Foundations of ARM64 Linux Debugging, Disassembling, and Reversing: Analyze Code, Understand Stack Memory Usage, and Reconstruct Original C/C++ Code with ARM64

© The Author(s), under exclusive license to APress Media, LLC, part of Springer Nature 2023

D. VostokovFoundations of ARM64 Linux Debugging, Disassembling, and Reversinghttps://doi.org/10.1007/978-1-4842-9082-8_14

14. Summary of Code Disassembly Patterns

Dmitry Vostokov¹  

(1)

Dublin, Ireland

 

This final chapter summarizes the various patterns we have encountered during the reading of this book.

Function Prolog/Epilog

Function prolog

stp  x29, x30, [sp,#-48]!

mov  x29, sp

Some code may omit stp if there are no nested calls inside:

sub  sp, sp, #0x10

Function epilog

ldp  x29, x30, [sp],#48

ret

Some code may omit to restore X29/X30 if there are no nested calls inside:

add  sp, sp, #0x10

ret

Knowing the prolog can help identify situations when symbol files or function ...