Report the nop and ret encodings a big-endian machine holds in memory - #371
Report the nop and ret encodings a big-endian machine holds in memory#371zardus wants to merge 1 commit into
Conversation
|
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS Validation record for head
Every architecture, both endnesses, before and after. Only three rows move, and all three were undecodable before:
Checked against Capstone rather than against angr. Blast radius, 1710 objects over 138 architecture/container strata, 55 architectures, 16 containers, scored with That flat result rules out a regression rather than showing a benefit: Caveats: no big-endian AArch64 or RISC-V object exists in the corpus, so those two rows rest on the ISA and on Capstone, not on a binary. Nothing exercises |
|
Corpus decompilation diffs can be found at angr/dec-snapshots@master...angr/archinfo_371 |
Arch.__init__ swapped nop_instruction and ret_instruction for every
big-endian architecture, through reverse_ends, which works in four-byte
words and zero-extends anything shorter. Three architectures came out
with bytes that decode to nothing:
ArchS390X("Iend_BE") nop 00000707 ret 0000f407
ArchAArch64("Iend_BE") nop d503201f ret d65f03c0
ArchRISCV64("Iend_BE") nop 00000001 ret 00008082
s390x instructions are two bytes here, and the padding to four turns
them into a string that appears in no s390x binary. AArch64 and RISC-V
declare instruction_endness LE: their instructions stay little-endian
however data is stored, so the swap reverses an encoding that was
already right.
Swap only when instructions themselves are big-endian, and stop
reverse_ends inventing bytes for a length that is not a multiple of
four. PowerPC, MIPS and ARM, whose instruction endness does follow data
endness, are unchanged, as are all little-endian architectures.
The s390x literals are now written little-endian like every other
class, and ret_instruction encodes br %r14, the ABI return, rather than
br %r4.
ArchS390X("Iend_BE") nop 0707 ret 07fe
ArchAArch64("Iend_BE") nop 1f2003d5 ret c0035fd6
ArchRISCV64("Iend_BE") nop 0100 ret 8280
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
b798d53 to
b43aa15
Compare
2 participants
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
Arch.__init__byte-swapsnop_instructionandret_instructionfor every big-endian architecture throughreverse_ends, which works in four-byte words and zero-extends anything shorter.ArchS390X("Iend_BE")therefore reported00000707/0000f407for two-byte instructions, andArchAArch64("Iend_BE")andArchRISCV64("Iend_BE")had a correct little-endian encoding reversed, since both keep little-endian instructions whatever the endness of data. None of the six byte strings decodes to anything.The swap now runs only when
instruction_endnessis big-endian, andreverse_endsno longer invents bytes for a length that is not a multiple of four. PowerPC, MIPS and ARM, whose instruction endness does follow data endness, are byte-identical, as is every little-endian architecture. The s390x literals move to the little-endian spelling the other classes use, andret_instructionbecomesbr %r14, the ABI return, rather thanbr %r4.tests/test_instruction_bytes.pypins the encoding every architecture reports in both endnesses.Fixes #370. Validation: #371 (comment)