Repository navigation
Expand file tree
/
Copy pathghidra_extraction_hybrid.json
More file actions
117 lines (116 loc) · 9.31 KB
/
Copy pathghidra_extraction_hybrid.json
File metadata and controls
117 lines (116 loc) · 9.31 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
{
"binary_name": "benchmark_arm64",
"architecture": "AARCH64",
"functions": [
{
"name": "_start_main",
"entry_point": "0010478c",
"decompiled_c": "\r\nvoid _start_main(undefined8 param_1)\r\n\r\n{\r\n code *UNRECOVERED_JUMPTABLE;\r\n undefined8 local_40;\r\n undefined8 uStack_38;\r\n undefined1 *local_30;\r\n undefined8 uStack_28;\r\n undefined8 uStack_20;\r\n undefined8 uStack_18;\r\n \r\n uStack_28 = 0;\r\n local_30 = (undefined1 *)0x0;\r\n uStack_18 = 0;\r\n uStack_20 = 0;\r\n uStack_38 = 0;\r\n local_40 = 0;\r\n if (0 < (long)PTR__start_00108b68 - (long)PTR__start_00108b60) {\r\n local_30 = &fini_array_with_sentinels;\r\n }\r\n UNRECOVERED_JUMPTABLE = (code *)__libc_init(param_1,0,PTR_main_00108b70,&local_40);\r\n if (UNRECOVERED_JUMPTABLE != (code *)0x0) {\r\n /* WARNING: Could not recover jumptable at 0x001047f0. Too many branches */\r\n /* WARNING: Treating indirect jump as call */\r\n (*UNRECOVERED_JUMPTABLE)();\r\n return;\r\n }\r\n return;\r\n}\r\n\r\n",
"assembly": [
"0010478c: paciasp",
"00104790: sub sp,sp,#0x40",
"00104794: stp x29,x30,[sp, #0x30]",
"00104798: add x29,sp,#0x30",
"0010479c: adrp x8,0x108000",
"001047a0: adrp x9,0x108000",
"001047a4: movi v0.2D,#0x0",
"001047a8: ldr x8,[x8, #0xb60]",
"001047ac: ldr x9,[x9, #0xb68]",
"001047b0: sub x8,x9,x8",
"001047b4: cmp x8,#0x1",
"001047b8: stp q0,q0,[sp, #0x10]",
"001047bc: str q0,[sp]",
"001047c0: b.lt 0x001047d0",
"001047c4: nop",
"001047c8: adr x8,0x10cbc0",
"001047cc: str x8,[sp, #0x10]",
"001047d0: adrp x2,0x108000",
"001047d4: mov x3,sp",
"001047d8: mov x1,xzr",
"001047dc: ldr x2,[x2, #0xb70]",
"001047e0: bl 0x00104980"
],
"resolved_data": {
},
"calls": {"0x104980": "__libc_init"},
"loops": [
]
},
{
"name": "main",
"entry_point": "00104878",
"decompiled_c": "\r\nundefined8 main(void)\r\n\r\n{\r\n byte bVar1;\r\n byte bVar2;\r\n ulong uVar3;\r\n ulong uVar4;\r\n ulong uVar5;\r\n ulong uVar6;\r\n ulong uVar7;\r\n ulong uVar8;\r\n ulong uVar9;\r\n ulong uVar10;\r\n ulong uVar11;\r\n clock_t cVar12;\r\n clock_t cVar13;\r\n int iVar14;\r\n long lVar15;\r\n long lVar16;\r\n uint uVar17;\r\n byte bVar18;\r\n uint uVar19;\r\n byte bVar20;\r\n uint uVar21;\r\n uint uVar22;\r\n long lVar23;\r\n long lVar24;\r\n byte bVar25;\r\n uint uVar26;\r\n uint uVar28;\r\n undefined8 uVar27;\r\n \r\n puts(\"[+] Execucao nativa ARM64 iniciada no Android!