0

I was analyzing the code of an Android app ARMv7 native library and I have found this code:

LOAD:0000FC20 getOpCode                               ; DATA XREF: LOAD:00000188↑o
LOAD:0000FC20                                         ; LOAD:0003AFA8↓o
LOAD:0000FC20                 LDRSH           R5, [R6,R2]
LOAD:0000FC22                 SVC             0xB0
LOAD:0000FC24                 LDR             R0, [R6,R2]
LOAD:0000FC26                 ADR             R0, unk_10024
LOAD:0000FC28                 PUSH            {R1-R3,R5-R7,LR}
LOAD:0000FC2A                 B               stru_F4A4.r_offset+2

I can't find anything online about SVC 0xB0. What is that used for?

na29
  • 45
  • 6
  • If you explicitly want to know the unix call, it is in unistd.h as `getgid()`. Try: `man syscall` on a Linux system. But this mechanics is called 'OABI' and should not be used. I don't think Android would use OABI. The number should be passed in `R7`. – artless noise Jun 19 '23 at 22:10
  • It is possible that if they are trying to obfuscate something, they might grab the '0xB0' on an EABI kernel as some 'secret' data. As most kernels without OABI support will ignore the`SVC` number. See also: [SVC and SWI](https://stackoverflow.com/questions/8459279/are-arm-instructuons-swi-and-svc-exactly-same-thing).. Ie, these are the same opcode. – artless noise Jun 19 '23 at 22:15
  • @artlessnoise which details should I add? – na29 Jun 20 '23 at 06:58
  • Sorry, do you need more details or the other Q/A explain everything? If everything is explained, then we can leave the question as a duplicate. – artless noise Jun 20 '23 at 11:54
  • And [another one on SVC immediates](https://stackoverflow.com/questions/76129320/interpretation-of-svc-n-imm-instruction-in-arm). – artless noise Jun 20 '23 at 14:09

0 Answers0