BinaryAnalysisPlatform / bap

Binary Analysis Platform
MIT License
2.05k stars 271 forks source link

Fixes ARM/Thumb `movt` semantics #1391

Closed bmourad01 closed 2 years ago

bmourad01 commented 2 years ago

The lifter was incorrectly re-using the upper 16 bits of the destination register, when the manual states that it is completely overwritten by the source operand:

"F5.1.114 MOVT Move Top writes an immediate value to the top halfword of the destination register. It does not affect the contents of the bottom halfword."

if ConditionPassed() then
EncodingSpecificOperations();
R[d]<31:16> = imm16;
// R[d]<15:0> unchanged

So, the previous result of lifting, say, movt r0, #28 would be:

R0 := R0 | 0x1C0000

This PR changes the behavior to be:

R0 := pad:32[low:16[R0]] | 0x1C0000