ARM Reverse Engineering (Part 31 – Hacking Float Variables)

ARM Reverse Engineering (Part 31 – Hacking Float Variables)

Kevin ThomasKevin Thomas

Kevin Thomas

Author of the world’s most popular Reverse Engineering Tutorial

Published Mar 23, 2018

For a complete table of contents of all the lessons please click below as it will give you a brief of each lesson in addition to the topics it will cover. https://github.com/mytechnotalent/Reverse-Engineering-Tutorial

Let’s re-examine our code.

#include <iostream> int main(void) {            int myNumber = 1337.1;             std::cout << myNumber << std::endl;             return 0;}
No alt text provided for this image

Let’s review last week’s tutorial.

No alt text provided for this image

Let’s break onmain+20 and continue to that point.

No alt text provided for this image

Let’s examine what value is insider11-8. We clearly see it is1337.09998 which approximates our value in our original c++ code. Keep in mind a float has roughly 7 decimal digits of precision and that is why we do not see1337.1 so please remember that as we go forward.

No alt text provided for this image

We can also see this value in high memory.

No alt text provided for this image

Let’s break onmain+28 and continue.

No alt text provided for this image

We see a strange new instruction. We seevldr and the value withinr11, #8 being moved into s0. So what iss0? We have a math co-processor which has a series of additional registers that work with decimal or floating-point numbers. Here we see an example of such to which the value of1337.09998is being moved intos0. Thevldr instruction loads a constant value into every element of a single-precision or double-precision register such as s0.

No alt text provided for this image

We can only see these special registers if we do a info registers all command as we do below.

No alt text provided for this image

Below we see the value now being moved intos0.

No alt text provided for this image

Let’s hack!

No alt text provided for this image

Let’s now look at the registers and see what has transpired.

No alt text provided for this image
No alt text provided for this image

As you can see we have hacked the value (less the precision issue of the float variable accurate up to 6 decimal places)!

No alt text provided for this image

Finally as we continue we see our hacked value echoed back out to the terminal when the c++coutfunction executes.

Next week we will dive into Double Variables.

To view or add a comment,sign in

More articles by Kevin Thomas

Explore content categories