\");\r\n uVar27 = DAT_001005c8;\r\n iVar14 = 10000000;\r\n cVar12 = clock();\r\n lVar23 = 0;\r\n lVar24 = 0;\r\n lVar15 = 0;\r\n lVar16 = 0;\r\n do {\r\n uVar26 = (uint)uVar27;\r\n uVar17 = uVar26 + 2;\r\n uVar28 = (uint)((ulong)uVar27 >> 0x20);\r\n uVar19 = uVar28 + 2;\r\n iVar14 = iVar14 + -4;\r\n uVar21 = uVar17 >> 3;\r\n uVar22 = uVar19 >> 3;\r\n uVar8 = (ulong)uVar27 >> 8;\r\n bVar25 = (byte)uVar27;\r\n uVar9 = (ulong)uVar27 >> 0x10;\r\n uVar3 = (ulong)uVar27 >> 8;\r\n bVar1 = (byte)((ulong)uVar27 >> 0x18);\r\n uVar4 = (ulong)uVar27 >> 0x10;\r\n uVar10 = (ulong)uVar27 >> 0x2b;\r\n uVar5 = (ulong)uVar27 >> 0x20;\r\n uVar11 = (ulong)uVar27 >> 0x33;\r\n uVar6 = (ulong)uVar27 >> 0x28;\r\n bVar2 = (byte)((ulong)uVar27 >> 0x38);\r\n uVar7 = (ulong)uVar27 >> 0x30;\r\n uVar27 = CONCAT44(uVar28 + 4,uVar26 + 4);\r\n bVar18 = (byte)(uVar17 >> 0x18);\r\n bVar20 = (byte)(uVar19 >> 0x18);\r\n lVar23 = lVar23 + (ulong)(uint)(CONCAT13(bVar1 >> 3 ^ bVar1,\r\n CONCAT12((byte)((ushort)uVar9 >> 3) ^ (byte)uVar4,\r\n CONCAT11((byte)((uint3)uVar8 >> 3) ^\r\n (byte)uVar3,\r\n (byte)(uVar26 >> 3) ^ bVar25))) * 3);\r\n lVar24 = lVar24 + (ulong)(uint)(CONCAT13(bVar2 >> 3 ^ bVar2,\r\n CONCAT12((byte)(ushort)uVar11 ^ (byte)uVar7,\r\n CONCAT11((byte)(uint3)uVar10 ^ (byte)uVar6,\r\n (byte)(uVar28 >> 3) ^ (byte)uVar5)))\r\n * 3);\r\n lVar15 = lVar15 + (ulong)(uint)(CONCAT13(bVar18 >> 3 ^ bVar18,\r\n CONCAT12((byte)(uVar21 >> 0x10) ^\r\n (byte)(uVar17 >> 0x10),\r\n CONCAT11((byte)(uVar21 >> 8) ^\r\n (byte)(uVar17 >> 8),\r\n (byte)uVar21 ^ (byte)uVar17))) * 3);\r\n lVar16 = lVar16 + (ulong)(uint)(CONCAT13(bVar20 >> 3 ^ bVar20,\r\n CONCAT12((byte)(uVar22 >> 0x10) ^\r\n (byte)(uVar19 >> 0x10),\r\n CONCAT11((byte)(uVar22 >> 8) ^\r\n (byte)(uVar19 >> 8),\r\n (byte)uVar22 ^ (byte)uVar19))) * 3);\r\n } while (iVar14 != 0);\r\n cVar13 = clock();\r\n printf(\"[+] Resultado: %lld\\n\",(double)(cVar13 - cVar12),lVar15 + lVar23 + lVar16 + lVar24);\r\n printf(\"[+] Tempo decorrido: %.4f s\\n\",(double)(cVar13 - cVar12) / 1000000.0);\r\n puts(\"[+] Executado nativamente no hardware AArch64.\");\r\n return 0;\r\n}\r\n\r\n",
"assembly": [
"00104878: str d8,[sp, #-0x30]!",
"0010487c: stp x29,x30,[sp, #0x10]",
"00104880: stp x20,x19,[sp, #0x20]",
"00104884: add x29,sp,#0x10",
"00104888: adrp x0,0x100000",
"0010488c: add x0,x0,#0x631",
"00104890: bl 0x001049b0",
"00104894: adrp x8,0x100000",
"00104898: mov w20,#0x9680",
"0010489c: ldr d8,[x8, #0x5c8]",
"001048a0: movk w20,#0x98, LSL #16",
"001048a4: bl 0x001049c0",
"001048a8: movi v7.2D,#0x0",
"001048ac: movi v0.2S,#0x2",
"001048b0: mov x19,x0",
