{

switch (orig)

{

HANDLE_CASE(COND_EQ, COND_NE);

HANDLE_CASE(COND_CS, COND_CC);

HANDLE_CASE(COND_MI, COND_PL);

HANDLE_CASE(COND_VS, COND_VC);

HANDLE_CASE(COND_HI, COND_LS);

HANDLE_CASE(COND_GE, COND_LT);

HANDLE_CASE(COND_GT, COND_LE);

default: return false;

}

{

switch (instr.operation)

{

case ARMV7_BX:

case ARMV7_B:

return false;

case ARMV7_ADC:

case ARMV7_ADD:

case ARMV7_AND:

case ARMV7_ASR:

case ARMV7_BIC:

case ARMV7_EOR:

case ARMV7_LDR:

case ARMV7_LSL:

case ARMV7_LSR:

case ARMV7_MOV:

case ARMV7_MVN:

case ARMV7_ORR:

case ARMV7_ROR:

case ARMV7_RRX:

case ARMV7_RSB:

case ARMV7_RSC:

case ARMV7_SUB:

case ARMV7_SBC:

case ARMV7_MOVW:

case ARMV7_MOVT:

case ARMV7_LDRT:

case ARMV7_LDRH:

case ARMV7_LDRHT:

case ARMV7_LDRB:

case ARMV7_LDRBT:

case ARMV7_LDRSH:

case ARMV7_LDRSHT:

case ARMV7_LDRSB:

case ARMV7_LDRSBT:

case ARMV7_LDRD:

case ARMV7_ADR:

case ARMV7_UBFX:

case ARMV7_UXTAB:

case ARMV7_UXTB:

case ARMV7_UXTH:

case ARMV7_MUL:

case ARMV7_SDIV:

case ARMV7_UDIV:

case ARMV7_SBFX:

case ARMV7_SXTB:

case ARMV7_SXTH:

case ARMV7_BFC:

case ARMV7_BFI:

case ARMV7_CLZ:

if (instr.operands[0].cls == REG && instr.operands[0].reg == REG_PC)

return false;

return true;

default:

return true;

