diff options
Diffstat (limited to 'docs/PROJECTS.md')
| -rw-r--r-- | docs/PROJECTS.md | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/docs/PROJECTS.md b/docs/PROJECTS.md index 10274ab..fe6c2a8 100644 --- a/docs/PROJECTS.md +++ b/docs/PROJECTS.md @@ -297,6 +297,58 @@ conversion happens in `BinaryRef.load_args`, and a base that isn't 16-byte aligned is rejected rather than silently landing somewhere else. `ida_args` passes anything else through untouched. +### ARM/Thumb + +Thumb is not a property of the bytes — it's a mode the CPU is in — so a raw image +gives IDA nothing to detect. At a Thumb entry point it decodes 16-bit +instructions as 32-bit ARM and produces confident nonsense: `push {r3,lr}` +(`08 b5`) reads as `SVCLT 0xBF00`, and `c` either refuses or carves garbage. + +`t` on the listing switches the mode at the cursor and disassembles in it: + + Thumb @ 0x0 (segment set to 32-bit; Thumb needs ARM32) — 10 instructions + +It sets IDA's `T` segment register, and forces the segment to 32-bit when +turning Thumb on. That second part isn't optional: Thumb doesn't exist in +AArch64, and a headerless blob loaded with `-parm` comes up 64-bit, so setting +`T` alone changes nothing and looks broken. Asking for Thumb *is* asking for +ARM32. + +`t` again toggles back — the mode is a guess, and guesses get revised. Both +states are saved in the `.i64`. + +**Pick a 32-bit processor at load, or none of this decompiles.** Bare `arm` +gives a 64-BIT database (AArch64), and that is decided at load time and cannot be +changed afterwards — setting the bitness post-hoc makes the decompiler INTERR. +In a 64-bit database: + +* Thumb doesn't exist, so `t` sets a segment flag that means nothing; and +* Hex-Rays refuses a 32-bit function outright — *"only 64-bit functions can be + decompiled in the current database"* — so the disassembly looks right and F5 + silently produces nothing. + +So the list offers `arm:ARMv7-A` (most firmware), `arm:ARMv7-M` / `arm:ARMv6-M` +(Cortex-M, Thumb only) and `arm:ARMv5TE` alongside 64-bit `arm`. `t` warns when +it notices the database is 64-bit and points at `Ctrl+L`. + +Worth knowing: a correctly-chosen 32-bit ARM database also lets IDA's own +auto-analysis find Thumb functions — `experiments/fibonacci.bin` yields 54 +functions on load with `arm:ARMv7-A` and none with `arm`. + +### Thumb entry points from a vector table + +`Shift+T` scans forward from the cursor for **odd pointers** — an ARM function +pointer carries the mode in bit 0, so a Cortex-M vector table is a list of Thumb +entry points. IDA won't follow them on a headerless image, because nothing tells +it those words are pointers at all: + + 3 Thumb entries found, 3 disassembled + +A word only counts when it is odd, lands inside a loaded segment, and its target +is executable and not already data. The even words in a vector table (the initial +stack pointer) fail the first test, which is the point — marking a data word as +code corrupts the listing, so a false positive costs more than a miss. + ### When analysis finds nothing Zero functions is what a raw image described wrongly looks like — right file, |