views:

110

answers:

1

I've been messing around with IDA Pro and trying to disassemble my own products just for the sake of it.

I've noticed a couple of things I don't understand because my assembly language knowledge is terrible. Here is a little chunk of code which invokes CGContextSetRGBStrokeColor.

CGContextSetRGBStrokeColor(ctx, 1, 1, 1, 1);

In IDA it looks like this:

IDA Output

I don't understand a number of things:

  1. How does 0x3F800000 relate to the number 1? I assume it is a reference, however I did not get what it refers to.
  2. Why is MOVS being called three times instead of four (because there are four arguments)?
  3. Are R0,R1,R2 etc. CPU registers?
  4. Could someone explaing these:

Some text lines

This file is a Framework (therefore a Mach-O file). That function comes from CoreGraphics.

+7  A: 

How does 0x3F800000 relate to the number 1? I assume it is a reference, however I did not get what it refers to.

0x3F800000 is 1.0 in IEEE single precision representation. You could right click on that 0x3F800000 and choose floating point representation to convert it to 1.0.

Why is MOVS being called three times instead of four (because there are four arguments)?

In the standard ARM calling convention, the first 4 arguments are stored in R0 to R3 respectively. The ldr r1, =0x3f800000 instruction already stores the 2nd argument.

Are R0,R1,R2 etc. CPU registers?

Yes.

Could someone explaing these:

Please don't take apart non-consecutive instructions, since the r3 at the 2nd instruction and that in the 3rd are different.

If you check the whole function, you should see that "var_4C" is the address to the variable ctx on stack. Hence,

add r3, sp, #0x50+var_4c
ldr r2, [r3]

just means r2 = ctx. The instruction movs r0, r2 much later put the context as the 1st argument.

Also, in ARM, var_?? is equivalent to the value -0x??. In ARM, the 5th argument and above are stored on the stack at [sp, #0], [sp, #4], etc. Hence, the instruction

ldr r3, =0x3f800000
str r3, [sp, #0]     ;// #0x50+var_50 = 0x50 - 0x50 = 0

put the 1.0 on at the 5th argument.

KennyTM
+1. The final argument is pushed to the stack by the `STR` instruction.
Carl Norum
ARM Application Binary Interface (ABI) defines the calling convention. You can download the ABI specification from ARM's own website: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.subset.swdev.abi/index.html Be aware that GNU/Linux uses "EABI" (Extended ABI) which is GNU's implementation of the ARM ABI. Mostly the two are now compatible. Historically this was not the case.
RobM
Actually, "EABI" means "Embedded ABI" and is defined by ARM. The old ABI is the "ADS" (ARM Developer Suite) ABI. ADS has been replaced by RVCT, which uses the new ABI and is (for the most part) GCC-compatible.
tc.
Excellent answer. Thanks a lot.
Nick Brooks