}

{

ARM_RELOC_VANILLA = 0,

ARM_RELOC_PAIR = 1,

ARM_RELOC_SECTDIFF = 2,

ARM_RELOC_LOCAL_SECTDIFF = 3,

ARM_RELOC_PB_LA_PTR = 4,

ARM_RELOC_BR24 = 5,

ARM_THUMB_RELOC_BR22 = 6,

ARM_THUMB_32BIT_BRANCH = 7,

ARM_RELOC_HALF = 8,

ARM_RELOC_HALF_SECTDIFF = 9,

MACHO_MAX_ARM_RELOCATION

{

R_ARM_NONE = 0,

R_ARM_PC24 = 1,

R_ARM_ABS32 = 2,

R_ARM_REL32 = 3,

R_ARM_LDR_PC_G0 = 4,

R_ARM_ABS16 = 5,

R_ARM_ABS12 = 6,

R_ARM_THM_ABS5 = 7,

R_ARM_ABS8 = 8,

R_ARM_SBREL32 = 9,

R_ARM_THM_CALL = 10,

R_ARM_THM_PC8 = 11,

R_ARM_BREL_ADJ = 12,

R_ARM_TLS_DESC = 13,

R_ARM_THM_SWI8 = 14,

R_ARM_XPC25 = 15,

R_ARM_THM_XPC22 = 16,

R_ARM_TLS_DTPMOD32 = 17,

R_ARM_TLS_DTPOFF32 = 18,

R_ARM_TLS_TPOFF32 = 19,

R_ARM_COPY = 20,

R_ARM_GLOB_DAT = 21,

R_ARM_JUMP_SLOT = 22,

R_ARM_RELATIVE = 23,

R_ARM_GOTOFF32 = 24,

R_ARM_BASE_PREL = 25,

R_ARM_GOT_BREL = 26,

R_ARM_PLT32 = 27,

R_ARM_CALL = 28,

R_ARM_JUMP24 = 29,

R_ARM_THM_JUMP24 = 30,

R_ARM_BASE_ABS = 31,

R_ARM_ALU_PCREL_7_0 = 32,

R_ARM_ALU_PCREL_15_8 = 33,

R_ARM_ALU_PCREL_23_15 = 34,

R_ARM_LDR_SBREL_11_0_NC = 35,

R_ARM_ALU_SBREL_19_12_NC = 36,

R_ARM_ALU_SBREL_27_20_CK = 37,

R_ARM_TARGET1 = 38,

R_ARM_SBREL31 = 39,

R_ARM_V4BX = 40,

R_ARM_TARGET2 = 41,

R_ARM_PREL31 = 42,

R_ARM_MOVW_ABS_NC = 43,

R_ARM_MOVT_ABS = 44,

R_ARM_MOVW_PREL_NC = 45,

R_ARM_MOVT_PREL = 46,

R_ARM_THM_MOVW_ABS_NC = 47,

R_ARM_THM_MOVT_ABS = 48,

R_ARM_THM_MOVW_PREL_NC = 49,

R_ARM_THM_MOVT_PREL = 50,

R_ARM_THM_JUMP19 = 51,

R_ARM_THM_JUMP6 = 52,

R_ARM_THM_ALU_PREL_11_0 = 53,

R_ARM_THM_PC12 = 54,

R_ARM_ABS32_NOI = 55,

R_ARM_REL32_NOI = 56,

R_ARM_ALU_PC_G0_NC = 57,

R_ARM_ALU_PC_G0 = 58,

R_ARM_ALU_PC_G1_NC = 59,

R_ARM_ALU_PC_G1 = 60,

R_ARM_ALU_PC_G2 = 61,

R_ARM_LDR_PC_G1 = 62,

R_ARM_LDR_PC_G2 = 63,

R_ARM_LDRS_PC_G0 = 64,

R_ARM_LDRS_PC_G1 = 65,

R_ARM_LDRS_PC_G2 = 66,

R_ARM_LDC_PC_G0 = 67,

R_ARM_LDC_PC_G1 = 68,

R_ARM_LDC_PC_G2 = 69,

R_ARM_ALU_SB_G0_NC = 70,

R_ARM_ALU_SB_G0 = 71,

R_ARM_ALU_SB_G1_NC = 72,

R_ARM_ALU_SB_G1 = 73,

R_ARM_ALU_SB_G2 = 74,

R_ARM_LDR_SB_G0 = 75,

R_ARM_LDR_SB_G1 = 76,

R_ARM_LDR_SB_G2 = 77,

R_ARM_LDRS_SB_G0 = 78,

R_ARM_LDRS_SB_G1 = 79,

R_ARM_LDRS_SB_G2 = 80,

R_ARM_LDC_SB_G0 = 81,

R_ARM_LDC_SB_G1 = 82,

R_ARM_LDC_SB_G2 = 83,

R_ARM_MOVW_BREL_NC = 84,

R_ARM_MOVT_BREL = 85,

R_ARM_MOVW_BREL = 86,

R_ARM_THM_MOVW_BREL_NC = 87,

R_ARM_THM_MOVT_BREL = 88,

R_ARM_THM_MOVW_BREL = 89,

R_ARM_TLS_GOTDESC = 90,

R_ARM_TLS_CALL = 91,

R_ARM_TLS_DESCSEQ = 92,

R_ARM_THM_TLS_CALL = 93,

R_ARM_PLT32_ABS = 94,

R_ARM_GOT_ABS = 95,

R_ARM_GOT_PREL = 96,

R_ARM_GOT_BREL12 = 97,

R_ARM_GOTOFF12 = 98,

R_ARM_GOTRELAX = 99,

R_ARM_GNU_VTENTRY = 100,

R_ARM_GNU_VTINHERIT = 101,

R_ARM_THM_JUMP11 = 102,

R_ARM_THM_JUMP8 = 103,

R_ARM_TLS_GD32 = 104,

R_ARM_TLS_LDM32 = 105,

R_ARM_TLS_LDO32 = 106,

R_ARM_TLS_IE32 = 107,

R_ARM_TLS_LE32 = 108,

R_ARM_TLS_LDO12 = 109,

R_ARM_TLS_LE12 = 110,

R_ARM_TLS_IE12GP = 111,

R_ARM_ME_TOO = 128,

R_ARM_THM_TLS_DESCSEQ16 = 129,

R_ARM_THM_TLS_DESCSEQ32 = 130,

R_ARM_THM_GOT_BREL12 = 131,

R_ARM_THM_ALU_ABS_G0_NC = 132,

