iOS Hacker Xcode使用和内联汇编

1.在C/C++/Objective C调用汇编函数

在iOS工程里新建Assemble文件,编写代码
.text
.align 4
.globl _funcAdd_arm

_funcAdd_arm:
    add w0,w0,w1
    add w0,w0,w2
    add w0,w0,w3
    add w0,w0,w4
    add w0,w0,w5
    ret

然后在main函数里导出,就可以直接用了。
extern int funcAdd_arm(int a, int b, int c, int d, int e,int f);

int main(int argc, char * argv[])
 {
    int num1 = funcAdd_arm(1,2,3,4,5,6);
    NSLog(@"%d\n",num);
}

2.内联汇编

VC的内联汇编非常简单,几乎和直接写汇编差不多,但是Xcode内联汇编比较复杂,格式如下:

asm ( 汇编语句  
    : 输出操作数     // 非必需  
    : 输入操作数     // 非必需  
    : 其他被污染的寄存器 // 非必需  
    );  

第1行是汇编语句,如果有多句需要用\t\n来分隔
第2行是输出操作数,都是 "=r"(var) 的形式,var可以是任意内存变量(输出结果会存到这个变量中),除了r之外,一般还有下面这些标识符:
r 上面的寄存器的任意一个(谁闲着就用谁)
m 内存
i 立即数(常量,只用于输入操作数)
g 寄存器、内存、立即数 都行(gcc你看着办)
第3行是输入操作数,也是和输出操作数一样的格式。
第4行是的作用可以在汇编代码一运行之前,将指定的寄存器保存起来,当汇编代码结束后再恢复。

实例代码如下:

#import 
#import "AppDelegate.h"

extern int funcAdd_arm(int a, int b, int c, int d, int e,int f);

int funcAdd(a,b,c,d,e,f)
{
    int g=a+b+c+d+e+f;
    return g;
}

int main(int argc, char * argv[]) {
    
    int num = funcAdd(1, 2, 3, 4, 5, 6);
    
    int num2 = funcAdd_arm(1,2,3,4,5,6);
    
    NSLog(@"%d\n",num);
    
    int f_address = (int)&funcAdd_arm;
    
    NSLog(@"%x\n",f_address);
    
    num = 0;
    num2 = 0;
    
    asm(
        "mov x0,1\t\n"
        "mov x1,2\t\n"
        "mov x2,3\t\n"
        "mov x3,4\t\n"
        "mov x4,5\t\n"
        "mov x5,6\t\n"
        "bl _funcAdd_arm\t\n"
        "mov %0,x0\t\n"
        "mov %1,#2\t\n"
        :"=r"(num),"=r"(num2)
        :
        :
        );
    
lable1:
    NSLog(@"lable1");
    
    @autoreleasepool {
        return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
    }
}

真机运行的汇编代码

armasm`main:
    0x100020970 <+0>:   stp    x29, x30, [sp, #-16]!
    0x100020974 <+4>:   mov    x29, sp
    0x100020978 <+8>:   sub    sp, sp, #80
    0x10002097c <+12>:  orr    w8, wzr, #0x1
    0x100020980 <+16>:  orr    w9, wzr, #0x2
    0x100020984 <+20>:  orr    w2, wzr, #0x3
    0x100020988 <+24>:  orr    w3, wzr, #0x4
    0x10002098c <+28>:  movz   w4, #0x5
    0x100020990 <+32>:  orr    w5, wzr, #0x6
    0x100020994 <+36>:  stur   wzr, [x29, #-4]
    0x100020998 <+40>:  stur   w0, [x29, #-8]
    0x10002099c <+44>:  stur   x1, [x29, #-16]
    0x1000209a0 <+48>:  mov    x0, x8
    0x1000209a4 <+52>:  mov    x1, x9
    0x1000209a8 <+56>:  bl     0x100020918               ; funcAdd at main.m:15
    0x1000209ac <+60>:  orr    w8, wzr, #0x1
    0x1000209b0 <+64>:  orr    w1, wzr, #0x2
    0x1000209b4 <+68>:  orr    w2, wzr, #0x3
    0x1000209b8 <+72>:  orr    w3, wzr, #0x4
    0x1000209bc <+76>:  movz   w4, #0x5
    0x1000209c0 <+80>:  orr    w5, wzr, #0x6
    0x1000209c4 <+84>:  stur   w0, [x29, #-20]
    0x1000209c8 <+88>:  mov    x0, x8
    0x1000209cc <+92>:  bl     0x100020900               ; funcAdd_arm
    0x1000209d0 <+96>:  stur   w0, [x29, #-24]
    0x1000209d4 <+100>: ldur   w8, [x29, #-20]
    0x1000209d8 <+104>: mov    x6, x8
    0x1000209dc <+108>: mov    x10, sp
    0x1000209e0 <+112>: str    x6, [x10]
    0x1000209e4 <+116>: adrp   x0, 4
    0x1000209e8 <+120>: add    x0, x0, #520
    0x1000209ec <+124>: bl     0x10002246c               ; symbol stub for: NSLog
    0x1000209f0 <+128>: adrp   x10, 0
    0x1000209f4 <+132>: add    x10, x10, #2304
    0x1000209f8 <+136>: mov    x8, x10
    0x1000209fc <+140>: stur   w8, [x29, #-28]
    0x100020a00 <+144>: ldur   w8, [x29, #-28]
    0x100020a04 <+148>: mov    x0, x8
    0x100020a08 <+152>: mov    x10, sp
    0x100020a0c <+156>: str    x0, [x10]
    0x100020a10 <+160>: adrp   x0, 4
    0x100020a14 <+164>: add    x0, x0, #552
    0x100020a18 <+168>: bl     0x10002246c               ; symbol stub for: NSLog
    0x100020a1c <+172>: stur   wzr, [x29, #-20]
    0x100020a20 <+176>: stur   wzr, [x29, #-24]
    0x100020a24 <+180>: movz   x0, #0x1
    0x100020a28 <+184>: movz   x1, #0x2
    0x100020a2c <+188>: movz   x2, #0x3
    0x100020a30 <+192>: movz   x3, #0x4
    0x100020a34 <+196>: movz   x4, #0x5
    0x100020a38 <+200>: movz   x5, #0x6
    0x100020a3c <+204>: bl     0x100020900               ; funcAdd_arm
    0x100020a40 <+208>: mov    x8, x0
    0x100020a44 <+212>: movz   x9, #0x2
    0x100020a48 <+216>: stur   w8, [x29, #-20]
->  0x100020a4c <+220>: stur   w9, [x29, #-24]


你可能感兴趣的:(iOS/MacOSX/移动安全,逆向/汇编语言相关)