Fix ARM MTE addg/subg and big endian decoding ##anal (#17995)
* ARM: Fix addg/subg instruction decoding * ARM: Fix MTE intruction decoding in big endian mode
This commit is contained in:
GustavoLCR
Anton Kochkov
parent
b823017cb1
commit
0c26b5a4ea
4 changed files with 80 additions and 14 deletions
|
|
@ -105,7 +105,7 @@ static int hack_handle_dp_imm(ut32 insn, RzAnalysisOp *op) {
|
|||
const bool sf = (insn >> 31) & 0x1;
|
||||
const bool op_ = (insn >> 30) & 0x1;
|
||||
const bool S = (insn >> 29) & 0x1;
|
||||
const bool o2 = (insn >> 2) & 0x1;
|
||||
const bool o2 = (insn >> 22) & 0x1;
|
||||
if (sf && !S && !o2) {
|
||||
if (op_ ) {
|
||||
// subg
|
||||
|
|
@ -147,8 +147,8 @@ static inline int hackyArmAnal(RzAnalysis *a, RzAnalysisOp *op, const ut8 *buf,
|
|||
int ret = -1;
|
||||
// Hacky support for ARMv8.3 and ARMv8.5
|
||||
if (a->bits == 64 && len >= 4) {
|
||||
ut32 *insn = (ut32 *)buf;
|
||||
int insn_class = (*insn >> 25) & 0xf;
|
||||
ut32 insn = rz_read_ble32 (buf, a->big_endian);
|
||||
int insn_class = (insn >> 25) & 0xf;
|
||||
// xpaci // e#43c1da
|
||||
if (!memcmp (buf + 1, "\x43\xc1\xda", 3)) {
|
||||
op->type = RZ_ANALYSIS_OP_TYPE_MOV;
|
||||
|
|
@ -170,18 +170,18 @@ static inline int hackyArmAnal(RzAnalysis *a, RzAnalysisOp *op, const ut8 *buf,
|
|||
case 5:
|
||||
case 13:
|
||||
// irg, subp, gmi, subps
|
||||
ret = hack_handle_dp_reg (*insn, op);
|
||||
ret = hack_handle_dp_reg (insn, op);
|
||||
break;
|
||||
// Data Processing -- Immediate
|
||||
case 8:
|
||||
case 9:
|
||||
// addg, subg
|
||||
ret = hack_handle_dp_imm (*insn, op);
|
||||
ret = hack_handle_dp_imm (insn, op);
|
||||
break;
|
||||
case 10:
|
||||
case 11:
|
||||
// bti
|
||||
ret = hack_handle_br_exc_sys (*insn, op);
|
||||
ret = hack_handle_br_exc_sys (insn, op);
|
||||
break;
|
||||
// Loads and Stores
|
||||
case 4:
|
||||
|
|
@ -189,7 +189,7 @@ static inline int hackyArmAnal(RzAnalysis *a, RzAnalysisOp *op, const ut8 *buf,
|
|||
case 12:
|
||||
case 14:
|
||||
// stg, stzgm, ldg, stzg, st2g, stgm, stz2g, ldgm, stgp
|
||||
ret = hack_handle_ldst (*insn, op);
|
||||
ret = hack_handle_ldst (insn, op);
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ static char *hack_handle_dp_imm(ut32 insn) {
|
|||
const bool sf = (insn >> 31) & 0x1;
|
||||
const bool op = (insn >> 30) & 0x1;
|
||||
const bool S = (insn >> 29) & 0x1;
|
||||
const bool o2 = (insn >> 2) & 0x1;
|
||||
const bool o2 = (insn >> 22) & 0x1;
|
||||
if (sf && !S && !o2) {
|
||||
if (op) {
|
||||
mnemonic = "subg";
|
||||
|
|
@ -221,26 +221,26 @@ static int hackyArmAsm(RzAsm *a, RzAsmOp *op, const ut8 *buf, int len) {
|
|||
char *buf_asm = NULL;
|
||||
// Hacky support for ARMv8.5
|
||||
if (a->bits == 64 && len >= 4) {
|
||||
ut32 *insn = (ut32 *)buf;
|
||||
int insn_class = (*insn >> 25) & 0xf;
|
||||
ut32 insn = rz_read_ble32 (buf, a->big_endian);
|
||||
int insn_class = (insn >> 25) & 0xf;
|
||||
