1

I'm trying to understands how it works by decompiling my own Objective-C code. Here's the decompiled instruction:

var_8= -8
var_4= -4

SUB             SP, SP, #8
MOVS            R2, #1
STR             R0, [SP,#8+var_4]
STR             R1, [SP,#8+var_8]
MOV             R0, R2
ADD             SP, SP, #8
BX              LR

From my understanding (correct me if I'm wrong), by line:

SP=SP-8
Move 1 to R2
Store R0 into SP+8+var_4
Store R1 into SP+8+var_8
Move R2 into R0
SP=SP+8
Next Function

And the actual code:

%hook SomeClass
- (int)somemethod {
return 1;
}
%end

Now I don't understand why it needs STR R0, [SP,#8+var_4] and STR R1, [SP,#8+var_8] for, as I can't see it purposes. And if I were to return 0, a simple change to of MOVS R2, #1 to MOVS R2, #0 would do, wouldn't it? But that didn't works.

Gregor Isack
  • 151
  • 1
  • 5

1 Answers1

2

Objective C methods are not called directly, but via a piece of trampoline code in the ObjC's runtime "objc_msgSend" function, which in turn calls a regular C function implementing the ObjC method.

In addition to the method parameters, the C function is passed two additional parameters in the first two parameter slows, which are R0 and R1 on ARM (see this description):

  • R0: "self", a reference to the actual object that is executing the current method

Inside an instance method, self refers to the receiver (object) of the message that invoked the method, while in a class method self will indicate which class is calling.

  • R1: "_cmd"

This points to the selector being sent, in your case this should point to a string "somemethod" (or a struct containing this string, not sure about the current ARM implementation).

  • Thanks for the answer. But which line of the offset should I modify to make it return 0? Modifying MOVS R2, #1 to MOVS R2, #0 still return 1 for me. – Gregor Isack Jul 18 '18 at 05:05
  • Probably you patch wrong binary. iOS usually has fat binaries (e.g. one 32-bit ARMv7 and another for 64 bit ARMv8). New devices has 64-bit processors, so if you has this, you need patch 64-bit ARMv8 binary (in the example code for 32-bit) – mailwl Jul 18 '18 at 06:16
  • @mailwl I'm patching a .dylib though, there's only one file. – Gregor Isack Jul 18 '18 at 10:17
  • @mailwl you're right. I patched the wrong binary. A simple file myfile.dylib revealed it has two archs. Now it seems to working fine. Thanks for the head-ups :) – Gregor Isack Jul 18 '18 at 13:25