Skip to content

ARM Thumb: 16-bit instruction decoded as 32-bit #1201

@lwerdna

Description

@lwerdna

Capstone disassembles CD 00 0B 00 as a 32-bit instruction but it should be two 16-bit instructions. Note that, taken as a 32-bit instruction word, 0xCD000B00 is missing the leading three bits set required for a 4-byte wide encoding.

Here is minimal code for reproduction:

#!/usr/bin/env python
from capstone import *
md = Cs(CS_ARCH_ARM, CS_MODE_BIG_ENDIAN|CS_MODE_THUMB)
for i in md.disasm("\xCD\x00\x0b\x00", 0):
	print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

Which outputs vstr d0, [r0, #-0] when it should be ldmia r5!, {} and lsrs r0, r0, #12.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions