pfalcon / ScratchABit

Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

plugins/cpu/arm_thumb: Supports only Thumb, not Thumb2

pfalcon opened this issue · comments

Continuing from #23 . See "orr/mov.w", "sub.w", "ldr" below.

│0802cf44 9878         ldrb     r0, [r3, #2]                                                                                           │
│0802cf46 5978         ldrb     r1, [r3, #1]                                                                                           │
│0802cf48 f268         ldr      r2, [r6, #12]                                                                                          │
│0802cf4a 41ea0021     orr/mov.w                                                                                                       │
│0802cf4e 0333         add      r3, #3                                                                                                 │
│0802cf50 0b44         add      r3, r1                                                                                                 │
│0802cf52 043a         sub      r2, #4                                                                                                 │
│0802cf54 7360         str      r3, [r6, #4]                                                                                           │
│0802cf56 f260         str      r2, [r6, #12]                                                                                          │
│0802cf58 fff732ba     b.w      0xa02c3c0                                                                                              │
│0802cf5c 5b10         asr      r3, r3, #1                                                                                             │
│0802cf5e 012b         cmp      r3, #1                                                                                                 │
│0802cf60 a5f10401     sub.w                                                                                                           │
│0802cf64 5ed0         beq      loc_0802d024                                                                                           │
│0802cf66 55f8042c     ldr                                  

Only standard Thumb instructions were fully implemented. As such there's a lot of decoding missing from the Thumb 2 extensions.

@dpgeorge : Thanks for emphasizing that. Added explicit note of that in 72da2e8 and keeping this open as a known issue.

The situation is now documented in https://github.com/pfalcon/ScratchABit/tree/master/plugins/cpu , and there's an alternative in the form of Capstone plugin.