R_ARM_THM_ALU_ABS_G1_NC = 133,

R_ARM_THM_ALU_ABS_G2_NC = 134,

R_ARM_THM_ALU_ABS_G3 = 135,

R_ARM_IRELATIVE = 160,

R_ARM_RXPC25 = 249,

R_ARM_RSBREL32 = 250,

R_ARM_THM_RPC22 = 251,

R_ARM_RREL32 = 252,

R_ARM_RABS32 = 253,

R_ARM_RPC24 = 254,

R_ARM_RBASE = 255

{

PE_IMAGE_REL_ARM_ABSOLUTE = 0x0000, // The relocation is ignored.

PE_IMAGE_REL_ARM_ADDR32 = 0x0001, // The 32-bit VA of the target.

PE_IMAGE_REL_ARM_ADDR32NB = 0x0002, // The 32-bit RVA of the target.

PE_IMAGE_REL_ARM_BRANCH24 = 0x0003, // The 24-bit relative displacement to the target.

PE_IMAGE_REL_ARM_BRANCH11 = 0x0004, // The reference to a subroutine call. The reference consists of two 16-bit instructions with 11-bit offsets.

PE_IMAGE_REL_ARM_BLX24 = 0x0008, // The most significant 24 or 25 bits of the signed 26-bit relative displacement of the target. Applied to an unconditional BL instruction in ARM mode. The BL is transformed to a BLX during relocation if the target is in Thumb mode.

PE_IMAGE_REL_ARM_BLX11 = 0x0009, // The most significant 21 or 22 bits of the signed 23-bit relative displacement of the target. Applied to a contiguous 16-bit B+BL pair in Thumb mode prior to ARMv7. The BL is transformed to a BLX during relocation if the target is in ARM mode.

PE_IMAGE_REL_ARM_REL32 = 0x000A, // TODO: description

PE_IMAGE_REL_ARM_SECTION = 0x000E, // The 16-bit section index of the section that contains the target. This is used to support debugging information.

PE_IMAGE_REL_ARM_SECREL = 0x000F, // The 32-bit offset of the target from the beginning of its section. This is used to support debugging information and static thread local storage.

PE_IMAGE_REL_ARM_MOV32 = 0x0010, // The 32-bit VA of the target. This relocation is applied using a MOVW instruction for the low 16 bits followed by a MOVT for the high 16 bits.

PE_IMAGE_REL_THUMB_MOV32 = 0x0011, // The 32-bit VA of the target. This relocation is applied using a MOVW instruction for the low 16 bits followed by a MOVT for the high 16 bits.

PE_IMAGE_REL_THUMB_BRANCH20 = 0x0012, // The instruction is fixed up with the 21-bit relative displacement to the 2-byte aligned target. The least significant bit of the displacement is always zero and is not stored. This relocation corresponds to a Thumb-2 32-bit conditional B instruction.

PE_IMAGE_REL_THUMB_UNUSED = 0x0013, // Unused

PE_IMAGE_REL_THUMB_BRANCH24 = 0x0014, // The instruction is fixed up with the 25-bit relative displacement to the 2-byte aligned target. The least significant bit of the displacement is zero and is not stored.This relocation corresponds to a Thumb-2 B instruction.

PE_IMAGE_REL_THUMB_BLX23 = 0x0015, // The instruction is fixed up with the 25-bit relative displacement to the 4-byte aligned target. The low 2 bits of the displacement are zero and are not stored. This relocation corresponds to a Thumb-2 BLX instruction.

PE_IMAGE_REL_ARM_PAIR = 0x0016, // The relocation is valid only when it immediately follows a ARM_REFHI or THUMB_REFHI. Its SymbolTableIndex contains a displacement and not an index into the symbol table.

