beehive-lab / mambo

A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).
Apache License 2.0
323 stars 69 forks source link

thumb_load_store_single_reg_imm12_32 caculate wrong instruction whem imm12 is less than 0x40 #35

Closed sundalin0512 closed 9 months ago

sundalin0512 commented 5 years ago

if imm12 < 0x40, the instruction generated by thumb_load_store_single_reg_imm12_32 is ldr Rt, [Rn, Rm, LSL imm], rather than ldr Rt, [Rn, imm]

such as if we want to generate ldr R1, [R1], but actually ldr R1, [R1, R0] generated.

lgeek commented 5 years ago

Hi. Could you show me how you're calling thumb_load_store_single_reg_imm12_32? In any case, you probably should use thumb_ldrwi32() instead.

sundalin0512 commented 5 years ago

In my case, the instruction is ldr.w r1, [pc, #-80], the opcode is f85f 1050, generated ldr R1, [R1, R0], but shoule be ldr R1, [R1]. But for ldr.w r1, [pc, #936], opcode is f8df 13a8, the generated instruction is correct.

sundalin0512 commented 5 years ago

When upwards == 0 && imm < 0x40, this function generates ldr Rt, [Rn, Rm, LSL imm]; When upwards == 0 && imm >= 0x40 && imm < 0x800, this function generates illegal instruction.

IgWod commented 9 months ago

Since it's an old issue and I have no way of testing it at the moment, I'm going to close it in the effort to clean up the repo. If anyone still requires this fix, please re-open the issue and I can look into it.