keystone icon indicating copy to clipboard operation
keystone copied to clipboard

Assembling b{cond}.w with negative hex value fails silently (ARM/thumb)

Open pr0me opened this issue 3 years ago • 0 comments

Architecture: THUMB

Example: bne.w #0xfffffe9e

Expected outcome: "\x7f\xf4\x4d\xaf" Little Endian

Explanation: The u32 hex value '0xfffffe9e' is -358 in decimal. This is in range for conditional branches in THUMB mode when we assemble to a wide (4 byte) instruction (https://www.keil.com/support/man/docs/armasm/armasm_dom1361289863797.htm#!#dom1361289863797__b_instr_fn). Instead of outputting the expected byte sequence, keystone-engine fails silently and outputs an empty byte vector. I am using the Rust bindings but e.g. shell-storm.org, which is also based on keystone, shows the same behavior (failing to assemble). However, trying to assemble the instruction with the operand being supplied in decimal form succeeds.

pr0me avatar Apr 24 '21 09:04 pr0me