diff options
| author | blasty <blasty@local> | 2026-07-26 14:51:07 +0200 |
|---|---|---|
| committer | blasty <blasty@local> | 2026-07-26 14:51:07 +0200 |
| commit | 7bdf3741c91f76bfff3f3e054a5cf41b7f476d0b (patch) | |
| tree | 26404f9b55551980505dbc94f9757f7ee7c187e7 /tests/test_formats.py | |
| parent | TODO: DisasmView removed (diff) | |
| download | ida-tui-7bdf3741c91f76bfff3f3e054a5cf41b7f476d0b.tar.gz ida-tui-7bdf3741c91f76bfff3f3e054a5cf41b7f476d0b.tar.xz ida-tui-7bdf3741c91f76bfff3f3e054a5cf41b7f476d0b.zip | |
arm: switch ARM/Thumb decoding with `t`
`c` could not carve Thumb code. Thumb isn't a property of the bytes — it's a
mode the CPU is in — so a raw image gives IDA nothing to detect: at a Thumb entry
point it decodes 16-bit instructions as 32-bit ARM and produces confident
nonsense. experiments/fibonacci.bin starts with `08 b5` = push {r3,lr}, which
IDA reads as SVCLT 0xBF00.
`t` on the listing switches the mode at the cursor and disassembles in it:
Thumb @ 0x0 (segment set to 32-bit; Thumb needs ARM32) — 10 instructions
0x0 PUSH {R3,LR} 0x2 MOVS R1, #0 0x4 MOV R4, R0 0x6 BL unk_E3C
Setting the T segment register is only half of it. Thumb does not exist in
AArch64, and a headerless blob loaded with -parm comes up 64-bit, so T alone
changes nothing and looks broken — I watched exactly that happen while probing
the API. Asking for Thumb IS asking for ARM32, so set_thumb forces the segment
to 32-bit and says so rather than doing it silently.
It also has to del_items over the range first: the bytes are currently decoded
in the old mode, and leaving that item defined pins the wrong instruction length
so the new mode has nothing to apply to.
Implemented as a `thumb` kind in the existing edit-item flow, so it inherits the
shared reload — same cache bump, same ViewAnchor restore, same status flash. It
switches AND disassembles, because flipping T and leaving the bytes undefined
shows you nothing and reading the code was the point.
tests: new tests/test_thumb_ui.py (8) driving the real Thumb binary — `c` alone
does NOT produce the prologue, `t` does, the instructions are 16-bit wide (in ARM
mode those three rows would be one 4-byte instruction), the run continues, the
status explains the 32-bit forcing, and `t` toggles back. Deletes the .i64 first,
because T and the segment's addressing mode are saved in it and a stale database
would answer the question for us.
209/0 scenarios, 26/0 blob, 8/0 thumb.
Diffstat (limited to 'tests/test_formats.py')
0 files changed, 0 insertions, 0 deletions
