Skip to content

Fix negative offsets in arm32 ldr and str ##arch - #27137

Merged
trufae merged 1 commit into
radareorg:masterfrom
HuzaifaChaudary:arm32-negative-load-store-offsets
Oct 23, 2026
Merged

trufae merged 1 commit into
radareorg:masterfrom
HuzaifaChaudary:arm32-negative-load-store-offsets

Conversation

@HuzaifaChaudary

@HuzaifaChaudary HuzaifaChaudary commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor
  • Mark this if you consider it ready to merge
  • I've added tests (optional)
  • I wrote some lines in the book (optional)

Description

negative offsets in arm32 ldr / str addressing were assembled as a different instruction without an error :

input before ( decoded with llvm-mc ) after
ldr r0, [r1, #-4] ldr r0, [r1, #4092] 040011e5
str r0, [r1], #-8 str r0, [r1], #4088 080001e4
str r0, [r1, #-8]! str r0, [r1, #4088]! 080021e5
strb r3, [fp, #-0xfff] strb r3, [r11, #1] ff3f4be5
ldr r0, [r1, -r2] adds r0, r1, r0 020011e7
str lr, [r0, -r6, lsl #31] add lr, r0, r0 86ef00e7
ldr r0, [r1, #-4096] ldr r0, [r1] refused

the immediate was masked with 0xfff as is , so -4 became 4092 with the U bit still set , and a - in front of a register made getreg fail and fall through to a data processing encoding . the offset now drops a leading - , clears the U bit ( 0x8000 in the swapped word ) and encodes the magnitude , for both the immediate and the register forms . an immediate that does not fit in 12 bits is refused instead of wrapping .

found by decoding random words with llvm-mc ( -triple=armv7 ) , assembling the text with rasm2 -a arm -b 32 and decoding the result again . same as llvm went from 618 to 738 of 3459 , nothing that was right changed . the 7 new lines in db/asm/arm_32 fail before the change , and 6 lines that were marked broken there ( ldreq r0, [fp, -180] , streq r3, [r5, -4] and friends ) pass now , so they are unmarked . db/asm and db/tools/rasm2 have no failures .

Copilot AI balanced review requested due to automatic review settings October 22, 2026 22:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@trufae
trufae merged commit 0c45615 into radareorg:master Oct 23, 2026
50 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants