LDR Instruction
ARM Load Instructions
How LDR Works
Instruction:
LDR r0, [pc, #12]
Step 1: Calculate addr
addr = PC + 12
Step 2: Read memory
value = *(addr)
Step 3: Load into reg
r0 = value
r0 now holds the
address of our
"hello, world" string
Why It Matters
String Loading
printf needs addr
of string in r0
r0 = first argument
PC-Relative
Address computed
relative to current
PC position
Works from any addr
The Attack Point
If we change r0
AFTER the LDR
printf prints OUR
string instead!
This is the hack!