You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If given those six bytes, the Reko ThumbRewriter class handles this correctly and generates the following RTL clusters:
l0000:
nop
l0002:
if (Test(EQ,Z)) branch l0004
r7 = 1<32>
l0004:
if (TEST(NE,Z)) branch l0006
r7 = 0<32>
This relies on the ThumbDisassembler maintaining the state of the current IT block to perform the appropriate conditional jumps. However, the Reko Scanner create a new disassembler instance after every basic block it completes, and the new disassembler instance doesn't have the IT state set correctly. Therefore we get the following RTL:
l0000:
nop
l0002:
if (Test(EQ,Z)) branch l0004
r7 = 1<32>
l0004: <-- new basic block, so blank IT state
r7 = 0<32>
which generates the wrong result.
What Reko should do here is try to hang on to the ThumbRewriter (with its ThumbDisassembler inside) across the fall-through of a basic block. That way the IT` state will preserved and correct output will be obtained.
The text was updated successfully, but these errors were encountered:
An example of this code in the wild is the subject binary subjects/Elf/ARM/angr-685/RTOSDemo at address 0000925C, corresponding to the procedure GPIOPadConfigGet
The following sequence of ARM Thumb instructions model setting
r7
to 1 or 0 depending on the value of theZ
processor flag.If given those six bytes, the Reko
ThumbRewriter
class handles this correctly and generates the following RTL clusters:This relies on the
ThumbDisassembler
maintaining the state of the currentIT
block to perform the appropriate conditional jumps. However, the Reko Scanner create a new disassembler instance after every basic block it completes, and the new disassembler instance doesn't have theIT
state set correctly. Therefore we get the following RTL:which generates the wrong result.
What Reko should do here is try to hang on to the
ThumbRewriter
(with itsThumbDisassembler inside) across the fall-through of a basic block. That way the
IT` state will preserved and correct output will be obtained.The text was updated successfully, but these errors were encountered: