Closed
Description
There is something unexpected in ARM IT block disassembling.
The trigger code (with python binding):
import capstone
from capstone.arm import *
CODE = '\xbc\xbf\x20\x60\x18\x46'
ADDR = 0x8a42
thumb_md = capstone.Cs(capstone.CS_ARCH_ARM, capstone.CS_MODE_THUMB)
thumb_md.detail = True
print '=' * 10
for insn in thumb_md.disasm(CODE[:4], ADDR):
print '{0.mnemonic}\t{0.op_str}'.format(insn)
print '=' * 10
for insn in thumb_md.disasm(CODE, ADDR):
print '{0.mnemonic}\t{0.op_str}'.format(insn)
print '=' * 10
for insn in thumb_md.disasm(CODE, ADDR):
print '{0.mnemonic}\t{0.op_str}'.format(insn)Output for above code:
==========
itt lt
strlt r0, [r4]
==========
itt lt
strlt r0, [r4]
mov r0, r3
==========
itt lt
strlt r0, [r4]
movlt r0, r3
But it should be:
==========
itt lt
strlt r0, [r4]
==========
itt lt
strlt r0, [r4]
movlt r0, r3
==========
itt lt
strlt r0, [r4]
movlt r0, r3
Metadata
Assignees
Labels
No labels