0

For 8051 target exist famous no-return function with body of

d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df

which correspond to ?C?CCASE function:

/ 38: fcn.00000000 ();
    |           0x00000000      d083           pop dph                     ; [0x10000183:1]=0
    |           0x00000002      d082           pop dpl                     ; [0x10000182:1]=0
    |           0x00000004      f8             mov r0, a
    |           ; CODE XREF from fcn.00000000 @ 0x24
    |       .-> 0x00000005      e4             clr a
    |       :   0x00000006      93             movc a, @a+dptr
    |      ,==< 0x00000007      7012           jnz 0x001b
    |      |:   0x00000009      7401           mov a, #0x01
    |      |:   0x0000000b      93             movc a, @a+dptr
    |     ,===< 0x0000000c      700d           jnz 0x001b
    |     ||:   0x0000000e      a3             inc dptr
    |     ||:   0x0000000f      a3             inc dptr
    |     ||:   ; CODE XREF from fcn.00000000 @ 0x1f
    |    .----> 0x00000010      93             movc a, @a+dptr
    |    :||:   0x00000011      f8             mov r0, a
    |    :||:   0x00000012      7401           mov a, #0x01
    |    :||:   0x00000014      93             movc a, @a+dptr
    |    :||:   0x00000015      f582           mov dpl, a                  ; [0x10000182:1]=0
    |    :||:   0x00000017      8883           mov dph, r0                 ; [0x10000183:1]=0
    |    :||:   0x00000019      e4             clr a
    |    :||:   0x0000001a      73             jmp @a+dptr
    |    :||:   ; CODE XREFS from fcn.00000000 @ 0x7, 0xc
    |    :``--> 0x0000001b      7402           mov a, #0x02
    |    :  :   0x0000001d      93             movc a, @a+dptr
    |    :  :   0x0000001e      68             xrl a, r0
    |    `====< 0x0000001f      60ef           jz 0x0010
    |       :   0x00000021      a3             inc dptr
    |       :   0x00000022      a3             inc dptr
    |       :   0x00000023      a3             inc dptr
    \       `=< 0x00000024      80df           sjmp 0x0005

Function parse jump table following immediately after call instruction. It seems that Radare2 3.9.0 aaaa analysis do not walk correctly thru it.

What is correct way to instruct/hint Radare2 to walk thru this kind of functions?

Guess that it should be related to anal.jmptbl option

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.