MAX_ARM_PE_RELOCATION

{

PE_IMAGE_REL_BASED_ABSOLUTE = 0, // The base relocation is skipped. This type can be used to pad a block.

PE_IMAGE_REL_BASED_HIGH = 1, // The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word.

PE_IMAGE_REL_BASED_LOW = 2, // The base relocation adds the low 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the low half of a 32-bit word.

PE_IMAGE_REL_BASED_HIGHLOW = 3, // The base relocation applies all 32 bits of the difference to the 32-bit field at offset.

PE_IMAGE_REL_BASED_HIGHADJ = 4, // The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. The low 16 bits of the 32-bit value are stored in the 16-bit word that follows this base relocation. This means that this base relocation occupies two slots.

PE_IMAGE_REL_BASED_MIPS_JMPADDR = 5, // The relocation interpretation is dependent on the machine type. When the machine type is MIPS, the base relocation applies to a MIPS jump instruction.

PE_IMAGE_REL_BASED_ARM_MOV32 = 5, // This relocation is meaningful only when the machine type is ARM or Thumb. The base relocation applies the 32-bit address of a symbol across a consecutive MOVW/MOVT instruction pair.

PE_IMAGE_REL_BASED_RISCV_HIGH20 = 5, // This relocation is only meaningful when the machine type is RISC-V. The base relocation applies to the high 20 bits of a 32-bit absolute address.

PE_IMAGE_REL_BASE_RESERVED = 6, // Reserved, must be zero.

PE_IMAGE_REL_BASED_THUMB_MOV32 = 7, // This relocation is meaningful only when the machine type is Thumb. The base relocation applies the 32-bit address of a symbol to a consecutive MOVW/MOVT instruction pair.

PE_IMAGE_REL_BASED_RISCV_LOW12I = 7, // This relocation is only meaningful when the machine type is RISC-V. The base relocation applies to the low 12 bits of a 32-bit absolute address formed in RISC-V I-type instruction format.

PE_IMAGE_REL_BASED_RISCV_LOW12S = 8, // This relocation is only meaningful when the machine type is RISC-V. The base relocation applies to the low 12 bits of a 32-bit absolute address formed in RISC-V S-type instruction format.

PE_IMAGE_REL_BASED_MIPS_JMPADDR16 = 9, // The relocation is only meaningful when the machine type is MIPS. The base relocation applies to a MIPS16 jump instruction.

PE_IMAGE_REL_BASED_DIR64 = 10, // The base relocation applies the difference to the 64-bit field at offset.

