);int f_address = (int)&funcAdd_arm;NSLog(@"%x\n",f_address);num = 0;num2 = 0;asm("mov x0,1\t\n""mov x1,2\t\n""mov x2,3\t\n""mov x3,4\t\n""mov x4,5\t\n""mov x5,6\t\n""bl _funcAdd_arm\t\n""mov %0,x0\t\n""mov %1,#2\t\n":"=r"(num),"=r"(num2)::);lable1:NSLog(@"lable1");@autoreleasepool {return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));} }真機(jī)運(yùn)行的匯編代碼
armasm`main:0x100020970 <+0>: stp x29, x30, [sp, #-16]!0x100020974 <+4>: mov x29, sp0x100020978 <+8>: sub sp, sp, #800x10002097c <+12>: orr w8, wzr, #0x10x100020980 <+16>: orr w9, wzr, #0x20x100020984 <+20>: orr w2, wzr, #0x30x100020988 <+24>: orr w3, wzr, #0x40x10002098c <+28>: movz w4, #0x50x100020990 <+32>: orr w5, wzr, #0x60x100020994 <+36>: stur wzr, [x29, #-4]0x100020998 <+40>: stur w0, [x29, #-8]0x10002099c <+44>: stur x1, [x29, #-16]0x1000209a0 <+48>: mov x0, x80x1000209a4 <+52>: mov x1, x90x1000209a8 <+56>: bl 0x100020918 ; funcAdd at main.m:150x1000209ac <+60>: orr w8, wzr, #0x10x1000209b0 <+64>: orr w1, wzr, #0x20x1000209b4 <+68>: orr w2, wzr, #0x30x1000209b8 <+72>: orr w3, wzr, #0x40x1000209bc <+76>: movz w4, #0x50x1000209c0 <+80>: orr w5, wzr, #0x60x1000209c4 <+84>: stur w0, [x29, #-20]0x1000209c8 <+88>: mov x0, x80x1000209cc <+92>: bl 0x100020900 ; funcAdd_arm0x1000209d0 <+96>: stur w0, [x29, #-24]0x1000209d4 <+100>: ldur w8, [x29, #-20]0x1000209d8 <+104>: mov x6, x80x1000209dc <+108>: mov x10, sp0x1000209e0 <+112>: str x6, [x10]0x1000209e4 <+116>: adrp x0, 40x1000209e8 <+120>: add x0, x0, #5200x1000209ec <+124>: bl 0x10002246c ; symbol stub for: NSLog0x1000209f0 <+128>: adrp x10, 00x1000209f4 <+132>: add x10, x10, #23040x1000209f8 <+136>: mov x8, x100x1000209fc <+140>: stur w8, [x29, #-28]0x100020a00 <+144>: ldur w8, [x29, #-28]0x100020a04 <+148>: mov x0, x80x100020a08 <+152>: mov x10, sp0x100020a0c <+156>: str x0, [x10]0x100020a10 <+160>: adrp x0, 40x100020a14 <+164>: add x0, x0, #5520x100020a18 <+168>: bl 0x10002246c ; symbol stub for: NSLog0x100020a1c <+172>: stur wzr, [x29, #-20]0x100020a20 <+176>: stur wzr, [x29, #-24]0x100020a24 <+180>: movz x0, #0x10x100020a28 <+184>: movz x1, #0x20x100020a2c <+188>: movz x2, #0x30x100020a30 <+192>: movz x3, #0x40x100020a34 <+196>: movz x4, #0x50x100020a38 <+200>: movz x5, #0x60x100020a3c <+204>: bl 0x100020900 ; funcAdd_arm0x100020a40 <+208>: mov x8, x00x100020a44 <+212>: movz x9, #0x20x100020a48 <+216>: stur w8, [x29, #-20] -> 0x100020a4c <+220>: stur w9, [x29, #-24]
總結(jié)
以上是生活随笔為你收集整理的iOS Hacker Xcode使用和内联汇编的全部?jī)?nèi)容,希望文章能夠幫你解決所遇到的問題。
- 上一篇: iOS Hacker Xcode玩转ar
- 下一篇: 方式程0day MS17-010远程溢出