angr/pyvex

pyvex for ARM inst. "TBB" and "TBH"

Closed this issue · 2 comments

First of all, thank you for this great tool.

angr/vex has the translation code for tbb or tbh. But It seems that pyvex has an issue with the ARM instruction, tbb or tbh.
The following is an example of using pyvex:

# Decompile with capstone
$ ./cstool -d cortexm "\xdf\xe8\x03\xf0"
 0  df e8 03 f0  tbb	[pc, r3]
	ID: 419 (tbb)
	op_count: 1
		operands[0].type: MEM
			operands[0].mem.base: REG = pc
			operands[0].mem.index: REG = r3
		operands[0].access: READ
	Registers read: pc r3
	Groups: thumb2 jump
# Use pyvex to do lifting.
import pyvex
import archinfo
irsb=pyvex.lift(b"\xdf\xe8\x03\xf0", 0x40001, archinfo.ArchARMCortexM())
irsb.pp()
#### Output ####
# IRSB {
# 
#    NEXT: PUT(pc) = 0x00040001; Ijk_NoDecode
# } 

If the example of using pyvex was correct, could you let me know how to fix this issue?
Thank you.

You are missing a crucial piece of the API necessary to lift THUMB code - you need to pass bytes_offset=1 to the lift function. angr does this for you automatically when you provide an odd address, but pyvex needs more explicit help.

Thank you, @rhelmot , and forgive me for this naive question.