AFLplusplus / AFLplusplus/LibAFL

LibAFL_QEMU: Issues switching between thumb and non-thumb on ARM

Open
#2,622 0 comments 1 reaction 1 assignee Claimed by @rmalmain View on GitHub
bug qemu
Dominant language
Rust
Stars
2.6k
Forks
481
Avg merge
2d 30m
Merged PRs (30d)
16

Description

A breakpoint that switches to non-thumb and setting PC to thumb will lead to non-thumb execution:

In LibAFL_QEMU on arm
- Set Lr to a non-thumb addr
- Set Breakpoint on that address
- Run a thumb function until return (first exec runs fine, in thumb)
- After the breakpoint on non-thumb triggers, re-run that same function by placing the Pc to the entry of the thumb function (with last bit set)
=> The second execution is happening in non-thumb mode

A workaround is to set the return address to thumb, but this is not a general solution

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.