Figure 2-16 is a function from Windows RT. Read MSDN if needed. Ignore the security PUSH/POP cookie routines.
Here is the disassembly of the function:
Figure 2-16. Practical Reverse Engineering. © 2014 by Bruce Dang |
The ARM processor is in Thumb state, but transfers out during some of the syscalls. The function queries different clock APIs depending on the size of the supplied struct.
size_t QueryChrono(size_t *bytes_copied, size_t max_size, struct *clock_info) { /* MOVS R4, #0 */ bytes_copied = 0; /* CMP R5, #0x10 */ if (max_size >= 16) { SYSTEMTIME sysTime; /* SUB SP, SP, #0x10 */ GetSystemTime(&sysTime); /* LDR R3, =__imp_GetSystemTime */ /* LDR R3, [SP,#0x1C+var_1C] */ /* LDR R3, [SP,#0x1C+var_18] */ /* LDR R3, [SP,#0x1C+var_14] */ /* LDR R3, [SP,#0x1C+var_10] */ /* STR R3, [R6,#0xC] */ memcpy(clock_info->sysTime0x0, &sysTime, sizeof(SYSTEMTIME)); bytes_copied = 16; /* MOVS R4, #0x10 */ } /* SUBS R3, R5, R4 */ /* CMP R3, #4 */ if ((max_size - bytes_copied) >= 4) { /* LDR R3, =__imp_GetCurrentProcessId */ /* STR R0, [R6,R4] */ *(clock_info + bytes_copied) = GetCurrentProcessId(); bytes_copied += 4; /* ADDS R4, #4 */ } /* SUBS R3, R5, R4 */ /* CMP R3, #4 */ if ((max_size - bytes_copied) >= 4) { /* LDR R3, =__imp_GetTickCount */ /* STR R0, [R6,R4] */ *(clock_info + bytes_copied) = GetTickCount(); bytes_copied += 4; /* ADDS R4, #4 */ } /* SUBS R3, R5, R4 */ /* CMP R3, #9 */ if ((max_size - bytes_copied) >= 8) { /* MOV R0, SP */ LARGE_INTEGER perfCount; /* LDR R3, =__imp_QueryPerformanceCounter */ QueryPerformanceCounter(&perfCount); /* STR R3, [R6,R4] */ /* STR R3, [R2,#4] */ memcpy((clock_info + bytes_copied), &perfCount, sizeof(LARGE_INTEGER)); bytes_copied += 8; /* ADDS R4, #8 */ } return bytes_copied; /* MOV R0, R4 */ }
No comments :
Post a Comment