Arm: fixdstoffset computation, add asm reg test

3 files changed, 96 insertions, 15 deletions

diff --git a/example/asm_armt.py b/example/asm_armt.py
new file mode 100644
index 00000000..ccbdad3a
--- /dev/null
+++ b/example/asm_armt.py
@@ -0,0 +1,79 @@
+#! /usr/bin/env python
+
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.arm.arch import mn_armt, base_expr, variable
+from miasm2.core import parse_asm
+from miasm2.expression.expression import *
+from miasm2.core import asmbloc
+from elfesteem.strpatchwork import StrPatchwork
+from pdb import pm
+
+my_mn = mn_armt
+
+reg_and_id = dict(mn_armt.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+blocs, symbol_pool = parse_asm.parse_txt(my_mn, "armt", '''
+memcpy:
+     PUSH    {R0-R3, LR}
+     B       test_end
+loop:
+     LDRB    R3, [R1]
+     STRB    R3, [R0]
+     ADDS    R0, R0, 1
+     ADDS    R1, R1, 1
+     SUBS    R2, R2, 1
+test_end:
+     CMP     R2, 0
+     BNE     loop
+     POP     {R0-R3, PC}
+main:
+     PUSH    {LR}
+     SUB     SP, 0x100
+     MOV     R0, SP
+     ADD     R1, PC, mystr-$+6
+     MOV     R0, R0
+     EORS    R2, R2
+     ADDS    R2, R2, 0x4
+     BL      memcpy
+     ADD     SP, 0x100
+     POP     {PC}
+
+mystr:
+.string "toto"
+''')
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x3a4b8)
+
+for b in blocs[0]:
+    print b
+# graph sc####
+g = asmbloc.bloc2graph(blocs[0])
+open("graph.txt", "w").write(g)
+
+s = StrPatchwork(open('libandroid_runtime.so').read())
+
+print "symbols"
+print symbol_pool
+# dont erase from start to shell code padading
+resolved_b, patches = asmbloc.asm_resolve_final(
+    my_mn, 'armt', blocs[0], symbol_pool)
+print patches
+
+
+
+for offset, raw in patches.items():
+    s[offset] = raw
+
+open('demo_armt.bin', 'wb').write(str(s))
diff --git a/miasm2/arch/arm/arch.py b/miasm2/arch/arm/arch.py
index e4721d06..e7c5d535 100644
--- a/miasm2/arch/arm/arch.py
+++ b/miasm2/arch/arm/arch.py
@@ -406,6 +406,7 @@ class instruction_arm(instruction):
         if not isinstance(e, ExprInt):
             log.debug('dyn dst %r' % e)
             return
+        # Can't find the +4 reason in doc
         off = e.arg - (self.offset + 4 + self.l)
         if int(off % 4):
             raise ValueError('strange offset! %r' % off)
@@ -474,6 +475,21 @@ class instruction_armt(instruction_arm):
             return True
         return False
 
+    def fixDstOffset(self):
+        e = self.args[0]
+        if self.offset is None:
+            raise ValueError('symbol not resolved %s' % l)
+        if not isinstance(e, ExprInt):
+            log.debug('dyn dst %r' % e)
+            return
+        # The first +2 is to compensate instruction len, but strangely, 32 bits
+        # thumb2 instructions len is 2... For the second +2, didn't find it in
+        # the doc.
+        off = e.arg - (self.offset + 2 + 2)
+        if int(off % 2):
+            raise ValueError('strange offset! %r' % off)
+        self.args[0] = ExprInt32(off)
+
 mode_arm = 'arm'
 mode_armthumb = 'armt'
 
@@ -574,21 +590,6 @@ class mn_arm(cls_mn):
         v = super(mn_arm, self).value(mode)
         return [x[::-1] for x in v]
 
-    def fixDstOffset(self):
-        e = self.args[0].expr
-
-        if self.offset is None:
-            raise ValueError('symbol not resolved %s' % l)
-        if not isinstance(e, ExprInt):
-            # raise ValueError('dst must be int or label')
-            log.debug('dyn dst %r' % e)
-            return
-        # return ExprInt32(e.arg - (self.offset + self.l))
-        off = e.arg - (self.offset + 4 + self.l)
-        if int(off % 4):
-            raise ValueError('strange offset! %r' % off)
-        self.args[0].expr = ExprInt32(off / 4)
-
     def get_symbol_size(self, symbol, symbol_pool, mode):
         return 32
 
diff --git a/test/test_all.py b/test/test_all.py
index f5d66396..a4cb1063 100644
--- a/test/test_all.py
+++ b/test/test_all.py
@@ -62,6 +62,7 @@ all_tests = {
         "assembler": [
             ["asm_x86.py"],
             ["asm_arm.py"],
+            ["asm_armt.py"],
             ["asm_box_x86_32.py"],
             ["asm_box_x86_32_enc.py"],
             ["asm_box_x86_32_mod.py"],