Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CBZ & CBNZ decoded as unconditional jumps #578

Closed
abenkhadra opened this issue Jan 7, 2016 · 7 comments
Closed

CBZ & CBNZ decoded as unconditional jumps #578

abenkhadra opened this issue Jan 7, 2016 · 7 comments

Comments

@abenkhadra
Copy link
Contributor

The condition flag of Thumb instructions CBZ & CBNZ instructions is always ARM_CC_AL. Basically, it should be ARM_CC_EQ and ARM_CC_NE respectively.

I noticed that both instructions lack setting MCID_Predicable in file ARMGenInstrInfo.inc as can be found here. Adding that didn't fix the issue.

Function AddThumbPredicate assume that their predicate should be properly set. Therefore, it doesn't modify it. What is the best way for fixing this issue?

@aquynh
Copy link
Collaborator

aquynh commented Jan 11, 2016

what is the input (hexcode format) exposing this issue?

@abenkhadra
Copy link
Contributor Author

For CBNZ consider for example 0x1bb9 and for CBZ there is 0x2bb1.
I'm using the latest master branch.

@aquynh
Copy link
Collaborator

aquynh commented Jan 12, 2016

for the record, can you please list all similar instructions having this issue?

@abenkhadra
Copy link
Contributor Author

So far, these are the only ones. Condition code for all other branch instructions seems to be set properly in my tests. Additionally, IT condition codes seems correct.

@ripples-alive
Copy link

I just meet with the same issue. I'd like to know that whether you will fix it recently? @aquynh

@abenkhadra
Copy link
Contributor Author

I raised this issue only because building a CFG requires linking basic blocks that end with conditional jumps with their direct successors. That test can simply be done by checking the condition code of the jump instruction to be not equal to ARM_CC_AL. CBZ/CBNZ are the only exception to this rule since they always have ARM_CC_AL set.

However, it's worth mentioning that CBZ/CBNZ themselves can not be conditional. That is, there execution doesn't depend on a condition code being set. Under this interpretation, Capstone's behavior is correct.

If we adopt the latter interpretation, then we should close this issue and the related issue #368.

@ripples-alive
Copy link

ripples-alive commented Apr 26, 2016

This issue does depend on the interpretation for the cc field. Though the CBZ/CBNZ themselves are not conditional, the jump is conditional. Maybe I misunderstood the meaning of cc field in capstone before. As I could not find precise document for each field in capstone, I just guessed the meaning. Hoping there will be a more detailed document for capstone.

@kabeor kabeor closed this as completed Dec 1, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants