Skip to content

ARMv7 ARM rev instruction not lifted correctly: initial MSB is lost #3992

Description

@MartijnB

The rev instruction (rev r11, r11) is lifted to the following LL code:

45 @ 0001070c temp0.d = 0
46 @ 0001070c temp1.d = r11
47 @ 0001070c temp2.d = 0
48 @ 0001070c goto 49

49 @ 0001070c if (temp0.d != 3) then 50 else 55

50 @ 0001070c temp2.d = temp2.d | (temp1.d & 0xff)
51 @ 0001070c temp2.d = temp2.d << 8
52 @ 0001070c temp1.d = temp1.d u>> 8
53 @ 0001070c temp0.d = temp0.d + 1
54 @ 0001070c goto 49

55 @ 0001070c r11 = temp2.d

This looses the initial MSB (LSB of the output). So, when the input is 0x43424140 the output is 0x40414200 while I expect it to be 0x40414243.

Also, is there a particular reason why in this case a LL loop is used? Using bitwise operations seems to me to give a much nicer output, especially also in the HLIL.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Arch: ARM/ThumbIssues with the ARM/Thumb architecture pluginComponent: ArchitectureIssue needs changes to an architecture pluginEffort: LowIssues require < 1 week of workImpact: LowIssue is a papercut or has a good, supported workaroundLiftingissues related to LLIL lifting

Type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions