avast / avast/retdec

Some Thumb functions in raw binary decoded as ARM despite specifying -a thumb

Open
#1,012 1 comment 0 reactions 0 assignees View on GitHub
C-capstone2llvmir
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I am using retdec to decompile some Cortex-M0 firmware images in raw binary format. One thing I noticed is that sometimes retdec will mistakenly treat some valid Thumb functions as ARM functions and output nonsensical disassembly and decompilation results despite specifying `-a thumb`. Also when this happens, there's no way I know to manually override them as Thumb functions (e.g. by tweaking the `.config.json` file).

The command I used was roughly like:

```
retdec-decompiler -m raw -a thumb -b 32 -e little \
--raw-section-vma \
--raw-entry-point \

```

For confidentiality reasons the binary cannot be shared, but I can try to replicate the behavior with a minimal test case.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the retdec-decompiler invocation for raw binaries using -m raw -a thumb, -b 32, and --raw-entry-point, then try to reproduce the behavior with a minimal Cortex-M0 test case. Trace how valid Thumb functions are identified and whether the generated .config.json can express a manual override; done means affected functions disassemble and decompile as Thumb, with a documented override path if needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.