Skip to content

Point relocated ARM xrefs at Thumb entries ##analysis #26934

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
trufae merged 1 commit into from
Oct 9, 2026
Merged

Point relocated ARM xrefs at Thumb entries ##analysis #26934

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions libr/core/canal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5328,6 +5328,11 @@ R_API void r_core_anal_fcn_merge(RCore *core, ut64 addr, ut64 addr2) {
R_LOG_INFO ("Merge 0x%08"PFMT64x" into 0x%08"PFMT64x, addr, addr2);
}

static ut64 reloc_sym_vaddr(RCore *core, RBinSymbol *sym) {
return sym->paddr == UT64_MAX? sym->vaddr
: r_bin_get_vaddr (core->bin, sym->paddr, sym->vaddr);
}

#include "canal_esil.inc.c"

static bool isValidAddress(RCore *core, ut64 addr) {
Expand Down Expand Up @@ -5940,8 +5945,7 @@ static void plt_stub_flag(RCore *core, ut64 entry, ut64 size, ut64 slot) {
if (!target->vaddr || target->vaddr == UT64_MAX) {
return;
}
const ut64 taddr = target->paddr == UT64_MAX? target->vaddr
: r_bin_get_vaddr (core->bin, target->paddr, target->vaddr);
const ut64 taddr = reloc_sym_vaddr (core, target);
if (taddr == entry) {
return;
}
Expand Down
14 changes: 12 additions & 2 deletions libr/core/canal_esil.inc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -880,6 +880,12 @@ static ut64 pulldata(RCore *core, ut8 *buf, size_t buf_size, ut64 start, ut64 en
return addr - *buf_addr;
}

static ut64 thumb_slot_target(RCore *core, ut64 slot, ut64 dst) {
RBinReloc *rel = r_core_getreloc (core, slot, 1);
RBinSymbol *sym = rel? rel->symbol: NULL;
return (sym && sym->bits == 16 && reloc_sym_vaddr (core, sym) == dst - 1)? dst - 1: dst;
}

// R2R db/cmd/cmd_search_esil db/cmd/cmd_aae
R_API void r_core_anal_esil(RCore *core, const char *str /* len */, const char *target /* addr */) {
R_RETURN_IF_FAIL (core && str);
Expand Down Expand Up @@ -1372,12 +1378,16 @@ R_API void r_core_anal_esil(RCore *core, const char *str /* len */, const char *
// the type mask preserves the COND bit, strip it too so
// conditional variants like UCCALL are handled as calls
const int utype = op.type & R_ANAL_OP_TYPE_MASK & ~R_ANAL_OP_TYPE_COND;
if (!skip_ref && CHECKREF (dst)) {
const ut64 to = (!skip_ref && (arch == R2_ARCH_ARM32 || is_thumb)
&& op.type == R_ANAL_OP_TYPE_MJMP && (dst & 1))
? thumb_slot_target (core, ctx.last_read, dst): dst;
if (!skip_ref && (CHECKREF (dst) || CHECKREF (to))) {
// Normalizing an xref must not seed another function.
if (myvalid (core, dst)) {
RAnalRefType ref = utype == R_ANAL_OP_TYPE_UCALL
? R_ANAL_REF_TYPE_CALL
: R_ANAL_REF_TYPE_CODE;
r_anal_xrefs_setf (core->anal, fcn, cur, dst, ref | R_ANAL_REF_TYPE_EXEC);
r_anal_xrefs_setf (core->anal, fcn, cur, to, ref | R_ANAL_REF_TYPE_EXEC);
if (!xrefs_only) {
r_core_anal_fcn (core, dst, UT64_MAX, R_ANAL_REF_TYPE_NULL, 1);
}
Expand Down
161 changes: 161 additions & 0 deletions test/db/anal/arm-esil
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,3 +104,164 @@ EXPECT=<<EOF
0x185c
EOF
RUN

NAME=arm ldr pc plt stub xref names the thumb function
FILE=bins/elf/analysis/libstagefright_soft_g711dec.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
aaa
ax~0x202c~CODE
e anal.calls=true
aa
afl~0x0000289
EOF
EXPECT=<<EOF
rsym._ZN7android8SoftG711D1Ev+8 0x202c > CODE:--x > 0x2740 method.destructor.android::SoftG711._SoftG711__
0x0000289c 6 66 dbg.android::SoftG711::DecodeALaw(short*, unsigned char const*, unsigned int)
EOF
RUN

NAME=arm ldr pc plt stub xref survives a rebased load
FILE=bins/elf/analysis/libstagefright_soft_g711dec.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
aaa
ax~0x10202c~CODE
EOF
EXPECT=<<EOF
rsym._ZN7android8SoftG711D1Ev+8 0x10202c > CODE:--x > 0x102740 method.destructor.android::SoftG711._SoftG711__
EOF
RUN

NAME=arm ldr pc slot off its thumb symbol keeps the odd target
FILE=bins/elf/analysis/libstagefright_soft_g711dec.so
ARGS=-e bin.relocs.apply=true -e io.cache=true
CMDS=<<EOF
wv4 0x2743 @ 0x6f10
aaa
ax~0x202c~CODE
EOF
EXPECT=<<EOF
rsym._ZN7android8SoftG711D1Ev+8 0x202c > CODE:--x > 0x2743 sym.android::SoftG711::_SoftG711____1+3
EOF
RUN

NAME=arm ldr pc targeted search accepts raw and thumb addresses
FILE=bins/elf/analysis/libstagefright_soft_g711dec.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
aae 12 0x2740 @ 0x2024
ax~0x202c~CODE
ax-*
aae 12 0x2741 @ 0x2024
ax~0x202c~CODE
EOF
EXPECT=<<EOF
rsym._ZN7android8SoftG711D1Ev+8 0x202c > CODE:--x > 0x2740 method.destructor.android::SoftG711._SoftG711__
rsym._ZN7android8SoftG711D1Ev+8 0x202c > CODE:--x > 0x2740 method.destructor.android::SoftG711._SoftG711__
EOF
RUN

NAME=arm ldr pc slot holding an arm symbol plus one keeps the odd target
FILE=bins/elf/analysis/libsimplejni.so
ARGS=-e bin.relocs.apply=true -e io.cache=true
CMDS=<<EOF
wv4 0x2045 @ 0x3fa0
aaa
ax~0xe30~CODE
EOF
EXPECT=<<EOF
rsym.__gnu_Unwind_Restore_VFP_D+8 0xe30 > CODE:--x > 0x2045 sym.__gnu_Unwind_Restore_VFP_D+1
EOF
RUN

NAME=arm plt stubs on libarm.so reach even thumb entries
FILE=bins/elf/libarm.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
aaa
ax~0x3e158~CODE
ax*~axc~!axc 0x3e~1 0x3e,3 0x3e,5 0x3e,7 0x3e,9 0x3e,b 0x3e,d 0x3e,f 0x3e~?
ax*~axc~!axc 0x3e~ 0x3e~?
aflc
EOF
EXPECT=<<EOF
fcn.0003e150+8 0x3e158 > CODE:--x > 0x2d588 sym.std::__ndk1::to_string_int_
0
203
926
EOF
RUN

NAME=arm blx through a register load keeps the odd target
FILE=malloc://0x4000
ARGS=-a arm -b 32
CMDS=<<EOF
ahb 32 @ 0x1000
ahb 16 @ 0x2000
wx 7047 @ 0x2000
wx 183093e533ff2fe1 @ 0x1000
wx 01200000 @ 0x18
af @ 0x2000
af @ 0x1000
aae 8 @ 0x1000
ax~CALL
aflc
EOF
EXPECT=<<EOF
fcn.00001000+4 0x1004 > CALL:--x > 0x2001 fcn.00002000+1
2
EOF
RUN

NAME=arm ldr pc without a reloc keeps the odd target despite a thumb hint
FILE=malloc://0x4000
ARGS=-a arm -b 32
CMDS=<<EOF
ahb 32 @ 0x1000
ahb 16 @ 0x2000
wx 7047 @ 0x2000
wx 00f09fe5 @ 0x1000
wx 01200000 @ 0x1008
af @ 0x2000
aae 4 @ 0x1000
ax~CODE
EOF
EXPECT=<<EOF
? 0x1000 > CODE:--x > 0x2001 fcn.00002000+1
EOF
RUN

NAME=arm libgcc unwind wrapper and pic veneer keep their odd targets
FILE=bins/elf/libmagic.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
aaa
ax~0x7fec
ax~0x12ef8
ax*~axc 0x1bf~?
aflc
EOF
EXPECT=<<EOF
sym.___Unwind_RaiseException+28 0x7fec > CODE:--x > 0x7ff1 sym.___Unwind_RaiseException+33
fcn.00012ef0+8 0x12ef8 > CODE:--x > 0x7935 sym._Unwind_VRS_Set+1
36
331
EOF
RUN

NAME=arm thumb reloc slot that no ldr pc reads adds no xref
FILE=bins/elf/arm-thumb-bit.o
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
aaa
afl
ax
EOF
EXPECT=<<EOF
0x08000034 1 6 sym.caller
0x0800003c 1 2 sym.tf
0x08000040 1 16 sym.armf
sym.caller 0x8000034 > CALL:--x > 0x800003c sym.tf
EOF
RUN
Loading