"001048b4: movi v1.2S,#0x3",
"001048b8: movi v2.2S,#0x4",
"001048bc: movi v3.2D,#0x0",
"001048c0: add v4.2S,v8.2S,v0.2S",
"001048c4: ushr v5.2S,v8.2S,#0x3",
"001048c8: subs w20,w20,#0x4",
"001048cc: ushr v6.2S,v4.2S,#0x3",
"001048d0: eor v5.8B,v5.8B,v8.8B",
"001048d4: add v8.2S,v8.2S,v2.2S",
"001048d8: eor v4.8B,v6.8B,v4.8B",
"001048dc: mul v5.2S,v5.2S,v1.2S",
"001048e0: mul v4.2S,v4.2S,v1.2S",
"001048e4: uaddw v7.2D,v7.2D,v5.2S",
"001048e8: uaddw v3.2D,v3.2D,v4.2S",
"001048ec: b.ne 0x001048c0",
"001048f0: add v0.2D,v3.2D,v7.2D",
"001048f4: addp d0,v0.2D",
"001048f8: fmov x20,d0",
"001048fc: bl 0x001049c0",
"00104900: sub x8,x0,x19",
"00104904: nop",
"00104908: adr x0,0x1005d0",
"0010490c: scvtf d0,x8",
"00104910: mov x8,#0x848000000000",
"00104914: mov x1,x20",
"00104918: movk x8,#0x412e, LSL #48",
"0010491c: fmov d1,x8",
"00104920: fdiv d8,d0,d1",
"00104924: bl 0x001049d0",
"00104928: fmov d0,d8",
"0010492c: adrp x0,0x100000",
"00104930: add x0,x0,#0x614",
"00104934: bl 0x001049d0",
"00104938: adrp x0,0x100000",
"0010493c: add x0,x0,#0x5e5",
"00104940: bl 0x001049b0",
"00104944: mov w0,wzr",
"00104948: ldp x20,x19,[sp, #0x20]",
"0010494c: ldp x29,x30,[sp, #0x10]",
"00104950: ldr d8,[sp], #0x30",
"00104954: ret"
],
"resolved_data": {
"DAT_1005c8": "00 00 00 00 01 00 00 00"
},
"calls": {"0x1049b0": "puts", "0x1049d0": "printf", "0x1049c0": "clock"},
"loops": [
{
"start": "001048c0",
"end": "001048ec",
"preheader": ["00104898: mov w20,#0x9680", "0010489c: ldr d8,[x8, #0x5c8]", "001048a0: movk w20,#0x98, LSL #16", "001048a8: movi v7.2D,#0x0", "001048ac: movi v0.2S,#0x2", "001048b4: movi v1.2S,#0x3", "001048b8: movi v2.2S,#0x4", "001048bc: movi v3.2D,#0x0"],
"body": ["001048c0: add v4.2S,v8.2S,v0.2S", "001048c4: ushr v5.2S,v8.2S,#0x3", "001048c8: subs w20,w20,#0x4", "001048cc: ushr v6.2S,v4.2S,#0x3", "001048d0: eor v5.8B,v5.8B,v8.8B", "001048d4: add v8.2S,v8.2S,v2.2S", "001048d8: eor v4.8B,v6.8B,v4.8B", "001048dc: mul v5.2S,v5.2S,v1.2S", "001048e0: mul v4.2S,v4.2S,v1.2S", "001048e4: uaddw v7.2D,v7.2D,v5.2S", "001048e8: uaddw v3.2D,v3.2D,v4.2S", "001048ec: b.ne 0x001048c0"]
}
]
}
],
"strings": {"0x1005e5": "[+] Executado nativamente no hardware AArch64.", "0x1004b5": "clock", "0x1005d0": "[+] Resultado: %lld\n", "0x1004b0": "puts", "0x1004c2": "libc.so", "0x1002e0": "/system/bin/linker64", "0x10049e": "__register_atfork", "0x100614": "[+] Tempo decorrido: %.4f s\n", "0x1004cf": "libdl.so", "0x100485": "__libc_init", "0x1004ca": "LIBC", "0x1004bb": "printf", "0x100631": "[+] Execucao nativa ARM64 iniciada no Android!", "0x1006a9": "zR", "0x100491": "__cxa_atexit"}
}