From 781c5eff4218d7ffdc9905f652ca08ce10953e43 Mon Sep 17 00:00:00 2001 From: blasty Date: Sun, 26 Jul 2026 20:49:30 +0200 Subject: arm: find Thumb entry points from a vector table (Shift+T) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An ARM function pointer carries the mode in bit 0: odd means Thumb. A Cortex-M vector table is therefore a list of Thumb entry points, and IDA won't follow them on a headerless image because nothing tells it those words are pointers at all. Shift+T scans forward from the cursor and marks them. 0 functions -> 3 Thumb entries found, 3 disassembled A word only counts when it is odd, lands in a loaded segment, and its target is executable and not already data. The even words in a vector table — the initial stack pointer — fail the first test, which is the point: marking a data word as code corrupts the listing, so a false positive costs more than a miss. The fixture includes an even in-range word and an odd OUT-of-range word to keep that honest. A note on how this started: I recommended this feature, then probed experiments/fibonacci.bin for the signal and found ZERO odd in-range pointers — it's a flat code blob, not a firmware image. Rather than build a detector I couldn't test, I wrote experiments/cortexm.bin: a real vector table pointing at small self-contained Thumb handlers. The first version of that fixture aimed its handlers into the middle of copied code, so two "entries" were really inside one function — the tool was right and the fixture was wrong, which is worth stating because I nearly filed it as a bug. Function creation goes through one _idatui_add_func helper now, shared with define_func_run: add_func(ea) alone fails on freshly-marked code (IDA can't find the end), and the scan hit exactly the same wall `p` did. Status precedence, fixed properly this time. An action's result kept being overwritten by the reload it triggered — cursor moved, filter re-applied, functions re-counted. I patched that at FIVE separate call sites before admitting it's one problem. _status(text, priority=True) now marks a result: it holds the bar for 8s or until the next keypress, and routine chatter can't outrank it. The per-site special cases are gone. tests: +4 thumb (20) — a bare vector table gives IDA nothing, scanning finds exactly the three handlers, the non-pointer words are ignored, and the result survives both the reload and the reindex. 209/0 scenarios, 30/0 blob, 30/0 project UI. --- experiments/cortexm.bin | Bin 0 -> 1024 bytes experiments/fibonacci.bin | Bin 0 -> 7016 bytes experiments/fibonacci.c | 43 +++++++++++++++++++++++++++++++++++++++++++ experiments/fibonacci.elf | Bin 0 -> 109028 bytes experiments/fibonacci.o | Bin 0 -> 3040 bytes 5 files changed, 43 insertions(+) create mode 100644 experiments/cortexm.bin create mode 100755 experiments/fibonacci.bin create mode 100644 experiments/fibonacci.c create mode 100755 experiments/fibonacci.elf create mode 100644 experiments/fibonacci.o (limited to 'experiments') diff --git a/experiments/cortexm.bin b/experiments/cortexm.bin new file mode 100644 index 0000000..173bb10 Binary files /dev/null and b/experiments/cortexm.bin differ diff --git a/experiments/fibonacci.bin b/experiments/fibonacci.bin new file mode 100755 index 0000000..6f7b470 Binary files /dev/null and b/experiments/fibonacci.bin differ diff --git a/experiments/fibonacci.c b/experiments/fibonacci.c new file mode 100644 index 0000000..26fca0c --- /dev/null +++ b/experiments/fibonacci.c @@ -0,0 +1,43 @@ +#include + +/* Iterative Fibonacci. */ +uint32_t fib_iter(uint32_t n) +{ + uint32_t a = 0, b = 1; + for (uint32_t i = 0; i < n; i++) { + uint32_t t = a + b; + a = b; + b = t; + } + return a; +} + +/* Naive recursive Fibonacci. */ +uint32_t fib_rec(uint32_t n) +{ + if (n < 2) + return n; + return fib_rec(n - 1) + fib_rec(n - 2); +} + +/* Memoized Fibonacci (static table). */ +uint32_t fib_memo(uint32_t n) +{ + static uint32_t cache[48]; + if (n < 2) + return n; + if (n >= sizeof(cache) / sizeof(cache[0])) + return fib_iter(n); + if (cache[n]) + return cache[n]; + return cache[n] = fib_memo(n - 1) + fib_memo(n - 2); +} + +volatile uint32_t sink; + +int main(void) +{ + for (uint32_t n = 0; n < 20; n++) + sink = fib_iter(n) + fib_rec(n) + fib_memo(n); + return 0; +} diff --git a/experiments/fibonacci.elf b/experiments/fibonacci.elf new file mode 100755 index 0000000..05ac21d Binary files /dev/null and b/experiments/fibonacci.elf differ diff --git a/experiments/fibonacci.o b/experiments/fibonacci.o new file mode 100644 index 0000000..c474d49 Binary files /dev/null and b/experiments/fibonacci.o differ -- cgit v1.3.1-sl0p