Fix ThumbWriter VLDR codegen

frida · May 15, 2020 · 5888845 · 5888845
1 parent 1085857
commit 5888845
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 16 deletions.
diff --git a/gum/arch-arm/gumthumbwriter.c b/gum/arch-arm/gumthumbwriter.c
@@ -834,32 +834,37 @@ gum_thumb_writer_put_vldr_reg_reg_offset (GumThumbWriter * self,
                                           arm_reg src_reg,
                                           gssize src_offset)
 {
-  GumArmRegInfo src_reg_info;
-  GumArmRegInfo dst_reg_info;
-  guint32 insn = 0xed900a00;
-  gboolean is_float;
+  GumArmRegInfo dst, src;
+  guint16 u, d, vd, size;
+  gsize abs_src_offset;
 
-  gum_arm_reg_describe (src_reg, &src_reg_info);
-  gum_arm_reg_describe (dst_reg, &dst_reg_info);
+  gum_arm_reg_describe (dst_reg, &dst);
+  gum_arm_reg_describe (src_reg, &src);
 
-  insn |= (src_offset >> 2) & 0xff;
-  insn |= src_reg_info.index << 16;
+  u = src_offset >= 0;
 
-  is_float = (dst_reg_info.meta >= GUM_ARM_MREG_S0 &&
-      dst_reg_info.meta <= GUM_ARM_MREG_S31);
+  abs_src_offset = ABS (src_offset) / 4;
+  if (abs_src_offset > G_MAXUINT8)
+    return FALSE;
 
-  if (is_float)
+  if (dst.meta >= GUM_ARM_MREG_S0 && dst.meta <= GUM_ARM_MREG_S31)
   {
-    insn |= (dst_reg_info.index >> 1) << 12;
-    insn |= (dst_reg_info.index & 1) << 22;
+    vd = (dst.index >> 1) & GUM_INT4_MASK;
+    d = dst.index & 1;
+
+    size = 0x2;
   }
   else
   {
-    insn |= (dst_reg_info.index) << 12;
-    insn |= 1 << 8;
+    d = (dst.index >> 4) & 1;
+    vd = dst.index & GUM_INT4_MASK;
+
+    size = 0x3;
   }
 
-  gum_thumb_writer_put_instruction_wide (self, insn >> 16, insn & 0xffff);
+  gum_thumb_writer_put_instruction_wide (self,
+      0xed10 | (u << 7) | (d << 6) | src.index,
+      0x0800 | (vd << 12) | (size << 8) | abs_src_offset);
 
   return TRUE;
 }

diff --git a/gum/gumdefs.h b/gum/gumdefs.h
@@ -398,6 +398,7 @@ enum _GumRelocationScenario
 #define GUM_POINTER_TO_FUNCPTR(t, p) ((t) GPOINTER_TO_SIZE (p))
 
 #define GUM_INT2_MASK  0x00000003U
+#define GUM_INT4_MASK  0x0000000fU
 #define GUM_INT5_MASK  0x0000001fU
 #define GUM_INT6_MASK  0x0000003fU
 #define GUM_INT8_MASK  0x000000ffU