sleigh
sleigh copied to clipboard
Sleigh-lifter will lift past the end of the provided bytes
We should probably check the length of the lifted instruction to make sure we arent reading bytes from the 0 fill https://github.com/lifting-bits/sleigh/blob/b3669ea4bd65938d30b32e8db708f0938d8229e6/extra-tools/sleigh-lift/src/main.cpp#L72
ie. ./extra-tools/sleigh-lift/sleigh-lift disassemble ARM7_le.sla 002C -p ./specfiles
should not print:
0x00000000: andeq r2,r0,r0, lsl #0x18
and should probably present an error like "not enough bytes"
For users who are not aware of how fills work on the backend/context registers etc the current behavior is non-obvious
Had a quick look at this today but I think it'll require a bit more thought. Even in the normal case where we've provided sufficient instruction data, Sleigh calls loadFill
with a size argument past the end of the image buffer.
I suspect that's not a bug on our end but rather that's how Sleigh expects LoadImage
implementations to work since the implementations that I can spot in Ghidra seem to have this zero-fill behaviour.