MAX_PE_RELOCATION

{

map<ElfArmRelocationType, bool> isDataMap =

{

{R_ARM_NONE, false},

{R_ARM_PC24, false},

{R_ARM_ABS32, true},

{R_ARM_REL32, true},

{R_ARM_LDR_PC_G0, false},

{R_ARM_ABS16, true},

{R_ARM_ABS12, false},

{R_ARM_THM_ABS5, false},

{R_ARM_ABS8, true},

{R_ARM_SBREL32, true},

{R_ARM_THM_CALL, false},

{R_ARM_THM_PC8, false},

{R_ARM_BREL_ADJ, true},

{R_ARM_TLS_DESC, true},

{R_ARM_THM_SWI8, false},

{R_ARM_XPC25, false},

{R_ARM_THM_XPC22, false},

{R_ARM_TLS_DTPMOD32, true},

{R_ARM_TLS_DTPOFF32, true},

{R_ARM_TLS_TPOFF32, true},

{R_ARM_COPY, true},

{R_ARM_GLOB_DAT, true},

{R_ARM_JUMP_SLOT, true},

{R_ARM_RELATIVE, true},

{R_ARM_GOTOFF32, true},

{R_ARM_BASE_PREL, true},

{R_ARM_GOT_BREL, true},

{R_ARM_PLT32, false},

{R_ARM_CALL, false},

{R_ARM_JUMP24, false},

{R_ARM_THM_JUMP24, false},

{R_ARM_BASE_ABS, true},

{R_ARM_ALU_PCREL_7_0, false},

{R_ARM_ALU_PCREL_15_8, false},

{R_ARM_ALU_PCREL_23_15, false},

{R_ARM_LDR_SBREL_11_0_NC, false},

{R_ARM_ALU_SBREL_19_12_NC, false},

{R_ARM_ALU_SBREL_27_20_CK, false},

{R_ARM_TARGET1, false},

{R_ARM_SBREL31, true},

{R_ARM_V4BX, false},

{R_ARM_TARGET2, false},

{R_ARM_PREL31, true},

{R_ARM_MOVW_ABS_NC, false},

{R_ARM_MOVT_ABS, false},

{R_ARM_MOVW_PREL_NC, false},

{R_ARM_MOVT_PREL, false},

{R_ARM_THM_MOVW_ABS_NC, false},

{R_ARM_THM_MOVT_ABS, false},

{R_ARM_THM_MOVW_PREL_NC, false},

{R_ARM_THM_MOVT_PREL, false},

{R_ARM_THM_JUMP19, false},

{R_ARM_THM_JUMP6, false},

{R_ARM_THM_ALU_PREL_11_0, false},

{R_ARM_THM_PC12, false},

{R_ARM_ABS32_NOI, true},

{R_ARM_REL32_NOI, true},

{R_ARM_ALU_PC_G0_NC, false},

{R_ARM_ALU_PC_G0, false},

{R_ARM_ALU_PC_G1_NC, false},

{R_ARM_ALU_PC_G1, false},

{R_ARM_ALU_PC_G2, false},

{R_ARM_LDR_PC_G1, false},

{R_ARM_LDR_PC_G2, false},

{R_ARM_LDRS_PC_G0, false},

{R_ARM_LDRS_PC_G1, false},

{R_ARM_LDRS_PC_G2, false},

{R_ARM_LDC_PC_G0, false},

{R_ARM_LDC_PC_G1, false},

{R_ARM_LDC_PC_G2, false},

{R_ARM_ALU_SB_G0_NC, false},

{R_ARM_ALU_SB_G0, false},

{R_ARM_ALU_SB_G1_NC, false},

{R_ARM_ALU_SB_G1, false},

{R_ARM_ALU_SB_G2, false},

{R_ARM_LDR_SB_G0, false},

{R_ARM_LDR_SB_G1, false},

{R_ARM_LDR_SB_G2, false},

{R_ARM_LDRS_SB_G0, false},

{R_ARM_LDRS_SB_G1, false},

{R_ARM_LDRS_SB_G2, false},

{R_ARM_LDC_SB_G0, false},

{R_ARM_LDC_SB_G1, false},

{R_ARM_LDC_SB_G2, false},

{R_ARM_MOVW_BREL_NC, false},

{R_ARM_MOVT_BREL, false},

{R_ARM_MOVW_BREL, false},

{R_ARM_THM_MOVW_BREL_NC, false},

{R_ARM_THM_MOVT_BREL, false},

{R_ARM_THM_MOVW_BREL, false},

{R_ARM_TLS_GOTDESC, true},

{R_ARM_TLS_CALL, false},

{R_ARM_TLS_DESCSEQ, false},

{R_ARM_THM_TLS_CALL, false},

{R_ARM_PLT32_ABS, true},

{R_ARM_GOT_ABS, true},

{R_ARM_GOT_PREL, true},

{R_ARM_GOT_BREL12, false},

{R_ARM_GOTOFF12, false},

{R_ARM_GOTRELAX, false},

{R_ARM_GNU_VTENTRY, true},

{R_ARM_GNU_VTINHERIT, true},

{R_ARM_THM_JUMP11, false},

{R_ARM_THM_JUMP8, false},

{R_ARM_TLS_GD32, true},

{R_ARM_TLS_LDM32, true},

{R_ARM_TLS_LDO32, true},

{R_ARM_TLS_IE32, true},

{R_ARM_TLS_LE32, false},

{R_ARM_TLS_LDO12, false},

{R_ARM_TLS_LE12, false},

{R_ARM_TLS_IE12GP, false},

{R_ARM_ME_TOO, false},

