Quick Research & Development Thread
View Single Post
July 26th, 2010, 05:12 PM
Join Date: Aug 2007
Originally Posted by
Some hwords have no opcode in Thumb.
If you try to decompile one of this hwords the output is [???].
Maybe it is a grafik or an ARM code.
That's what I thought at first too. But it all makes sense:
The function pushes registers in the first line
The function pops registers in the last line
The registers are popped to the positions they were pushed from except for lr/pc of course.
The stack-pointer is decreased and then used to the limit. (Why allocate more or less?)
The cmp-opcode is followed by a beq-opcode.
The functions called from this function are valid too.
It *has* to be THUMB-Code!
Firered IDA 6.1 DB:
VBA-M with lua scripting support
(no longer in development)
View Public Profile
Send a private message to knizz
Find all posts by knizz
Find threads started by knizz
Ignore Posts by knizz