arm: find Thumb entry points from a vector table (Shift+T)

An ARM function pointer carries the mode in bit 0: odd means Thumb. A Cortex-M
vector table is therefore a list of Thumb entry points, and IDA won't follow them
on a headerless image because nothing tells it those words are pointers at all.
Shift+T scans forward from the cursor and marks them.

  0 functions -> 3 Thumb entries found, 3 disassembled

A word only counts when it is odd, lands in a loaded segment, and its target is
executable and not already data. The even words in a vector table — the initial
stack pointer — fail the first test, which is the point: marking a data word as
code corrupts the listing, so a false positive costs more than a miss. The
fixture includes an even in-range word and an odd OUT-of-range word to keep that
honest.

A note on how this started: I recommended this feature, then probed
experiments/fibonacci.bin for the signal and found ZERO odd in-range pointers —
it's a flat code blob, not a firmware image. Rather than build a detector I
couldn't test, I wrote experiments/cortexm.bin: a real vector table pointing at
small self-contained Thumb handlers. The first version of that fixture aimed its
handlers into the middle of copied code, so two "entries" were really inside one
function — the tool was right and the fixture was wrong, which is worth stating
because I nearly filed it as a bug.

Function creation goes through one _idatui_add_func helper now, shared with
define_func_run: add_func(ea) alone fails on freshly-marked code (IDA can't find
the end), and the scan hit exactly the same wall `p` did.

Status precedence, fixed properly this time. An action's result kept being
overwritten by the reload it triggered — cursor moved, filter re-applied,
functions re-counted. I patched that at FIVE separate call sites before
admitting it's one problem. _status(text, priority=True) now marks a result: it
holds the bar for 8s or until the next keypress, and routine chatter can't
outrank it. The per-site special cases are gone.

tests: +4 thumb (20) — a bare vector table gives IDA nothing, scanning finds
exactly the three handlers, the non-pointer words are ignored, and the result
survives both the reload and the reindex. 209/0 scenarios, 30/0 blob, 30/0
project UI.

1 files changed, 47 insertions, 0 deletions

diff --git a/tests/test_thumb_ui.py b/tests/test_thumb_ui.py
index 84afcaf..b0ca00b 100644
--- a/tests/test_thumb_ui.py
+++ b/tests/test_thumb_ui.py
@@ -202,6 +202,53 @@ async def run() -> int:
               any("(" in t and ")" in t for t in (dec._texts or [])[:3]),
               f"{(dec._texts or [])[:3]}")
 
+    # -- Thumb entry points from a vector table ----------------------------- #
+    # An ARM function pointer carries the mode in bit 0: odd means Thumb. A
+    # Cortex-M vector table is therefore a list of Thumb entry points, and IDA
+    # won't follow them on a headerless image because nothing says those words
+    # are pointers at all.
+    vec = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+                       "experiments", "cortexm.bin")
+    if not os.path.isfile(vec):
+        check("the cortexm fixture exists", False, vec)
+    else:
+        for ext in (".i64", ".id0", ".id1", ".id2", ".nam", ".til"):
+            try:
+                os.remove(vec + ext)
+            except OSError:
+                pass
+        app = IdaTui(open_path=vec, keepalive=False, load_args="-parm:ARMv7-M")
+        async with app.run_test(size=(140, 44)) as pilot:
+            await wait(lambda: app._func_index is not None
+                       and app._func_index.complete, pilot)
+            check("a bare vector table gives IDA nothing to go on",
+                  len(app._func_index) == 0, f"n={len(app._func_index)}")
+            if type(app.screen).__name__ != "Screen":
+                await pilot.press("escape")
+                await pilot.pause(0.5)
+            app._goto_ea(0, push=True)
+            lst = app.query_one(ListingView)
+            await wait(lambda: lst.model is not None, pilot, 60)
+            lst.focus()
+            lst.cursor = lst.model.index_of_ea(0)
+            lst._scroll_cursor_into_view()
+            await pilot.pause(0.3)
+            await pilot.press("T")
+            await wait(lambda: app._func_index is not None
+                       and len(app._func_index) >= 3, pilot, 90)
+            names = sorted(f.name for f in app._func_index.all_loaded())
+            check("scanning the table finds the Thumb handlers",
+                  names == ["sub_200", "sub_240", "sub_280"], f"{names}")
+            # The table also holds an even word (the initial stack pointer), an
+            # even in-range word and an odd word pointing outside the image. All
+            # three must be ignored — marking a data word as code corrupts the
+            # listing, so the cost of a false positive is high.
+            check("and ignores the words that aren't Thumb pointers",
+                  len(app._func_index) == 3, f"n={len(app._func_index)}")
+            status = str(app.query_one("#status", Static).render())
+            check("the result survives the reload AND the reindex",
+                  "3 Thumb entries" in status, status[:90])
+
     print(f"\n{PASS} passed, {FAIL} failed")
     return 1 if FAIL else 0