You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When disassembling ARM Thumb instructions using Capstone with the CS_MODE_THUMB mode enabled, there is a problem where some instructions have missing operands.
Observed Behavior:
Some instructions, particularly ldr and str, when disassembled using Capstone with ARM Thumb mode, have only one operand reported, missing the memory operand information which includes the base register, index register, scale, and displacement.
Capstone (4, 0, 1024)
0x1000: ldr r0, [r0]
Number of Operands: 2
Operand Type: Register
Register: R0
Operand Type: Memory
Base Register: R0
Index Register: None
Scale: 1
Disp: 0
0x1002: ldr r0, [r0]
Number of Operands: 2
Operand Type: Register
Register: R0
Operand Type: Memory
Base Register: R0
Index Register: None
Scale: 1
Disp: 0
0x1004: str r0, [sp, #0x1c]
Number of Operands: 2
Operand Type: Register
Register: R0
Operand Type: Memory
Base Register: SP
Index Register: None
Scale: 1
Disp: 28
0x1006: ldr r3, [r1]
Number of Operands: 2
Operand Type: Register
Register: R3
Operand Type: Memory
Base Register: R1
Index Register: None
Scale: 1
Disp: 0
0x1008: cbz r3, #0x1026
Number of Operands: 2
Operand Type: Register
Register: R3
Operand Type: Immediate
Value: 4134
0x100a: ldr r1, [pc, #0x21c]
Number of Operands: 2
Operand Type: Register
Register: R1
Operand Type: Memory
Base Register: PC
Index Register: None
Scale: 1
Disp: 540
0x100c: add r5, sp, #8
Number of Operands: 3
Operand Type: Register
Register: R5
Operand Type: Register
Register: SP
Operand Type: Immediate
Value: 8
0x100e: ldr r2, [pc, #0x21c]
Number of Operands: 2
Operand Type: Register
Register: R2
Operand Type: Memory
Base Register: PC
Index Register: None
Scale: 1
Disp: 540
Capstone version: 5.0.1280
Capstone (5, 0, 1280)
0x1000: ldr r0, [r0]
Number of Operands: 1
Operand Type: Register
Register: R0
0x1002: ldr r0, [r0]
Number of Operands: 1
Operand Type: Register
Register: R0
0x1004: str r0, [sp, #0x1c]
Number of Operands: 1
Operand Type: Register
Register: R0
0x1006: ldr r3, [r1]
Number of Operands: 1
Operand Type: Register
Register: R3
0x1008: cbz r3, #0x1026
Number of Operands: 2
Operand Type: Register
Register: R3
Operand Type: Immediate
Value: 4134
0x100a: ldr r1, [pc, #0x21c]
Number of Operands: 2
Operand Type: Register
Register: R1
Operand Type: Memory
Base Register: PC
Index Register: None
Scale: 1
Disp: 540
0x100c: add r5, sp, #8
Number of Operands: 3
Operand Type: Register
Register: R5
Operand Type: Register
Register: SP
Operand Type: Immediate
Value: 8
0x100e: ldr r2, [pc, #0x21c]
Number of Operands: 2
Operand Type: Register
Register: R2
Operand Type: Memory
Base Register: PC
Index Register: None
Scale: 1
The text was updated successfully, but these errors were encountered:
AntoineBlaud
changed the title
Title: Missing Operands in ARM Thumb Mode Disassembly with Capstone 5.0.1280
Missing Operands in ARM Thumb Mode Disassembly with Capstone 5.0.1280
Feb 23, 2024
Maybe related to #2260. @AntoineBlaud please try the cstool of your installed capstone version and check if it gives the correct output. I am trying to debug this issue and more info will be helpful.
I suspect the error originates from the Python library bindings. While version 5.0.0 functions correctly, version 5.0.1 triggers the reported error with the same Capstone library version (5.0.1280)
Issue Description:
When disassembling ARM Thumb instructions using Capstone with the
CS_MODE_THUMB
mode enabled, there is a problem where some instructions have missing operands.Observed Behavior:
Some instructions, particularly
ldr
andstr
, when disassembled using Capstone with ARM Thumb mode, have only one operand reported, missing the memory operand information which includes the base register, index register, scale, and displacement.Environment:
Code Snippet:
Output:
Capstone version: 4.0.1024
Capstone version: 5.0.1280
The text was updated successfully, but these errors were encountered: