• State Accepted Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 346 subscribers
  • Views 11442 views
  • Users 0 members are here
Options
Related
How was your experience today?
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to know thumb code or arm code?

박주병

Hello Expert.!!

I have a only code in elf file .text section.

I want make a dis-assembler but i don't know which is thumb or arm code.

how to distinguish arm or thumb.   i can not read cpsr regester infomation. only have a code...

thanks

Parents
  • 0

    this is idea scan in libc..

    sometimes mixed arm code and thumb code.

    how to distinguish .. that....

    .text:0000DD8C 08 48                       LDR             R0, =(unk_4C540 - 0xDD96)

    .text:0000DD8E 09 49                       LDR             R1, =(sub_E02C+1 - 0xDD98)

    .text:0000DD90 08 B5                       PUSH            {R3,LR}

    .text:0000DD92 78 44                       ADD             R0, PC ; unk_4C540

    .text:0000DD94 79 44                       ADD             R1, PC ; sub_E02C

    .text:0000DD96 01 F0 92 E9             BLX             pthread_once

    .text:0000DD9A 40 B1                       CBZ             R0, locret_DDAE

    .text:0000DD9C 06 49                       LDR             R1, =(aMalloc_leak_ch - 0xDDA6)

    .text:0000DD9E 06 20                       MOVS            R0, #6

    .text:0000DDA0 06 4A                       LDR             R2, =(aUnableToInitia - 0xDDA8)

    .text:0000DDA2 79 44                       ADD             R1, PC  ; "malloc_leak_check"

    .text:0000DDA4 7A 44                       ADD             R2, PC  ; "Unable to initialize malloc_debug compo"...

    .text:0000DDA6 BD E8 08 40            POP.W           {R3,LR}

    .text:0000DDAA 04 F0 FF BD           B.W             sub_129AC

Reply
  • 0

    this is idea scan in libc..

    sometimes mixed arm code and thumb code.

    how to distinguish .. that....

    .text:0000DD8C 08 48                       LDR             R0, =(unk_4C540 - 0xDD96)

    .text:0000DD8E 09 49                       LDR             R1, =(sub_E02C+1 - 0xDD98)

    .text:0000DD90 08 B5                       PUSH            {R3,LR}

    .text:0000DD92 78 44                       ADD             R0, PC ; unk_4C540

    .text:0000DD94 79 44                       ADD             R1, PC ; sub_E02C

    .text:0000DD96 01 F0 92 E9             BLX             pthread_once

    .text:0000DD9A 40 B1                       CBZ             R0, locret_DDAE

    .text:0000DD9C 06 49                       LDR             R1, =(aMalloc_leak_ch - 0xDDA6)

    .text:0000DD9E 06 20                       MOVS            R0, #6

    .text:0000DDA0 06 4A                       LDR             R2, =(aUnableToInitia - 0xDDA8)

    .text:0000DDA2 79 44                       ADD             R1, PC  ; "malloc_leak_check"

    .text:0000DDA4 7A 44                       ADD             R2, PC  ; "Unable to initialize malloc_debug compo"...

    .text:0000DDA6 BD E8 08 40            POP.W           {R3,LR}

    .text:0000DDAA 04 F0 FF BD           B.W             sub_129AC

Children