@attheodo

Cracking a 3rd party iOS framework for fun & profit

Assembly Primer

Assembly Primer

CPU Registers

  • Little "hardware variables" very close to the CPU that are blazing fast

CPU Instructions

  • Single purpose "functions" that operate on/with CPU registers

  • They can perform arithmetic, moving values etc

Memory

  • A continuous, volatile space of "storage slots" (words) that can be addressed by the CPU

  • It's mostly where your program lives when it's running

Assembly Primer

CPU Registers

  • Specific to each architecture

  • x86_64 uses 16 general purpose registers

RAX A extended Typically return values
RBX B extended Callee-saved
RCX C extended 4th arg to functions
RDX D extended 3rd argument to functions
RDI Destination Index 1st arg to functions
RSI Source Index  2nd arg to functions
RSP Stack pointer
RBP Base Pointer (start of stack)
R8 - R15

Assembly Primer

CPU Instructions

  • mov (Move - Copies the data refered by one item to the other)

  • Push (Places stuff on top of the stack)

  • pop (Removes stuff from the top of the stack)

  • ...

Data Movement

  • add (Integer addition)
  • sub (Integer subtraction)
  • inc, dec (Increment/Decrement)
  • ...

Arithmetic

  • jmp (Jump - Transfers flow to the instruction at a memory location)
  • jCondition(je/jne/... - JumpWhenEqual/JumpWhenNotEqual according to the "machine status word"
  • cmp (Compare - Sets the "machine status word" according to the comparison
  • ...

Control flow

Assembly Primer

Memory

Assembly Primer

Memory

Stack

  • LIFO Datastructure

  • Usually grows downwards to lower addresses

  • Stores all the data required by a function call

    • Everytime a new function is execute, a new stack frame is being created at the top of the stack

    • When it finishes, the stack from is poped from the stack

    • The stack frame contains all the functions parameters, the return address back to the caller of the function and any variables local to that function.

Assembly Primer

Memory

Heap

  • A memory segment for dynamic memory allocation

    • All reference types created by malloc/new 

    • Uses the brk and sbrk system calls to adjust its size

  • Heap is used:

    • Memory size is dynamically allocated at run-time 

    • Scope is not local to a function

    • Allocated size is large

Assembly Primer

Memory

BSS (Block Started by Symbol)

  • An unitialized data segment

  • Data in this segment is usually initialized by the kernel before the program starts its execution

  • I.e static let index = 0 will be allocated in the BSS

Assembly Primer

Memory

Data

  • This segment contains initialized global and static variables which have a pre-defined value and can be modified.

  • It has a read-only and a read-write space.

  • Let's just say it holds global variables

Text

  • A segment where basically assembly instructions are stored.

  • This is read-only

Assembly Primer

Memory

How stack frames work

Questions?

Cracking an iOS Framework for fun

By Thanos Theodoridis

Cracking an iOS Framework for fun

  • 189