The rizin function analysis stops analyzing the current function, if it encounters a direct jump instruction. This is problematic in our case since the jump instructions often is located at the beginning of a packet. Hence the rest of the packet is not analyzed by the analysis code, although it is executed on a real processor.
Example:
This function should actually look like this:
Possible, but not very nice, solutions:
Back up the jump target if jump #Ii is disassembled.
Once the last instruction of this packet is disassembled, set its type to RZ_ANALYSIS_OP_TYPE_JMP and set RzAnalysisOp.jump = #Ii
Dig into the rizin analysis code and add an exception for the hexagon architecture, so it always disassembles until the end of a packet before interpreting the instructions (seems like way too much work).
The rizin function analysis stops analyzing the current function, if it encounters a direct jump instruction. This is problematic in our case since the jump instructions often is located at the beginning of a packet. Hence the rest of the packet is not analyzed by the analysis code, although it is executed on a real processor.
Example:
This function should actually look like this:
Possible, but not very nice, solutions:
jump #Ii
is disassembled. Once the last instruction of this packet is disassembled, set its type toRZ_ANALYSIS_OP_TYPE_JMP
and setRzAnalysisOp.jump = #Ii