2

I have a portion of a raw binary file that contains ARM instructions, specifically in Thumb mode (and I've manually disassembled a few instructions using the Architecture Manual, and they seemed reasonable).

I'm now trying to disassemble using objdump, but it always returns an ARM mode interpretation:

arm-none-eabi-objdump -marmv7 -Mno-force-thumb -b -D binFileSnippet.bin

    00000000 <.data>:
   0:   4b10b508        blmi    0x42d428
   4:   0711681a                        ; <UNDEFINED> instruction: 0x0711681a
   8:   2109d501        tstcs   r9, r1, lsl #10
   c:   06d26019                        ; <UNDEFINED> instruction: 0x06d26019

What's the best way to get thumb interpreted disassembled instructions?

1 Answer 1

1

use capstone with your favorite binding
demo code use python (pip install capstone)

import binascii
from capstone import *
CODE = binascii.unhexlify("4b10b5080711681a2109d50106d26019")
md = Cs(CS_ARCH_ARM, CS_MODE_THUMB)
for i in md.disasm(CODE, 0x1000):
    print("0x%x" % i.address,end ="\t")
    print(binascii.hexlify(i.bytes),end = "\t")
    print("%s\t%s" %(i.mnemonic, i.op_str),end ="\n")
print("\n========thumb mode ends arm mode starts ==============\n")    
md = Cs(CS_ARCH_ARM, CS_MODE_ARM)
for i in md.disasm(CODE, 0x1000):
    print("0x%x" % i.address,end ="\t")
    print(binascii.hexlify(i.bytes),end = "\t")
    print("%s\t%s" %(i.mnemonic, i.op_str),end ="\n")

result

D:\>python disarmthumb.py
0x1000  b'4b10' asrs    r3, r1, #1
0x1002  b'b508' lsrs    r5, r6, #2
0x1004  b'0711' asrs    r7, r0, #4
0x1006  b'681a' subs    r0, r5, r1
0x1008  b'2109' lsrs    r1, r4, #4
0x100a  b'd501' lsls    r5, r2, #7
0x100c  b'06d2' bhs     #0x101c
0x100e  b'6019' adds    r0, r4, r5

========thumb mode ends arm mode starts ==============

0x1000  b'4b10b508'     ldmeq   r5!, {r0, r1, r3, r6, ip}
0x1004  b'0711681a'     bne     #0x1a05428
0x1008  b'2109d501'     bicseq  r0, r5, r1, lsr #18
0x100c  b'06d26019'     stmdbne r0!, {r1, r2, sb, ip, lr, pc}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.