{R_ARM_THM_TLS_DESCSEQ16, false},

{R_ARM_THM_TLS_DESCSEQ32, false},

{R_ARM_THM_GOT_BREL12, false},

{R_ARM_THM_ALU_ABS_G0_NC, false},

{R_ARM_THM_ALU_ABS_G1_NC, false},

{R_ARM_THM_ALU_ABS_G2_NC, false},

{R_ARM_THM_ALU_ABS_G3, false},

{R_ARM_IRELATIVE, false},

{R_ARM_RXPC25, false},

{R_ARM_RSBREL32, false},

{R_ARM_THM_RPC22, false},

{R_ARM_RREL32, false},

{R_ARM_RABS32, false},

{R_ARM_RPC24, false},

{R_ARM_RBASE, false}

};

if (!isDataMap.count(reloc))

return false;

return isDataMap.at(reloc);

{

BNRegisterInfo result;

result.fullWidthRegister = fullWidthReg;

result.offset = offset;

result.size = size;

result.extend = zeroExtend ? ZeroExtendToFullWidth : NoExtend;

return result;

{

virtual std::string GetAssemblerTriple() override

{

if(m_endian == BigEndian)

return "armv7eb-none-none";

return "armv7-none-none";

}

virtual bool Disassemble(const uint8_t* data, uint64_t addr, size_t maxLen, Instruction& result)

{

(void)addr;

(void)maxLen;

memset(&result, 0, sizeof(result));

if (armv7_decompose(*(uint32_t*)data, &result, (uint32_t)addr, (uint32_t)(m_endian == BigEndian)) != 0)

return false;

return true;

}

void SetInstructionInfoForInstruction(uint64_t addr, const Instruction& instr, InstructionInfo& result)

{

result.length = 4;

switch (instr.operation)

{

case ARMV7_BL:

if (UNCONDITIONAL(instr.cond) && (instr.operands[0].cls == LABEL))

result.AddBranch(CallDestination, instr.operands[0].imm, this);

break;

case ARMV7_BLX:

result.archTransitionByTargetAddr = true;

if (UNCONDITIONAL(instr.cond))

{

if (instr.operands[0].cls == LABEL)

result.AddBranch(CallDestination, instr.operands[0].imm, m_thumbArch);

else if (instr.operands[0].cls == REG && instr.operands[0].reg == REG_LR)

result.AddBranch(FunctionReturn); // initially indicate "blx lr" as a return since this is common and conservative; subsequent analysis determines if it's a function call

}

break;

case ARMV7_BX:

if (UNCONDITIONAL(instr.cond))

{

if (instr.operands[0].cls == REG && instr.operands[0].reg == REG_LR)

{

result.AddBranch(FunctionReturn);

result.archTransitionByTargetAddr = true;

}

else

{

result.AddBranch(UnresolvedBranch);

result.archTransitionByTargetAddr = true;

}

}

else if (instr.operands[0].cls == REG && instr.operands[0].reg == REG_LR)

result.AddBranch(FalseBranch, addr + 4, this);

break;

case ARMV7_B:

if (UNCONDITIONAL(instr.cond))

result.AddBranch(UnconditionalBranch, instr.operands[0].imm, this);

else

{

result.AddBranch(TrueBranch, instr.operands[0].imm, this);

result.AddBranch(FalseBranch, addr + 4, this);

}

break;

case ARMV7_POP:

//if pop with PC in the register list treat as a return

if (instr.operands[0].cls == REG_LIST && ((instr.operands[0].reg & REG_LIST_PC) == REG_LIST_PC))

{

result.AddBranch(FunctionReturn);

if (!UNCONDITIONAL(instr.cond))

result.AddBranch(FalseBranch, addr + 4, this);

}

break;

case ARMV7_LDM:

case ARMV7_LDMDA:

case ARMV7_LDMDB:

case ARMV7_LDMIA: // defaults to ARMV7_LDM

case ARMV7_LDMIB:

//if this is an unconditional load multiple with PC in the register list treat as a return

if (UNCONDITIONAL(instr.cond))

{

if (instr.operands[1].cls == REG_LIST && ((RegisterList)instr.operands[1].reg == REG_LIST_PC))

{

result.archTransitionByTargetAddr = true;

result.AddBranch(UnresolvedBranch);

}

else if (instr.operands[1].cls == REG_LIST && ((instr.operands[1].reg & REG_LIST_PC) == REG_LIST_PC))

result.AddBranch(FunctionReturn);

}

break;

case ARMV7_ADC:

case ARMV7_ADD:

case ARMV7_AND:

case ARMV7_ASR:

case ARMV7_BIC:

case ARMV7_EOR:

case ARMV7_LDR:

case ARMV7_LSL:

case ARMV7_LSR:

case ARMV7_MOV:

case ARMV7_MVN:

case ARMV7_ORR:

case ARMV7_ROR:

case ARMV7_RRX:

case ARMV7_RSB:

case ARMV7_RSC:

case ARMV7_SUB:

case ARMV7_SBC:

if (instr.operands[0].cls == REG && instr.operands[0].reg == REG_PC)

{

result.archTransitionByTargetAddr = true;

result.AddBranch(UnresolvedBranch);

if (!UNCONDITIONAL(instr.cond))

result.AddBranch(FalseBranch, addr + 4, this);

}

break;

case ARMV7_MOVW:

case ARMV7_MOVT:

case ARMV7_LDRT:

case ARMV7_LDRH:

case ARMV7_LDRHT:

case ARMV7_LDRB:

case ARMV7_LDRBT:

case ARMV7_LDRSH:

case ARMV7_LDRSHT:

case ARMV7_LDRSB:

case ARMV7_LDRSBT:

case ARMV7_LDRD:

case ARMV7_ADR:

case ARMV7_UBFX:

case ARMV7_UXTAB:

case ARMV7_UXTB:

case ARMV7_UXTH:

case ARMV7_MUL:

case ARMV7_SDIV:

case ARMV7_UDIV:

case ARMV7_SBFX:

case ARMV7_SXTB:

case ARMV7_SXTH:

case ARMV7_BFC:

case ARMV7_BFI:

case ARMV7_CLZ:

if (instr.operands[0].cls == REG && instr.operands[0].reg == REG_PC)

{

result.AddBranch(UnresolvedBranch);

if (!UNCONDITIONAL(instr.cond))

result.AddBranch(FalseBranch, addr + 4, this);

}

break;

case ARMV7_SVC:

if (instr.operands[0].cls == IMM && instr.operands[0].imm == 0)

result.AddBranch(SystemCall);

break;

case ARMV7_UDF:

result.AddBranch(ExceptionBranch);

break;

default:

break;

}

}

uint32_t tokenize_shift(const InstructionOperand& op, vector<InstructionTextToken>& result)

{

char operand[64] = {0};

if (op.shift != SHIFT_NONE)

{

const char* shiftStr = get_shift(op.shift);

if (shiftStr == NULL)

return FAILED_TO_DISASSEMBLE_OPERAND;

result.emplace_back(TextToken, ", ");

result.emplace_back(KeywordToken, shiftStr);

snprintf(operand, sizeof(operand), "%#x", (uint32_t)op.imm);

result.emplace_back(OperationToken, " #");

result.emplace_back(IntegerToken, operand, op.imm);

}

return DISASM_SUCCESS;

}

void tokenize_shifted_immediate(const InstructionOperand& op, vector<InstructionTextToken>& result)

{

char operand[64] = {0};

const char* sign = "";

switch (op.cls)

{

case FIMM16:

case FIMM32:

snprintf(operand, sizeof(operand), "%f", op.immf);

result.emplace_back(OperationToken, "#");

result.emplace_back(FloatingPointToken, operand);

break;

case FIMM64:

snprintf(operand, sizeof(operand), "%e", op.immd);

result.emplace_back(OperationToken, "#");

result.emplace_back(FloatingPointToken, operand);

break;

case IMM:

snprintf(operand, sizeof(operand), "%s%#x", sign, (uint32_t)op.imm);

result.emplace_back(OperationToken, "#");

result.emplace_back(IntegerToken, operand, op.imm);

break;

case IMM64:

snprintf(operand, sizeof(operand), "%s%#" PRIx64, sign, op.imm64);

result.emplace_back(OperationToken, "#");

result.emplace_back(IntegerToken, operand, op.imm64);

break;

case LABEL:

snprintf(operand, sizeof(operand), "%#x", op.imm);

result.emplace_back(PossibleAddressToken, operand, op.imm);

break;

default:

return;

}

tokenize_shift(op, result);

}

uint32_t tokenize_shifted_register(

const InstructionOperand& op,

vector<InstructionTextToken>& result)

{

const char* reg = NULL;

reg = GetRegisterName((enum Register)op.reg).c_str();

if (reg == NULL)

return FAILED_TO_DISASSEMBLE_REGISTER;

result.emplace_back(RegisterToken, reg);

tokenize_shift(op, result);

return DISASM_SUCCESS;

}

bool GetCoalescedLowLevelIL(const uint8_t* data, uint64_t addr, size_t& len, LowLevelILFunction& il, Instruction& instr)

{

size_t remaining = len / 4;

if (remaining > COALESCE_MAX_INSTRS)

remaining = COALESCE_MAX_INSTRS;

Condition cond = instr.cond;

Instruction coalesced[COALESCE_MAX_INSTRS];

bool liftInstruction[COALESCE_MAX_INSTRS];

size_t disassembled = 1;

coalesced[0] = instr;

liftInstruction[0] = true;

auto setsFlags = [](const Instruction& instr)

{

if (instr.setsFlags)

return true;

switch(instr.operation)

{

case ARMV7_CMP:

case ARMV7_CMN:

case ARMV7_TST:

return true;

case ARMV7_BL:

case ARMV7_BLX:

return true;

default:

return false;

}

};

for (bool condValid[2] = {true, true}; (disassembled < remaining) && (condValid[0] || condValid[1]); disassembled++)

{

size_t consumed = disassembled * 4;

auto& newInstr = coalesced[disassembled];

if (!Disassemble(data + consumed, addr + consumed, len - consumed, newInstr))

break;

if (UNCONDITIONAL(newInstr.cond))

break;

if (!IsRelatedCondition(newInstr.cond, cond))

break;

liftInstruction[disassembled] = condValid[newInstr.cond != cond];

if (!CanCoalesceAfterInstruction(newInstr))

condValid[newInstr.cond != cond] = false;

if (setsFlags(instr))

{

condValid[0] = true;

condValid[1] = true;

}

}

if (disassembled == 1)

{

len = 4;

return GetLowLevelILForArmInstruction(this, addr, il, instr, GetAddressSize());

}

LowLevelILLabel doneLabel;

LowLevelILLabel condLabels[2];

BNLowLevelILLabel* doneLabelExisting = il.GetLabelForAddress(this, addr + (disassembled * 4));

BNLowLevelILLabel* doneLabelToUse = doneLabelExisting ? doneLabelExisting : &doneLabel;

for (size_t blockStart = 0; blockStart < disassembled;)

{

auto& beginInstr = coalesced[blockStart];

size_t stateIdx = (beginInstr.cond != cond);

// determine how many instructions to lift this iteration.

// generally, this will be set to `disassembled`, but in the

// event that cmp/cmn/tst instructions are used in the conditional

// block, they each require re-evaluation of the condition on the side

// that executed the flag setting instructions

size_t nextFlagSet = blockStart;

for (; nextFlagSet < disassembled; nextFlagSet++)

{

if (!liftInstruction[nextFlagSet])

continue; // skip unreachable instructions

if (setsFlags(coalesced[nextFlagSet]))

break;

}

// figure out where the next block start for the *other* condition in the sequence is

size_t otherCondNext = blockStart + 1;

for (; otherCondNext < disassembled ; otherCondNext++)

{

if (!liftInstruction[otherCondNext])

continue; // skip unreachable instructions

if (coalesced[otherCondNext].cond != beginInstr.cond)

break;

}