switch (insn_class) {
|
||||
// Data Processing -- Register
|
||||
case 5:
|
||||
case 13:
|
||||
// irg, subp, gmi, subps
|
||||
buf_asm = hack_handle_dp_reg (*insn);
|
||||
buf_asm = hack_handle_dp_reg (insn);
|
||||
break;
|
||||
// Data Processing -- Immediate
|
||||
case 8:
|
||||
case 9:
|
||||
// addg, subg
|
||||
buf_asm = hack_handle_dp_imm (*insn);
|
||||
buf_asm = hack_handle_dp_imm (insn);
|
||||
break;
|
||||
// Branches, Exception generating, and System instructions
|
||||
case 10:
|
||||
case 11:
|
||||
// bti
|
||||
buf_asm = hack_handle_br_exc_sys (*insn);
|
||||
buf_asm = hack_handle_br_exc_sys (insn);
|
||||
break;
|
||||
// Loads and Stores
|
||||
case 4:
|
||||
|
|
@ -248,7 +248,7 @@ static int hackyArmAsm(RzAsm *a, RzAsmOp *op, const ut8 *buf, int len) {
|
|||
case 12:
|
||||
case 14:
|
||||
// stg, stzgm, ldg, stzg, st2g, stgm, stz2g, ldgm, stgp
|
||||
buf_asm = hack_handle_ldst (*insn);
|
||||
buf_asm = hack_handle_ldst (insn);
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -125,6 +125,71 @@ family: sec
|
|||
EOF
|
||||
RUN
|
||||
|
||||
NAME=ao mte big endian
|
||||
FILE=-
|
||||
ARGS=-a arm -b 64 -e cfg.bigendian=true
|
||||
CMDS=<<EOF
|
||||
wx 91a0090c918201099ac813e8
|
||||
ao@0
|
||||
?e ---
|
||||
ao@4
|
||||
?e ---
|
||||
ao@8
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
address: 0x0
|
||||
opcode: addg x12, x8, 0x0, 0x2
|
||||
esilcost: 0
|
||||
disasm: addg x12, x8, 0x0, 0x2
|
||||
pseudo: addg x12,x8,0x0, 0x2
|
||||
mnemonic: addg
|
||||
mask: ffffffff
|
||||
prefix: 0
|
||||
id: 0
|
||||
bytes: 91a0090c
|
||||
refptr: 0
|
||||
size: 4
|
||||
sign: false
|
||||
type: add
|
||||
cycles: 0
|
||||
family: sec
|
||||
---
|
||||
address: 0x4
|
||||
opcode: addg x9, x8, 0x20, 0x0
|
||||
esilcost: 0
|
||||
disasm: addg x9, x8, 0x20, 0x0
|
||||
pseudo: addg x9,x8,0x20, 0x0
|
||||
mnemonic: addg
|
||||
mask: ffffffff
|
||||
prefix: 0
|
||||
id: 0
|
||||
bytes: 91820109
|
||||
refptr: 0
|
||||
size: 4
|
||||
sign: false
|
||||
type: add
|
||||
cycles: 0
|
||||
family: sec
|
||||
---
|
||||
address: 0x8
|
||||
opcode: irg x8, sp, x8
|
||||
esilcost: 0
|
||||
disasm: irg x8, sp, x8
|
||||
pseudo: irg x8,sp,x8
|
||||
mnemonic: irg
|
||||
mask: ffffffff
|
||||
prefix: 0
|
||||
id: 0
|
||||
bytes: 9ac813e8
|
||||
refptr: 0
|
||||
size: 4
|
||||
sign: false
|
||||
type: mov
|
||||
cycles: 0
|
||||
family: sec
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=Variable analysis with stp/preindexed str
|
||||
FILE=-
|
||||
ARGS=-a arm -b 64
|
||||
|
|
|
|||
|
|
@ -267,6 +267,7 @@ a "msr sp_el0, x3" 034118d5
|
|||
a "cbnz w3, 0x1fffd4" a3feff35
|
||||
a "cbz x3, 0x1fffe8" 43ffffb4
|
||||
d "addg x0, sp, 0x80, 0x4" e0138891
|
||||
dE "addg x12, x8, 0x0, 0x2" 91a0090c
|
||||
d "subg x0, sp, 0x20, 0xf" e03f82d1
|
||||
d "irg sp, x0" 1f10df9a
|
||||
d "irg x13, x3, x7" 6d10c79a
|
||||
|
|
|
|||
Loading…
Reference in a new issue