|
From: Josef W. <Jos...@gm...> - 2006-09-28 20:03:23
|
On Thursday 28 September 2006 21:16, Julian Seward wrote:
> I later documented the trick as shown below, so at least we can see what
> it is doing.
>
> J
>
> /* We have to determine whether or not LR currently holds this fn
> (call it F)'s return address. It might not if F has previously
> called some other function, hence overwriting LR with a pointer
> to some part of F. Hence if LR and IP point to the same
> function then we conclude LR does not hold this function's
> return address; instead the LR at entry must have been saved in
> the stack by F's prologue and so we must get it from there
> instead. Note all this guff only applies to the innermost
> frame. */
Wow. This implies the assumption that LR never can hold any other value
than either the return address of the current function or the return address of
the function we called (which resides in the current function).
Is this always correct? I think that "blr" could be reused as
indirect jump by loading code pointer into LR. Hmmm... such a
jump still _should_ be in the current function (?).
For an indirect call ("brlr"?), the assumption is also true *after*
the call happened (but *not* directly before the call...).
Now the question is whether we really have to check this whenever we
branch to LR (blr), ie. whether a blr should map to a "return" or a
"boring jump".
Josef
>
>
|