Skip to content

Encode rotated immediates in arm32 data processing instructions ##arch - #27140

Closed
HuzaifaChaudary wants to merge 1 commit into
radareorg:masterfrom
HuzaifaChaudary:arm32-data-processing-immediates
Closed

HuzaifaChaudary wants to merge 1 commit into
radareorg:masterfrom
HuzaifaChaudary:arm32-data-processing-immediates

Conversation

@HuzaifaChaudary

@HuzaifaChaudary HuzaifaChaudary commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor
  • Mark this if you consider it ready to merge
  • I've added tests (optional)
  • I wrote some lines in the book (optional)

Description

arm32 data processing instructions with an immediate above 255 were assembled with the wrong constant , without an error :

input before ( decoded with llvm-mc ) after
adc r11, r0, 61341696 adc r11, r0, #0 eab7a0e2
adcmi r11, lr, 984 adcmi r11, lr, #216 f6bfae42
orreq r3, r3, 0x80000000 orreq r3, r3, #0 02318303
eor r0, r0, 0x101 eor r0, r0, #1 refused

TYPE_ARI only searched for a rotation when the value was a power of two , and every other value went through (imm << 24) | 2 , which keeps the low 8 bits . 0x80000000 did not even reach the search , as an int it is negative . the mov path already had getimmed8 , which tries every even rotation and sets err when there is none , so add , adc , sub , sbc , rsb , rsc , and , orr , eor and bic , and the s forms the table has , use it too now . a value with no 8 bit rotated form is refused , as llvm-mc and gas do .

found by decoding random words with llvm-mc ( -triple=armv7 ) , assembling the text with rasm2 -a arm -b 32 and decoding the result again . same as llvm went from 618 to 764 of 3459 , nothing that was right changed , and the set that does not assemble is the same . the 7 new lines in db/asm/arm_32 and the new test in db/tools/rasm2 fail before the change , 3 lines that were marked broken in arm_32 ( andeq r3, r5, 0x80000000 and the two orreq r3, r3 ones ) pass now and are unmarked . db/asm has no failures .

this touches a different part of armass.c than #27137 , they do not conflict .

Copilot AI balanced review requested due to automatic review settings October 22, 2026 23:42

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@HuzaifaChaudary
HuzaifaChaudary force-pushed the arm32-data-processing-immediates branch from c3178e0 to a8aeac9 Compare October 22, 2026 23:49

trufae commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

The encoding fix looks good. Reusing getimmed8() is the right approach. I checked all 4096 imm8/rotation combinations across the 19 TYPE_ARI mnemonics (77,824 assemblies). The immediate and register fields round-trip correctly. The search is bounded to 15 rotations, so no perf concern here.

Please rebase on current master and resolve the conflicts.

One tiny fix while you're here: use ut32 immed, matching the helper's return type. UBSan trips on the new (immed & 0xff) << 24 with orr r0, r1, 128, because the shift overflows signed int. The old code had this too, but let's avoid carrying it into the replacement. The MOV path could use the same type fix.

Separate follow-ups, already broken before this PR:

  • getimmed8() narrows the parsed value before checking it. add r0, r1, 0x100000000 silently becomes add r0, r1, 0. Check the range before narrowing, keeping valid signed 32-bit spellings working.
  • TYPE_TST still uses findyz(). cmp r3, 256 becomes cmp r0, 256: the rotated branch drops Rn. Could we reuse getimmed8() there too and set Rn once outside the immediate branches? That should also remove the slower nested search.

No broader rewrite needed for this fix.

@trufae

trufae commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

Ping

@trufae

trufae commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

i did the changes and pushed to master in your name

@trufae trufae closed this Oct 28, 2026
@HuzaifaChaudary

Copy link
Copy Markdown
Contributor Author

thanks for finishing it and landing it , and sorry i missed the ping .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants